From 317bb1ea4d86a90dbaac47b77fe16129fdc1fe68 Mon Sep 17 00:00:00 2001
From: shivam <shivam@berri.ai>
Date: Fri, 24 Jul 2026 01:34:10 +0000
Subject: [PATCH 01/24] fix(streaming): guard empty-choices chunks in Responses
 bridge and Anthropic adapter iterators

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .../adapters/streaming_iterator.py            |  6 +-
 .../adapters/transformation.py                |  2 +-
 .../streaming_iterator.py                     |  6 ++
 .../test_streaming_iterator_combined_chunk.py | 54 +++++++++++
 .../test_empty_choices_streaming_iterator.py  | 91 +++++++++++++++++++
 5 files changed, 156 insertions(+), 3 deletions(-)
 create mode 100644 tests/test_litellm/responses/litellm_completion_transformation/test_empty_choices_streaming_iterator.py

diff --git a/litellm/llms/anthropic/experimental_pass_through/adapters/streaming_iterator.py b/litellm/llms/anthropic/experimental_pass_through/adapters/streaming_iterator.py
index f02333c34c8..367f2585a9b 100644
--- a/litellm/llms/anthropic/experimental_pass_through/adapters/streaming_iterator.py
+++ b/litellm/llms/anthropic/experimental_pass_through/adapters/streaming_iterator.py
@@ -423,7 +423,7 @@ class AnthropicStreamWrapper(AdapterCompletionStreamWrapper):
                 will_merge_into_held = (
                     self.holding_stop_reason_chunk is not None and getattr(chunk, "usage", None) is not None
                 )
-                is_final_chunk = chunk.choices[0].finish_reason is not None
+                is_final_chunk = bool(chunk.choices) and chunk.choices[0].finish_reason is not None
                 processed_chunk = LiteLLMAnthropicMessagesAdapter().translate_streaming_openai_response_to_anthropic(
                     response=chunk,
                     current_content_block_index=self.current_content_block_index,
@@ -646,7 +646,7 @@ class AnthropicStreamWrapper(AdapterCompletionStreamWrapper):
                 will_merge_into_held = (
                     self.holding_stop_reason_chunk is not None and getattr(chunk, "usage", None) is not None
                 )
-                is_final_chunk = chunk.choices[0].finish_reason is not None
+                is_final_chunk = bool(chunk.choices) and chunk.choices[0].finish_reason is not None
                 processed_chunk = LiteLLMAnthropicMessagesAdapter().translate_streaming_openai_response_to_anthropic(
                     response=chunk,
                     current_content_block_index=self.current_content_block_index,
@@ -889,6 +889,8 @@ class AnthropicStreamWrapper(AdapterCompletionStreamWrapper):
 
         # Example logic - customize based on your needs:
         # If chunk indicates a tool call
+        if not chunk.choices:
+            return False
         if chunk.choices[0].finish_reason is not None:
             return False
 
diff --git a/litellm/llms/anthropic/experimental_pass_through/adapters/transformation.py b/litellm/llms/anthropic/experimental_pass_through/adapters/transformation.py
index 4b6617fbeac..91efc39670e 100644
--- a/litellm/llms/anthropic/experimental_pass_through/adapters/transformation.py
+++ b/litellm/llms/anthropic/experimental_pass_through/adapters/transformation.py
@@ -1476,7 +1476,7 @@ class LiteLLMAnthropicMessagesAdapter:
         applied_edits: Optional[List[AppliedEdit]] = None,
     ) -> Union[ContentBlockDelta, MessageBlockDelta]:
         ## base case - final chunk w/ finish reason
-        if response.choices[0].finish_reason is not None:
+        if response.choices and response.choices[0].finish_reason is not None:
             delta = MessageDelta(
                 stop_reason=self._translate_openai_finish_reason_to_anthropic(response.choices[0].finish_reason),
             )
diff --git a/litellm/responses/litellm_completion_transformation/streaming_iterator.py b/litellm/responses/litellm_completion_transformation/streaming_iterator.py
index cf69654d15d..439c4715506 100644
--- a/litellm/responses/litellm_completion_transformation/streaming_iterator.py
+++ b/litellm/responses/litellm_completion_transformation/streaming_iterator.py
@@ -125,6 +125,8 @@ class LiteLLMCompletionStreamingIterator(ResponsesAPIStreamingIterator):
             return None
 
     def _is_reasoning_end(self, chunk):
+        if not chunk.choices:
+            return False
         delta = chunk.choices[0].delta
 
         # if this indicates reasoning content, don't consider reasoning ended
@@ -722,6 +724,8 @@ class LiteLLMCompletionStreamingIterator(ResponsesAPIStreamingIterator):
         # Change: Never return a value, just enqueue output item events
         if self.sent_output_item_added_event:
             return
+        if not chunk.choices:
+            return
         delta = chunk.choices[0].delta
 
         self._sequence_number += 1
@@ -1033,6 +1037,8 @@ class LiteLLMCompletionStreamingIterator(ResponsesAPIStreamingIterator):
 
         It's unclear how users expect litellm to translate multiple-choices-per-chunk to the responses API output.
         """
+        if not choices:
+            return ""
         choice = choices[0]
         chat_completion_delta: ChatCompletionDelta = choice.delta
         return chat_completion_delta.content or ""
diff --git a/tests/test_litellm/llms/anthropic/experimental_pass_through/adapters/test_streaming_iterator_combined_chunk.py b/tests/test_litellm/llms/anthropic/experimental_pass_through/adapters/test_streaming_iterator_combined_chunk.py
index 6973340101e..a6523f5a39d 100644
--- a/tests/test_litellm/llms/anthropic/experimental_pass_through/adapters/test_streaming_iterator_combined_chunk.py
+++ b/tests/test_litellm/llms/anthropic/experimental_pass_through/adapters/test_streaming_iterator_combined_chunk.py
@@ -143,6 +143,60 @@ def test_delayed_usage_chunk_preserves_cache_tokens():
     assert message_delta["usage"]["cache_creation_input_tokens"] == 20
 
 
+def test_trailing_empty_choices_usage_chunk_emits_message_delta_usage():
+    """Regression for LIT-4767.
+
+    The trailing usage-only chunk an OpenAI-compatible provider sends when
+    ``include_usage`` is set has ``choices: []``. The adapter used to index
+    ``choices[0]`` unguarded (``is_final_chunk`` / ``_should_start_new_content_block``)
+    and crash with IndexError. It must instead merge the usage into the held
+    stop-reason chunk so ``message_delta`` still reports it.
+    """
+    chunks = [
+        ModelResponseStream(
+            choices=[StreamingChoices(index=0, delta=Delta(content="Two."), finish_reason=None)],
+        ),
+        ModelResponseStream(
+            choices=[StreamingChoices(index=0, delta=Delta(), finish_reason="stop")],
+        ),
+        ModelResponseStream(
+            choices=[],
+            usage=Usage(prompt_tokens=10, completion_tokens=5, total_tokens=15),
+        ),
+    ]
+    wrapper = AnthropicStreamWrapper(completion_stream=iter(chunks), model="gpt-4o")
+    events = list(wrapper)
+
+    message_delta = next(event for event in events if event.get("type") == "message_delta")
+    assert message_delta["usage"]["input_tokens"] == 10
+    assert message_delta["usage"]["output_tokens"] == 5
+
+
+def test_leading_empty_choices_chunk_does_not_crash_stream():
+    """Azure emits a leading ``prompt_filter_results`` chunk with ``choices: []``
+    before any content. It must be tolerated and the following content emitted."""
+    chunks = [
+        ModelResponseStream(choices=[]),
+        ModelResponseStream(
+            choices=[StreamingChoices(index=0, delta=Delta(content="Hi"), finish_reason=None)],
+        ),
+        ModelResponseStream(
+            choices=[StreamingChoices(index=0, delta=Delta(), finish_reason="stop")],
+            usage=Usage(prompt_tokens=3, completion_tokens=1, total_tokens=4),
+        ),
+    ]
+
+    async def _aiter() -> "AsyncIterator[ModelResponseStream]":
+        for chunk in chunks:
+            yield chunk
+
+    wrapper = AnthropicStreamWrapper(completion_stream=_aiter(), model="gpt-4o")
+    sse = _collect_async(wrapper)
+
+    assert "Hi" in sse
+    assert "message_stop" in sse
+
+
 def test_splitter_passes_through_non_combined_chunks():
     """A chunk with content but no finish_reason is not split."""
     chunk = ModelResponseStream(
diff --git a/tests/test_litellm/responses/litellm_completion_transformation/test_empty_choices_streaming_iterator.py b/tests/test_litellm/responses/litellm_completion_transformation/test_empty_choices_streaming_iterator.py
new file mode 100644
index 00000000000..b7a3611501d
--- /dev/null
+++ b/tests/test_litellm/responses/litellm_completion_transformation/test_empty_choices_streaming_iterator.py
@@ -0,0 +1,91 @@
+"""
+Regression tests for LIT-4767.
+
+When an upstream OpenAI-compatible provider emits a chunk with ``choices: []``
+(the trailing usage-only chunk every provider sends when ``include_usage`` is
+set, or Azure's leading ``prompt_filter_results`` chunk), the Responses bridge
+iterator used to index ``choices[0]`` unguarded and die with
+``IndexError: list index out of range``, killing the whole stream.
+
+The empty-choices chunk must be tolerated without crashing, and the usage it
+carries must still reach ``response.completed``.
+"""
+
+from unittest.mock import AsyncMock
+
+from litellm.responses.litellm_completion_transformation.streaming_iterator import (
+    LiteLLMCompletionStreamingIterator,
+)
+from litellm.types.llms.openai import ResponsesAPIStreamEvents
+from litellm.types.utils import (
+    Delta,
+    ModelResponseStream,
+    StreamingChoices,
+    Usage,
+)
+
+
+def _iterator() -> LiteLLMCompletionStreamingIterator:
+    return LiteLLMCompletionStreamingIterator(
+        model="gpt-4o",
+        litellm_custom_stream_wrapper=AsyncMock(),
+        request_input="hi",
+        responses_api_request={},
+        custom_llm_provider="openai",
+    )
+
+
+def _empty_choices_usage_chunk() -> ModelResponseStream:
+    chunk = ModelResponseStream(id="chunk-usage", model="gpt-4o", choices=[])
+    chunk.usage = Usage(prompt_tokens=10, completion_tokens=5, total_tokens=15)
+    return chunk
+
+
+def test_ensure_output_item_for_empty_choices_chunk_does_not_crash():
+    """First chunk with no choices must not raise (traceback frame in the ticket)."""
+    iterator = _iterator()
+    # Would raise IndexError before the fix.
+    assert iterator._ensure_output_item_for_chunk(_empty_choices_usage_chunk()) is None
+    assert iterator.sent_output_item_added_event is False
+
+
+def test_transform_empty_choices_chunk_returns_no_delta():
+    """The mid/trailing usage chunk flows through transform without crashing."""
+    iterator = _iterator()
+    # Would raise IndexError in _get_delta_string_from_streaming_choices before the fix.
+    assert iterator._transform_chat_completion_chunk_to_response_api_chunk(_empty_choices_usage_chunk()) is None
+
+
+def test_is_reasoning_end_false_for_empty_choices_chunk():
+    iterator = _iterator()
+    assert iterator._is_reasoning_end(_empty_choices_usage_chunk()) is False
+
+
+def test_empty_choices_usage_chunk_still_reaches_response_completed():
+    """End-to-end: a text chunk followed by a choices=[] usage chunk must emit
+    response.completed carrying the usage rather than dying mid-stream."""
+
+    class _SyncWrapper:
+        def __init__(self, chunks):
+            self._it = iter(chunks)
+            self.logging_obj = None
+            self.stream_options = {"include_usage": True}
+
+        def __next__(self):
+            return next(self._it)
+
+    text_chunk = ModelResponseStream(
+        id="chunk-1",
+        model="gpt-4o",
+        choices=[StreamingChoices(index=0, delta=Delta(role="assistant", content="Hi"), finish_reason=None)],
+    )
+    iterator = _iterator()
+    iterator.litellm_logging_obj = None
+    iterator.litellm_custom_stream_wrapper = _SyncWrapper([text_chunk, _empty_choices_usage_chunk()])
+
+    events = list(iterator)
+
+    completed = [e for e in events if getattr(e, "type", None) == ResponsesAPIStreamEvents.RESPONSE_COMPLETED]
+    assert len(completed) == 1
+    assert completed[0].response.usage is not None
+    assert completed[0].response.usage.total_tokens == 15

From 69e9edb91a9bc8efcadf876917f11cce1b31eae6 Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Tue, 15 Sep 2026 15:31:38 -0700
Subject: [PATCH 02/24] test(responses): fold the empty-choices regression
 tests into the mapped streaming iterator test file

---
 .../test_empty_choices_streaming_iterator.py  | 91 -------------------
 .../test_streaming_iterator_transformation.py | 43 +++++++++
 2 files changed, 43 insertions(+), 91 deletions(-)
 delete mode 100644 tests/test_litellm/responses/litellm_completion_transformation/test_empty_choices_streaming_iterator.py

diff --git a/tests/test_litellm/responses/litellm_completion_transformation/test_empty_choices_streaming_iterator.py b/tests/test_litellm/responses/litellm_completion_transformation/test_empty_choices_streaming_iterator.py
deleted file mode 100644
index b7a3611501d..00000000000
--- a/tests/test_litellm/responses/litellm_completion_transformation/test_empty_choices_streaming_iterator.py
+++ /dev/null
@@ -1,91 +0,0 @@
-"""
-Regression tests for LIT-4767.
-
-When an upstream OpenAI-compatible provider emits a chunk with ``choices: []``
-(the trailing usage-only chunk every provider sends when ``include_usage`` is
-set, or Azure's leading ``prompt_filter_results`` chunk), the Responses bridge
-iterator used to index ``choices[0]`` unguarded and die with
-``IndexError: list index out of range``, killing the whole stream.
-
-The empty-choices chunk must be tolerated without crashing, and the usage it
-carries must still reach ``response.completed``.
-"""
-
-from unittest.mock import AsyncMock
-
-from litellm.responses.litellm_completion_transformation.streaming_iterator import (
-    LiteLLMCompletionStreamingIterator,
-)
-from litellm.types.llms.openai import ResponsesAPIStreamEvents
-from litellm.types.utils import (
-    Delta,
-    ModelResponseStream,
-    StreamingChoices,
-    Usage,
-)
-
-
-def _iterator() -> LiteLLMCompletionStreamingIterator:
-    return LiteLLMCompletionStreamingIterator(
-        model="gpt-4o",
-        litellm_custom_stream_wrapper=AsyncMock(),
-        request_input="hi",
-        responses_api_request={},
-        custom_llm_provider="openai",
-    )
-
-
-def _empty_choices_usage_chunk() -> ModelResponseStream:
-    chunk = ModelResponseStream(id="chunk-usage", model="gpt-4o", choices=[])
-    chunk.usage = Usage(prompt_tokens=10, completion_tokens=5, total_tokens=15)
-    return chunk
-
-
-def test_ensure_output_item_for_empty_choices_chunk_does_not_crash():
-    """First chunk with no choices must not raise (traceback frame in the ticket)."""
-    iterator = _iterator()
-    # Would raise IndexError before the fix.
-    assert iterator._ensure_output_item_for_chunk(_empty_choices_usage_chunk()) is None
-    assert iterator.sent_output_item_added_event is False
-
-
-def test_transform_empty_choices_chunk_returns_no_delta():
-    """The mid/trailing usage chunk flows through transform without crashing."""
-    iterator = _iterator()
-    # Would raise IndexError in _get_delta_string_from_streaming_choices before the fix.
-    assert iterator._transform_chat_completion_chunk_to_response_api_chunk(_empty_choices_usage_chunk()) is None
-
-
-def test_is_reasoning_end_false_for_empty_choices_chunk():
-    iterator = _iterator()
-    assert iterator._is_reasoning_end(_empty_choices_usage_chunk()) is False
-
-
-def test_empty_choices_usage_chunk_still_reaches_response_completed():
-    """End-to-end: a text chunk followed by a choices=[] usage chunk must emit
-    response.completed carrying the usage rather than dying mid-stream."""
-
-    class _SyncWrapper:
-        def __init__(self, chunks):
-            self._it = iter(chunks)
-            self.logging_obj = None
-            self.stream_options = {"include_usage": True}
-
-        def __next__(self):
-            return next(self._it)
-
-    text_chunk = ModelResponseStream(
-        id="chunk-1",
-        model="gpt-4o",
-        choices=[StreamingChoices(index=0, delta=Delta(role="assistant", content="Hi"), finish_reason=None)],
-    )
-    iterator = _iterator()
-    iterator.litellm_logging_obj = None
-    iterator.litellm_custom_stream_wrapper = _SyncWrapper([text_chunk, _empty_choices_usage_chunk()])
-
-    events = list(iterator)
-
-    completed = [e for e in events if getattr(e, "type", None) == ResponsesAPIStreamEvents.RESPONSE_COMPLETED]
-    assert len(completed) == 1
-    assert completed[0].response.usage is not None
-    assert completed[0].response.usage.total_tokens == 15
diff --git a/tests/test_litellm/responses/litellm_completion_transformation/test_streaming_iterator_transformation.py b/tests/test_litellm/responses/litellm_completion_transformation/test_streaming_iterator_transformation.py
index 5d97b0531d6..343fc873fa4 100644
--- a/tests/test_litellm/responses/litellm_completion_transformation/test_streaming_iterator_transformation.py
+++ b/tests/test_litellm/responses/litellm_completion_transformation/test_streaming_iterator_transformation.py
@@ -752,6 +752,49 @@ def test_completed_event_restores_usage_hidden_by_stream_options_none():
     assert completed.response.usage.output_tokens == 5
 
 
+def _empty_choices_chunk(usage: Usage | None = None) -> ModelResponseStream:
+    return ModelResponseStream(id=CHAT_COMPLETION_ID, model="claude-haiku-4-5", choices=[], usage=usage)
+
+
+@pytest.mark.asyncio
+async def test_leading_empty_choices_chunk_does_not_kill_the_stream():
+    """
+    Azure leads some streams with a `prompt_filter_results` chunk whose `choices` is empty.
+    The bridge used to index `choices[0]` on it and die before the first token.
+    """
+    iterator = _build_iterator([_empty_choices_chunk(), _chunk("Hello"), _chunk("!", finish_reason="stop")])
+
+    events = [event async for event in iterator]
+
+    event_types = [getattr(event, "type", None) for event in events]
+    assert event_types.count(ResponsesAPIStreamEvents.OUTPUT_ITEM_ADDED) == 1
+    assert "".join(event.delta for event in events if event.type == ResponsesAPIStreamEvents.OUTPUT_TEXT_DELTA) == "Hello!"
+    assert event_types[-1] == ResponsesAPIStreamEvents.RESPONSE_COMPLETED
+
+
+@pytest.mark.asyncio
+async def test_trailing_empty_choices_usage_chunk_reaches_response_completed():
+    """
+    With `stream_options.include_usage` (which the bridge always sets) the last upstream chunk
+    carries only usage and an empty `choices`. It must not crash the stream, and its usage must
+    still land on `response.completed`.
+    """
+    usage: Final = Usage(prompt_tokens=10, completion_tokens=5, total_tokens=15)
+    iterator = _build_iterator([_chunk("Hello"), _chunk("", finish_reason="stop"), _empty_choices_chunk(usage)])
+
+    events = [event async for event in iterator]
+
+    completed = next(
+        event for event in events if getattr(event, "type", None) == ResponsesAPIStreamEvents.RESPONSE_COMPLETED
+    )
+    assert completed.response.usage.input_tokens == 10
+    assert completed.response.usage.output_tokens == 5
+
+
+def test_is_reasoning_end_ignores_empty_choices_chunk():
+    assert _build_iterator([])._is_reasoning_end(_empty_choices_chunk()) is False
+
+
 def test_object_tool_call_arguments_stream_as_valid_json():
     """A provider that sends decoded object arguments must still stream valid JSON.
 

