Merge pull request #24905 from BerriAI/litellm_pin_pip_2

[Infra] Pin All Docker Build Dependencies

.circleci/config.yml

@@ -39,7 +39,7 @@ commands:
             # conflicts with transitive dep pins like openai<2 and pydantic>=2.11.5)
             pip install "pytest-mock==3.12.0" "pytest==7.3.1" "pytest-retry==1.6.3" \
               "pytest-asyncio==0.21.1" "respx==0.22.0" "hypercorn==0.17.3" \
-              "pydantic==2.11.0" "mcp==1.25.0" "requests-mock>=1.12.1" \
+              "pydantic==2.12.5" "mcp==1.26.0" "requests-mock>=1.12.1" \
               "responses==0.25.7" "pytest-xdist==3.6.1" "pytest-timeout==2.2.0" \
               "pytest-cov==5.0.0" "semantic_router==0.1.10" "fastapi-offline==1.7.3" \
               "a2a" "parameterized>=0.9.0"
@@ -150,16 +150,16 @@ jobs:
             python -m pip install --upgrade pip
             python -m pip install -r .circleci/requirements.txt
             pip install "pytest==7.3.1" "pytest-retry==1.6.3" "pytest-asyncio==0.21.1" "pytest-cov==5.0.0" \
-              "mypy==1.18.2" "google-generativeai==0.3.2" "google-cloud-aiplatform==1.43.0" pyarrow \
-              "boto3==1.36.0" "aioboto3==13.4.0" langchain lunary==0.2.5 \
-              "azure-identity==1.16.1" "langfuse==2.59.7" "logfire==0.29.0" numpydoc \
+              "mypy==1.18.2" "google-generativeai==0.3.2" "google-cloud-aiplatform==1.133.0" pyarrow \
+              "boto3==1.42.80" langchain lunary==0.2.5 \
+              "azure-identity==1.25.3" "langfuse==2.59.7" "logfire==0.29.0" numpydoc \
               traceloop-sdk==0.21.1 openai==1.100.1 prisma==0.11.0 \
               "detect_secrets==1.5.0" "respx==0.22.0" fastapi \
-              "gunicorn==21.2.0" "aiodynamo==23.10.1" "asyncio==3.4.3" \
-              "apscheduler==3.10.4" "PyGithub==1.59.1" argon2-cffi "pytest-mock==3.12.0" \
-              python-multipart prometheus-client==0.20.0 "pydantic==2.10.2" \
-              "diskcache==5.6.1" "Pillow==10.3.0" "jsonschema==4.22.0" \
-              "pytest-xdist==3.6.1" "pytest-timeout==2.2.0" "websockets==13.1.0"
+              "gunicorn==23.0.0" "aiodynamo==23.10.1" "asyncio==3.4.3" \
+              "apscheduler==3.11.2" "PyGithub==1.59.1" argon2-cffi "pytest-mock==3.12.0" \
+              python-multipart prometheus-client==0.20.0 "pydantic==2.12.5" \
+              "diskcache==5.6.1" "Pillow==12.1.1" "jsonschema==4.23.0" \
+              "pytest-xdist==3.6.1" "pytest-timeout==2.2.0" "websockets==15.0.1"
             pip install semantic_router --no-deps
             pip install aurelio_sdk --no-deps
             pip uninstall posthog -y
@@ -245,16 +245,16 @@ jobs:
             python -m pip install --upgrade pip
             python -m pip install -r .circleci/requirements.txt
             pip install "pytest==7.3.1" "pytest-retry==1.6.3" "pytest-asyncio==0.21.1" "pytest-cov==5.0.0" \
-              "mypy==1.18.2" "google-generativeai==0.3.2" "google-cloud-aiplatform==1.43.0" pyarrow \
-              "boto3==1.36.0" "aioboto3==13.4.0" langchain lunary==0.2.5 \
-              "azure-identity==1.16.1" "langfuse==2.59.7" "logfire==0.29.0" numpydoc \
+              "mypy==1.18.2" "google-generativeai==0.3.2" "google-cloud-aiplatform==1.133.0" pyarrow \
+              "boto3==1.42.80" langchain lunary==0.2.5 \
+              "azure-identity==1.25.3" "langfuse==2.59.7" "logfire==0.29.0" numpydoc \
               traceloop-sdk==0.21.1 openai==1.100.1 prisma==0.11.0 \
               "detect_secrets==1.5.0" "respx==0.22.0" fastapi \
-              "gunicorn==21.2.0" "aiodynamo==23.10.1" "asyncio==3.4.3" \
-              "apscheduler==3.10.4" "PyGithub==1.59.1" argon2-cffi "pytest-mock==3.12.0" \
-              python-multipart prometheus-client==0.20.0 "pydantic==2.10.2" \
-              "diskcache==5.6.1" "Pillow==10.3.0" "jsonschema==4.22.0" \
-              "pytest-xdist==3.6.1" "pytest-timeout==2.2.0" "websockets==13.1.0"
+              "gunicorn==23.0.0" "aiodynamo==23.10.1" "asyncio==3.4.3" \
+              "apscheduler==3.11.2" "PyGithub==1.59.1" argon2-cffi "pytest-mock==3.12.0" \
+              python-multipart prometheus-client==0.20.0 "pydantic==2.12.5" \
+              "diskcache==5.6.1" "Pillow==12.1.1" "jsonschema==4.23.0" \
+              "pytest-xdist==3.6.1" "pytest-timeout==2.2.0" "websockets==15.0.1"
             pip install semantic_router --no-deps
             pip install aurelio_sdk --no-deps
             pip uninstall posthog -y
@@ -346,42 +346,41 @@ jobs:
             pip install "pytest-cov==5.0.0"
             pip install "mypy==1.18.2"
             pip install "google-generativeai==0.3.2"
-            pip install "google-cloud-aiplatform==1.43.0"
+            pip install "google-cloud-aiplatform==1.133.0"
             pip install pyarrow
-            pip install "boto3==1.36.0"
-            pip install "aioboto3==13.4.0"
+            pip install "boto3==1.42.80"
             pip install langchain
             pip install lunary==0.2.5
-            pip install "azure-identity==1.16.1"
+            pip install "azure-identity==1.25.3"
             pip install "langfuse==2.59.7"
             pip install "logfire==0.29.0"
             pip install numpydoc
             pip install traceloop-sdk==0.21.1
-            pip install opentelemetry-api==1.25.0
-            pip install opentelemetry-sdk==1.25.0
-            pip install opentelemetry-exporter-otlp==1.25.0
+            pip install opentelemetry-api==1.28.0
+            pip install opentelemetry-sdk==1.28.0
+            pip install opentelemetry-exporter-otlp==1.28.0
             pip install openai==1.100.1
             pip install prisma==0.11.0
             pip install "detect_secrets==1.5.0"
-            pip install "httpx==0.24.1"
+            pip install "httpx==0.28.1"
             pip install "respx==0.22.0"
             pip install fastapi
-            pip install "gunicorn==21.2.0"
-            pip install "anyio==4.2.0"
+            pip install "gunicorn==23.0.0"
+            pip install "anyio==4.8.0"
             pip install "aiodynamo==23.10.1"
             pip install "asyncio==3.4.3"
-            pip install "apscheduler==3.10.4"
+            pip install "apscheduler==3.11.2"
             pip install "PyGithub==1.59.1"
             pip install argon2-cffi
             pip install "pytest-mock==3.12.0"
             pip install python-multipart
             pip install google-cloud-aiplatform
             pip install prometheus-client==0.20.0
-            pip install "pydantic==2.10.2"
+            pip install "pydantic==2.12.5"
             pip install "diskcache==5.6.1"
-            pip install "Pillow==10.3.0"
-            pip install "jsonschema==4.22.0"
-            pip install "websockets==13.1.0"
+            pip install "Pillow==12.1.1"
+            pip install "jsonschema==4.23.0"
+            pip install "websockets==15.0.1"
       - setup_litellm_enterprise_pip
       - save_cache:
           paths:
@@ -700,8 +699,8 @@ jobs:
             pip install "pytest-cov==5.0.0"
             pip install "pytest-asyncio==0.21.1"
             pip install "respx==0.22.0"
-            pip install "pydantic==2.11.0"
-            pip install "mcp==1.25.0"
+            pip install "pydantic==2.12.5"
+            pip install "mcp==1.26.0"
             pip install "pytest-xdist==3.6.1"
       # Run pytest and generate JUnit XML report
       - run:
@@ -746,7 +745,7 @@ jobs:
             pip install "pytest-cov==5.0.0"
             pip install "pytest-asyncio==0.21.1"
             pip install "respx==0.22.0"
-            pip install "pydantic==2.11.0"
+            pip install "pydantic==2.12.5"
             pip install "a2a-sdk"
       # Run pytest and generate JUnit XML report
       - run:
@@ -791,8 +790,8 @@ jobs:
             pip install "pytest-cov==5.0.0"
             pip install "pytest-asyncio==0.21.1"
             pip install "respx==0.22.0"
-            pip install "pydantic==2.10.2"
-            pip install "boto3==1.36.0"
+            pip install "pydantic==2.12.5"
+            pip install "boto3==1.42.80"
             pip install "semantic_router==0.1.10" --no-deps
             pip install aurelio_sdk
             pip install "pytest-xdist==3.6.1"
