fix(ai-gateway): update litellm to 1.98.0

[Gary Henderson (Gary-H9)]

Summary

• Updates the active LiteLLM image in contrib/docker-compose-ai-gateway.yml from v1.97.0 to v1.98.0.
• Pairs the local Data Platform App gateway with the development/test rollout in modernisation-platform-environments#18566. Preproduction and production remain on 1.97.0 until the first stage merges and is verified.
• 1.98.0 is the latest published non-draft, non-prerelease LiteLLM release; 1.99.0-rc.1 and 1.100.0-dev.1 are excluded prereleases.
• Validation completed: Docker Compose configuration, Prettier formatting, and git diff --check passed; exactly one active LiteLLM image reference uses v1.98.0. All 26 focused AI Gateway client tests passed. Repository Build and Test, Super Linter, container scan, dependency review, CodeQL, spell check and Zizmor checks also passed in CI.

Data Platform client compatibility

No breaking changes affecting the Data Platform AI Gateway client were identified between 1.97.0 and 1.98.0. The authoritative latest-main AIGatewayClient was checked against the complete v1.97.0...v1.98.0 upstream range:

• Access groups and organisations: GET /v1/access_group and GET /organization/list?org_alias=... retain the paths, methods and response fields used by the client (access_group_name, access_group_id, access_model_names, organization_alias, organization_id). v1.98.0 improves bidirectional access-group consistency for team writes and key writes; it does not remove those fields. Evidence: BerriAI/litellm access-group and organisation endpoints.
• Teams: POST /team/new, POST /team/delete, GET /team/info?team_id=..., and POST /team/update retain the client payloads and team_id, team_info, and access_group_ids responses. Explicit-null budget behaviour changed in #36699, but the client sends budget_duration: "monthly", which remains a supported alias in the v1.98.0 duration parser. Team deletion now cleans stale keys, caches and membership references in #36819, a compatible correctness fix.
• Virtual keys: POST /key/generate, POST /key/{key}/regenerate, POST /key/delete, GET /key/info?key=..., GET /key/list, and POST /key/update retain the bodies and key, keys, models, and total_pages fields consumed by the client. /key/list still accepts team_id, return_full_object, size, and page. #36488 adds a nullable key audit timestamp and #36843 fixes access-group synchronisation; both are additive. Evidence: BerriAI/litellm key endpoints.
• Models and activity: GET /v1/model/info retains the data response used by the client. #34211 changes access-group expansion for /v2/model/info, not the client's v1 endpoint. GET /team/daily/activity gains additive PTU flat_cost/total_flat_cost metrics in #35391; existing results, metrics.spend, breakdown.api_keys, and breakdown.models consumption remains valid.
• Authentication and errors: the client continues to send the master key as a bearer token and raises on non-success responses. #35773 restores query validation only for /management/v1 routes, so it does not alter the management paths above. The focused client contract suite passed all 26 tests, including authentication, error handling and /key/list pagination.

Other breaking changes

• No breaking-change entry applicable to this deployment was identified in the complete v1.98.0 release notes.
• The tagged schema.prisma adds nullable key audit metadata, a defaulted PTU cost column, managed-object metadata, and new shadow-evaluation tables. The supplied SQL migrations are additive; the paired Modernisation Platform rollout enables the migration job and Prisma migration.
• #36747 makes the litellm-helm migration job honour nodeSelector; it matches the paired MOJ Helm values. The componentised-chart startup-probe/HPA additions in #36382 are not applicable to the paired litellm-helm deployment.
• The Data Platform App uses HTTP contracts through pinned httpx==0.28.1 and does not import the LiteLLM Python package, so no Python client-library coupling is introduced.

Release notes

• LiteLLM 1.98.0 release notes
• Full upstream comparison

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Pull request overview

Updates the local AI Gateway Docker Compose configuration to run a newer LiteLLM proxy image, aligning the developer/local gateway setup with the planned development/test environment rollout.

Changes:

• Bumps the ghcr.io/berriai/litellm image tag from v1.97.0 to v1.98.0 in the AI Gateway Docker Compose file.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Container Scan Summary

✅ No fixable high or critical vulnerabilities found.

[Gary Henderson (Gary-H9)]