From a7a61db78dcdb71a9b72c8e11806c0cfa4151fc4 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 00:37:55 +0000
Subject: [PATCH 03/24] fix(fireworks_ai): flatten dict-form reasoning_effort
 to its effort string

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .../llms/fireworks_ai/chat/transformation.py  |  9 ++++----
 .../test_fireworks_ai_chat_transformation.py  | 22 +++++++++++++++++++
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/litellm/llms/fireworks_ai/chat/transformation.py b/litellm/llms/fireworks_ai/chat/transformation.py
index 05160d83c12..54a122f7beb 100644
--- a/litellm/llms/fireworks_ai/chat/transformation.py
+++ b/litellm/llms/fireworks_ai/chat/transformation.py
@@ -327,12 +327,13 @@ class FireworksAIConfig(FireworksAIMixin, OpenAIGPTConfig):
             elif param == "max_completion_tokens":
                 optional_params["max_tokens"] = value
             elif param == "reasoning_effort":
-                if value is True:
+                effort: Final = value.get("effort") if isinstance(value, dict) else value
+                if effort is True:
                     optional_params["reasoning_effort"] = "medium"
-                elif value is False:
+                elif effort is False:
                     optional_params["reasoning_effort"] = "none"
-                elif value != "auto":
-                    optional_params["reasoning_effort"] = value
+                elif effort is not None and effort != "auto":
+                    optional_params["reasoning_effort"] = effort
             elif param in supported_openai_params:
                 if value is not None:
                     optional_params[param] = value
diff --git a/tests/test_litellm/llms/fireworks_ai/chat/test_fireworks_ai_chat_transformation.py b/tests/test_litellm/llms/fireworks_ai/chat/test_fireworks_ai_chat_transformation.py
index fb0311ef39b..7715e7b32ff 100644
--- a/tests/test_litellm/llms/fireworks_ai/chat/test_fireworks_ai_chat_transformation.py
+++ b/tests/test_litellm/llms/fireworks_ai/chat/test_fireworks_ai_chat_transformation.py
@@ -1189,6 +1189,28 @@ def test_reasoning_effort_integer_passthrough():
     assert isinstance(result["reasoning_effort"], int)
 
 
+def test_reasoning_effort_dict_from_anthropic_adapter_flattened_to_effort_string():
+    config = FireworksAIConfig()
+    result = config.map_openai_params(
+        {"reasoning_effort": {"effort": "medium", "summary": "detailed"}},
+        {},
+        _REASONING_MODEL,
+        drop_params=False,
+    )
+    assert result["reasoning_effort"] == "medium"
+
+
+def test_reasoning_effort_dict_without_effort_key_dropped():
+    config = FireworksAIConfig()
+    result = config.map_openai_params(
+        {"reasoning_effort": {"summary": "detailed"}},
+        {},
+        _REASONING_MODEL,
+        drop_params=False,
+    )
+    assert "reasoning_effort" not in result
+
+
 def test_reasoning_effort_auto_dropped_to_model_default():
     config = FireworksAIConfig()
     result = config.map_openai_params(

From 232233f654f727fa308f925d012d2cbd7cbfa7a2 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 00:39:11 +0000
Subject: [PATCH 04/24] refactor(fireworks_ai): extract reasoning_effort
 mapping into helper

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .../llms/fireworks_ai/chat/transformation.py  | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/litellm/llms/fireworks_ai/chat/transformation.py b/litellm/llms/fireworks_ai/chat/transformation.py
index 54a122f7beb..b6c2b379d66 100644
--- a/litellm/llms/fireworks_ai/chat/transformation.py
+++ b/litellm/llms/fireworks_ai/chat/transformation.py
@@ -49,6 +49,17 @@ if TYPE_CHECKING:
     import tiktoken
 
 
+def _map_reasoning_effort(value: object) -> object:
+    effort: Final[object] = cast(Mapping[str, object], value).get("effort") if isinstance(value, Mapping) else value
+    if effort is True:
+        return "medium"
+    if effort is False:
+        return "none"
+    if effort == "auto":
+        return None
+    return effort
+
+
 def _extract_fireworks_hidden_params(payload: dict) -> dict:
     """
     Collect Fireworks-specific response fields (perf_metrics, prompt_token_ids,
@@ -327,12 +338,8 @@ class FireworksAIConfig(FireworksAIMixin, OpenAIGPTConfig):
             elif param == "max_completion_tokens":
                 optional_params["max_tokens"] = value
             elif param == "reasoning_effort":
-                effort: Final = value.get("effort") if isinstance(value, dict) else value
-                if effort is True:
-                    optional_params["reasoning_effort"] = "medium"
-                elif effort is False:
-                    optional_params["reasoning_effort"] = "none"
-                elif effort is not None and effort != "auto":
+                effort = _map_reasoning_effort(value)
+                if effort is not None:
                     optional_params["reasoning_effort"] = effort
             elif param in supported_openai_params:
                 if value is not None:

From 3a8679d3d81308a2b6dab32bb210d03df2879534 Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Tue, 15 Sep 2026 17:54:58 -0700
Subject: [PATCH 05/24] fix(proxy): never forward the LiteLLM virtual key to
 Anthropic on the /anthropic passthrough

The /anthropic/{endpoint} route forwarded every incoming header upstream, so
the header carrying the caller's LiteLLM virtual key (Authorization, x-api-key,
x-litellm-api-key, or the operator-configured key header) reached Anthropic and
was rejected there as an invalid credential, with or without a proxy-side
Anthropic key layered on top.

Share the Vertex credential-less header filter: drop the proxy-only credential
headers by name, drop the value that authenticated the caller (virtual key,
master key, or JWT) from Authorization / x-api-key, keep a caller's own
Anthropic credential, layer the proxy's Anthropic credential on top, and fail
with a clean 401 when neither the proxy nor the caller supplied one.

Resolves LIT-3550
---
 .../llm_passthrough_endpoints.py              |  59 +++-
 .../test_llm_pass_through_endpoints.py        | 293 ++++++++++++++++++
 2 files changed, 339 insertions(+), 13 deletions(-)

diff --git a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
index 3c2ae02dc52..3c5f7da1859 100644
--- a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
+++ b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
@@ -708,8 +708,7 @@ async def anthropic_proxy_route(
     endpoint_func: Final = create_pass_through_route(
         endpoint=endpoint,
         target=str(updated_url),
-        custom_headers=auth_header if auth_header is not None else {},
-        _forward_headers=True,
+        custom_headers=_upstream_headers_for_anthropic_route(request, user_api_key_dict, auth_header),
         is_streaming_request=is_streaming_request,
     )  # dynamically construct pass-through endpoint based on incoming path
     received_value: Final = await endpoint_func(
@@ -1909,6 +1908,19 @@ _HEADERS_NEVER_FORWARDED_TO_VERTEX: Final = frozenset({"content-length", "host"}
     SpecialHeaders.litellm_credential_header_names() - _VERTEX_UPSTREAM_CREDENTIAL_HEADERS
 )
 
+_CREDENTIALLESS_ANTHROPIC_MISSING_CREDENTIAL_DETAIL: Final = (
+    "No Anthropic credential is configured on this proxy and the request carried no upstream "
+    "Anthropic credential. The LiteLLM virtual key is not forwarded to Anthropic. Configure an "
+    "Anthropic credential (ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN, or a model with "
+    "use_in_pass_through: true), or send your own Anthropic API key in the x-api-key header or "
+    "your own Anthropic OAuth token in the Authorization header."
+)
+
+_ANTHROPIC_UPSTREAM_CREDENTIAL_HEADERS: Final = frozenset({"authorization", "x-api-key"})
+_HEADERS_NEVER_FORWARDED_TO_ANTHROPIC: Final = frozenset({"content-length", "host", "accept-encoding"}) | (
+    SpecialHeaders.litellm_credential_header_names() - _ANTHROPIC_UPSTREAM_CREDENTIAL_HEADERS
+)
+
 
 _MAPPED_ROUTE_CALLER_KEY_HEADER: Final = "litellm_user_api_key"
 
@@ -1964,26 +1976,47 @@ def _is_authenticated_caller_secret(value: str, user_api_key_dict: UserAPIKeyAut
     return hmac.compare_digest(stored_representation.encode(), authenticated_key.encode())
 
 
+def _caller_headers_without_litellm_secrets(
+    request: Request, user_api_key_dict: UserAPIKeyAuth, never_forwarded: frozenset[str]
+) -> Mapping[str, str]:
+    """Incoming headers minus the ones only LiteLLM consumes and minus whatever value authenticated the caller."""
+    incoming: Final = _safe_get_request_headers(request)
+    dropped_by_name: Final = never_forwarded.union(
+        (_MAPPED_ROUTE_CALLER_KEY_HEADER, *_operator_configured_caller_key_header_names())
+    )
+    return MappingProxyType(
+        {
+            name: value
+            for name, value in incoming.items()
+            if name not in dropped_by_name and not _is_authenticated_caller_secret(value, user_api_key_dict)
+        }
+    )
+
+
 def _forwarded_headers_for_credentialless_vertex_passthrough(
     request: Request, user_api_key_dict: UserAPIKeyAuth
 ) -> Mapping[str, str]:
     """Caller headers to forward on the bring-your-own-credentials Vertex branch, minus LiteLLM secrets."""
-    incoming: Final = _safe_get_request_headers(request)
-    never_forwarded: Final = _HEADERS_NEVER_FORWARDED_TO_VERTEX.union(
-        (_MAPPED_ROUTE_CALLER_KEY_HEADER, *_operator_configured_caller_key_header_names())
+    forwarded: Final = _caller_headers_without_litellm_secrets(
+        request, user_api_key_dict, _HEADERS_NEVER_FORWARDED_TO_VERTEX
     )
-    forwarded: Final = MappingProxyType(
-        {
-            name: value
-            for name, value in incoming.items()
-            if name not in never_forwarded and not _is_authenticated_caller_secret(value, user_api_key_dict)
-        }
-    )
-    if "authorization" not in forwarded and "x-goog-api-key" not in forwarded:
+    if _VERTEX_UPSTREAM_CREDENTIAL_HEADERS.isdisjoint(forwarded):
         raise HTTPException(status_code=401, detail=_CREDENTIALLESS_VERTEX_MISSING_CREDENTIAL_DETAIL)
     return forwarded
 
 
+def _upstream_headers_for_anthropic_route(
+    request: Request, user_api_key_dict: UserAPIKeyAuth, proxy_auth_header: Mapping[str, str] | None
+) -> Mapping[str, str]:
+    """Caller headers minus LiteLLM secrets, with the proxy's own Anthropic credential layered on top."""
+    caller_headers: Final = _caller_headers_without_litellm_secrets(
+        request, user_api_key_dict, _HEADERS_NEVER_FORWARDED_TO_ANTHROPIC
+    )
+    if proxy_auth_header is None and _ANTHROPIC_UPSTREAM_CREDENTIAL_HEADERS.isdisjoint(caller_headers):
+        raise HTTPException(status_code=401, detail=_CREDENTIALLESS_ANTHROPIC_MISSING_CREDENTIAL_DETAIL)
+    return MappingProxyType({**caller_headers, **(proxy_auth_header or {})})
+
+
 async def _prepare_vertex_auth_headers(
     request: Request,
     vertex_credentials: VertexPassThroughCredentials | None,
diff --git a/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py b/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
index 7b285674145..8cb9afc1efb 100644
--- a/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
+++ b/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
@@ -28,6 +28,7 @@ from litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints import (
     BaseOpenAIPassThroughHandler,
     RouteChecks,
     _join_url_paths,
+    anthropic_proxy_route,
     azure_proxy_route,
     bedrock_llm_proxy_route,
     bedrock_proxy_route,
@@ -4285,6 +4286,298 @@ class TestVertexCredentiallessPassthroughVirtualKeyLeak:
         assert "sk-master-1234" not in " ".join(f"{name}:{value}" for name, value in forwarded.items())
 
 
+class TestAnthropicPassthroughVirtualKeyLeak:
+    """Regression coverage for LIT-3550.
+
+    ``/anthropic/{endpoint}`` forwarded every incoming header to Anthropic, so the
+    header that carried the caller's LiteLLM virtual key (``Authorization``,
+    ``x-api-key``, ``x-litellm-api-key``, or an operator-configured name) reached
+    Anthropic and was rejected there as an invalid credential, with or without a
+    proxy-side Anthropic key layered on top. The virtual key must never leave the
+    proxy: it is dropped by value from the headers Anthropic reads as credentials
+    (``Authorization`` / ``x-api-key``), the proxy-only credential headers are
+    dropped by name, a caller's own Anthropic credential still passes through, and
+    a request with neither a proxy credential nor a caller credential fails with a
+    clean 401 instead of reaching ``create_pass_through_route``.
+
+    The forwarded set is rebuilt the way ``pass_through_request`` builds it from
+    the captured ``create_pass_through_route`` kwargs, so a route that re-enables
+    ``_forward_headers`` fails these tests the same way the original bug did.
+    """
+
+    VKEY = "sk-litellm-victim-key"
+    PROXY_KEY = "sk-ant-api03-proxy-configured-key"
+    ENDPOINT = "v1/messages"
+
+    async def _run(
+        self,
+        monkeypatch,
+        headers: list[tuple[bytes, bytes]],
+        authenticated: UserAPIKeyAuth | None = None,
+        master_key: str | None = "sk-master-1234",
+        proxy_api_key: str | None = None,
+    ) -> tuple[HTTPException | None, dict | None]:
+        from litellm.proxy.pass_through_endpoints.pass_through_endpoints import HttpPassThroughEndpointHelpers
+        from litellm.proxy.pass_through_endpoints.passthrough_endpoint_router import (
+            PassthroughEndpointRouter,
+        )
+
+        monkeypatch.setattr("litellm.proxy.proxy_server.master_key", master_key)
+        monkeypatch.delenv("ANTHROPIC_AUTH_TOKEN", raising=False)
+        if proxy_api_key is None:
+            monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
+        else:
+            monkeypatch.setenv("ANTHROPIC_API_KEY", proxy_api_key)
+        caller: Final = authenticated if authenticated is not None else UserAPIKeyAuth(api_key=self.VKEY)
+
+        async def receive():
+            return {"type": "http.request", "body": b"{}", "more_body": False}
+
+        request = Request(
+            {
+                "type": "http",
+                "method": "POST",
+                "path": f"/anthropic/{self.ENDPOINT}",
+                "headers": headers,
+                "query_string": b"",
+            },
+            receive=receive,
+        )
+
+        captured: dict = {}
+
+        def fake_create_pass_through_route(**kwargs):
+            captured.update(kwargs)
+            return AsyncMock(return_value={"status": "success"})
+
+        module = "litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints"
+        monkeypatch.setattr(f"{module}.passthrough_endpoint_router", PassthroughEndpointRouter(lambda: None))
+        raised: HTTPException | None = None
+        with (
+            mock.patch(f"{module}.create_pass_through_route", side_effect=fake_create_pass_through_route),
+            mock.patch(f"{module}.user_api_key_auth", new=AsyncMock(return_value=caller)),
+        ):
+            try:
+                await anthropic_proxy_route(
+                    endpoint=self.ENDPOINT,
+                    request=request,
+                    fastapi_response=Response(),
+                    user_api_key_dict=caller,
+                )
+            except HTTPException as exc:
+                raised = exc
+
+        if not captured:
+            return raised, None
+        upstream: Final = HttpPassThroughEndpointHelpers.forward_headers_from_request(
+            request_headers=dict(request.headers),
+            headers=dict(captured["custom_headers"] or {}),
+            forward_headers=captured.get("_forward_headers", False),
+        )
+        return raised, upstream
+
+    @staticmethod
+    def _blob(forwarded: dict) -> str:
+        return " ".join(f"{name}:{value}" for name, value in forwarded.items())
+
+    @pytest.mark.asyncio
+    async def test_authorization_bearer_virtual_key_is_rejected_not_forwarded(self, monkeypatch):
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [(b"authorization", f"Bearer {self.VKEY}".encode()), (b"content-type", b"application/json")],
+        )
+        assert forwarded is None, "credential-less request must never reach the upstream forwarder"
+        assert raised is not None and raised.status_code == 401
+        assert "ANTHROPIC_API_KEY" in str(raised.detail) and "use_in_pass_through" in str(raised.detail)
+
+    @pytest.mark.asyncio
+    async def test_x_api_key_virtual_key_is_rejected_not_forwarded(self, monkeypatch):
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [(b"x-api-key", self.VKEY.encode()), (b"content-type", b"application/json")],
+        )
+        assert forwarded is None, "a virtual key that authenticated via x-api-key must be stripped, not forwarded"
+        assert raised is not None and raised.status_code == 401
+
+    @pytest.mark.asyncio
+    async def test_x_litellm_api_key_virtual_key_is_rejected_not_forwarded(self, monkeypatch):
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [(b"x-litellm-api-key", self.VKEY.encode()), (b"content-type", b"application/json")],
+        )
+        assert forwarded is None, "credential-less request must never reach the upstream forwarder"
+        assert raised is not None and raised.status_code == 401
+
+    @pytest.mark.asyncio
+    async def test_master_key_in_authorization_is_rejected_not_forwarded(self, monkeypatch):
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [(b"authorization", b"Bearer sk-master-1234"), (b"content-type", b"application/json")],
+            authenticated=UserAPIKeyAuth(api_key="sk-master-1234", user_role=LitellmUserRoles.PROXY_ADMIN),
+        )
+        assert forwarded is None, "the master key must never reach Anthropic"
+        assert raised is not None and raised.status_code == 401
+
+    @pytest.mark.asyncio
+    async def test_byo_anthropic_oauth_token_still_forwards_without_virtual_key(self, monkeypatch):
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [
+                (b"x-litellm-api-key", self.VKEY.encode()),
+                (b"authorization", b"Bearer sk-ant-oat01-caller-oauth-token"),
+                (b"anthropic-version", b"2023-06-01"),
+                (b"content-type", b"application/json"),
+            ],
+        )
+        assert raised is None
+        assert forwarded is not None
+        assert forwarded.get("authorization") == "Bearer sk-ant-oat01-caller-oauth-token"
+        assert forwarded.get("anthropic-version") == "2023-06-01"
+        assert "x-litellm-api-key" not in forwarded
+        assert self.VKEY not in self._blob(forwarded)
+
+    @pytest.mark.asyncio
+    async def test_byo_x_api_key_still_forwards_without_virtual_key(self, monkeypatch):
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [
+                (b"authorization", f"Bearer {self.VKEY}".encode()),
+                (b"x-api-key", b"sk-ant-api03-caller-own-key"),
+                (b"content-type", b"application/json"),
+            ],
+        )
+        assert raised is None
+        assert forwarded is not None
+        assert forwarded.get("x-api-key") == "sk-ant-api03-caller-own-key"
+        assert "authorization" not in forwarded
+        assert self.VKEY not in self._blob(forwarded)
+
+    @pytest.mark.asyncio
+    async def test_custom_auth_caller_keeps_own_authorization_token(self, monkeypatch):
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [(b"authorization", b"Bearer sk-ant-oat01-caller-oauth-token"), (b"content-type", b"application/json")],
+            authenticated=UserAPIKeyAuth(api_key=None),
+            master_key=None,
+        )
+        assert raised is None
+        assert forwarded is not None
+        assert forwarded.get("authorization") == "Bearer sk-ant-oat01-caller-oauth-token"
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize(
+        "credential_header",
+        sorted(SpecialHeaders.litellm_credential_header_names() - {"authorization", "x-api-key", "x-litellm-api-key"}),
+    )
+    async def test_every_non_anthropic_credential_header_is_dropped_by_name(self, monkeypatch, credential_header):
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [
+                (b"x-litellm-api-key", self.VKEY.encode()),
+                (b"x-api-key", b"sk-ant-api03-caller-own-key"),
+                (credential_header.encode(), b"some-distinct-caller-secret-value"),
+                (b"content-type", b"application/json"),
+            ],
+        )
+        assert raised is None
+        assert forwarded is not None
+        assert forwarded.get("x-api-key") == "sk-ant-api03-caller-own-key"
+        assert credential_header not in forwarded
+        assert "x-litellm-api-key" not in forwarded
+        assert self.VKEY not in self._blob(forwarded)
+        assert "some-distinct-caller-secret-value" not in self._blob(forwarded)
+
+    @pytest.mark.asyncio
+    async def test_virtual_key_in_operator_configured_header_is_stripped(self, monkeypatch):
+        with mock.patch.dict(  # test-quality-ok: general_settings is the real proxy config surface for litellm_key_header_name; no injection seam exists on this route
+            "litellm.proxy.proxy_server.general_settings",
+            {"litellm_key_header_name": "x-company-key"},
+        ):
+            raised, forwarded = await self._run(
+                monkeypatch,
+                [
+                    (b"x-company-key", f"Bearer {self.VKEY}".encode()),
+                    (b"x-api-key", b"sk-ant-api03-caller-own-key"),
+                    (b"content-type", b"application/json"),
+                ],
+            )
+        assert raised is None
+        assert forwarded is not None
+        assert forwarded.get("x-api-key") == "sk-ant-api03-caller-own-key"
+        assert "x-company-key" not in forwarded
+        assert self.VKEY not in self._blob(forwarded)
+
+    @pytest.mark.asyncio
+    async def test_proxy_credential_replaces_virtual_key_sent_as_bearer(self, monkeypatch):
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [
+                (b"authorization", f"Bearer {self.VKEY}".encode()),
+                (b"anthropic-version", b"2023-06-01"),
+                (b"content-type", b"application/json"),
+            ],
+            proxy_api_key=self.PROXY_KEY,
+        )
+        assert raised is None
+        assert forwarded is not None
+        assert forwarded.get("x-api-key") == self.PROXY_KEY
+        assert "authorization" not in forwarded
+        assert forwarded.get("anthropic-version") == "2023-06-01"
+        assert self.VKEY not in self._blob(forwarded)
+
+    @pytest.mark.asyncio
+    async def test_proxy_credential_replaces_virtual_key_sent_as_x_api_key(self, monkeypatch):
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [(b"x-api-key", self.VKEY.encode()), (b"content-type", b"application/json")],
+            proxy_api_key=self.PROXY_KEY,
+        )
+        assert raised is None
+        assert forwarded is not None
+        assert forwarded.get("x-api-key") == self.PROXY_KEY
+        assert self.VKEY not in self._blob(forwarded)
+
+    @pytest.mark.asyncio
+    async def test_proxy_credential_wins_over_callers_own_x_api_key(self, monkeypatch):
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [
+                (b"x-litellm-api-key", self.VKEY.encode()),
+                (b"x-api-key", b"sk-ant-api03-caller-own-key"),
+                (b"content-type", b"application/json"),
+            ],
+            proxy_api_key=self.PROXY_KEY,
+        )
+        assert raised is None
+        assert forwarded is not None
+        assert forwarded.get("x-api-key") == self.PROXY_KEY
+        assert "sk-ant-api03-caller-own-key" not in self._blob(forwarded)
+
+    @pytest.mark.asyncio
+    async def test_x_pass_and_hop_by_hop_handling_is_unchanged(self, monkeypatch):
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [
+                (b"authorization", f"Bearer {self.VKEY}".encode()),
+                (b"x-pass-anthropic-beta", b"interleaved-thinking-2025-05-14"),
+                (b"x-pass-authorization", b"Bearer smuggled"),
+                (b"content-length", b"2"),
+                (b"host", b"proxy.internal"),
+                (b"accept-encoding", b"br"),
+                (b"user-agent", b"curl/8.7.1"),
+            ],
+            proxy_api_key=self.PROXY_KEY,
+        )
+        assert raised is None
+        assert forwarded is not None
+        assert forwarded.get("anthropic-beta") == "interleaved-thinking-2025-05-14"
+        assert forwarded.get("user-agent") == "curl/8.7.1"
+        assert "authorization" not in forwarded
+        assert "content-length" not in forwarded
+        assert "host" not in forwarded
+        assert "accept-encoding" not in forwarded
+
+
 class TestVertexPassthroughDefaultLocationOnShortRoutes:
     PROJECT = "test-project"
     SHORT_ROUTE = "publishers/google/models/gemini-2.5-flash:generateContent"