@@ -841,7 +840,7 @@ jobs:
             pip install "pytest-cov==5.0.0"
             pip install "pytest-asyncio==0.21.1"
             pip install "respx==0.22.0"
-            pip install "pydantic==2.10.2"
+            pip install "pydantic==2.12.5"
       # Run pytest and generate JUnit XML report
       - run:
           name: Run tests
@@ -1048,8 +1047,8 @@ jobs:
             pip install "pytest-asyncio==0.21.1"
             pip install "respx==0.22.0"
             pip install "hypercorn==0.17.3"
-            pip install "pydantic==2.11.0"
-            pip install "mcp==1.25.0"
+            pip install "pydantic==2.12.5"
+            pip install "mcp==1.26.0"
             pip install "requests-mock>=1.12.1"
             pip install "responses==0.25.7"
             pip install "pytest-xdist==3.6.1"
@@ -1090,7 +1089,7 @@ jobs:
             pip install "pytest-asyncio==0.21.1"
             pip install "pytest-cov==5.0.0"
             pip install "google-generativeai==0.3.2"
-            pip install "google-cloud-aiplatform==1.43.0"
+            pip install "google-cloud-aiplatform==1.133.0"
             pip install "pytest-xdist==3.6.1"
       # Run pytest and generate JUnit XML report
       - run:
@@ -1137,7 +1136,7 @@ jobs:
             pip install "pytest-asyncio==0.21.1"
             pip install "pytest-cov==5.0.0"
             pip install "google-generativeai==0.3.2"
-            pip install "google-cloud-aiplatform==1.43.0"
+            pip install "google-cloud-aiplatform==1.133.0"
             pip install pytest-mock
             pip install "pytest-xdist==3.6.1"
       # Run pytest and generate JUnit XML report
@@ -1259,9 +1258,9 @@ jobs:
             pip install pytest-mock
             pip install "respx==0.22.0"
             pip install "google-generativeai==0.3.2"
-            pip install "google-cloud-aiplatform==1.43.0"
+            pip install "google-cloud-aiplatform==1.133.0"
             pip install "mlflow==2.17.2"
-            pip install "anthropic==0.52.0"
+            pip install "anthropic==0.54.0"
             pip install "blockbuster==1.5.24"
             pip install "pytest-xdist==3.6.1"
             pip install "pytest-timeout==2.2.0"
@@ -1352,11 +1351,11 @@ jobs:
             pip install aiohttp
             pip install openai
             pip install click
-            pip install "boto3==1.36.0"
+            pip install "boto3==1.42.80"
             pip install jinja2
-            pip install "tokenizers==0.20.0"
+            pip install "tokenizers==0.22.2"
             pip install "uvloop==0.21.0"
-            pip install "fastuuid==0.12.0"
+            pip install "fastuuid==0.14.0"
             pip install jsonschema
       - setup_litellm_enterprise_pip
       - run:
@@ -1389,7 +1388,7 @@ jobs:
             pip install "pytest-asyncio==0.21.1"
             pip install "pytest-cov==5.0.0"
             pip install "tomli==2.2.1"
-            pip install "mcp==1.25.0"
+            pip install "mcp==1.26.0"
       - run:
           name: Run tests
           command: |
@@ -1679,10 +1678,9 @@ jobs:
             pip install "pytest-asyncio==0.21.1"
             pip install "mypy==1.18.2"
             pip install "google-generativeai==0.3.2"
-            pip install "google-cloud-aiplatform==1.43.0"
+            pip install "google-cloud-aiplatform==1.133.0"
             pip install pyarrow
-            pip install "boto3==1.36.0"
-            pip install "aioboto3==13.4.0"
+            pip install "boto3==1.42.80"
             pip install langchain
             pip install "langfuse>=2.0.0"
             pip install "logfire==0.29.0"
@@ -1690,9 +1688,9 @@ jobs:
             pip install prisma
             pip install fastapi
             pip install jsonschema
-            pip install "httpx==0.24.1"
-            pip install "gunicorn==21.2.0"
-            pip install "anyio==3.7.1"
+            pip install "httpx==0.28.1"
+            pip install "gunicorn==23.0.0"
+            pip install "anyio==4.8.0"
             pip install "aiodynamo==23.10.1"
             pip install "asyncio==3.4.3"
             pip install "PyGithub==1.59.1"
@@ -1823,10 +1821,9 @@ jobs:
             pip install "mypy==1.18.2"
             pip install "jsonlines==4.0.0"
             pip install "google-generativeai==0.3.2"
-            pip install "google-cloud-aiplatform==1.43.0"
+            pip install "google-cloud-aiplatform==1.133.0"
             pip install pyarrow
-            pip install "boto3==1.36.0"
-            pip install "aioboto3==13.4.0"
+            pip install "boto3==1.42.80"
             pip install langchain
             pip install "langchain_mcp_adapters==0.0.5"
             pip install "langfuse>=2.0.0"
@@ -1835,9 +1832,9 @@ jobs:
             pip install prisma
             pip install fastapi
             pip install jsonschema
-            pip install "httpx==0.24.1"
-            pip install "gunicorn==21.2.0"
-            pip install "anyio==3.7.1"
+            pip install "httpx==0.28.1"
+            pip install "gunicorn==23.0.0"
+            pip install "anyio==4.8.0"
             pip install "aiodynamo==23.10.1"
             pip install "asyncio==3.4.3"
             pip install "PyGithub==1.59.1"
@@ -1969,10 +1966,9 @@ jobs:
             pip install "pytest-asyncio==0.21.1"
             pip install "mypy==1.18.2"
             pip install "google-generativeai==0.3.2"
-            pip install "google-cloud-aiplatform==1.43.0"
+            pip install "google-cloud-aiplatform==1.133.0"
             pip install pyarrow
-            pip install "boto3==1.36.0"
-            pip install "aioboto3==13.4.0"
+            pip install "boto3==1.42.80"
             pip install langchain
             pip install "langfuse>=2.0.0"
             pip install "logfire==0.29.0"
@@ -1980,9 +1976,9 @@ jobs:
             pip install prisma
             pip install fastapi
             pip install jsonschema
-            pip install "httpx==0.24.1"
-            pip install "gunicorn==21.2.0"
-            pip install "anyio==3.7.1"
+            pip install "httpx==0.28.1"
+            pip install "gunicorn==23.0.0"
+            pip install "anyio==4.8.0"
             pip install "aiodynamo==23.10.1"
             pip install "asyncio==3.4.3"
             pip install "PyGithub==1.59.1"
@@ -2611,16 +2607,16 @@ jobs:
             pip install "pytest==7.3.1"
             pip install "pytest-retry==1.6.3"
             pip install "pytest-asyncio==0.21.1"
-            pip install "google-cloud-aiplatform==1.43.0"
+            pip install "google-cloud-aiplatform==1.133.0"
             pip install aiohttp
             pip install "openai==1.100.1"
             pip install "assemblyai==0.37.0"
             python -m pip install --upgrade pip
-            pip install "pydantic==2.10.2"
+            pip install "pydantic==2.12.5"
             pip install "pytest==7.3.1"
             pip install "pytest-mock==3.12.0"
             pip install "pytest-asyncio==0.21.1"
-            pip install "boto3==1.36.0"
+            pip install "boto3==1.42.80"
             pip install "mypy==1.18.2"
             pip install pyarrow
             pip install numpydoc
@@ -2628,11 +2624,11 @@ jobs:
             pip install fastapi
             pip install jsonschema
             pip install "httpx==0.27.0"
-            pip install "anyio==3.7.1"
+            pip install "anyio==4.8.0"
             pip install "asyncio==3.4.3"
             pip install "PyGithub==1.59.1"
             pip install "google-cloud-aiplatform==1.59.0"
-            pip install "anthropic==0.52.0"
+            pip install "anthropic==0.54.0"
             pip install "langchain_mcp_adapters==0.0.5"
             pip install "langchain_openai==0.2.1"
             pip install "langgraph==0.3.18"
@@ -2799,7 +2795,7 @@ jobs:
             conda activate myenv
             pip install "pytest==7.3.1"
             pip install "pytest-asyncio==0.21.1"
-            pip install "boto3==1.36.0"
+            pip install "boto3==1.42.80"
             pip install "httpx==0.27.0"
             pip install "claude-agent-sdk"
             pip install -r requirements.txt