From f8fb31db3a33017dbb9a7386fcc50cb222133f44 Mon Sep 17 00:00:00 2001
From: "berriai-litellm-provider-info-sync[bot]"
 <328147090+berriai-litellm-provider-info-sync[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 17:51:09 +0000
Subject: [PATCH 06/24] chore(prices): sync Azure prices: 2 models

azure_ai/grok-4.3: input_cost_per_token_above_200k_tokens, output_cost_per_token_above_200k_tokens, cache_read_input_token_cost_above_200k_tokens
azure_ai/grok-4.6: input_cost_per_token_above_200k_tokens, output_cost_per_token_above_200k_tokens, cache_read_input_token_cost_above_200k_tokens
---
 litellm/model_prices_and_context_window_backup.json | 6 ++++++
 model_prices_and_context_window.json                | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/litellm/model_prices_and_context_window_backup.json b/litellm/model_prices_and_context_window_backup.json
index cd458666539..88850135e19 100644
--- a/litellm/model_prices_and_context_window_backup.json
+++ b/litellm/model_prices_and_context_window_backup.json
@@ -11313,13 +11313,16 @@
     },
     "azure_ai/grok-4.3": {
         "cache_read_input_token_cost": 2e-07,
+        "cache_read_input_token_cost_above_200k_tokens": 4e-07,
         "input_cost_per_token": 1.25e-06,
+        "input_cost_per_token_above_200k_tokens": 2.5e-06,
         "litellm_provider": "azure_ai",
         "max_input_tokens": 200000,
         "max_output_tokens": 200000,
         "max_tokens": 200000,
         "mode": "chat",
         "output_cost_per_token": 2.5e-06,
+        "output_cost_per_token_above_200k_tokens": 5e-06,
         "source": "https://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20'Foundry%20Models'%20and%20armRegionName%20eq%20'eastus'%20and%20priceType%20eq%20'Consumption'",
         "supports_function_calling": true,
         "supports_prompt_caching": true,
@@ -11331,13 +11334,16 @@
     },
     "azure_ai/grok-4.6": {
         "cache_read_input_token_cost": 5e-07,
+        "cache_read_input_token_cost_above_200k_tokens": 1e-06,
         "input_cost_per_token": 2e-06,
+        "input_cost_per_token_above_200k_tokens": 4e-06,
         "litellm_provider": "azure_ai",
         "max_input_tokens": 200000,
         "max_output_tokens": 128000,
         "max_tokens": 128000,
         "mode": "chat",
         "output_cost_per_token": 6e-06,
+        "output_cost_per_token_above_200k_tokens": 1.2e-05,
         "source": "https://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20'Foundry%20Models'%20and%20armRegionName%20eq%20'eastus'%20and%20priceType%20eq%20'Consumption'",
         "supports_function_calling": true,
         "supports_prompt_caching": true,
diff --git a/model_prices_and_context_window.json b/model_prices_and_context_window.json
index cd458666539..88850135e19 100644
--- a/model_prices_and_context_window.json
+++ b/model_prices_and_context_window.json
@@ -11313,13 +11313,16 @@
     },
     "azure_ai/grok-4.3": {
         "cache_read_input_token_cost": 2e-07,
+        "cache_read_input_token_cost_above_200k_tokens": 4e-07,
         "input_cost_per_token": 1.25e-06,
+        "input_cost_per_token_above_200k_tokens": 2.5e-06,
         "litellm_provider": "azure_ai",
         "max_input_tokens": 200000,
         "max_output_tokens": 200000,
         "max_tokens": 200000,
         "mode": "chat",
         "output_cost_per_token": 2.5e-06,
+        "output_cost_per_token_above_200k_tokens": 5e-06,
         "source": "https://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20'Foundry%20Models'%20and%20armRegionName%20eq%20'eastus'%20and%20priceType%20eq%20'Consumption'",
         "supports_function_calling": true,
         "supports_prompt_caching": true,
@@ -11331,13 +11334,16 @@
     },
     "azure_ai/grok-4.6": {
         "cache_read_input_token_cost": 5e-07,
+        "cache_read_input_token_cost_above_200k_tokens": 1e-06,
         "input_cost_per_token": 2e-06,
+        "input_cost_per_token_above_200k_tokens": 4e-06,
         "litellm_provider": "azure_ai",
         "max_input_tokens": 200000,
         "max_output_tokens": 128000,
         "max_tokens": 128000,
         "mode": "chat",
         "output_cost_per_token": 6e-06,
+        "output_cost_per_token_above_200k_tokens": 1.2e-05,
         "source": "https://prices.azure.com/api/retail/prices?$filter=serviceName%20eq%20'Foundry%20Models'%20and%20armRegionName%20eq%20'eastus'%20and%20priceType%20eq%20'Consumption'",
         "supports_function_calling": true,
         "supports_prompt_caching": true,

From 17059564a8efea88a0a47fff19f0e720a399d32c Mon Sep 17 00:00:00 2001
From: yassin <yassin@berri.ai>
Date: Wed, 16 Sep 2026 18:08:14 +0000
Subject: [PATCH 07/24] feat(otel): promote nested request metadata keys to
 litellm.metadata.* span attributes

baggage_metadata_keys entries such as requester_metadata.trace_id now resolve the caller's nested metadata.trace_id and stamp it on the LLM-call span as litellm.metadata.trace_id, in both the OTEL v2 logger and the legacy OpenTelemetry callback. Nested metadata mappings are flattened to dotted paths, only allowlisted leaves are promoted, and the requester_metadata blob itself is never promoted

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/integrations/opentelemetry.py         | 15 +++++++
 litellm/integrations/otel/logger.py           | 11 ++++-
 litellm/integrations/otel/model/baggage.py    | 22 ++++++++--
 litellm/integrations/otel/model/config.py     |  5 ++-
 litellm/integrations/otel/model/metadata.py   | 44 ++++++++++++++++---
 .../integrations/otel/test_otel_v2_baggage.py | 28 ++++++++++++
 .../integrations/otel/test_otel_v2_logger.py  | 35 +++++++++++++++
 .../integrations/test_opentelemetry.py        | 30 +++++++++++++
 8 files changed, 177 insertions(+), 13 deletions(-)

diff --git a/litellm/integrations/opentelemetry.py b/litellm/integrations/opentelemetry.py
index d4e7fcb577e..9456817a205 100644
--- a/litellm/integrations/opentelemetry.py
+++ b/litellm/integrations/opentelemetry.py
@@ -5,6 +5,7 @@ from collections.abc import Callable, Iterable, Mapping
 from concurrent.futures import ThreadPoolExecutor
 from dataclasses import dataclass, field
 from datetime import datetime
+from types import MappingProxyType
 from typing import TYPE_CHECKING, Any, Final, TypedDict, cast
 
 import litellm
@@ -20,7 +21,9 @@ from litellm.integrations.opentelemetry_utils.gen_ai_semconv import (
     OTELSemconvCategory,
     parse_semconv_opt_in,
 )
+from litellm.integrations.otel.model.baggage import promoted_metadata
 from litellm.integrations.otel.model.db_endpoint import db_span_attributes
+from litellm.integrations.otel.model.metadata import flatten_metadata
 from litellm.integrations.otel.model.semconv import Metric
 from litellm.litellm_core_utils.internal_call_metadata import is_unbilled_non_inference_call_from_params
 from litellm.litellm_core_utils.safe_json_dumps import safe_dumps
@@ -288,6 +291,7 @@ class OpenTelemetryConfig:
     # under ``litellm.team.metadata``. Empty by default so none of a team's
     # metadata leaves the process until explicitly allowlisted.
     baggage_team_metadata_keys: list[str] = field(default_factory=list)
+    baggage_metadata_keys: list[str] = field(default_factory=list)
     # Prometheus-style include/exclude control over which attributes are stamped
     # on emitted metrics, to cap metric cardinality.
     attributes: OTELMetricAttributeFilter | None = None
@@ -314,6 +318,9 @@ class OpenTelemetryConfig:
         self.baggage_team_metadata_keys = _normalize_team_metadata_keys(
             self.baggage_team_metadata_keys
         ) or _normalize_team_metadata_keys(os.getenv("LITELLM_OTEL_BAGGAGE_TEAM_METADATA_KEYS"))
+        self.baggage_metadata_keys = _normalize_team_metadata_keys(
+            self.baggage_metadata_keys
+        ) or _normalize_team_metadata_keys(os.getenv("LITELLM_OTEL_BAGGAGE_METADATA_KEYS"))
 
     @classmethod
     def from_env(cls):
@@ -366,11 +373,14 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger):
         **kwargs,
     ):
         team_metadata_keys_override: Final = kwargs.pop("baggage_team_metadata_keys", None)
+        metadata_keys_override: Final = kwargs.pop("baggage_metadata_keys", None)
         metric_attributes_override: Final = kwargs.pop("attributes", None)
         if config is None:
             config = OpenTelemetryConfig.from_env()
         if team_metadata_keys_override is not None:
             config.baggage_team_metadata_keys = _normalize_team_metadata_keys(team_metadata_keys_override)
+        if metadata_keys_override is not None:
+            config.baggage_metadata_keys = _normalize_team_metadata_keys(metadata_keys_override)
         if metric_attributes_override is not None:
             config.attributes = _build_metric_attribute_filter(metric_attributes_override)
 
@@ -1542,6 +1552,11 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger):
         if team_metadata:
             self.safe_set_attribute(span=span, key=TEAM_METADATA_ATTRIBUTE, value=team_metadata)
 
+        if self.config.baggage_metadata_keys:
+            flat_metadata: Final = MappingProxyType(dict(flatten_metadata(metadata)))
+            for key, value in promoted_metadata(flat_metadata, tuple(self.config.baggage_metadata_keys)).items():
+                self.safe_set_attribute(span=span, key=key, value=value)
+
         model_group: Final = standard_logging_payload.get("model_group")
         if model_group:
             self.safe_set_attribute(span=span, key=MODEL_GROUP_ATTRIBUTE, value=model_group)
diff --git a/litellm/integrations/otel/logger.py b/litellm/integrations/otel/logger.py
index 9ac748b231c..285a5c3aa97 100644
--- a/litellm/integrations/otel/logger.py
+++ b/litellm/integrations/otel/logger.py
@@ -33,6 +33,7 @@ from litellm.integrations.otel.model.metadata import (
     LLMCallEvent,
     RequestIdentity,
     auth_metadata,
+    metadata_from_request_data,
     model_from_request_data,
 )
 from litellm.integrations.otel.model.payloads import (
@@ -679,7 +680,12 @@ class OpenTelemetryV2(CustomLogger):
     #  / errors are the FastAPI instrumentor's job, so we don't touch it here.
     # ====================================================================== #
 
-    def seed_request_identity(self, user_api_key_dict: object, model: str | None = None) -> None:
+    def seed_request_identity(
+        self,
+        user_api_key_dict: object,
+        model: str | None = None,
+        request_metadata: Mapping[str, object] | None = None,
+    ) -> None:
         """Attach request-identity Baggage to the current context + server span.
 
         Seeding identity into Baggage makes **every** span emitted afterwards for
@@ -691,7 +697,7 @@ class OpenTelemetryV2(CustomLogger):
         isn't determined yet, which is correct.
         """
         try:
-            identity: Final = RequestIdentity.from_user_api_key_auth(user_api_key_dict)
+            identity: Final = RequestIdentity.from_user_api_key_auth(user_api_key_dict, request_metadata)
             bag: Final = promoted_baggage(
                 identity,
                 model,
@@ -743,6 +749,7 @@ class OpenTelemetryV2(CustomLogger):
         self.seed_request_identity(
             user_api_key_dict,
             model=model_from_request_data(data),
+            request_metadata=metadata_from_request_data(data),
         )
         return data
 
diff --git a/litellm/integrations/otel/model/baggage.py b/litellm/integrations/otel/model/baggage.py
index 2be9bb36def..0511eadaa8b 100644
--- a/litellm/integrations/otel/model/baggage.py
+++ b/litellm/integrations/otel/model/baggage.py
@@ -15,6 +15,7 @@ never promoted whole.
 
 import json
 from collections.abc import Callable, Mapping
+from types import MappingProxyType
 from typing import Final
 
 from litellm.integrations.otel.model.metadata import RequestIdentity
@@ -85,13 +86,26 @@ def promoted_baggage(
             value = extract(identity, request_model, team_metadata_keys)
             if value:
                 out[key] = value
-    for meta_key in metadata_keys:
-        value = identity.metadata.get(meta_key)
-        if value:
-            out[f"{LiteLLM.METADATA_PREFIX}{meta_key}"] = value
+    out.update(promoted_metadata(identity.metadata, metadata_keys))
     return out
 
 
+def promoted_metadata(metadata: Mapping[str, str], metadata_keys: tuple[str, ...]) -> Mapping[str, str]:
+    """Allowlisted entries of a flattened metadata mapping under ``litellm.metadata.*``.
+
+    A dotted key such as ``requester_metadata.trace_id`` reads the nested value and
+    is promoted under its last segment (``litellm.metadata.trace_id``), so the
+    caller-facing attribute name is independent of where the proxy stored it.
+    """
+    return MappingProxyType(
+        {
+            f"{LiteLLM.METADATA_PREFIX}{meta_key.rsplit('.', 1)[-1]}": value
+            for meta_key in metadata_keys
+            if (value := metadata.get(meta_key))
+        }
+    )
+
+
 def _filtered_team_metadata_json(
     metadata: Mapping[str, object] | None,
     allowed_keys: tuple[str, ...],
diff --git a/litellm/integrations/otel/model/config.py b/litellm/integrations/otel/model/config.py
index bd542ddc20c..e5a8132dc71 100644
--- a/litellm/integrations/otel/model/config.py
+++ b/litellm/integrations/otel/model/config.py
@@ -210,7 +210,10 @@ class OpenTelemetryV2Config(BaseSettings):
         validation_alias=AliasChoices("baggage_metadata_keys", "LITELLM_OTEL_BAGGAGE_METADATA_KEYS"),
         description=(
             "Metadata sub-keys promoted under the ``litellm.metadata.*`` "
-            "namespace. Configure via the ``LITELLM_OTEL_BAGGAGE_METADATA_KEYS`` "
+            "namespace. A dotted path such as ``requester_metadata.trace_id`` "
+            "reads the caller's nested ``metadata.trace_id`` and is promoted under "
+            "its last segment (``litellm.metadata.trace_id``). "
+            "Configure via the ``LITELLM_OTEL_BAGGAGE_METADATA_KEYS`` "
             "env var (comma-separated) or "
             "``callback_settings.otel.baggage_metadata_keys`` in config.yaml."
         ),
diff --git a/litellm/integrations/otel/model/metadata.py b/litellm/integrations/otel/model/metadata.py
index cc81b689708..d1fb3beae20 100644
--- a/litellm/integrations/otel/model/metadata.py
+++ b/litellm/integrations/otel/model/metadata.py
@@ -78,7 +78,7 @@ class RequestIdentity:
         model, not just the user-facing one.
         """
         raw_meta: Final = cast(Mapping[str, object], payload.get("metadata") or {})
-        metadata = {key: str(value) for key, value in raw_meta.items() if isinstance(value, (str, bool, int, float))}
+        metadata: Final = MappingProxyType(dict(flatten_metadata(raw_meta)))
         return cls(
             call_id=as_str(payload.get("litellm_call_id")) or as_str(payload.get("id")),
             # StandardLoggingMetadata's canonical key is ``user_api_key_team_id``;
@@ -95,7 +95,9 @@ class RequestIdentity:
         )
 
     @classmethod
-    def from_user_api_key_auth(cls, auth: object) -> RequestIdentity:
+    def from_user_api_key_auth(
+        cls, auth: object, request_metadata: Mapping[str, object] | None = None
+    ) -> RequestIdentity:
         """Identity from a ``UserAPIKeyAuth`` (duck-typed to keep this module
         free of a proxy import).
 
@@ -103,11 +105,12 @@ class RequestIdentity:
         guardrail, or service span is created — so the whole request's spans
         inherit identity, not just the LLM-call span. Metadata sub-keys use the
         ``user_api_key_*`` names that ``baggage.DEFAULT_BAGGAGE_METADATA_KEYS``
-        promotes.
+        promotes; ``request_metadata`` (the proxy's per-request metadata dict) is
+        flattened to dotted keys so ``requester_metadata.<key>`` resolves too.
         """
         get: Final = lambda name: getattr(auth, name, None)  # noqa: E731
-        metadata: Final = {
-            meta_key: str(value)
+        auth_meta: Final = tuple(
+            (meta_key, str(value))
             for meta_key, attr in (
                 ("user_api_key_user_id", "user_id"),
                 ("user_api_key_org_id", "org_id"),
@@ -115,7 +118,9 @@ class RequestIdentity:
                 ("user_api_key_end_user_id", "end_user_id"),
             )
             if (value := get(attr))
-        }
+        )
+        request_meta: Final = flatten_metadata(request_metadata) if request_metadata is not None else ()
+        metadata: Final = MappingProxyType(dict((*request_meta, *auth_meta)))
         return cls(
             team_id=as_str(get("team_id")),
             team_alias=as_str(get("team_alias")),
@@ -351,6 +356,33 @@ def model_from_request_data(data: object) -> str | None:
     return None
 
 
+def metadata_from_request_data(data: object) -> Mapping[str, object] | None:
+    """The proxy's per-request metadata dict from a pre-call ``data`` dict.
+
+    The proxy writes it under ``metadata`` or ``litellm_metadata`` depending on
+    the route; the one carrying the ``requester_metadata`` snapshot wins.
+    """
+    top: Final = _as_str_mapping(data)
+    if top is None:
+        return None
+    candidates: Final = tuple(
+        nested for name in ("metadata", "litellm_metadata") if (nested := _as_str_mapping(top.get(name))) is not None
+    )
+    return next(
+        (c for c in candidates if isinstance(c.get("requester_metadata"), Mapping)),
+        candidates[0] if candidates else None,
+    )
+
+
+def flatten_metadata(raw: Mapping[str, object], prefix: str = "") -> Iterator[tuple[str, str]]:
+    """Scalar leaves of a nested metadata mapping, keyed by their dotted path."""
+    for key, value in raw.items():
+        if (nested := _as_str_mapping(value)) is not None:
+            yield from flatten_metadata(nested, f"{prefix}{key}.")
+        elif isinstance(value, (str, bool, int, float)):
+            yield f"{prefix}{key}", str(value)
+
+
 def resolve_provider_model(payload: StandardLoggingPayload) -> str | None:
     """The model litellm dispatched to the provider, from the payload.
 
diff --git a/tests/test_litellm/integrations/otel/test_otel_v2_baggage.py b/tests/test_litellm/integrations/otel/test_otel_v2_baggage.py
index b379b8bebc9..78fdd251d18 100644
--- a/tests/test_litellm/integrations/otel/test_otel_v2_baggage.py
+++ b/tests/test_litellm/integrations/otel/test_otel_v2_baggage.py
@@ -168,6 +168,34 @@ def test_allowlisted_metadata_subkey_promoted_blob_excluded():
     assert all("private_note" not in k for k in span.attributes)
 
 
+def test_nested_metadata_key_promoted_under_leaf_name():
+    """A dotted allowlist entry reads the nested caller metadata the proxy stores
+    under ``requester_metadata`` and lands on the LLM-call span as
+    ``litellm.metadata.<leaf>``; unlisted siblings and the blob stay out."""
+    engine, exporter = _engine_and_exporter()
+    payload = _payload()
+    payload["metadata"]["requester_metadata"] = {
+        "trace_id": "abc",
+        "attempt": 0,
+        "empty": "",
+        "nested": {"deep": "x"},
+    }
+    data = LLMCallSpanData.from_standard_logging_payload(payload)
+    bag = promoted_baggage(
+        data.identity,
+        data.request_model,
+        BAGGAGE_PROMOTED_KEYS,
+        metadata_keys=("requester_metadata.trace_id", "requester_metadata.attempt", "requester_metadata.empty"),
+    )
+    engine.emit(SpanRole.LLM_CALL, data, ctx_mod.set_request_baggage(bag))
+    (span,) = exporter.get_finished_spans()
+    assert span.attributes[f"{LiteLLM.METADATA_PREFIX}trace_id"] == "abc"
+    assert span.attributes[f"{LiteLLM.METADATA_PREFIX}attempt"] == "0"
+    assert f"{LiteLLM.METADATA_PREFIX}empty" not in span.attributes
+    assert f"{LiteLLM.METADATA_PREFIX}deep" not in span.attributes
+    assert not any(k.startswith(f"{LiteLLM.METADATA_PREFIX}requester_metadata") for k in span.attributes)
+
+
 def test_http_attributes_never_promoted():
     """Even if http.* is present in baggage, the processor must not stamp it on
     child spans (it belongs on the SERVER span only)."""
diff --git a/tests/test_litellm/integrations/otel/test_otel_v2_logger.py b/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
index 2869c804c07..aa78e3b7c4d 100644
--- a/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
+++ b/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
@@ -1655,6 +1655,41 @@ def test_pre_call_hook_seeds_baggage_onto_server_and_child_spans():
     assert srv.attributes[f"{LiteLLM.METADATA_PREFIX}user_api_key_user_id"] == "u1"
 
 
+def test_pre_call_hook_promotes_nested_request_metadata_key():
+    """``baggage_metadata_keys: [requester_metadata.trace_id]`` reads the caller's
+    ``metadata.trace_id`` (snapshotted by the proxy under ``requester_metadata``)
+    and stamps ``litellm.metadata.trace_id`` on the server, LLM-call and service
+    spans of the request; unlisted siblings are not promoted."""
+    cfg = OpenTelemetryV2Config(exporter="in_memory", baggage_metadata_keys=["requester_metadata.trace_id"])
+    exporter = InMemorySpanExporter()
+    logger = OpenTelemetryV2(config=cfg, tracer_provider=providers.build_tracer_provider(cfg, exporter=exporter))
+    server = logger._emitter.start_span(SpanRole.PROXY_REQUEST, LITELLM_PROXY_REQUEST_SPAN_NAME)
+    data = {"model": "gpt-4o", "metadata": {"requester_metadata": {"trace_id": "abc", "nested": {"deep": "x"}}}}
+    kwargs = _kwargs()
+
+    async def _flow():
+        await logger.async_pre_call_hook(_Auth(), None, data, "completion")
+        logger.log_pre_api_call(model="gpt-4o", messages=[], kwargs=kwargs)
+        await logger.async_log_success_event(kwargs, None, None, None)
+        await logger.async_service_success_hook(payload=_ServicePayload("redis", "set"), parent_otel_span=server)
+
+    with trace.use_span(server, end_on_exit=False):
+        asyncio.run(_flow())
+    server.end()
+
+    spans = {s.name: s for s in exporter.get_finished_spans()}
+    key = f"{LiteLLM.METADATA_PREFIX}trace_id"
+    assert spans[LITELLM_PROXY_REQUEST_SPAN_NAME].attributes[key] == "abc"
+    assert spans["chat gpt-4o"].attributes[key] == "abc"
+    assert spans["redis set"].attributes[key] == "abc"
+    assert data == {"model": "gpt-4o", "metadata": {"requester_metadata": {"trace_id": "abc", "nested": {"deep": "x"}}}}
+    assert not any(
+        k.startswith(f"{LiteLLM.METADATA_PREFIX}requester_metadata") or k == f"{LiteLLM.METADATA_PREFIX}deep"
+        for s in spans.values()
+        for k in s.attributes
+    )
+
+
 # --------------------------------------------------------------------------- #
 #  Service hooks (Phase 3)
 # --------------------------------------------------------------------------- #
diff --git a/tests/test_litellm/integrations/test_opentelemetry.py b/tests/test_litellm/integrations/test_opentelemetry.py
index 9ec8489f784..e25fb3964b8 100644
--- a/tests/test_litellm/integrations/test_opentelemetry.py
+++ b/tests/test_litellm/integrations/test_opentelemetry.py
@@ -5581,6 +5581,31 @@ class TestOpenTelemetryInferenceIdentityAttributes(unittest.TestCase):
         otel.set_attributes(span, kwargs, {"model": "azure/gpt-4o"})
         assert "http.route" not in self._attr(span, exp)
 
+    def test_nested_metadata_key_promoted_under_leaf_name(self):
+        """``baggage_metadata_keys: [requester_metadata.trace_id]`` stamps the
+        caller's nested metadata value as ``litellm.metadata.trace_id``; unlisted
+        siblings stay inside the ``metadata.requester_metadata`` blob."""
+        otel = OpenTelemetry(config=OpenTelemetryConfig(baggage_metadata_keys=["requester_metadata.trace_id"]))
+        kwargs = self._kwargs()
+        kwargs["standard_logging_object"]["metadata"]["requester_metadata"] = {
+            "trace_id": "abc",
+            "nested": {"deep": "x"},
+        }
+        span, exp = self._span()
+        otel.set_attributes(span, kwargs, {"model": "azure/gpt-4o"})
+        attrs = self._attr(span, exp)
+        assert attrs["litellm.metadata.trace_id"] == "abc"
+        assert "litellm.metadata.deep" not in attrs
+        assert not any(k.startswith("litellm.metadata.requester_metadata") for k in attrs)
+
+    def test_metadata_keys_default_to_none_promoted(self):
+        otel = OpenTelemetry()
+        kwargs = self._kwargs()
+        kwargs["standard_logging_object"]["metadata"]["requester_metadata"] = {"trace_id": "abc"}
+        span, exp = self._span()
+        otel.set_attributes(span, kwargs, {"model": "azure/gpt-4o"})
+        assert not any(k.startswith("litellm.metadata.") for k in self._attr(span, exp))
+
     def test_team_metadata_json_helper(self):
         keys = ["a", "b"]
         assert OpenTelemetry._team_metadata_json(None, keys) is None
@@ -5631,6 +5656,11 @@ class TestOpenTelemetryTeamMetadataKeysConfig(unittest.TestCase):
             cfg = OpenTelemetryConfig(baggage_team_metadata_keys=["from_arg"])
             assert cfg.baggage_team_metadata_keys == ["from_arg"]
 
+    def test_metadata_keys_from_kwargs_and_env(self):
+        with patch.dict("os.environ", {"LITELLM_OTEL_BAGGAGE_METADATA_KEYS": "requester_metadata.trace_id, a.b"}):
+            assert OpenTelemetryConfig().baggage_metadata_keys == ["requester_metadata.trace_id", "a.b"]
+        assert OpenTelemetry(baggage_metadata_keys="x.y").config.baggage_metadata_keys == ["x.y"]
+
 
 class TestOpenTelemetryMetricAttributeFiltering(unittest.TestCase):
     """LIT-3600: include/exclude control over which attributes are stamped on

From 8cab3a78465610b59de920e1c4d9bac5560566d3 Mon Sep 17 00:00:00 2001
From: yassin <yassin@berri.ai>
Date: Wed, 16 Sep 2026 18:20:10 +0000
Subject: [PATCH 08/24] refactor(otel): walk nested metadata iteratively
 instead of recursively

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/integrations/otel/model/metadata.py | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/litellm/integrations/otel/model/metadata.py b/litellm/integrations/otel/model/metadata.py
index d1fb3beae20..9c2c214a45c 100644
--- a/litellm/integrations/otel/model/metadata.py
+++ b/litellm/integrations/otel/model/metadata.py
@@ -374,13 +374,15 @@ def metadata_from_request_data(data: object) -> Mapping[str, object] | None:
     )
 
 
-def flatten_metadata(raw: Mapping[str, object], prefix: str = "") -> Iterator[tuple[str, str]]:
+def flatten_metadata(raw: Mapping[str, object]) -> Iterator[tuple[str, str]]:
     """Scalar leaves of a nested metadata mapping, keyed by their dotted path."""
-    for key, value in raw.items():
+    stack: Final = list(tuple(raw.items())[::-1])  # mutable-ok: iterative worklist keeps the walk off the call stack
+    while stack:
+        key, value = stack.pop()
         if (nested := _as_str_mapping(value)) is not None:
-            yield from flatten_metadata(nested, f"{prefix}{key}.")
+            stack.extend(tuple((f"{key}.{sub_key}", sub_value) for sub_key, sub_value in nested.items())[::-1])
         elif isinstance(value, (str, bool, int, float)):
-            yield f"{prefix}{key}", str(value)
+            yield key, str(value)
 
 
 def resolve_provider_model(payload: StandardLoggingPayload) -> str | None:

From 774fc6021b3267f5fe0d9fdedd61830b2a76a7b3 Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Wed, 16 Sep 2026 11:35:43 -0700
Subject: [PATCH 09/24] chore(proxy): drop restating docstrings on the
 passthrough header helpers and refresh the lazy OpenAPI snapshot

---
 litellm/proxy/_lazy_openapi_snapshot.json      |  2 +-
 .../llm_passthrough_endpoints.py               |  2 --
 .../test_llm_pass_through_endpoints.py         | 18 ------------------
 3 files changed, 1 insertion(+), 21 deletions(-)

diff --git a/litellm/proxy/_lazy_openapi_snapshot.json b/litellm/proxy/_lazy_openapi_snapshot.json
index 74f38b3ca6d..b749d01310a 100644
--- a/litellm/proxy/_lazy_openapi_snapshot.json
+++ b/litellm/proxy/_lazy_openapi_snapshot.json
@@ -19346,7 +19346,7 @@
                   }
                 }
               },
-              "description": "\n    Unified rate-limit error.\n\n    Every rate-limit condition surfaced by litellm \u2014 whether it originated from\n    an upstream LLM provider, a vendor batch endpoint, or one of litellm's own\n    proxy-side limiters (parallel-requests, dynamic-rate, batch-rate, budget,\n    max-iterations, etc.) \u2014 is raised as an instance of this class.\n\n    The :attr:`category` attribute lets callers distinguish the source. See\n    :class:`RateLimitErrorCategory` for the available values.\n    "
+              "description": "\nUnified rate-limit error.\n\nEvery rate-limit condition surfaced by litellm \u2014 whether it originated from\nan upstream LLM provider, a vendor batch endpoint, or one of litellm's own\nproxy-side limiters (parallel-requests, dynamic-rate, batch-rate, budget,\nmax-iterations, etc.) \u2014 is raised as an instance of this class.\n\nThe :attr:`category` attribute lets callers distinguish the source. See\n:class:`RateLimitErrorCategory` for the available values.\n"
             },
             "500": {
               "content": {
diff --git a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
index 82e9adaccf9..0a584ece4b9 100644
--- a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
+++ b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
@@ -2059,7 +2059,6 @@ def _is_authenticated_caller_secret(value: str, user_api_key_dict: UserAPIKeyAut
 def _caller_headers_without_litellm_secrets(
     request: Request, user_api_key_dict: UserAPIKeyAuth, never_forwarded: frozenset[str]
 ) -> Mapping[str, str]:
-    """Incoming headers minus the ones only LiteLLM consumes and minus whatever value authenticated the caller."""
     incoming: Final = _safe_get_request_headers(request)
     dropped_by_name: Final = never_forwarded.union(
         (_MAPPED_ROUTE_CALLER_KEY_HEADER, *_operator_configured_caller_key_header_names())
@@ -2088,7 +2087,6 @@ def _forwarded_headers_for_credentialless_vertex_passthrough(
 def _upstream_headers_for_anthropic_route(
     request: Request, user_api_key_dict: UserAPIKeyAuth, proxy_auth_header: Mapping[str, str] | None
 ) -> Mapping[str, str]:
-    """Caller headers minus LiteLLM secrets, with the proxy's own Anthropic credential layered on top."""
     caller_headers: Final = _caller_headers_without_litellm_secrets(
         request, user_api_key_dict, _HEADERS_NEVER_FORWARDED_TO_ANTHROPIC
     )
diff --git a/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py b/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
index ab44df56354..dcce6712b41 100644
--- a/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
+++ b/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
@@ -4288,24 +4288,6 @@ class TestVertexCredentiallessPassthroughVirtualKeyLeak:
 
 
 class TestAnthropicPassthroughVirtualKeyLeak:
-    """Regression coverage for LIT-3550.
-
-    ``/anthropic/{endpoint}`` forwarded every incoming header to Anthropic, so the
-    header that carried the caller's LiteLLM virtual key (``Authorization``,
-    ``x-api-key``, ``x-litellm-api-key``, or an operator-configured name) reached
-    Anthropic and was rejected there as an invalid credential, with or without a
-    proxy-side Anthropic key layered on top. The virtual key must never leave the
-    proxy: it is dropped by value from the headers Anthropic reads as credentials
-    (``Authorization`` / ``x-api-key``), the proxy-only credential headers are
-    dropped by name, a caller's own Anthropic credential still passes through, and
-    a request with neither a proxy credential nor a caller credential fails with a
-    clean 401 instead of reaching ``create_pass_through_route``.
-
-    The forwarded set is rebuilt the way ``pass_through_request`` builds it from
-    the captured ``create_pass_through_route`` kwargs, so a route that re-enables
-    ``_forward_headers`` fails these tests the same way the original bug did.
-    """
-
     VKEY = "sk-litellm-victim-key"
     PROXY_KEY = "sk-ant-api03-proxy-configured-key"
     ENDPOINT = "v1/messages"

From 8a059cd4b411af7aad3191dc87e85a4a953e9929 Mon Sep 17 00:00:00 2001
From: yassin <yassin@berri.ai>
Date: Wed, 16 Sep 2026 18:39:55 +0000
Subject: [PATCH 10/24] fix(otel): promote nested metadata keys under the
 caller's dotted path

Strip only the proxy's requester_metadata. wrapper from an allowlisted key so
requester_metadata.trace_id lands as litellm.metadata.trace_id while other
dotted keys keep their full path and cannot collide on a shared leaf name

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/integrations/otel/model/baggage.py    | 11 +++-------
 litellm/integrations/otel/model/config.py     |  4 ++--
 litellm/integrations/otel/model/metadata.py   |  1 +
 .../integrations/otel/test_otel_v2_baggage.py | 22 ++++++++++++++-----
 .../integrations/otel/test_otel_v2_logger.py  |  2 +-
 .../integrations/test_opentelemetry.py        | 17 +++++++++-----
 6 files changed, 36 insertions(+), 21 deletions(-)

diff --git a/litellm/integrations/otel/model/baggage.py b/litellm/integrations/otel/model/baggage.py
index 0511eadaa8b..d380d868e90 100644
--- a/litellm/integrations/otel/model/baggage.py
+++ b/litellm/integrations/otel/model/baggage.py
@@ -18,7 +18,7 @@ from collections.abc import Callable, Mapping
 from types import MappingProxyType
 from typing import Final
 
-from litellm.integrations.otel.model.metadata import RequestIdentity
+from litellm.integrations.otel.model.metadata import REQUESTER_METADATA_PATH, RequestIdentity
 from litellm.integrations.otel.model.semconv import GenAI, LiteLLM
 
 # Attribute key -> value extractor over (identity, request_model,
@@ -91,15 +91,10 @@ def promoted_baggage(
 
 
 def promoted_metadata(metadata: Mapping[str, str], metadata_keys: tuple[str, ...]) -> Mapping[str, str]:
-    """Allowlisted entries of a flattened metadata mapping under ``litellm.metadata.*``.
-
-    A dotted key such as ``requester_metadata.trace_id`` reads the nested value and
-    is promoted under its last segment (``litellm.metadata.trace_id``), so the
-    caller-facing attribute name is independent of where the proxy stored it.
-    """
+    """Allowlisted entries of a flattened metadata mapping under ``litellm.metadata.*``."""
     return MappingProxyType(
         {
-            f"{LiteLLM.METADATA_PREFIX}{meta_key.rsplit('.', 1)[-1]}": value
+            f"{LiteLLM.METADATA_PREFIX}{meta_key.removeprefix(REQUESTER_METADATA_PATH)}": value
             for meta_key in metadata_keys
             if (value := metadata.get(meta_key))
         }
diff --git a/litellm/integrations/otel/model/config.py b/litellm/integrations/otel/model/config.py
index e5a8132dc71..5bda66ed618 100644
--- a/litellm/integrations/otel/model/config.py
+++ b/litellm/integrations/otel/model/config.py
@@ -211,8 +211,8 @@ class OpenTelemetryV2Config(BaseSettings):
         description=(
             "Metadata sub-keys promoted under the ``litellm.metadata.*`` "
             "namespace. A dotted path such as ``requester_metadata.trace_id`` "
-            "reads the caller's nested ``metadata.trace_id`` and is promoted under "
-            "its last segment (``litellm.metadata.trace_id``). "
+            "reads the caller's nested ``metadata.trace_id`` and is promoted as "
+            "``litellm.metadata.trace_id``; other dotted keys keep their full path. "
             "Configure via the ``LITELLM_OTEL_BAGGAGE_METADATA_KEYS`` "
             "env var (comma-separated) or "
             "``callback_settings.otel.baggage_metadata_keys`` in config.yaml."
diff --git a/litellm/integrations/otel/model/metadata.py b/litellm/integrations/otel/model/metadata.py
index 9c2c214a45c..8b3a5fc3fd5 100644
--- a/litellm/integrations/otel/model/metadata.py
+++ b/litellm/integrations/otel/model/metadata.py
@@ -49,6 +49,7 @@ if TYPE_CHECKING:
     from litellm.types.utils import StandardLoggingPayload
 
 LANGFUSE_TRACE_NAME_HEADER: Final = "langfuse_trace_name"
+REQUESTER_METADATA_PATH: Final = "requester_metadata."
 