.circleci/requirements.txt

@@ -7,15 +7,15 @@ cohere
 redis==5.2.1
 redisvl==0.4.1
 anthropic
-orjson==3.10.12 # fast /embedding responses
-pydantic==2.11.0
-google-cloud-aiplatform==1.43.0
+orjson==3.10.15 # fast /embedding responses
+pydantic==2.12.5
+google-cloud-aiplatform==1.133.0
 google-cloud-iam==2.19.1
 fastapi-sso==0.16.0 
 uvloop==0.21.0
-mcp==1.25.0    # for MCP server  
+mcp==1.26.0    # for MCP server
 semantic_router==0.1.10 # for auto-routing with litellm
-fastuuid==0.12.0
+fastuuid==0.14.0
 responses==0.25.7  # for proxy client tests
 pytest-retry==1.6.3  # for automatic test retries
 litellm-proxy-extras  # for prisma migrations

Dockerfile

@@ -1,8 +1,8 @@
 # Base image for building
-ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
 
 # Runtime image
-ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
 
 # Builder stage
 FROM $LITELLM_BUILD_IMAGE AS builder
@@ -15,7 +15,7 @@ USER root
 # Install build dependencies
 RUN apk add --no-cache bash gcc py3-pip python3 python3-dev openssl openssl-dev
 