 
 @dataclass(frozen=True)
diff --git a/tests/test_litellm/integrations/otel/test_otel_v2_baggage.py b/tests/test_litellm/integrations/otel/test_otel_v2_baggage.py
index 78fdd251d18..930c01e524e 100644
--- a/tests/test_litellm/integrations/otel/test_otel_v2_baggage.py
+++ b/tests/test_litellm/integrations/otel/test_otel_v2_baggage.py
@@ -168,31 +168,43 @@ def test_allowlisted_metadata_subkey_promoted_blob_excluded():
     assert all("private_note" not in k for k in span.attributes)
 
 
-def test_nested_metadata_key_promoted_under_leaf_name():
+def test_nested_metadata_key_promoted_under_caller_path():
     """A dotted allowlist entry reads the nested caller metadata the proxy stores
-    under ``requester_metadata`` and lands on the LLM-call span as
-    ``litellm.metadata.<leaf>``; unlisted siblings and the blob stay out."""
+    under ``requester_metadata`` and lands on the LLM-call span under the caller's
+    own path (``litellm.metadata.trace_id``, ``litellm.metadata.nested.deep``);
+    a pre-existing flat dotted key keeps its full name, and unlisted siblings and
+    the blob stay out."""
     engine, exporter = _engine_and_exporter()
     payload = _payload()
+    payload["metadata"]["a.b"] = "flat"
     payload["metadata"]["requester_metadata"] = {
         "trace_id": "abc",
         "attempt": 0,
         "empty": "",
-        "nested": {"deep": "x"},
+        "nested": {"deep": "x", "skipped": "y"},
     }
     data = LLMCallSpanData.from_standard_logging_payload(payload)
     bag = promoted_baggage(
         data.identity,
         data.request_model,
         BAGGAGE_PROMOTED_KEYS,
-        metadata_keys=("requester_metadata.trace_id", "requester_metadata.attempt", "requester_metadata.empty"),
+        metadata_keys=(
+            "requester_metadata.trace_id",
+            "requester_metadata.attempt",
+            "requester_metadata.empty",
+            "requester_metadata.nested.deep",
+            "a.b",
+        ),
     )
     engine.emit(SpanRole.LLM_CALL, data, ctx_mod.set_request_baggage(bag))
     (span,) = exporter.get_finished_spans()
     assert span.attributes[f"{LiteLLM.METADATA_PREFIX}trace_id"] == "abc"
     assert span.attributes[f"{LiteLLM.METADATA_PREFIX}attempt"] == "0"
+    assert span.attributes[f"{LiteLLM.METADATA_PREFIX}nested.deep"] == "x"
+    assert span.attributes[f"{LiteLLM.METADATA_PREFIX}a.b"] == "flat"
     assert f"{LiteLLM.METADATA_PREFIX}empty" not in span.attributes
     assert f"{LiteLLM.METADATA_PREFIX}deep" not in span.attributes
+    assert f"{LiteLLM.METADATA_PREFIX}nested.skipped" not in span.attributes
     assert not any(k.startswith(f"{LiteLLM.METADATA_PREFIX}requester_metadata") for k in span.attributes)
 
 
diff --git a/tests/test_litellm/integrations/otel/test_otel_v2_logger.py b/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
index aa78e3b7c4d..f9a61b689cb 100644
--- a/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
+++ b/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
@@ -1684,7 +1684,7 @@ def test_pre_call_hook_promotes_nested_request_metadata_key():
     assert spans["redis set"].attributes[key] == "abc"
     assert data == {"model": "gpt-4o", "metadata": {"requester_metadata": {"trace_id": "abc", "nested": {"deep": "x"}}}}
     assert not any(
-        k.startswith(f"{LiteLLM.METADATA_PREFIX}requester_metadata") or k == f"{LiteLLM.METADATA_PREFIX}deep"
+        k.startswith(f"{LiteLLM.METADATA_PREFIX}requester_metadata") or k.endswith("deep")
         for s in spans.values()
         for k in s.attributes
     )
diff --git a/tests/test_litellm/integrations/test_opentelemetry.py b/tests/test_litellm/integrations/test_opentelemetry.py
index e25fb3964b8..7812590b3e7 100644
--- a/tests/test_litellm/integrations/test_opentelemetry.py
+++ b/tests/test_litellm/integrations/test_opentelemetry.py
@@ -5581,21 +5581,28 @@ class TestOpenTelemetryInferenceIdentityAttributes(unittest.TestCase):
         otel.set_attributes(span, kwargs, {"model": "azure/gpt-4o"})
         assert "http.route" not in self._attr(span, exp)
 
-    def test_nested_metadata_key_promoted_under_leaf_name(self):
+    def test_nested_metadata_key_promoted_under_caller_path(self):
         """``baggage_metadata_keys: [requester_metadata.trace_id]`` stamps the
-        caller's nested metadata value as ``litellm.metadata.trace_id``; unlisted
-        siblings stay inside the ``metadata.requester_metadata`` blob."""
-        otel = OpenTelemetry(config=OpenTelemetryConfig(baggage_metadata_keys=["requester_metadata.trace_id"]))
+        caller's nested metadata value as ``litellm.metadata.trace_id`` and a deeper
+        path keeps its dotted name; unlisted siblings stay inside the
+        ``metadata.requester_metadata`` blob."""
+        otel = OpenTelemetry(
+            config=OpenTelemetryConfig(
+                baggage_metadata_keys=["requester_metadata.trace_id", "requester_metadata.nested.deep"]
+            )
+        )
         kwargs = self._kwargs()
         kwargs["standard_logging_object"]["metadata"]["requester_metadata"] = {
             "trace_id": "abc",
-            "nested": {"deep": "x"},
+            "nested": {"deep": "x", "skipped": "y"},
         }
         span, exp = self._span()
         otel.set_attributes(span, kwargs, {"model": "azure/gpt-4o"})
         attrs = self._attr(span, exp)
         assert attrs["litellm.metadata.trace_id"] == "abc"
+        assert attrs["litellm.metadata.nested.deep"] == "x"
         assert "litellm.metadata.deep" not in attrs
+        assert "litellm.metadata.nested.skipped" not in attrs
         assert not any(k.startswith("litellm.metadata.requester_metadata") for k in attrs)
 
     def test_metadata_keys_default_to_none_promoted(self):

From 033aa8ba6d6a1d0de5fc1e16b466fcf9f329abfb Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Wed, 16 Sep 2026 11:50:36 -0700
Subject: [PATCH 11/24] fix(bedrock): forward userContext in Knowledge Base
 Retrieve requests

The Bedrock vector store search only lifted retrievalConfiguration out of extra_body, so the caller's userContext (the Retrieve API's ACL identity) never reached Bedrock and ACL-enabled data sources answered with zero results. The transform now forwards userContext, taken from extra_body first and then from the top-level params where the OpenAI SDK's extra_body merge lands, as the caller sent it.
---
 .../bedrock/vector_stores/transformation.py   | 21 ++++++++++
 .../integrations/rag/bedrock_knowledgebase.py |  7 +++-
 ...est_bedrock_vector_store_transformation.py | 42 +++++++++++++++++++
 tests/test_litellm/vector_stores/test_main.py | 25 +++++++++++
 4 files changed, 94 insertions(+), 1 deletion(-)

diff --git a/litellm/llms/bedrock/vector_stores/transformation.py b/litellm/llms/bedrock/vector_stores/transformation.py
index 27c90c9d71e..ba8ce7e5625 100644
--- a/litellm/llms/bedrock/vector_stores/transformation.py
+++ b/litellm/llms/bedrock/vector_stores/transformation.py
@@ -1,3 +1,4 @@
+from collections.abc import Mapping
 from copy import deepcopy
 from typing import TYPE_CHECKING, Any, Final, cast
 from urllib.parse import urlparse
@@ -14,6 +15,7 @@ from litellm.types.integrations.rag.bedrock_knowledgebase import (
     BedrockKBResponse,
     BedrockKBRetrievalConfiguration,
     BedrockKBRetrievalQuery,
+    BedrockKBUserContext,
 )
 from litellm.types.router import GenericLiteLLMParams
 from litellm.types.vector_stores import (
@@ -242,10 +244,29 @@ class BedrockVectorStoreConfig(BaseVectorStoreConfig, BaseAWSLLM):
             retrieval_config.setdefault("vectorSearchConfiguration", {})["filter"] = filters
         if retrieval_config:
             request_body["retrievalConfiguration"] = cast(BedrockKBRetrievalConfiguration, retrieval_config)
+        user_context: Final = self._user_context(extra_body=extra_body, litellm_params=litellm_params)
+        if user_context is not None:
+            request_body["userContext"] = user_context
 
         litellm_logging_obj.model_call_details["query"] = query
         return url, request_body
 
+    @staticmethod
+    def _user_context(
+        extra_body: Mapping[str, object] | None, litellm_params: Mapping[str, object]
+    ) -> BedrockKBUserContext | None:
+        sources: Final = tuple(source for source in (extra_body, litellm_params) if isinstance(source, Mapping))
+        found: Final = next(
+            (
+                source[key]
+                for source in sources
+                for key in ("userContext", "user_context")
+                if source.get(key) is not None
+            ),
+            None,
+        )
+        return None if found is None else cast(BedrockKBUserContext, found)
+
     def sign_request(
         self,
         headers: dict,
diff --git a/litellm/types/integrations/rag/bedrock_knowledgebase.py b/litellm/types/integrations/rag/bedrock_knowledgebase.py
index e3aba85ed9b..7156d8101e1 100644
--- a/litellm/types/integrations/rag/bedrock_knowledgebase.py
+++ b/litellm/types/integrations/rag/bedrock_knowledgebase.py
@@ -1,6 +1,6 @@
 from typing import Any, Literal
 
-from typing_extensions import TypedDict
+from typing_extensions import ReadOnly, TypedDict
 
 
 class BedrockKBLocation(TypedDict, total=False):
@@ -127,6 +127,10 @@ class BedrockKBGuardrailConfiguration(TypedDict, total=False):
     guardrailVersion: str | None
 
 
+class BedrockKBUserContext(TypedDict):
+    userId: ReadOnly[str]
+
+
 class BedrockKBRequest(TypedDict, total=False):
     """Complete request structure for Bedrock Knowledge Base retrieval."""
 
@@ -134,6 +138,7 @@ class BedrockKBRequest(TypedDict, total=False):
     nextToken: str | None
     retrievalConfiguration: BedrockKBRetrievalConfiguration | None
     retrievalQuery: BedrockKBRetrievalQuery
+    userContext: ReadOnly[BedrockKBUserContext | None]
 
 
 #########################################################################
diff --git a/tests/test_litellm/llms/bedrock/vector_stores/test_bedrock_vector_store_transformation.py b/tests/test_litellm/llms/bedrock/vector_stores/test_bedrock_vector_store_transformation.py
index 7b04efa17dc..e435f0f7a8b 100644
--- a/tests/test_litellm/llms/bedrock/vector_stores/test_bedrock_vector_store_transformation.py
+++ b/tests/test_litellm/llms/bedrock/vector_stores/test_bedrock_vector_store_transformation.py
@@ -82,6 +82,7 @@ def test_transform_search_request_uses_only_retrieval_config_from_extra_body():
         == "HYBRID"
     )
     assert "unrelatedField" not in body
+    assert "userContext" not in body
 
 
 def test_transform_search_request_does_not_mutate_extra_body_and_overrides_number_of_results():
@@ -152,3 +153,44 @@ def test_transform_search_request_overrides_filter_without_mutating_extra_body()
         ]["value"]
         == "a"
     )
+
+
+def _search_body(extra_body, litellm_params):
+    config = BedrockVectorStoreConfig()
+    mock_log = MagicMock()
+    mock_log.model_call_details = {}
+    _, body = config.transform_search_vector_store_request(
+        vector_store_id="kb123",
+        query="hello",
+        vector_store_search_optional_params={"max_num_results": 3},
+        api_base="https://bedrock-agent-runtime.us-west-2.amazonaws.com/knowledgebases",
+        litellm_logging_obj=mock_log,
+        litellm_params=litellm_params,
+        extra_body=extra_body,
+    )
+    return body
+
+
+def test_transform_search_request_forwards_user_context_from_extra_body():
+    body = _search_body(extra_body={"userContext": {"userId": "alice@example.com"}}, litellm_params={})
+
+    assert body["userContext"] == {"userId": "alice@example.com"}
+    assert body["retrievalConfiguration"] == {"vectorSearchConfiguration": {"numberOfResults": 3}}
+
+
+def test_transform_search_request_forwards_top_level_user_context_from_litellm_params():
+    body = _search_body(
+        extra_body=None,
+        litellm_params={"vector_store_id": "kb123", "user_context": {"userId": "bob@example.com"}},
+    )
+
+    assert body["userContext"] == {"userId": "bob@example.com"}
+
+
+def test_transform_search_request_prefers_extra_body_user_context_over_top_level():
+    body = _search_body(
+        extra_body={"userContext": {"userId": "alice@example.com"}},
+        litellm_params={"userContext": {"userId": "bob@example.com"}},
+    )
+
+    assert body["userContext"] == {"userId": "alice@example.com"}
diff --git a/tests/test_litellm/vector_stores/test_main.py b/tests/test_litellm/vector_stores/test_main.py
index e3575c33b17..1c968126c42 100644
--- a/tests/test_litellm/vector_stores/test_main.py
+++ b/tests/test_litellm/vector_stores/test_main.py
@@ -7,6 +7,7 @@ executor, and it must never leak into litellm_params/kwargs where logging would
 model_dump() it (the #19550 serialization trap).
 """
 
+import json
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -15,6 +16,7 @@ import litellm.vector_stores.main as vector_stores_main
 from litellm.llms.base_llm.vector_store.transformation import (
     RouterVectorStoreEmbeddingExecutor,
 )
+from litellm.llms.custom_httpx.http_handler import HTTPHandler
 from litellm.vector_stores.main import search
 
 MOCK_SEARCH_RESPONSE = {
@@ -89,3 +91,26 @@ def test_search_router_not_in_litellm_params():
     litellm_params = mock_handler.call_args.kwargs["litellm_params"]
     assert "router" not in litellm_params.model_dump(exclude_none=True)
     assert getattr(litellm_params, "router", None) is None
+
+
+def test_search_forwards_top_level_user_context_to_bedrock_retrieve():
+    """Regression (LIT-4415): a top-level userContext, the shape the OpenAI SDK's extra_body
+    produces on the proxy path, reaches the Bedrock Retrieve request body."""
+    client = MagicMock(spec=HTTPHandler)
+    client.post.return_value = MagicMock(status_code=200, json=MagicMock(return_value={"retrievalResults": []}))
+
+    search(
+        vector_store_id="kb123",
+        query="q",
+        custom_llm_provider="bedrock",
+        aws_region_name="us-west-2",
+        aws_access_key_id="test-key-id",
+        aws_secret_access_key="test-secret-key",
+        userContext={"userId": "alice@example.com"},
+        client=client,
+        litellm_logging_obj=MagicMock(),
+    )
+
+    posted = json.loads(client.post.call_args.kwargs["data"])
+    assert posted["userContext"] == {"userId": "alice@example.com"}
+    assert posted["retrievalQuery"] == {"text": "q"}

From 878fe17735c210a59d67f6ac15114e591de735b3 Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Wed, 16 Sep 2026 11:56:18 -0700
Subject: [PATCH 12/24] chore(proxy): restore the lazy OpenAPI snapshot main
 renders under Python 3.12

---
 litellm/proxy/_lazy_openapi_snapshot.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/litellm/proxy/_lazy_openapi_snapshot.json b/litellm/proxy/_lazy_openapi_snapshot.json
index b749d01310a..74f38b3ca6d 100644
--- a/litellm/proxy/_lazy_openapi_snapshot.json
+++ b/litellm/proxy/_lazy_openapi_snapshot.json
@@ -19346,7 +19346,7 @@
                   }
                 }
               },
-              "description": "\nUnified rate-limit error.\n\nEvery rate-limit condition surfaced by litellm \u2014 whether it originated from\nan upstream LLM provider, a vendor batch endpoint, or one of litellm's own\nproxy-side limiters (parallel-requests, dynamic-rate, batch-rate, budget,\nmax-iterations, etc.) \u2014 is raised as an instance of this class.\n\nThe :attr:`category` attribute lets callers distinguish the source. See\n:class:`RateLimitErrorCategory` for the available values.\n"
+              "description": "\n    Unified rate-limit error.\n\n    Every rate-limit condition surfaced by litellm \u2014 whether it originated from\n    an upstream LLM provider, a vendor batch endpoint, or one of litellm's own\n    proxy-side limiters (parallel-requests, dynamic-rate, batch-rate, budget,\n    max-iterations, etc.) \u2014 is raised as an instance of this class.\n\n    The :attr:`category` attribute lets callers distinguish the source. See\n    :class:`RateLimitErrorCategory` for the available values.\n    "
             },
             "500": {
               "content": {

From 5e2d9e1d5c8e94f9053eba49ff123edfc231672a Mon Sep 17 00:00:00 2001
From: yassin <yassin@berri.ai>
Date: Wed, 16 Sep 2026 18:59:21 +0000
Subject: [PATCH 13/24] refactor(otel): build promoted baggage without local
 dict mutation

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/integrations/otel/model/baggage.py | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/litellm/integrations/otel/model/baggage.py b/litellm/integrations/otel/model/baggage.py
index d380d868e90..131848e1380 100644
--- a/litellm/integrations/otel/model/baggage.py
+++ b/litellm/integrations/otel/model/baggage.py
@@ -80,14 +80,12 @@ def promoted_baggage(
     ``team_metadata_keys`` selects sub-keys of the team's metadata to promote
     under ``litellm.team.metadata``. Empty values are dropped.
     """
-    out: Final[dict[str, str]] = {}
-    for key, extract in _PROMOTABLE.items():
-        if key in promoted_keys:
-            value = extract(identity, request_model, team_metadata_keys)
-            if value:
-                out[key] = value
-    out.update(promoted_metadata(identity.metadata, metadata_keys))
-    return out
+    identity_values: Final = {
+        key: value
+        for key, extract in _PROMOTABLE.items()
+        if key in promoted_keys and (value := extract(identity, request_model, team_metadata_keys))
+    }
+    return {**identity_values, **promoted_metadata(identity.metadata, metadata_keys)}
 
 
 def promoted_metadata(metadata: Mapping[str, str], metadata_keys: tuple[str, ...]) -> Mapping[str, str]:

From b893e6b926dde5136a2b733fa5ade4d038ed120c Mon Sep 17 00:00:00 2001
From: "berriai-litellm-provider-info-sync[bot]"
 <328147090+berriai-litellm-provider-info-sync[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 19:06:19 +0000
Subject: [PATCH 14/24] chore(prices): sync Google Gemini prices: 22 models

gemini/gemini-2.5-flash: max_tokens, max_output_tokens, supports_audio_input
gemini/gemini-2.5-flash-image: max_input_tokens, supports_web_search, supports_audio_input, supports_response_schema, supports_function_calling
gemini/gemini-2.5-flash-lite: max_tokens, max_output_tokens, supports_audio_input
gemini-2.5-flash-native-audio-preview-12-2025: supports_vision, max_input_tokens, supports_web_search, supports_response_schema, supports_function_calling
gemini/gemini-2.5-flash-native-audio-preview-12-2025: supports_vision, max_input_tokens, supports_web_search, supports_response_schema, supports_function_calling
gemini-2.5-flash-preview-tts: max_tokens, max_input_tokens, max_output_tokens, supports_web_search, supports_audio_input, supports_response_schema, supports_function_calling
gemini/gemini-2.5-flash-preview-tts: max_tokens, max_input_tokens, max_output_tokens, supports_web_search, supports_audio_input, supports_response_schema, supports_function_calling
gemini/gemini-2.5-pro: max_tokens, max_output_tokens
gemini/gemini-2.5-pro-preview-tts: max_tokens, supports_vision, max_input_tokens, max_output_tokens, supports_web_search, supports_audio_input, supports_response_schema, supports_function_calling
gemini/gemini-3-flash-preview: max_tokens, max_output_tokens, supports_audio_input
gemini/gemini-3-pro-image: supports_response_schema
gemini/gemini-3.1-flash-image: max_input_tokens, supports_response_schema
gemini/gemini-3.1-flash-lite-image: supports_web_search, supports_function_calling
gemini-3.1-flash-live-preview: supports_response_schema
gemini/gemini-3.1-flash-live-preview: supports_response_schema
gemini/gemini-3.1-flash-tts-preview: supports_web_search, supports_response_schema, supports_function_calling
gemini/gemini-3.5-flash: max_tokens, max_output_tokens
gemini/gemini-3.5-live-translate-preview: supports_web_search, supports_response_schema, supports_function_calling
gemini/gemini-3.5-transcribe: supports_function_calling
gemini/gemini-3.5-transcribe-live: supports_function_calling
gemini/gemini-embedding-2: supports_vision, supports_audio_input
gemini/gemini-omni-1.1-flash: max_input_tokens
---
 ...odel_prices_and_context_window_backup.json | 118 ++++++++++++------
 model_prices_and_context_window.json          | 118 ++++++++++++------
 2 files changed, 158 insertions(+), 78 deletions(-)