-RUN python -m pip install build
+RUN python -m pip install build==1.4.2
 
 # Copy the current directory contents into the container at /app
 COPY . .
@@ -49,7 +49,7 @@ USER root
 
 # Install runtime dependencies (libsndfile needed for audio processing on ARM64)
 RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
-    npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
+    npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     # SECURITY FIX: npm bundles tar, glob, and brace-expansion at multiple nested
     # levels inside its dependency tree. `npm install -g <pkg>` only creates a
     # SEPARATE global package, it does NOT replace npm's internal copies.
@@ -90,7 +90,7 @@ COPY --from=builder /app/dist/*.whl .
 COPY --from=builder /wheels/ /wheels/
 
 # Install the built wheel using pip; again using a wildcard if it's the only file
-RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl && rm -rf /wheels
+RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ --no-deps && rm -f *.whl && rm -rf /wheels
 
 # Replace the nodejs-wheel-binaries bundled node with the system node (fixes CVE-2025-55130)
 RUN NODEJS_WHEEL_NODE=$(find /usr/lib -path "*/nodejs_wheel/bin/node" 2>/dev/null) && \

deploy/Dockerfile.ghcr_base

@@ -1,5 +1,5 @@
 # Use the provided base image
-FROM ghcr.io/berriai/litellm:main-latest
+FROM ghcr.io/berriai/litellm:main-latest@sha256:7c311546c25e7bb6e8cafede9fcd3d0d622ac636b5c9418befaa32e85dfb0186
 
 # Set the working directory to /app
 WORKDIR /app

docker/Dockerfile.alpine

@@ -1,8 +1,8 @@
 # Base image for building
-ARG LITELLM_BUILD_IMAGE=python:3.11-alpine
+ARG LITELLM_BUILD_IMAGE=python:3.11-alpine@sha256:f07e2ace46f560f09a6eeec7b4913b80ee99546e749ef82342a419a326620856
 
 # Runtime image
-ARG LITELLM_RUNTIME_IMAGE=python:3.11-alpine
+ARG LITELLM_RUNTIME_IMAGE=python:3.11-alpine@sha256:f07e2ace46f560f09a6eeec7b4913b80ee99546e749ef82342a419a326620856
 
 # Builder stage
 FROM $LITELLM_BUILD_IMAGE AS builder
@@ -13,8 +13,8 @@ WORKDIR /app
 # Install build dependencies
 RUN apk add --no-cache gcc python3-dev musl-dev
 
-RUN pip install --upgrade pip && \
-    pip install build
+RUN pip install --upgrade pip==26.0.1 && \
+    pip install build==1.4.2
 
 # Copy the current directory contents into the container at /app
 COPY . .
@@ -44,7 +44,7 @@ COPY --from=builder /app/dist/*.whl .
 COPY --from=builder /wheels/ /wheels/
 
 # Install the built wheel using pip; again using a wildcard if it's the only file
-RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl && rm -rf /wheels
+RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ --no-deps && rm -f *.whl && rm -rf /wheels
 
 # Convert Windows line endings to Unix for entrypoint scripts
 RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh

docker/Dockerfile.custom_ui

@@ -1,4 +1,5 @@
 # Use the provided base image
+# NOTE: This is a dev/branch-specific tag. Update digest when the base image is rebuilt.
 FROM ghcr.io/berriai/litellm:litellm_fwd_server_root_path-dev
 
 # Set the working directory to /app
@@ -18,8 +19,8 @@ RUN apt-get update && apt-get upgrade -y \
         libxslt1.1 \
         libgnutls30 \
         libc6 && \
-    apt-get install -y nodejs npm && \
-    npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
+    apt-get install -y --no-install-recommends nodejs npm && \
+    npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     GLOBAL="$(npm root -g)" && \
     find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \

docker/Dockerfile.database

@@ -1,8 +1,8 @@
 # Base image for building
-ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
 
 # Runtime image
-ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
 # Builder stage
 FROM $LITELLM_BUILD_IMAGE AS builder
 
@@ -21,7 +21,7 @@ RUN apk add --no-cache \
     openssl \
     openssl-dev
 
-RUN python -m pip install build
+RUN python -m pip install build==1.4.2
 
 # Copy the current directory contents into the container at /app
 COPY . .
@@ -50,7 +50,7 @@ USER root
 
 # Install runtime dependencies
 RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
-    npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
+    npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     GLOBAL="$(npm root -g)" && \
     find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -82,7 +82,7 @@ COPY --from=builder /app/dist/*.whl .
 COPY --from=builder /wheels/ /wheels/
 
 # Install the built wheel using pip; again using a wildcard if it's the only file
-RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl && rm -rf /wheels
+RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ --no-deps && rm -f *.whl && rm -rf /wheels
 
 # SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
 # npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.

docker/Dockerfile.dev

@@ -1,8 +1,8 @@
 # Base image for building
-ARG LITELLM_BUILD_IMAGE=python:3.11-slim
+ARG LITELLM_BUILD_IMAGE=python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
 
 # Runtime image
-ARG LITELLM_RUNTIME_IMAGE=python:3.11-slim
+ARG LITELLM_RUNTIME_IMAGE=python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
 
 # Builder stage
 FROM $LITELLM_BUILD_IMAGE AS builder
@@ -19,7 +19,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libssl-dev \
     pkg-config \
     && rm -rf /var/lib/apt/lists/* \
-    && pip install --upgrade pip build
+    && pip install --upgrade pip==26.0.1 build==1.4.2
 
 # Copy requirements first for better layer caching
 COPY requirements.txt .
@@ -75,7 +75,7 @@ RUN apt-get update && apt-get upgrade -y \
     nodejs \
     npm \
     && rm -rf /var/lib/apt/lists/* \
-    && npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
+    && npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
     && GLOBAL="$(npm root -g)" \
     && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
           rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -109,7 +109,7 @@ COPY --from=builder /wheels/ /wheels/
 COPY --from=builder /app/dist/*.whl .
 