diff --git a/litellm/model_prices_and_context_window_backup.json b/litellm/model_prices_and_context_window_backup.json
index 88850135e19..dd21bbf0b25 100644
--- a/litellm/model_prices_and_context_window_backup.json
+++ b/litellm/model_prices_and_context_window_backup.json
@@ -26168,7 +26168,9 @@
         "output_vector_size": 3072,
         "rpm": 10000,
         "source": "https://ai.google.dev/gemini-api/docs/pricing",
+        "supports_audio_input": true,
         "supports_multimodal": true,
+        "supports_vision": true,
         "tpm": 10000000
     },
     "gemini/gemini-1.5-flash": {
@@ -26309,8 +26311,8 @@
         "input_cost_per_token": 3e-07,
         "litellm_provider": "gemini",
         "max_input_tokens": 1048576,
-        "max_output_tokens": 65535,
-        "max_tokens": 65535,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
         "mode": "chat",
         "output_cost_per_reasoning_token": 2.5e-06,
         "output_cost_per_token": 2.5e-06,
@@ -26356,6 +26358,7 @@
         "output_cost_per_token_batches": 1.25e-06,
         "output_cost_per_token_flex": 1.25e-06,
         "output_cost_per_token_priority": 4.5e-06,
+        "supports_audio_input": true,
         "supports_image_size": false
     },
     "gemini/gemini-2.5-flash-image": {
@@ -26368,7 +26371,7 @@
         "input_cost_per_token_priority": 5.4e-07,
         "litellm_provider": "gemini",
         "supports_reasoning": false,
-        "max_input_tokens": 32768,
+        "max_input_tokens": 65536,
         "max_output_tokens": 32768,
         "max_tokens": 32768,
         "mode": "image_generation",
@@ -26394,22 +26397,23 @@
             "image"
         ],
         "supports_audio_output": false,
-        "supports_function_calling": true,
+        "supports_function_calling": false,
         "supports_parallel_function_calling": true,
         "supports_pdf_input": true,
         "supports_prompt_caching": true,
-        "supports_response_schema": true,
+        "supports_response_schema": false,
         "supports_system_messages": true,
         "supports_tool_choice": true,
         "supports_url_context": true,
         "supports_vision": true,
-        "supports_web_search": true,
+        "supports_web_search": false,
         "tpm": 8000000,
         "search_context_cost_per_query": {
             "search_context_size_low": 0.035,
             "search_context_size_medium": 0.035,
             "search_context_size_high": 0.035
         },
+        "supports_audio_input": false,
         "supports_image_size": false
     },
     "gemini/gemini-3-pro-image": {
@@ -26447,7 +26451,7 @@
         ],
         "supports_function_calling": false,
         "supports_prompt_caching": true,
-        "supports_response_schema": true,
+        "supports_response_schema": false,
         "supports_system_messages": true,
         "supports_vision": true,
         "supports_web_search": true,
@@ -26550,7 +26554,7 @@
         "input_cost_per_token": 5e-07,
         "input_cost_per_token_batches": 2.5e-07,
         "litellm_provider": "gemini",
-        "max_input_tokens": 65536,
+        "max_input_tokens": 131072,
         "max_output_tokens": 32768,
         "max_tokens": 32768,
         "mode": "image_generation",
@@ -26577,7 +26581,7 @@
         "supports_function_calling": false,
         "supports_prompt_caching": true,
         "supports_reasoning": false,
-        "supports_response_schema": true,
+        "supports_response_schema": false,
         "supports_system_messages": true,
         "supports_vision": true,
         "supports_web_search": true,
@@ -26659,12 +26663,13 @@
             "text",
             "image"
         ],
-        "supports_function_calling": true,
+        "supports_function_calling": false,
         "supports_prompt_caching": false,
         "supports_reasoning": false,
         "supports_response_schema": false,
         "supports_system_messages": true,
         "supports_vision": true,
+        "supports_web_search": false,
         "tpm": 4000000
     },
     "gemini/deep-research-pro-preview-12-2025": {
@@ -26717,8 +26722,8 @@
         "input_cost_per_token": 1e-07,
         "litellm_provider": "gemini",
         "max_input_tokens": 1048576,
-        "max_output_tokens": 65535,
-        "max_tokens": 65535,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
         "mode": "chat",
         "output_cost_per_reasoning_token": 4e-07,
         "output_cost_per_token": 4e-07,
@@ -26764,6 +26769,7 @@
         "output_cost_per_token_batches": 2e-07,
         "output_cost_per_token_flex": 2e-07,
         "output_cost_per_token_priority": 7.2e-07,
+        "supports_audio_input": true,
         "supports_image_size": false
     },
     "gemini/gemini-2.5-flash-lite-preview-09-2025": {
@@ -27011,6 +27017,9 @@
         "input_cost_per_token": 5e-07,
         "input_cost_per_token_batches": 2.5e-07,
         "litellm_provider": "gemini",
+        "max_input_tokens": 8192,
+        "max_output_tokens": 16384,
+        "max_tokens": 16384,
         "mode": "audio_speech",
         "output_cost_per_audio_token": 1e-05,
         "output_cost_per_token": 1e-05,
@@ -27019,7 +27028,11 @@
             "/v1/audio/speech"
         ],
         "tpm": 4000000,
-        "rpm": 10
+        "rpm": 10,
+        "supports_audio_input": false,
+        "supports_function_calling": false,
+        "supports_response_schema": false,
+        "supports_web_search": false
     },
     "gemini/gemini-2.5-pro": {
         "cache_read_input_token_cost": 1.25e-07,
@@ -27033,8 +27046,8 @@
         "input_cost_per_token_above_200k_tokens_priority": 4.5e-06,
         "litellm_provider": "gemini",
         "max_input_tokens": 1048576,
-        "max_output_tokens": 65535,
-        "max_tokens": 65535,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
         "mode": "chat",
         "output_cost_per_token": 1e-05,
         "output_cost_per_token_above_200k_tokens": 1.5e-05,
@@ -27344,8 +27357,8 @@
         "input_cost_per_token": 5e-07,
         "litellm_provider": "gemini",
         "max_input_tokens": 1048576,
-        "max_output_tokens": 65535,
-        "max_tokens": 65535,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
         "mode": "chat",
         "output_cost_per_reasoning_token": 3e-06,
         "output_cost_per_token": 3e-06,
@@ -27394,7 +27407,8 @@
         "input_cost_per_token_batches": 2.5e-07,
         "input_cost_per_token_flex": 2.5e-07,
         "output_cost_per_token_batches": 1.5e-06,
-        "output_cost_per_token_flex": 1.5e-06
+        "output_cost_per_token_flex": 1.5e-06,
+        "supports_audio_input": true
     },
     "gemini/gemini-3.5-flash": {
         "prompt_cache_min_tokens": 4096,
@@ -27403,8 +27417,8 @@
         "input_cost_per_token": 1.5e-06,
         "litellm_provider": "gemini",
         "max_input_tokens": 1048576,
-        "max_output_tokens": 65535,
-        "max_tokens": 65535,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
         "mode": "chat",
         "output_cost_per_reasoning_token": 9e-06,
         "output_cost_per_token": 9e-06,
@@ -28118,9 +28132,9 @@
         "input_cost_per_token": 1e-06,
         "input_cost_per_token_batches": 5e-07,
         "litellm_provider": "gemini",
-        "max_input_tokens": 1048576,
-        "max_output_tokens": 65535,
-        "max_tokens": 65535,
+        "max_input_tokens": 8192,
+        "max_output_tokens": 16384,
+        "max_tokens": 16384,
         "mode": "chat",
         "output_cost_per_audio_token": 2e-05,
         "output_cost_per_token": 2e-05,
@@ -28133,19 +28147,20 @@
             "audio"
         ],
         "supports_audio_output": false,
-        "supports_function_calling": true,
+        "supports_function_calling": false,
         "supports_prompt_caching": true,
-        "supports_response_schema": true,
+        "supports_response_schema": false,
         "supports_system_messages": true,
         "supports_tool_choice": true,
-        "supports_vision": true,
-        "supports_web_search": true,
+        "supports_vision": false,
+        "supports_web_search": false,
         "tpm": 10000000,
         "search_context_cost_per_query": {
             "search_context_size_low": 0.035,
             "search_context_size_medium": 0.035,
             "search_context_size_high": 0.035
-        }
+        },
+        "supports_audio_input": false
     },
     "gemini/gemini-exp-1114": {
         "input_cost_per_token": 0,
@@ -55923,7 +55938,7 @@
         "input_cost_per_audio_token": 3e-06,
         "input_cost_per_token": 5e-07,
         "litellm_provider": "gemini",
-        "max_input_tokens": 1048576,
+        "max_input_tokens": 131072,
         "max_output_tokens": 8192,
         "max_tokens": 8192,
         "mode": "realtime",
@@ -55943,7 +55958,11 @@
         ],
         "supports_audio_input": true,
         "supports_audio_output": true,
-        "gemini_native_audio": true
+        "gemini_native_audio": true,
+        "supports_function_calling": true,
+        "supports_response_schema": false,
+        "supports_vision": true,
+        "supports_web_search": true
     },
     "gemini-3.1-flash-live-preview": {
         "input_cost_per_audio_token": 3e-06,
@@ -55977,7 +55996,8 @@
         "supports_vision": true,
         "supports_web_search": true,
         "gemini_audio_only_live": true,
-        "input_cost_per_second": 8.33333333333e-05
+        "input_cost_per_second": 8.33333333333e-05,
+        "supports_response_schema": false
     },
     "gemini/gemini-2.5-flash-native-audio-latest": {
         "input_cost_per_audio_token": 3e-06,
@@ -56039,7 +56059,7 @@
         "input_cost_per_audio_token": 3e-06,
         "input_cost_per_token": 5e-07,
         "litellm_provider": "gemini",
-        "max_input_tokens": 1048576,
+        "max_input_tokens": 131072,
         "max_output_tokens": 8192,
         "max_tokens": 8192,
         "mode": "realtime",
@@ -56061,7 +56081,11 @@
         "supports_audio_output": true,
         "tpm": 250000,
         "rpm": 10,
-        "gemini_native_audio": true
+        "gemini_native_audio": true,
+        "supports_function_calling": true,
+        "supports_response_schema": false,
+        "supports_vision": true,
+        "supports_web_search": true
     },
     "gemini/gemini-3.1-flash-live-preview": {
         "input_cost_per_audio_token": 3e-06,
@@ -56097,7 +56121,8 @@
         "tpm": 250000,
         "rpm": 10,
         "gemini_audio_only_live": true,
-        "input_cost_per_second": 8.33333333333e-05
+        "input_cost_per_second": 8.33333333333e-05,
+        "supports_response_schema": false
     },
     "gemini/gemini-3.1-flash-tts-preview": {
         "input_cost_per_token": 1e-06,
@@ -56114,19 +56139,29 @@
             "/v1/audio/speech"
         ],
         "tpm": 4000000,
-        "rpm": 10
+        "rpm": 10,
+        "supports_function_calling": false,
+        "supports_response_schema": false,
+        "supports_web_search": false
     },
     "gemini-2.5-flash-preview-tts": {
         "input_cost_per_token": 5e-07,
         "input_cost_per_token_batches": 2.5e-07,
         "litellm_provider": "gemini",
+        "max_input_tokens": 8192,
+        "max_output_tokens": 16384,
+        "max_tokens": 16384,
         "mode": "audio_speech",
         "output_cost_per_audio_token": 1e-05,
         "output_cost_per_token": 1e-05,
         "source": "https://ai.google.dev/gemini-api/docs/pricing",
         "supported_endpoints": [
             "/v1/audio/speech"
-        ]
+        ],
+        "supports_audio_input": false,
+        "supports_function_calling": false,
+        "supports_response_schema": false,
+        "supports_web_search": false
     },
     "gemini-flash-latest": {
         "cache_read_input_token_cost": 3e-08,
@@ -58700,6 +58735,9 @@
         ],
         "supports_audio_input": true,
         "supports_audio_output": true,
+        "supports_function_calling": false,
+        "supports_response_schema": false,
+        "supports_web_search": false,
         "tpm": 250000
     },
     "gemini/gemini-3.5-transcribe": {
@@ -58721,7 +58759,8 @@
         ],
         "supports_audio_input": true,
         "tpm": 800000,
-        "rpm": 2000
+        "rpm": 2000,
+        "supports_function_calling": false
     },
     "gemini/gemini-3.5-transcribe-live": {
         "input_cost_per_audio_token": 3.5e-06,
@@ -58741,7 +58780,8 @@
         ],
         "supports_audio_input": true,
         "tpm": 250000,
-        "rpm": 10
+        "rpm": 10,
+        "supports_function_calling": false
     },
     "vertex_ai/gemini-3.5-transcribe-preview": {
         "input_cost_per_audio_token": 2e-06,
@@ -61380,7 +61420,7 @@
         "input_cost_per_audio_token": 1.5e-06,
         "input_cost_per_token": 1.5e-06,
         "litellm_provider": "gemini",
-        "max_input_tokens": 131072,
+        "max_input_tokens": 1048576,
         "max_output_tokens": 65536,
         "max_tokens": 65536,
         "mode": "chat",
diff --git a/model_prices_and_context_window.json b/model_prices_and_context_window.json
index 88850135e19..dd21bbf0b25 100644
--- a/model_prices_and_context_window.json
+++ b/model_prices_and_context_window.json
@@ -26168,7 +26168,9 @@
         "output_vector_size": 3072,
         "rpm": 10000,
         "source": "https://ai.google.dev/gemini-api/docs/pricing",
+        "supports_audio_input": true,
         "supports_multimodal": true,
+        "supports_vision": true,
         "tpm": 10000000
     },
     "gemini/gemini-1.5-flash": {
@@ -26309,8 +26311,8 @@
         "input_cost_per_token": 3e-07,
         "litellm_provider": "gemini",
         "max_input_tokens": 1048576,
-        "max_output_tokens": 65535,
-        "max_tokens": 65535,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
         "mode": "chat",
         "output_cost_per_reasoning_token": 2.5e-06,
         "output_cost_per_token": 2.5e-06,
@@ -26356,6 +26358,7 @@
         "output_cost_per_token_batches": 1.25e-06,
         "output_cost_per_token_flex": 1.25e-06,
         "output_cost_per_token_priority": 4.5e-06,
+        "supports_audio_input": true,
         "supports_image_size": false
     },
     "gemini/gemini-2.5-flash-image": {
@@ -26368,7 +26371,7 @@
         "input_cost_per_token_priority": 5.4e-07,
         "litellm_provider": "gemini",
         "supports_reasoning": false,
-        "max_input_tokens": 32768,
+        "max_input_tokens": 65536,
         "max_output_tokens": 32768,
         "max_tokens": 32768,
         "mode": "image_generation",
@@ -26394,22 +26397,23 @@
             "image"
         ],
         "supports_audio_output": false,
-        "supports_function_calling": true,
+        "supports_function_calling": false,
         "supports_parallel_function_calling": true,
         "supports_pdf_input": true,
         "supports_prompt_caching": true,
-        "supports_response_schema": true,
+        "supports_response_schema": false,
         "supports_system_messages": true,
         "supports_tool_choice": true,
         "supports_url_context": true,
         "supports_vision": true,
-        "supports_web_search": true,
+        "supports_web_search": false,
         "tpm": 8000000,
         "search_context_cost_per_query": {
             "search_context_size_low": 0.035,
             "search_context_size_medium": 0.035,
             "search_context_size_high": 0.035
         },
+        "supports_audio_input": false,
         "supports_image_size": false
     },
     "gemini/gemini-3-pro-image": {
@@ -26447,7 +26451,7 @@
         ],
         "supports_function_calling": false,
         "supports_prompt_caching": true,
-        "supports_response_schema": true,
+        "supports_response_schema": false,
         "supports_system_messages": true,
         "supports_vision": true,
         "supports_web_search": true,
@@ -26550,7 +26554,7 @@
         "input_cost_per_token": 5e-07,
         "input_cost_per_token_batches": 2.5e-07,
         "litellm_provider": "gemini",
-        "max_input_tokens": 65536,
+        "max_input_tokens": 131072,
         "max_output_tokens": 32768,
         "max_tokens": 32768,
         "mode": "image_generation",
@@ -26577,7 +26581,7 @@
         "supports_function_calling": false,
         "supports_prompt_caching": true,
         "supports_reasoning": false,
-        "supports_response_schema": true,
+        "supports_response_schema": false,
         "supports_system_messages": true,
         "supports_vision": true,
         "supports_web_search": true,
@@ -26659,12 +26663,13 @@
             "text",
             "image"
         ],
-        "supports_function_calling": true,
+        "supports_function_calling": false,
         "supports_prompt_caching": false,
         "supports_reasoning": false,
         "supports_response_schema": false,
         "supports_system_messages": true,
         "supports_vision": true,
+        "supports_web_search": false,
         "tpm": 4000000
     },
     "gemini/deep-research-pro-preview-12-2025": {
@@ -26717,8 +26722,8 @@
         "input_cost_per_token": 1e-07,
         "litellm_provider": "gemini",
         "max_input_tokens": 1048576,
-        "max_output_tokens": 65535,
-        "max_tokens": 65535,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
         "mode": "chat",
         "output_cost_per_reasoning_token": 4e-07,
         "output_cost_per_token": 4e-07,
@@ -26764,6 +26769,7 @@
         "output_cost_per_token_batches": 2e-07,
         "output_cost_per_token_flex": 2e-07,
         "output_cost_per_token_priority": 7.2e-07,
+        "supports_audio_input": true,
         "supports_image_size": false
     },
     "gemini/gemini-2.5-flash-lite-preview-09-2025": {
@@ -27011,6 +27017,9 @@
         "input_cost_per_token": 5e-07,
         "input_cost_per_token_batches": 2.5e-07,
         "litellm_provider": "gemini",
+        "max_input_tokens": 8192,
+        "max_output_tokens": 16384,
+        "max_tokens": 16384,
         "mode": "audio_speech",
         "output_cost_per_audio_token": 1e-05,
         "output_cost_per_token": 1e-05,
@@ -27019,7 +27028,11 @@
             "/v1/audio/speech"
         ],
         "tpm": 4000000,
-        "rpm": 10
+        "rpm": 10,
+        "supports_audio_input": false,
+        "supports_function_calling": false,
+        "supports_response_schema": false,
+        "supports_web_search": false
     },
     "gemini/gemini-2.5-pro": {
         "cache_read_input_token_cost": 1.25e-07,
@@ -27033,8 +27046,8 @@
         "input_cost_per_token_above_200k_tokens_priority": 4.5e-06,
         "litellm_provider": "gemini",
         "max_input_tokens": 1048576,
-        "max_output_tokens": 65535,
-        "max_tokens": 65535,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
         "mode": "chat",
         "output_cost_per_token": 1e-05,
         "output_cost_per_token_above_200k_tokens": 1.5e-05,
@@ -27344,8 +27357,8 @@
         "input_cost_per_token": 5e-07,
         "litellm_provider": "gemini",
         "max_input_tokens": 1048576,
-        "max_output_tokens": 65535,
-        "max_tokens": 65535,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
         "mode": "chat",
         "output_cost_per_reasoning_token": 3e-06,
         "output_cost_per_token": 3e-06,
@@ -27394,7 +27407,8 @@
         "input_cost_per_token_batches": 2.5e-07,
         "input_cost_per_token_flex": 2.5e-07,
         "output_cost_per_token_batches": 1.5e-06,
-        "output_cost_per_token_flex": 1.5e-06
+        "output_cost_per_token_flex": 1.5e-06,
+        "supports_audio_input": true
     },
     "gemini/gemini-3.5-flash": {
         "prompt_cache_min_tokens": 4096,
@@ -27403,8 +27417,8 @@
         "input_cost_per_token": 1.5e-06,
         "litellm_provider": "gemini",
         "max_input_tokens": 1048576,
-        "max_output_tokens": 65535,
-        "max_tokens": 65535,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
         "mode": "chat",
         "output_cost_per_reasoning_token": 9e-06,
         "output_cost_per_token": 9e-06,
@@ -28118,9 +28132,9 @@
         "input_cost_per_token": 1e-06,
         "input_cost_per_token_batches": 5e-07,
         "litellm_provider": "gemini",
-        "max_input_tokens": 1048576,
-        "max_output_tokens": 65535,
-        "max_tokens": 65535,
+        "max_input_tokens": 8192,
+        "max_output_tokens": 16384,
+        "max_tokens": 16384,
         "mode": "chat",
         "output_cost_per_audio_token": 2e-05,
         "output_cost_per_token": 2e-05,
@@ -28133,19 +28147,20 @@
             "audio"
         ],
         "supports_audio_output": false,
-        "supports_function_calling": true,
+        "supports_function_calling": false,
         "supports_prompt_caching": true,
-        "supports_response_schema": true,
+        "supports_response_schema": false,
         "supports_system_messages": true,
         "supports_tool_choice": true,
-        "supports_vision": true,
-        "supports_web_search": true,
+        "supports_vision": false,
+        "supports_web_search": false,
         "tpm": 10000000,
         "search_context_cost_per_query": {
             "search_context_size_low": 0.035,
             "search_context_size_medium": 0.035,
             "search_context_size_high": 0.035
-        }
+        },
+        "supports_audio_input": false
     },
     "gemini/gemini-exp-1114": {
         "input_cost_per_token": 0,
@@ -55923,7 +55938,7 @@
         "input_cost_per_audio_token": 3e-06,
         "input_cost_per_token": 5e-07,
         "litellm_provider": "gemini",
-        "max_input_tokens": 1048576,
+        "max_input_tokens": 131072,
         "max_output_tokens": 8192,
         "max_tokens": 8192,
         "mode": "realtime",
@@ -55943,7 +55958,11 @@
         ],
         "supports_audio_input": true,
         "supports_audio_output": true,
-        "gemini_native_audio": true
+        "gemini_native_audio": true,
+        "supports_function_calling": true,
+        "supports_response_schema": false,
+        "supports_vision": true,
+        "supports_web_search": true
     },
     "gemini-3.1-flash-live-preview": {
         "input_cost_per_audio_token": 3e-06,
@@ -55977,7 +55996,8 @@
         "supports_vision": true,
         "supports_web_search": true,
         "gemini_audio_only_live": true,
-        "input_cost_per_second": 8.33333333333e-05
+        "input_cost_per_second": 8.33333333333e-05,
+        "supports_response_schema": false
     },
     "gemini/gemini-2.5-flash-native-audio-latest": {
         "input_cost_per_audio_token": 3e-06,
@@ -56039,7 +56059,7 @@
         "input_cost_per_audio_token": 3e-06,
         "input_cost_per_token": 5e-07,
         "litellm_provider": "gemini",
-        "max_input_tokens": 1048576,
+        "max_input_tokens": 131072,
         "max_output_tokens": 8192,
         "max_tokens": 8192,
         "mode": "realtime",
@@ -56061,7 +56081,11 @@
         "supports_audio_output": true,
         "tpm": 250000,
         "rpm": 10,
-        "gemini_native_audio": true
+        "gemini_native_audio": true,
+        "supports_function_calling": true,
+        "supports_response_schema": false,
+        "supports_vision": true,
+        "supports_web_search": true
     },
     "gemini/gemini-3.1-flash-live-preview": {
         "input_cost_per_audio_token": 3e-06,
@@ -56097,7 +56121,8 @@
         "tpm": 250000,
         "rpm": 10,
         "gemini_audio_only_live": true,
-        "input_cost_per_second": 8.33333333333e-05
+        "input_cost_per_second": 8.33333333333e-05,
+        "supports_response_schema": false
     },
     "gemini/gemini-3.1-flash-tts-preview": {
         "input_cost_per_token": 1e-06,
@@ -56114,19 +56139,29 @@
             "/v1/audio/speech"
         ],
         "tpm": 4000000,
-        "rpm": 10
+        "rpm": 10,
+        "supports_function_calling": false,
+        "supports_response_schema": false,
+        "supports_web_search": false
     },
     "gemini-2.5-flash-preview-tts": {
         "input_cost_per_token": 5e-07,
         "input_cost_per_token_batches": 2.5e-07,
         "litellm_provider": "gemini",
+        "max_input_tokens": 8192,
+        "max_output_tokens": 16384,
+        "max_tokens": 16384,
         "mode": "audio_speech",
         "output_cost_per_audio_token": 1e-05,
         "output_cost_per_token": 1e-05,
         "source": "https://ai.google.dev/gemini-api/docs/pricing",
         "supported_endpoints": [
             "/v1/audio/speech"
-        ]
+        ],
+        "supports_audio_input": false,
+        "supports_function_calling": false,
+        "supports_response_schema": false,
+        "supports_web_search": false
     },
     "gemini-flash-latest": {
         "cache_read_input_token_cost": 3e-08,
@@ -58700,6 +58735,9 @@
         ],
         "supports_audio_input": true,
         "supports_audio_output": true,
+        "supports_function_calling": false,
+        "supports_response_schema": false,
+        "supports_web_search": false,
         "tpm": 250000
     },
     "gemini/gemini-3.5-transcribe": {
@@ -58721,7 +58759,8 @@
         ],
         "supports_audio_input": true,
         "tpm": 800000,
-        "rpm": 2000
+        "rpm": 2000,
+        "supports_function_calling": false
     },
     "gemini/gemini-3.5-transcribe-live": {
         "input_cost_per_audio_token": 3.5e-06,
@@ -58741,7 +58780,8 @@
         ],
         "supports_audio_input": true,
         "tpm": 250000,
-        "rpm": 10
+        "rpm": 10,
+        "supports_function_calling": false
     },
     "vertex_ai/gemini-3.5-transcribe-preview": {
         "input_cost_per_audio_token": 2e-06,
@@ -61380,7 +61420,7 @@
         "input_cost_per_audio_token": 1.5e-06,
         "input_cost_per_token": 1.5e-06,
         "litellm_provider": "gemini",
-        "max_input_tokens": 131072,
+        "max_input_tokens": 1048576,
         "max_output_tokens": 65536,
         "max_tokens": 65536,
         "mode": "chat",

From 30f02aa6da6d6bfc2352cf6c1f60de5354ce96d1 Mon Sep 17 00:00:00 2001
From: yassin <yassin@berri.ai>
Date: Wed, 16 Sep 2026 19:11:25 +0000
Subject: [PATCH 15/24] fix(otel): read only the caller's requester_metadata
 snapshot in the v2 pre-call hook

The pre-call hook passed the proxy's whole per-request metadata dict into the
request identity, so proxy-owned siblings such as requester_ip_address were
promoted alongside the caller's keys. Only the requester_metadata mapping is
read now, keyed under its wrapper, which keeps the default allowlist behaviour
unchanged

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/integrations/otel/model/metadata.py   | 26 ++++++++++---------
 .../integrations/otel/test_otel_v2_logger.py  | 17 +++++++++---
 2 files changed, 27 insertions(+), 16 deletions(-)

diff --git a/litellm/integrations/otel/model/metadata.py b/litellm/integrations/otel/model/metadata.py
index 8b3a5fc3fd5..5f90e70e119 100644
--- a/litellm/integrations/otel/model/metadata.py
+++ b/litellm/integrations/otel/model/metadata.py
@@ -49,7 +49,8 @@ if TYPE_CHECKING:
     from litellm.types.utils import StandardLoggingPayload
 
 LANGFUSE_TRACE_NAME_HEADER: Final = "langfuse_trace_name"
-REQUESTER_METADATA_PATH: Final = "requester_metadata."
+REQUESTER_METADATA_KEY: Final = "requester_metadata"
+REQUESTER_METADATA_PATH: Final = f"{REQUESTER_METADATA_KEY}."
 
 
 @dataclass(frozen=True)
@@ -106,8 +107,9 @@ class RequestIdentity:
         guardrail, or service span is created — so the whole request's spans
         inherit identity, not just the LLM-call span. Metadata sub-keys use the
         ``user_api_key_*`` names that ``baggage.DEFAULT_BAGGAGE_METADATA_KEYS``
-        promotes; ``request_metadata`` (the proxy's per-request metadata dict) is
-        flattened to dotted keys so ``requester_metadata.<key>`` resolves too.
+        promotes; ``request_metadata`` (the caller's ``requester_metadata``
+        snapshot) is flattened to dotted keys so ``requester_metadata.<key>``
+        resolves too.
         """
         get: Final = lambda name: getattr(auth, name, None)  # noqa: E731
         auth_meta: Final = tuple(
@@ -358,21 +360,21 @@ def model_from_request_data(data: object) -> str | None:
 
 
 def metadata_from_request_data(data: object) -> Mapping[str, object] | None:
-    """The proxy's per-request metadata dict from a pre-call ``data`` dict.
+    """The caller's ``requester_metadata`` snapshot from a pre-call ``data`` dict, keyed under its wrapper.
 
-    The proxy writes it under ``metadata`` or ``litellm_metadata`` depending on
-    the route; the one carrying the ``requester_metadata`` snapshot wins.
+    The proxy stores it under ``metadata`` or ``litellm_metadata`` depending on the route;
+    the proxy-owned siblings (``user_api_key_*``, ``requester_ip_address``) are not read.
     """
     top: Final = _as_str_mapping(data)
     if top is None:
         return None
-    candidates: Final = tuple(
-        nested for name in ("metadata", "litellm_metadata") if (nested := _as_str_mapping(top.get(name))) is not None
-    )
-    return next(
-        (c for c in candidates if isinstance(c.get("requester_metadata"), Mapping)),
-        candidates[0] if candidates else None,
+    snapshots: Final = tuple(
+        snapshot
+        for name in ("metadata", "litellm_metadata")
+        if (nested := _as_str_mapping(top.get(name))) is not None
+        and (snapshot := _as_str_mapping(nested.get(REQUESTER_METADATA_KEY))) is not None
     )
+    return MappingProxyType({REQUESTER_METADATA_KEY: snapshots[0]}) if snapshots else None
 
 
 def flatten_metadata(raw: Mapping[str, object]) -> Iterator[tuple[str, str]]:
diff --git a/tests/test_litellm/integrations/otel/test_otel_v2_logger.py b/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
index f9a61b689cb..34b55538dc3 100644
--- a/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
+++ b/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
@@ -1623,17 +1623,21 @@ def test_provider_model_and_team_metadata_on_real_boundary_flow():
 def test_pre_call_hook_seeds_baggage_onto_server_and_child_spans():
     """The pre-call hook seeds identity Baggage in the request context so the
     server span (stamped directly) AND later child spans (service here, via the
-    Baggage processor) carry identity — not just the LLM-call span."""
+    Baggage processor) carry identity — not just the LLM-call span. Only the
+    caller's ``requester_metadata`` is read from the request dict: the proxy's
+    own ``requester_ip_address`` stays unpromoted under the default allowlist."""
     logger, exporter = _logger()
     server = logger._emitter.start_span(
         SpanRole.PROXY_REQUEST, LITELLM_PROXY_REQUEST_SPAN_NAME
     )
+    data = {
+        "model": "gpt-4o",
+        "metadata": {"requester_ip_address": "127.0.0.1", "requester_metadata": {"trace_id": "abc"}},
+    }
 
     async def _flow():
         # pre-call seeds baggage + stamps the active server span
-        await logger.async_pre_call_hook(
-            _Auth(), None, {"model": "gpt-4o"}, "completion"
-        )
+        await logger.async_pre_call_hook(_Auth(), None, data, "completion")
         # a later service call (same task) must inherit the identity
         await logger.async_service_success_hook(
             payload=_ServicePayload("redis", "set"), parent_otel_span=server
@@ -1653,6 +1657,11 @@ def test_pre_call_hook_seeds_baggage_onto_server_and_child_spans():
         srv.attributes[LiteLLM.TEAM_ID] == "t1"
     )  # stamped directly on the server span
     assert srv.attributes[f"{LiteLLM.METADATA_PREFIX}user_api_key_user_id"] == "u1"
+    assert not any(
+        k in (f"{LiteLLM.METADATA_PREFIX}requester_ip_address", f"{LiteLLM.METADATA_PREFIX}trace_id")
+        for s in (redis, srv)
+        for k in s.attributes
+    )
 
 
 def test_pre_call_hook_promotes_nested_request_metadata_key():

From b70ddc2fd8cef1c86807974fb2cbef06f92bc85f Mon Sep 17 00:00:00 2001
From: Yujong Lee <yujong@berri.ai>
Date: Wed, 16 Sep 2026 19:14:32 +0000
Subject: [PATCH 16/24] ci(rust): split rust jobs, use nextest and
 Swatinem/rust-cache

Split the Rust workflow into fmt, clippy, nextest and wheel jobs so they run in parallel, replace manual actions/cache with Swatinem/rust-cache, and install a pinned checksum-verified cargo-nextest. Make two python-bridge tests self-contained so they pass when nextest runs each test in its own process.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .github/workflows/test-rust.yml               | 81 +++++++++++++------
 .../crates/python-bridge/src/lifecycle/mod.rs | 52 +++++++-----
 .../crates/python-bridge/src/marshal.rs       |  1 +
 3 files changed, 89 insertions(+), 45 deletions(-)

diff --git a/.github/workflows/test-rust.yml b/.github/workflows/test-rust.yml
index c4847aca20d..00c6fed8ae3 100644
--- a/.github/workflows/test-rust.yml
+++ b/.github/workflows/test-rust.yml
@@ -68,9 +68,9 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  rust-lint:
+  rust-fmt:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 5
     defaults:
       run:
         working-directory: litellm-rust
@@ -81,24 +81,67 @@ jobs:
 
       - run: rustup toolchain install --no-self-update
 
-      - run: cargo fmt --check
+      - run: cargo fmt --all --check
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+  rust-clippy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: litellm-rust
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            litellm-rust/target
-          key: ${{ runner.os }}-cargo-${{ github.job }}-${{ hashFiles('rust-toolchain.toml', '.cargo/**', 'litellm-rust/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-${{ github.job }}-
+          persist-credentials: false
+
+      - run: rustup toolchain install --no-self-update
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: litellm-rust
+          cache-on-failure: true
 
       - run: cargo clippy --workspace --all-targets --locked -- -D warnings
 
   rust-test:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: litellm-rust
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - run: rustup toolchain install --no-self-update
+
+      - name: Install cargo-nextest 0.9.143
+        working-directory: ${{ runner.temp }}
+        run: |
+          curl -fsSL --retry 3 -o cargo-nextest.tar.gz \
+            https://github.com/nextest-rs/nextest/releases/download/cargo-nextest-0.9.143/cargo-nextest-0.9.143-x86_64-unknown-linux-gnu.tar.gz
+          echo "66786b9abe23920d022a182d1416b1bbc8130dd4872a9553d76985a1708dcd1e  cargo-nextest.tar.gz" | sha256sum -c -
+          mkdir -p bin
+          tar xzf cargo-nextest.tar.gz -C bin cargo-nextest
+          echo "$PWD/bin" >> "$GITHUB_PATH"
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          workspaces: litellm-rust
+          cache-on-failure: true
+
+      - run: cargo nextest run --workspace --locked
+
+      - run: cargo test --workspace --doc --locked
+
+  rust-wheel:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
@@ -114,18 +157,10 @@ jobs:
 
       - run: rustup toolchain install --no-self-update
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            litellm-rust/target
-          key: ${{ runner.os }}-cargo-${{ github.job }}-${{ hashFiles('rust-toolchain.toml', '.cargo/**', 'litellm-rust/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-${{ github.job }}-
-
-      - run: cargo test --workspace --locked
-        working-directory: litellm-rust
+          workspaces: litellm-rust
+          cache-on-failure: true
 
       - run: uv build --wheel --out-dir dist
 
diff --git a/litellm-rust/crates/python-bridge/src/lifecycle/mod.rs b/litellm-rust/crates/python-bridge/src/lifecycle/mod.rs
index cf9f31c3c13..c4b8d8eaae0 100644
--- a/litellm-rust/crates/python-bridge/src/lifecycle/mod.rs
+++ b/litellm-rust/crates/python-bridge/src/lifecycle/mod.rs
@@ -599,6 +599,34 @@ mod tests {
 
     static PYTHON_GLOBALS: Mutex<()> = Mutex::new(());
 
+    fn install_lifecycle_module(py: Python<'_>) -> Bound<'_, PyModule> {
+        py.run(
+            pyo3::ffi::c_str!(
+                r#"
+import sys
+import types
+
+sys.modules.setdefault('litellm', types.ModuleType('litellm'))
+sys.modules.setdefault('litellm.rust_bridge', types.ModuleType('litellm.rust_bridge'))
+"#
+            ),
+            None,
+            None,
+        )
+        .unwrap();
+        let source = std::ffi::CString::new(include_str!(
+            "../../../../../litellm/rust_bridge/lifecycle.py"
+        ))
+        .unwrap();
+        PyModule::from_code(
+            py,
+            &source,
+            pyo3::ffi::c_str!("lifecycle.py"),
+            pyo3::ffi::c_str!("litellm.rust_bridge.lifecycle"),
+        )
+        .unwrap()
+    }
+
     fn install_logging_worker(py: Python<'_>, worker: &Bound<'_, PyAny>) -> PyResult<()> {
         py.import("litellm.litellm_core_utils.logging_worker")?
             .setattr("GLOBAL_LOGGING_WORKER", worker)
@@ -773,17 +801,7 @@ mod tests {
             .unwrap_or_else(|error| error.into_inner());
         Python::initialize();
         Python::attach(|py| {
-            let source = std::ffi::CString::new(include_str!(
-                "../../../../../litellm/rust_bridge/lifecycle.py"
-            ))
-            .unwrap();
-            PyModule::from_code(
-                py,
-                &source,
-                pyo3::ffi::c_str!("lifecycle.py"),
-                pyo3::ffi::c_str!("litellm.rust_bridge.lifecycle"),
-            )
-            .unwrap();
+            install_lifecycle_module(py);
             let route = SyntheticRoute(
                 PythonCallState::new(
                     py,
@@ -819,17 +837,7 @@ mod tests {
         Python::initialize();
         Python::attach(|py| {
             py.import("asyncio").unwrap();
-            let source = std::ffi::CString::new(include_str!(
-                "../../../../../litellm/rust_bridge/lifecycle.py"
-            ))
-            .unwrap();
-            let module = PyModule::from_code(
-                py,
-                &source,
-                pyo3::ffi::c_str!("lifecycle.py"),
-                pyo3::ffi::c_str!("litellm.rust_bridge.lifecycle"),
-            )
-            .unwrap();
+            let module = install_lifecycle_module(py);
             let locals = PyDict::new(py);
             locals
                 .set_item("drive", module.getattr("drive").unwrap())
diff --git a/litellm-rust/crates/python-bridge/src/marshal.rs b/litellm-rust/crates/python-bridge/src/marshal.rs
index 9038eb971b3..7f00298905f 100644
--- a/litellm-rust/crates/python-bridge/src/marshal.rs
+++ b/litellm-rust/crates/python-bridge/src/marshal.rs
@@ -190,6 +190,7 @@ mod tests {
 
     #[test]
     fn required_shapes_preserve_nested_values_and_existing_errors() {
+        Python::initialize();
         let nested = json!([{"role": "user", "content": [{"type": "text", "text": "hi"}]}]);
         assert_eq!(
             Value::Array(required_array("messages", nested.clone()).unwrap()),

From e46106e20ba5eeb1a02db8fbbc171df6d4bab211 Mon Sep 17 00:00:00 2001
From: kerry <kerry@berri.ai>
Date: Wed, 16 Sep 2026 19:21:50 +0000
Subject: [PATCH 17/24] test: drop gemini-3.1-flash-lite-image capability pins

The per-route capability test hardcoded vendor facts, including function calling support on the gemini route, which the live model card says is not supported. Keep the backup-matches-main invariant and the routing tests

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 ...est_gemini_3_1_flash_lite_image_pricing.py | 104 ------------------
 1 file changed, 104 deletions(-)

diff --git a/tests/test_litellm/test_gemini_3_1_flash_lite_image_pricing.py b/tests/test_litellm/test_gemini_3_1_flash_lite_image_pricing.py
index 10d1d6fecd1..250b587aaf1 100644
--- a/tests/test_litellm/test_gemini_3_1_flash_lite_image_pricing.py
+++ b/tests/test_litellm/test_gemini_3_1_flash_lite_image_pricing.py
@@ -3,14 +3,7 @@ from pathlib import Path
 
 import pytest
 
-import litellm
 from litellm.litellm_core_utils.get_llm_provider_logic import get_llm_provider
-from litellm.types.utils import (
-    ImageObject,
-    ImageResponse,
-    ImageUsage,
-    ImageUsageInputTokensDetails,
-)
 
 REPO_ROOT = Path(__file__).parents[2]
 MAIN_PATH = REPO_ROOT / "model_prices_and_context_window.json"
@@ -21,94 +14,12 @@ GEMINI = "gemini/gemini-3.1-flash-lite-image"
 VERTEX = "vertex_ai/gemini-3.1-flash-lite-image"
 ALL_KEYS = (UNPREFIXED, GEMINI, VERTEX)
 