 # Install all dependencies in one step with no-cache for smaller image
-RUN pip install --no-cache-dir *.whl /wheels/* --no-index --find-links=/wheels/ && \
+RUN pip install --no-cache-dir *.whl /wheels/* --no-index --find-links=/wheels/ --no-deps && \
     rm -f *.whl && \
     rm -rf /wheels
 

docker/Dockerfile.health_check

@@ -1,4 +1,4 @@
-FROM python:3.11-slim
+FROM python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
 
 WORKDIR /app
 
@@ -12,5 +12,13 @@ RUN pip install --no-cache-dir -r requirements.txt
 # Make script executable
 RUN chmod +x /app/health_check_client.py
 
+# Run as non-root user
+RUN adduser --disabled-password --gecos "" --uid 1001 healthcheck
+USER healthcheck
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
+  CMD python /app/health_check_client.py --help || exit 1
+
 # Set entrypoint
 ENTRYPOINT ["python", "/app/health_check_client.py"]

docker/Dockerfile.non_root

@@ -1,6 +1,6 @@
 # Base images
-ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base
-ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
 ARG PROXY_EXTRAS_SOURCE=published
 
 # -----------------
@@ -27,7 +27,7 @@ RUN for i in 1 2 3; do \
     nodejs \
     npm && break || sleep 5; \
     done \
-  && pip install --no-cache-dir --upgrade pip build
+  && pip install --no-cache-dir --upgrade pip==26.0.1 build==1.4.2
 
 # Cache Python dependencies
 COPY requirements.txt .
@@ -41,13 +41,19 @@ COPY . .
 ENV LITELLM_NON_ROOT=true
 
 # Build Admin UI using the upstream command order while keeping a single RUN layer
+# NOTE: .npmrc (which has ignore-scripts=true and min-release-age=3d) is temporarily
+# renamed during npm install/ci. This is safe because npm ci installs from
+# package-lock.json with pinned versions + integrity hashes.
 RUN mkdir -p /var/lib/litellm/ui && \
-    npm install -g npm@latest && npm cache clean --force && \
+    mv /app/.npmrc /app/.npmrc.bak && \
+    npm install -g npm@11.12.1 && npm cache clean --force && \
     cd /app/ui/litellm-dashboard && \
     if [ -f "/app/enterprise/enterprise_ui/enterprise_colors.json" ]; then \
       cp /app/enterprise/enterprise_ui/enterprise_colors.json ./ui_colors.json; \
     fi && \
+    mv .npmrc .npmrc.bak && \
     npm ci && \
+    mv .npmrc.bak .npmrc && mv /app/.npmrc.bak /app/.npmrc && \
     npm run build && \
     cp -r /app/ui/litellm-dashboard/out/* /var/lib/litellm/ui/ && \
     mkdir -p /var/lib/litellm/assets && \
@@ -106,7 +112,7 @@ RUN for i in 1 2 3; do \
     apk add --no-cache python3 py3-pip bash openssl tzdata nodejs npm supervisor && break || sleep 5; \
     done \
   && apk upgrade --no-cache nodejs \
-  && npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
+  && npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
   && GLOBAL="$(npm root -g)" \
   && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \

docker/build_from_pip/Dockerfile.build_from_pip

@@ -1,19 +1,17 @@
-FROM python:3.13-alpine
+FROM python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
 
 WORKDIR /app
 
 ENV HOME=/home/litellm
 ENV PATH="${HOME}/venv/bin:$PATH"
 
-# Install runtime dependencies
-# Note: Using Python 3.13 for compatibility with ddtrace and other packages
-# rust and cargo are required for building ddtrace from source
-# musl-dev and libffi-dev are needed for some Python packages on Alpine
-RUN apk update && \
-    apk add --no-cache gcc musl-dev libffi-dev openssl openssl-dev rust cargo
+# Install runtime dependencies needed for building native extensions
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends gcc libffi-dev && \
+    rm -rf /var/lib/apt/lists/*
 
 RUN python -m venv ${HOME}/venv
-RUN ${HOME}/venv/bin/pip install --no-cache-dir --upgrade pip
+RUN ${HOME}/venv/bin/pip install --no-cache-dir --upgrade pip==26.0.1
 
 COPY docker/build_from_pip/requirements.txt .
 RUN --mount=type=cache,target=${HOME}/.cache/pip \
@@ -28,4 +26,4 @@ RUN prisma generate
 EXPOSE 4000/tcp
 
 ENTRYPOINT ["litellm"]
-CMD ["--port", "4000"]
+CMD ["--port", "4000"]

docker/build_from_pip/requirements.txt

@@ -1,6 +1,6 @@
-litellm[proxy]==1.67.4.dev1 # Specify the litellm version you want to use
-prometheus_client
-langfuse
-prisma
-openai==1.99.9
+litellm[proxy]==1.83.0
+prometheus_client==0.20.0
+langfuse==2.59.7
+prisma==0.11.0
+openai==2.24.0
 ddtrace==2.19.0 # for advanced DD tracing / profiling

docker/install_auto_router.sh

@@ -1,3 +1,3 @@
 #!/bin/bash
 pip install semantic_router==0.1.11 --no-deps
-pip install aurelio-sdk==0.0.19
+pip install aurelio-sdk==0.0.19 --no-deps

pyproject.toml

@@ -18,66 +18,62 @@ Repository = "https://github.com/BerriAI/litellm"
 documentation = "https://docs.litellm.ai"
 Documentation = "https://docs.litellm.ai"
 
+# Dependencies pinned from `pip install litellm[proxy]==1.83.0` PyPI resolution.
+# Docker builds use requirements.txt (different pins). These two paths are independent.
 [tool.poetry.dependencies]
 python = ">=3.9,<4.0"
-fastuuid = ">=0.13.0"
-httpx = ">=0.23.0"
-openai = ">=2.8.0"
-python-dotenv = ">=0.2.0"
-tiktoken = ">=0.7.0"
-importlib-metadata = ">=6.8.0"
-tokenizers = "*"
-click = "*"
-jinja2 = "^3.1.2"
-aiohttp = ">=3.10"
-pydantic = "^2.5.0"
-jsonschema = ">=4.23.0,<5.0.0"
-numpydoc = {version = "*", optional = true} # used in utils.py
+fastuuid = "0.14.0"
+httpx = "0.28.1"
+openai = "2.30.0"
+python-dotenv = "1.0.1"
+tiktoken = "0.12.0"
+importlib-metadata = "8.5.0"
+tokenizers = "0.22.2"
+click = "8.1.8"
+jinja2 = "3.1.6"
+aiohttp = "3.13.5"
+pydantic = "2.12.5"
+jsonschema = "4.23.0"
+numpydoc = {version = "1.8.0", optional = true} # not in Docker or PyPI proxy extra
 
-uvicorn = {version = ">=0.32.1,<1.0.0", optional = true}
-uvloop = {version = "^0.21.0", optional = true, markers="sys_platform != 'win32'"}
-gunicorn = {version = "^23.0.0", optional = true}
-fastapi = {version = ">=0.120.1", optional = true}
-backoff = {version = "*", optional = true}
-pyyaml = {version = "^6.0.1", optional = true}
-rq = {version = "*", optional = true}
-orjson = {version = "^3.9.7", optional = true}
-apscheduler = {version = "^3.10.4", optional = true}
-fastapi-sso = { version = "^0.16.0", optional = true }
-PyJWT = { version = "^2.12.0", optional = true, python = ">=3.9" }
-python-multipart = { version = ">=0.0.20", optional = true}
-cryptography = {version = "*", optional = true}
-prisma = {version = "^0.11.0", optional = true}
-azure-identity = {version = "^1.15.0", optional = true, python = ">=3.9"}
-azure-keyvault-secrets = {version = "^4.8.0", optional = true}
-azure-storage-blob = {version="^12.25.1", optional=true}
-google-cloud-kms = {version = "^2.21.3", optional = true}
-google-cloud-iam = {version = "^2.19.1", optional = true}
-google-cloud-aiplatform = {version = ">=1.38.0", optional = true}
-resend = {version = ">=0.8.0", optional = true}
-pynacl = {version = "^1.5.0", optional = true}
-websockets = {version = "^15.0.1", optional = true}
-boto3 = { version = "^1.40.76", optional = true }
-redisvl = {version = "^0.4.1", optional = true, markers = "python_version >= '3.9' and python_version < '3.14'"}
-mcp = {version = ">=1.25.0,<2.0.0", optional = true, python = ">=3.10"}
-a2a-sdk = {version = "^0.3.22", optional = true, python = ">=3.10"}
-litellm-proxy-extras = {version = "^0.4.62", optional = true}
-rich = {version = "^13.7.1", optional = true}
+uvicorn = {version = "0.33.0", optional = true}
+uvloop = {version = "0.21.0", optional = true, markers="sys_platform != 'win32'"}
+gunicorn = {version = "23.0.0", optional = true}
+fastapi = {version = "0.124.4", optional = true}
+backoff = {version = "2.2.1", optional = true}
+pyyaml = {version = "6.0.3", optional = true}
+rq = {version = "2.7.0", optional = true}
+orjson = {version = "3.10.15", optional = true}
+apscheduler = {version = "3.11.2", optional = true}
+fastapi-sso = { version = "0.16.0", optional = true }
+PyJWT = { version = "2.12.1", optional = true, python = ">=3.9" }
+python-multipart = { version = "0.0.20", optional = true}
+cryptography = {version = "43.0.3", optional = true} # Docker uses 46.0.5; pyproject uses 43.0.3 for Poetry Python 3.9.0/3.9.1 compat
+prisma = {version = "0.11.0", optional = true}
+azure-identity = {version = "1.25.3", optional = true, python = ">=3.9"}
+azure-keyvault-secrets = {version = "4.10.0", optional = true}
+azure-storage-blob = {version = "12.28.0", optional = true}
+google-cloud-kms = {version = "2.24.2", optional = true} # not in PyPI proxy extra
+google-cloud-iam = {version = "2.19.1", optional = true}
+google-cloud-aiplatform = {version = "1.133.0", optional = true}
+resend = {version = "2.23.0", optional = true} # not in PyPI proxy extra
+pynacl = {version = "1.6.2", optional = true}
+websockets = {version = "15.0.1", optional = true}
+boto3 = { version = "1.42.80", optional = true }
+redisvl = {version = "0.4.1", optional = true, markers = "python_version >= '3.9' and python_version < '3.14'"}
+mcp = {version = "1.26.0", optional = true, python = ">=3.10"}
+a2a-sdk = {version = "0.3.25", optional = true, python = ">=3.10"}
+litellm-proxy-extras = {version = "0.4.62", optional = true}
+rich = {version = "13.9.4", optional = true}
 litellm-enterprise = {version = "0.1.35", optional = true}
-diskcache = {version = "^5.6.1", optional = true}
-polars = {version = "^1.31.0", optional = true, python = ">=3.10"}
-semantic-router = {version = ">=0.1.12", optional = true, python = ">=3.9,<3.14"}
-mlflow = {version = ">3.1.4", optional = true, python = ">=3.10"}
-soundfile = {version = "^0.12.1", optional = true}
-pyroscope-io = {version = "^0.8", optional = true, markers = "sys_platform != 'win32'"}
-# grpcio constraints:
-# - 1.62.3+ required by grpcio-status
-# - 1.68.0-1.68.1 has reconnect bug (https://github.com/grpc/grpc/issues/38290)
-# - 1.75.0+ has Python 3.14 wheels and bug fix
-grpcio = [
-    {version = ">=1.62.3,!=1.68.*,!=1.69.*,!=1.70.*,!=1.71.0,!=1.71.1,!=1.72.0,!=1.72.1,!=1.73.0", python = "<3.14", optional = true},
-    {version = ">=1.75.0", python = ">=3.14", optional = true},
-]
+diskcache = {version = "5.6.3", optional = true}
+polars = {version = "1.39.3", optional = true, python = ">=3.10"}
+semantic-router = {version = "0.1.12", optional = true, python = ">=3.9,<3.14"}
+mlflow = {version = "3.9.0", optional = true, python = ">=3.10"} # not in PyPI proxy extra
+soundfile = {version = "0.12.1", optional = true}
+pyroscope-io = {version = "0.8.16", optional = true, markers = "sys_platform != 'win32'"}
+# grpcio: pinned to 1.80.0 (past reconnect bug #38290 in 1.68.x, has Python 3.14 wheels)
+grpcio = {version = "1.80.0", optional = true}
 
 [tool.poetry.extras]
 proxy = [
@@ -143,42 +139,42 @@ litellm = 'litellm:run_server'
 litellm-proxy = 'litellm.proxy.client.cli:cli'
 