-INPUT_COST = 2.5e-07
-INPUT_COST_BATCHES = 1.25e-07
-OUTPUT_TEXT_COST = 1.5e-06
-OUTPUT_TEXT_COST_BATCHES = 7.5e-07
-OUTPUT_IMAGE_TOKEN_COST = 3e-05
-OUTPUT_COST_PER_1K_IMAGE = 0.0336
-INPUT_COST_PER_IMAGE = 0.00028
-CACHE_READ_COST = 2.5e-08
-MAX_INPUT_TOKENS = 65536
-MAX_OUTPUT_TOKENS = 4096
-TOKENS_PER_1K_IMAGE = 1120
-
-SHARED_FIELDS = {
-    "mode": "image_generation",
-    "input_cost_per_token": INPUT_COST,
-    "input_cost_per_token_batches": INPUT_COST_BATCHES,
-    "input_cost_per_image": INPUT_COST_PER_IMAGE,
-    "output_cost_per_token": OUTPUT_TEXT_COST,
-    "output_cost_per_token_batches": OUTPUT_TEXT_COST_BATCHES,
-    "output_cost_per_image": OUTPUT_COST_PER_1K_IMAGE,
-    "output_cost_per_image_token": OUTPUT_IMAGE_TOKEN_COST,
-    "max_input_tokens": MAX_INPUT_TOKENS,
-    "max_output_tokens": MAX_OUTPUT_TOKENS,
-    "max_tokens": MAX_OUTPUT_TOKENS,
-    "supported_endpoints": ["/v1/chat/completions", "/v1/completions", "/v1/batch"],
-    "supported_output_modalities": ["text", "image"],
-    "supports_reasoning": False,
-    "supports_response_schema": False,
-    "supports_system_messages": True,
-    "supports_vision": True,
-}
-
-VERTEX_ROUTE_FIELDS = {
-    "litellm_provider": "vertex_ai-language-models",
-    "cache_read_input_token_cost": CACHE_READ_COST,
-    "supported_modalities": ["text", "image", "video"],
-    "supports_function_calling": False,
-    "supports_pdf_input": True,
-    "supports_prompt_caching": True,
-    "supports_video_input": True,
-}
-
-PER_ROUTE_FIELDS = {
-    UNPREFIXED: VERTEX_ROUTE_FIELDS,
-    VERTEX: VERTEX_ROUTE_FIELDS,
-    GEMINI: {
-        "litellm_provider": "gemini",
-        "supported_modalities": ["text", "image"],
-        "supports_function_calling": True,
-        "supports_prompt_caching": False,
-        "rpm": 1000,
-        "tpm": 4000000,
-    },
-}
-
-GROUNDING_FIELDS = (
-    "supports_web_search",
-    "search_context_cost_per_query",
-    "web_search_billing_unit",
-)
-
 
 def _load(path: Path) -> dict:
     with open(path, encoding="utf-8") as f:
         return json.load(f)
 
 
-@pytest.fixture
-def local_model_cost_map(monkeypatch):
-    original_model_cost = litellm.model_cost
-    monkeypatch.setenv("LITELLM_LOCAL_MODEL_COST_MAP", "True")
-    litellm.model_cost = litellm.get_model_cost_map(url="")
-    litellm.get_model_info.cache_clear()
-    try:
-        yield
-    finally:
-        litellm.model_cost = original_model_cost
-        litellm.get_model_info.cache_clear()
-
-
-@pytest.mark.parametrize("model", ALL_KEYS)
-@pytest.mark.parametrize("path", (MAIN_PATH, BACKUP_PATH), ids=("main", "backup"))
-def test_per_route_capabilities_match_model_cards(model: str, path: Path):
-    info = _load(path)[model]
-    for field, value in PER_ROUTE_FIELDS[model].items():
-        assert info[field] == value, f"{model} {field} in {path.name}: {info.get(field)} != {value}"
-
-
 @pytest.mark.parametrize("model", ALL_KEYS)
 def test_backup_matches_main(model: str):
     assert _load(BACKUP_PATH).get(model) == _load(MAIN_PATH).get(model)
@@ -124,18 +35,3 @@ def test_vertex_prefix_routes_to_vertex():
     routed_model, provider, _, _ = get_llm_provider(model=VERTEX)
     assert routed_model == UNPREFIXED
     assert provider == "vertex_ai"
-
-
-def _one_k_image_response() -> ImageResponse:
-    return ImageResponse(
-        data=[ImageObject(b64_json="img1")],
-        usage=ImageUsage(
-            input_tokens=50 + TOKENS_PER_1K_IMAGE,
-            input_tokens_details=ImageUsageInputTokensDetails(
-                text_tokens=50,
-                image_tokens=TOKENS_PER_1K_IMAGE,
-            ),
-            output_tokens=TOKENS_PER_1K_IMAGE,
-            total_tokens=50 + TOKENS_PER_1K_IMAGE + TOKENS_PER_1K_IMAGE,
-        ),
-    )

From e8b5632c20676b1e5ec74de5cd21ac38875d5fa6 Mon Sep 17 00:00:00 2001
From: Yujong Lee <yujong@berri.ai>
Date: Wed, 16 Sep 2026 19:22:02 +0000
Subject: [PATCH 18/24] ci(rust): run the token counter timing test alone under
 nextest

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm-rust/.config/nextest.toml | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 litellm-rust/.config/nextest.toml

diff --git a/litellm-rust/.config/nextest.toml b/litellm-rust/.config/nextest.toml
new file mode 100644
index 00000000000..1762a151573
--- /dev/null
+++ b/litellm-rust/.config/nextest.toml
@@ -0,0 +1,3 @@
+[[profile.default.overrides]]
+filter = "test(long_repeated_runs_stay_cheap)"
+threads-required = "num-cpus"

From 8de51dfaabbf11ace508636883fe5cafe95f22bb Mon Sep 17 00:00:00 2001
From: yassin <yassin@berri.ai>
Date: Wed, 16 Sep 2026 19:25:40 +0000
Subject: [PATCH 19/24] test(otel): describe which request metadata the
 pre-call seed reads

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 tests/test_litellm/integrations/otel/test_otel_v2_logger.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tests/test_litellm/integrations/otel/test_otel_v2_logger.py b/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
index 34b55538dc3..9b5abae60cc 100644
--- a/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
+++ b/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
@@ -1624,8 +1624,9 @@ def test_pre_call_hook_seeds_baggage_onto_server_and_child_spans():
     """The pre-call hook seeds identity Baggage in the request context so the
     server span (stamped directly) AND later child spans (service here, via the
     Baggage processor) carry identity — not just the LLM-call span. Only the
-    caller's ``requester_metadata`` is read from the request dict: the proxy's
-    own ``requester_ip_address`` stays unpromoted under the default allowlist."""
+    caller's ``requester_metadata`` is read from the request dict, so a proxy-owned
+    sibling such as ``requester_ip_address`` is not stamped from here even though
+    the default allowlist names it, and an unlisted caller key is not promoted."""
     logger, exporter = _logger()
     server = logger._emitter.start_span(
         SpanRole.PROXY_REQUEST, LITELLM_PROXY_REQUEST_SPAN_NAME

From e850232f0208fb81c1187143bf9694b79d69149f Mon Sep 17 00:00:00 2001
From: Yujong Lee <yujong@berri.ai>
Date: Wed, 16 Sep 2026 19:43:42 +0000
Subject: [PATCH 20/24] test(rust): assert merge cost scales linearly instead
 of a wall-clock bound

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm-rust/.config/nextest.toml             |  3 ---
 .../crates/token-counter/src/tiktoken.rs      | 19 +++++++++++++------
 2 files changed, 13 insertions(+), 9 deletions(-)
 delete mode 100644 litellm-rust/.config/nextest.toml

diff --git a/litellm-rust/.config/nextest.toml b/litellm-rust/.config/nextest.toml
deleted file mode 100644
index 1762a151573..00000000000
--- a/litellm-rust/.config/nextest.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-[[profile.default.overrides]]
-filter = "test(long_repeated_runs_stay_cheap)"
-threads-required = "num-cpus"
diff --git a/litellm-rust/crates/token-counter/src/tiktoken.rs b/litellm-rust/crates/token-counter/src/tiktoken.rs
index c479ae01be9..7a9e71ed587 100644
--- a/litellm-rust/crates/token-counter/src/tiktoken.rs
+++ b/litellm-rust/crates/token-counter/src/tiktoken.rs
@@ -195,14 +195,21 @@ mod tests {
     }
 
     #[test]
-    fn long_repeated_runs_stay_cheap() {
+    fn long_repeated_runs_cost_close_to_linear() {
         let ranks = ranks();
         let mut scratch = MergeScratch::default();
-        let piece = vec![b' '; 1 << 20];
-        let started = std::time::Instant::now();
-        let count = ranks.count_piece(&piece, &mut scratch);
-        assert!(count > 0);
-        assert!(started.elapsed().as_secs() < 5, "{:?}", started.elapsed());
+        let mut time = |len: usize| {
+            let piece = vec![b' '; len];
+            let started = std::time::Instant::now();
+            assert!(ranks.count_piece(&piece, &mut scratch) > 0);
+            started.elapsed()
+        };
+        let small = (0..3).map(|_| time(1 << 14)).min().unwrap();
+        let large = time(1 << 18);
+        assert!(
+            large < small * 64,
+            "{small:?} for 2^14 bytes, {large:?} for 2^18"
+        );
     }
 
     #[test]

From 3f15dcd96b10206becb807a9d8bc57f2f9323096 Mon Sep 17 00:00:00 2001
From: Yujong Lee <yujong@berri.ai>
Date: Wed, 16 Sep 2026 19:47:48 +0000
Subject: [PATCH 21/24] ci(rust): fold fmt into the clippy job

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .github/workflows/test-rust.yml | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/test-rust.yml b/.github/workflows/test-rust.yml
index 00c6fed8ae3..e56726deb53 100644
--- a/.github/workflows/test-rust.yml
+++ b/.github/workflows/test-rust.yml
@@ -68,22 +68,7 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  rust-fmt:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    defaults:
-      run:
-        working-directory: litellm-rust
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - run: rustup toolchain install --no-self-update
-
-      - run: cargo fmt --all --check
-
-  rust-clippy:
+  rust-lint:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     defaults:
@@ -96,6 +81,8 @@ jobs:
 
       - run: rustup toolchain install --no-self-update
 
+      - run: cargo fmt --all --check
+
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: litellm-rust

From 043c954aa93083a503f3081761e4389e4b3cf273 Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Wed, 16 Sep 2026 12:52:37 -0700
Subject: [PATCH 22/24] fix(proxy): keep a caller's own Anthropic key when the
 proxy has no master key

Without a master key the auth layer echoes whatever key the caller presented as the authenticated key, so the passthrough's strip-by-value matched the caller's own Anthropic key and dropped it: a bring-your-own-key request that returned 200 on main answered 401 telling the caller to send the key they had just sent. Only the auth module's own no-auth dev-mode definition, shared through is_no_auth_dev_mode, decides that nothing was authenticated, and only when no custom auth is installed; JWTs, OAuth2 tokens, and custom-auth credentials are still stripped there. The sk- prefix heuristic goes with it.

The Vertex credential-less test now sets a master key, since a virtual key can only authenticate under one: the auth layer returns before any key lookup when the master key is unset.
---
 litellm/proxy/auth/user_api_key_auth.py       | 13 +++--
 .../llm_passthrough_endpoints.py              | 12 +++--
 .../test_llm_pass_through_endpoints.py        | 50 +++++++++++++++++++
 3 files changed, 66 insertions(+), 9 deletions(-)

diff --git a/litellm/proxy/auth/user_api_key_auth.py b/litellm/proxy/auth/user_api_key_auth.py
index ba267114bac..6757c0c594d 100644
--- a/litellm/proxy/auth/user_api_key_auth.py
+++ b/litellm/proxy/auth/user_api_key_auth.py
@@ -2571,6 +2571,13 @@ def _token_can_vouch_for_team(valid_token: UserAPIKeyAuth, lookup_error: BaseExc
     return PrismaDBExceptionHandler.should_allow_request_on_db_unavailable()
 
 
+def is_no_auth_dev_mode(master_key: str | None, general_settings: Mapping[str, object]) -> bool:
+    return master_key is None and not any(
+        general_settings.get(flag, False)
+        for flag in ("enable_jwt_auth", "enable_oauth2_auth", "enable_oauth2_proxy_auth")
+    )
+
+
 @tracer.wrap()
 async def _run_centralized_common_checks(
     user_api_key_auth_obj: UserAPIKeyAuth,
@@ -2630,11 +2637,7 @@ async def _run_centralized_common_checks(
     # Running common_checks would block every admin route on these
     # deployments where that was previously not the contract. If any
     # authn is enabled (JWT, OAuth2, OAuth2-proxy), authz must run.
-    if master_key is None and not (
-        general_settings.get("enable_jwt_auth", False)
-        or general_settings.get("enable_oauth2_auth", False)
-        or general_settings.get("enable_oauth2_proxy_auth", False)
-    ):
+    if is_no_auth_dev_mode(master_key, general_settings):
         return
 
     if user_custom_auth is not None and not general_settings.get("custom_auth_run_common_checks", False):
diff --git a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
index 0a584ece4b9..0fe9d1cc626 100644
--- a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
+++ b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
@@ -45,6 +45,7 @@ from litellm.proxy.auth.handle_jwt import JWTHandler
 from litellm.proxy.auth.route_checks import RouteChecks
 from litellm.proxy.auth.user_api_key_auth import (
     _get_bearer_token,
+    is_no_auth_dev_mode,
     user_api_key_auth,
     user_api_key_auth_websocket,
 )
@@ -2038,8 +2039,11 @@ def _is_authenticated_caller_jwt(value: str, jwt_claims: Mapping[str, object]) -
 
 
 def _is_authenticated_caller_secret(value: str, user_api_key_dict: UserAPIKeyAuth) -> bool:
-    """Whether a header value is the master key, the JWT that authenticated, or the key stored as ``api_key``."""
-    from litellm.proxy.proxy_server import master_key
+    """Whether a header value is the master key, the JWT that authenticated, or the key stored as ``api_key``.
+
+    A proxy in no-auth dev mode without custom auth authenticated nothing, so none of the caller's values is one.
+    """
+    from litellm.proxy.proxy_server import general_settings, master_key, user_custom_auth
 
     normalized: Final = _normalize_credential_value(value)
     if master_key is not None and hmac.compare_digest(normalized.encode(), master_key.encode()):
@@ -2047,11 +2051,11 @@ def _is_authenticated_caller_secret(value: str, user_api_key_dict: UserAPIKeyAut
     jwt_claims: Final = user_api_key_dict.jwt_claims
     if jwt_claims and _is_authenticated_caller_jwt(normalized, jwt_claims):
         return True
+    if is_no_auth_dev_mode(master_key, general_settings) and user_custom_auth is None:
+        return False
     authenticated_key: Final = user_api_key_dict.api_key
     if authenticated_key is None:
         return False
-    if master_key is None and not normalized.startswith("sk-"):
-        return False
     stored_representation: Final = UserAPIKeyAuth._safe_hash_litellm_api_key(normalized)  # pyright: ignore[reportPrivateUsage]  # the exact transform auth applied when it stored api_key
     return hmac.compare_digest(stored_representation.encode(), authenticated_key.encode())
 
diff --git a/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py b/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
index dcce6712b41..e0785b002b2 100644
--- a/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
+++ b/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
@@ -586,6 +586,7 @@ class TestVertexAIPassThroughHandler:
             "litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints.passthrough_endpoint_router",
             pass_through_router,
         )
+        monkeypatch.setattr("litellm.proxy.proxy_server.master_key", "sk-master-1234")
 
         endpoint = f"/v1/projects/{test_project}/locations/{test_location}/publishers/google/models/gemini-1.5-flash:generateContent"
 
@@ -4401,6 +4402,55 @@ class TestAnthropicPassthroughVirtualKeyLeak:
         assert forwarded is None, "the master key must never reach Anthropic"
         assert raised is not None and raised.status_code == 401
 
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize(
+        ("header", "value"),
+        [
+            pytest.param(b"x-api-key", b"sk-ant-api03-callers-own-key", id="x-api-key"),
+            pytest.param(b"authorization", b"Bearer sk-ant-api03-callers-own-key", id="authorization"),
+        ],
+    )
+    async def test_without_a_master_key_the_callers_own_anthropic_key_still_forwards(
+        self, monkeypatch, header: bytes, value: bytes
+    ):
+        monkeypatch.setattr("litellm.proxy.proxy_server.general_settings", {})
+        monkeypatch.setattr("litellm.proxy.proxy_server.user_custom_auth", None)
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [(header, value), (b"anthropic-version", b"2023-06-01"), (b"content-type", b"application/json")],
+            authenticated=UserAPIKeyAuth(api_key="sk-ant-api03-callers-own-key", user_role=LitellmUserRoles.INTERNAL_USER),
+            master_key=None,
+        )
+        assert raised is None, "with no master key the proxy authenticated nothing, so nothing of the caller's is a LiteLLM secret"
+        assert forwarded is not None
+        assert forwarded.get(header.decode()) == value.decode()
+
+    @pytest.mark.asyncio
+    async def test_without_a_master_key_a_custom_auth_credential_is_still_stripped(self, monkeypatch):
+        monkeypatch.setattr("litellm.proxy.proxy_server.general_settings", {})
+        monkeypatch.setattr("litellm.proxy.proxy_server.user_custom_auth", AsyncMock())
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [(b"authorization", b"Bearer sk-custom-auth-token"), (b"anthropic-version", b"2023-06-01")],
+            authenticated=UserAPIKeyAuth(api_key="sk-custom-auth-token", user_role=LitellmUserRoles.INTERNAL_USER),
+            master_key=None,
+        )
+        assert raised is not None and raised.status_code == 401
+        assert forwarded is None
+
+    @pytest.mark.asyncio
+    async def test_without_a_master_key_an_oauth2_token_is_still_stripped(self, monkeypatch):
+        monkeypatch.setattr("litellm.proxy.proxy_server.general_settings", {"enable_oauth2_auth": True})
+        monkeypatch.setattr("litellm.proxy.proxy_server.user_custom_auth", None)
+        raised, forwarded = await self._run(
+            monkeypatch,
+            [(b"authorization", b"Bearer oauth2-access-token"), (b"anthropic-version", b"2023-06-01")],
+            authenticated=UserAPIKeyAuth(api_key="oauth2-access-token", user_role=LitellmUserRoles.INTERNAL_USER),
+            master_key=None,
+        )
+        assert raised is not None and raised.status_code == 401
+        assert forwarded is None
+
     @pytest.mark.asyncio
     async def test_byo_anthropic_oauth_token_still_forwards_without_virtual_key(self, monkeypatch):
         raised, forwarded = await self._run(

From 48df3d5a48d87e45538f02625b5444e4ec867d6a Mon Sep 17 00:00:00 2001
From: Yujong Lee <yujong@berri.ai>
Date: Wed, 16 Sep 2026 19:54:46 +0000
Subject: [PATCH 23/24] ci(rust): install nextest via pinned
 taiki-e/install-action

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .github/workflows/test-rust.yml | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/test-rust.yml b/.github/workflows/test-rust.yml
index e56726deb53..551f783d4f9 100644
--- a/.github/workflows/test-rust.yml
+++ b/.github/workflows/test-rust.yml
@@ -107,15 +107,9 @@ jobs:
 
       - run: rustup toolchain install --no-self-update
 
-      - name: Install cargo-nextest 0.9.143
-        working-directory: ${{ runner.temp }}
-        run: |
-          curl -fsSL --retry 3 -o cargo-nextest.tar.gz \
-            https://github.com/nextest-rs/nextest/releases/download/cargo-nextest-0.9.143/cargo-nextest-0.9.143-x86_64-unknown-linux-gnu.tar.gz
-          echo "66786b9abe23920d022a182d1416b1bbc8130dd4872a9553d76985a1708dcd1e  cargo-nextest.tar.gz" | sha256sum -c -
-          mkdir -p bin
-          tar xzf cargo-nextest.tar.gz -C bin cargo-nextest
-          echo "$PWD/bin" >> "$GITHUB_PATH"
+      - uses: taiki-e/install-action@d438492cf8a250514fa2d34b30bc3c0dc37c65ff # v2.87.8
+        with:
+          tool: cargo-nextest@0.9.143
 
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:

From 884087f01cf902bab71930affdd686c8d42ec1c3 Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Wed, 16 Sep 2026 12:55:29 -0700
Subject: [PATCH 24/24] test(bedrock): type the vector store search test helper

---
 .../test_bedrock_vector_store_transformation.py            | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tests/test_litellm/llms/bedrock/vector_stores/test_bedrock_vector_store_transformation.py b/tests/test_litellm/llms/bedrock/vector_stores/test_bedrock_vector_store_transformation.py
index e435f0f7a8b..ab5a2531461 100644
--- a/tests/test_litellm/llms/bedrock/vector_stores/test_bedrock_vector_store_transformation.py
+++ b/tests/test_litellm/llms/bedrock/vector_stores/test_bedrock_vector_store_transformation.py
@@ -1,3 +1,4 @@
+from typing import Final
 from unittest.mock import MagicMock
 
 from litellm.llms.bedrock.vector_stores.transformation import BedrockVectorStoreConfig
@@ -155,9 +156,9 @@ def test_transform_search_request_overrides_filter_without_mutating_extra_body()
     )
 
 
-def _search_body(extra_body, litellm_params):
-    config = BedrockVectorStoreConfig()
-    mock_log = MagicMock()
+def _search_body(extra_body: dict[str, object] | None, litellm_params: dict[str, object]) -> dict[str, object]:
+    config: Final = BedrockVectorStoreConfig()
+    mock_log: Final = MagicMock()
     mock_log.model_call_details = {}
     _, body = config.transform_search_vector_store_request(
         vector_store_id="kb123",