 [tool.poetry.group.dev.dependencies]
-diff-cover = "^9.0"
-flake8 = "^6.1.0"
-black = "^23.12.0"
-mypy = "^1.0"
-pytest = "^7.4.3"
-pytest-mock = "^3.12.0"
-pytest-asyncio = "^0.21.1"
-pytest-postgresql = "^6.0.0"
-pytest-xdist = "^3.5.0"
-requests-mock = "^1.12.1"
-responses = "^0.25.7"
-respx = "^0.22.0"
-ruff = "^0.2.1"
-types-requests = "*"
-types-setuptools = "*"
-types-redis = "*"
-types-PyYAML = "*"
-opentelemetry-api = "^1.28.0"
-opentelemetry-sdk = "^1.28.0"
-opentelemetry-exporter-otlp = "^1.28.0"
-langfuse = "^2.45.0"
-fastapi-offline = "^1.7.3"
-fakeredis = "^2.27.1"
-pytest-rerunfailures = "^14.0"
-pytest-cov = "^5.0"
-parameterized = "^0.9.0"
+diff-cover = "9.7.2"
+flake8 = "7.3.0"
+black = "24.10.0"
+mypy = "1.19.0"
+pytest = "8.3.5"
+pytest-mock = "3.15.1"
+pytest-asyncio = "1.2.0"
+pytest-postgresql = "7.0.2"
+pytest-xdist = "3.8.0"
+requests-mock = "1.12.1"
+responses = "0.26.0"
+respx = "0.22.0"
+ruff = "0.15.3"
+types-requests = {version = "2.32.4.20260107", python = ">=3.10"}
+types-setuptools = "75.8.0.20250225"
+types-redis = "4.6.0.20241004"
+types-PyYAML = "6.0.12.20250915"
+opentelemetry-api = "1.28.0"
+opentelemetry-sdk = "1.28.0"
+opentelemetry-exporter-otlp = "1.28.0"
+langfuse = "2.59.7"
+fastapi-offline = "1.7.6"
+fakeredis = "2.34.1"
+pytest-rerunfailures = "15.1"
+pytest-cov = "5.0.0"
+parameterized = "0.9.0"
 
 [tool.poetry.group.proxy-dev.dependencies]
 prisma = "0.11.0"
-hypercorn = "^0.15.0"
+hypercorn = "0.17.3"
 prometheus-client = "0.20.0"
-opentelemetry-api = "^1.28.0"
-opentelemetry-sdk = "^1.28.0"
-opentelemetry-exporter-otlp = "^1.28.0"
-azure-identity = {version = "^1.15.0", python = ">=3.9"}
-a2a-sdk = {version = "^0.3.22", python = ">=3.10"}
+opentelemetry-api = "1.28.0"
+opentelemetry-sdk = "1.28.0"
+opentelemetry-exporter-otlp = "1.28.0"
+azure-identity = {version = "1.25.3", python = ">=3.9"}
+a2a-sdk = {version = "0.3.25", python = ">=3.10"}
 
 [build-system]
 requires = ["poetry-core", "wheel"]

requirements.txt

@@ -1,25 +1,25 @@
 # LITELLM PROXY DEPENDENCIES #
 # Security: explicit pins for transitive deps (CVE fixes)
-urllib3>=2.6.0  # CVE-2025-66471, CVE-2025-66418, CVE-2026-21441
-tornado>=6.5.5  # CVE-2025-67725, CVE-2025-67726, CVE-2025-67724, CVE-2026-31958, GHSA-78cv-mqj4-43f7
-filelock>=3.20.1  # CVE-2025-68146
-h11>=0.16.0    # CVE-2025-43859, GHSA-vqfr-h8mv-ghfj — HTTP request smuggling
-wheel>=0.46.2  # CVE-2026-24049 — path traversal
+urllib3==2.6.3  # CVE-2025-66471, CVE-2025-66418, CVE-2026-21441
+tornado==6.5.5  # CVE-2025-67725, CVE-2025-67726, CVE-2025-67724, CVE-2026-31958, GHSA-78cv-mqj4-43f7
+filelock==3.25.2  # CVE-2025-68146
+h11==0.16.0    # CVE-2025-43859, GHSA-vqfr-h8mv-ghfj — HTTP request smuggling
+wheel==0.46.3  # CVE-2026-24049 — path traversal
 Pillow==12.1.1  #GHSA-cfh3-3jmp-rvhc
 cryptography==46.0.5 #GHSA-r6ph-v2qm-q3c2
 
 anyio==4.8.0 # openai + http req.
 httpx==0.28.1
-openai==2.24.0  # openai req.
-fastapi==0.120.1 # server dep
+openai==2.30.0  # openai req.
+fastapi==0.124.4 # server dep
 starlette==0.49.1 # starlette fastapi dep
 backoff==2.2.1 # server dep
-pyyaml==6.0.2 # server dep
-uvicorn==0.31.1 # server dep
+pyyaml==6.0.3 # server dep
+uvicorn==0.33.0 # server dep
 gunicorn==23.0.0 # server dep
-fastuuid==0.13.5 # for uuid4
+fastuuid==0.14.0 # for uuid4
 uvloop==0.21.0 # uvicorn dep, gives us much better performance under load
-boto3==1.40.53 # aws bedrock/sagemaker calls (has bedrock-agentcore-control, compatible with aioboto3)
+boto3==1.42.80 # aws bedrock/sagemaker calls
 redis==5.2.1 # redis caching
 redisvl==0.4.1 ## redis semantic caching
 prisma==0.11.0 # for db
@@ -30,30 +30,29 @@ google-cloud-aiplatform==1.133.0 # for vertex ai calls
 google-cloud-iam==2.19.1 # for GCP IAM Redis authentication
 google-genai==1.37.0
 anthropic[vertex]==0.54.0
-mcp==1.25.0 ; python_version >= "3.10"    # for MCP server
+mcp==1.26.0 ; python_version >= "3.10"    # for MCP server
 # google-generativeai removed - deprecated, replaced by google-genai (line 21)
 async_generator==1.10.0 # for async ollama calls
 langfuse==2.59.7 # for langfuse self-hosted logging
 prometheus_client==0.20.0 # for /metrics endpoint on proxy
 ddtrace==2.19.0      # for advanced DD tracing / profiling
-orjson==3.11.7 # fast /embedding responses
-polars==1.31.0 # for data processing
-apscheduler==3.10.4 # for resetting budget in background
-fastapi-sso==0.19.0 # admin UI, SSO
-pyjwt[crypto]==2.12.0 ; python_version >= "3.9"
-python-multipart>=0.0.20 # admin UI
-jaraco.context>=6.1.0
+orjson==3.10.15 # fast /embedding responses
+polars==1.39.3 # for data processing
+apscheduler==3.11.2 # for resetting budget in background
+fastapi-sso==0.16.0 # admin UI, SSO
+pyjwt[crypto]==2.12.1 ; python_version >= "3.9"
+python-multipart==0.0.20 # admin UI
+jaraco.context==6.1.2
 azure-ai-contentsafety==1.0.0 # for azure content safety
-azure-identity==1.16.1 ; python_version >= "3.9" # for azure content safety
+azure-identity==1.25.3 ; python_version >= "3.9" # for azure content safety
 azure-keyvault==4.2.0 # for azure KMS integration
 azure-storage-file-datalake==12.20.0 # for azure buck storage logging
 opentelemetry-api==1.28.0
 opentelemetry-sdk==1.28.0
 opentelemetry-exporter-otlp==1.28.0
-a2a-sdk>=0.3.22 ; python_version >= "3.10"
-# grpcio: 1.68.0-1.68.1 has reconnect bug (#38290), 1.75+ has Python 3.14 wheels + fix
-grpcio>=1.62.3,!=1.68.*,!=1.69.*,!=1.70.*,!=1.71.0,!=1.71.1,!=1.72.0,!=1.72.1,!=1.73.0; python_version < "3.14"
-grpcio>=1.75.0; python_version >= "3.14"
+a2a-sdk==0.3.25 ; python_version >= "3.10"
+# grpcio: pinned to 1.80.0 (past reconnect bug #38290 in 1.68.x, has Python 3.14 wheels)
+grpcio==1.80.0
 sentry_sdk==2.21.0 # for sentry error handling
 detect-secrets==1.5.0 # Enterprise - secret detection / masking in LLM requests
 tzdata==2025.1 # IANA time zone database
@@ -61,21 +60,27 @@ litellm-proxy-extras==0.4.62 # for proxy extras - e.g. prisma migrations
 llm-sandbox==0.3.31 # for skill execution in sandbox
 ### LITELLM PACKAGE DEPENDENCIES
 python-dotenv==1.0.1 # for env
-tiktoken==0.8.0 # for calculating usage
-importlib-metadata==6.8.0 # for random utils
-tokenizers==0.20.2 # for calculating usage
-click==8.1.7 # for proxy cli
-rich==13.7.1 # for litellm proxy cli
+tiktoken==0.12.0 # for calculating usage
+importlib-metadata==8.5.0 # for random utils
+tokenizers==0.22.2 # for calculating usage
+click==8.1.8 # for proxy cli
+rich==13.9.4 # for litellm proxy cli
 jinja2==3.1.6 # for prompt templates
-aioboto3==15.5.0 # for async sagemaker calls (updated to match boto3 1.40.73)
-aiohttp==3.13.3 # for network calls
+aiohttp==3.13.5 # for network calls
 tenacity==8.5.0  # for retrying requests, when litellm.num_retries set
-pydantic>=2.11,<3 # proxy + openai req. + mcp
-jsonschema>=4.23.0,<5.0.0 # validating json schema - aligned with openapi-core + mcp
+pydantic==2.12.5 # proxy + openai req. + mcp
+jsonschema==4.23.0 # validating json schema - aligned with openapi-core + mcp
 websockets==15.0.1 # for realtime API
 soundfile==0.12.1 # for audio file processing
 openapi-core==0.21.0 # for OpenAPI compliance tests
-pypdf>=6.7.3 # for PDF text extraction in RAG ingestion (CVE-2026-27888)
+pypdf==6.9.2 # for PDF text extraction in RAG ingestion (CVE-2026-27888)
+
+# Transitive deps pinned to prevent floating between builds
+aiofiles==24.1.0 # transitive dep (langfuse)
+colorlog==6.10.1 # transitive dep (ddtrace)
+grpc-google-iam-v1==0.14.3 # transitive dep (google-cloud-iam)
+hf-xet==1.4.2 # transitive dep (huggingface_hub)
+requests-toolbelt==1.0.0 # transitive dep (langfuse)
 
 ########################
 # LITELLM ENTERPRISE DEPENDENCIES

scripts/health_check/health_check_requirements.txt

@@ -1,2 +1,2 @@
-httpx>=0.24.0
-pyyaml>=6.0
+httpx==0.28.1
+pyyaml==6.0.2

tests/code_coverage_tests/liccheck.ini

@@ -131,7 +131,6 @@ tiktoken: >=0.8.0 # Unknown license
 click: >=8.1.7 # Unknown license
 rich: >=13.7.1 # Unknown license
 aiohttp: >=3.10.2 # Unknown license
-aioboto3: >=12.3.0 # Unknown license
 tenacity: >=8.2.3 # Unknown license
 pydantic: >=2.10.2 # Unknown license
 jsonschema: >=4.22.0 # Unknown license
@@ -145,3 +144,4 @@ nodejs-wheel-binaries: >=24.12.0 # MIT license manually verified
 grpcio: >=1.69.0 # Apache License 2.0
 jaraco.context: >=6.1.0 # Unknown license
 pypdf: >=6.6.2 # BSD-3-Clause license - https://github.com/py-pdf/pypdf/blob/main/LICENSE
+hf-xet: >=1.4.2 # Apache 2.0 License - https://github.com/huggingface/xet-tools/blob/main/LICENSE

tests/test_litellm/proxy/middleware/test_in_flight_requests_middleware.py

@@ -92,7 +92,7 @@ def test_non_http_scopes_not_counted():
 
     mw = InFlightRequestsMiddleware(_InnerApp())
 
-    asyncio.get_event_loop().run_until_complete(
+    asyncio.run(
         mw({"type": "lifespan"}, None, None)  # type: ignore[arg-type]
     )
     assert get_in_flight_requests() == 0

tests/test_litellm/router_strategy/test_base_routing_strategy.py

@@ -20,7 +20,7 @@ from litellm.router_strategy.base_routing_strategy import BaseRoutingStrategy
 
 
 @pytest.fixture
-def mock_dual_cache():
+async def mock_dual_cache():
     dual_cache = MagicMock(spec=DualCache)
     dual_cache.in_memory_cache = MagicMock()
     dual_cache.redis_cache = MagicMock()
@@ -47,7 +47,7 @@ def mock_dual_cache():
 
 
 @pytest.fixture
-def base_strategy(mock_dual_cache):
+async def base_strategy(mock_dual_cache):
     return BaseRoutingStrategy(
         dual_cache=mock_dual_cache,
         should_batch_redis_writes=False,
@@ -137,7 +137,8 @@ async def test_sync_in_memory_spend_with_redis(base_strategy, mock_dual_cache):
     assert len(base_strategy.in_memory_keys_to_update) == 1
 
 
-def test_cache_keys_management(base_strategy):
+@pytest.mark.asyncio
+async def test_cache_keys_management(base_strategy):
     # Test adding and getting cache keys
     base_strategy.add_to_in_memory_keys_to_update("key1")
     base_strategy.add_to_in_memory_keys_to_update("key2")