From 045d32a2424ac3f82debaded122666b1dba3f1cc Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Tue, 14 Apr 2026 17:47:24 -0700
Subject: [PATCH 1/4] =?UTF-8?q?bump:=20version=201.83.7=20=E2=86=92=201.83?=
 =?UTF-8?q?.8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pyproject.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index a896d520abd..7ada72d0be8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "litellm"
-version = "1.83.7"
+version = "1.83.8"
 description = "Library to easily interface with LLM API providers"
 readme = "README.md"
 requires-python = ">=3.9, <3.14"
@@ -238,7 +238,7 @@ source-exclude = [
 profile = "black"
 
 [tool.commitizen]
-version = "1.83.7"
+version = "1.83.8"
 version_files = [
     "pyproject.toml:^version",
 ]

From 45d1e1b341c8f34f8ae824ee74034dfd4cef9e20 Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Tue, 14 Apr 2026 18:19:14 -0700
Subject: [PATCH 2/4] [Infra] Guard main branch with PR source-branch check

Adds a GHA that fails PRs to main unless the head branch is
'litellm_internal_staging' or 'litellm_hotfix_*'. Also fails merge_group
events since merge queue is not in use.
---
 .github/workflows/guard-main-branch.yml | 35 +++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 .github/workflows/guard-main-branch.yml

diff --git a/.github/workflows/guard-main-branch.yml b/.github/workflows/guard-main-branch.yml
new file mode 100644
index 00000000000..a3a1f33fb24
--- /dev/null
+++ b/.github/workflows/guard-main-branch.yml
@@ -0,0 +1,35 @@
+name: Guard main branch
+
+on:
+  pull_request:
+    branches:
+      - main
+  merge_group:
+
+permissions: {}
+
+# DO NOT RENAME the job's `name:` — it is referenced by GitHub branch
+# protection as a required status check on `main`. Renaming silently
+# breaks the gate.
+jobs:
+  guard:
+    name: Verify PR source branch
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Reject merge_group events
+        if: github.event_name == 'merge_group'
+        run: |
+          echo "::error::Merge queue is not supported for main. Disable merge queue or update this guard."
+          exit 1
+      - name: Check head branch name
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          echo "PR head branch: $HEAD_REF"
+          if [ "$HEAD_REF" = "litellm_internal_staging" ] || [[ "$HEAD_REF" == litellm_hotfix_?* ]]; then
+            echo "Allowed source branch."
+            exit 0
+          fi
+          echo "::error::PRs to main must originate from 'litellm_internal_staging' or a 'litellm_hotfix_*' branch. Got: '$HEAD_REF'."
+          exit 1

From ab71d3d7006b1d0acacdaf6801c2129edeaf38f2 Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Tue, 14 Apr 2026 18:39:54 -0700
Subject: [PATCH 3/4] Also reject PRs from forks, not just non-allowlisted
 branches

---
 .github/workflows/guard-main-branch.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/guard-main-branch.yml b/.github/workflows/guard-main-branch.yml
index a3a1f33fb24..3a84380e711 100644
--- a/.github/workflows/guard-main-branch.yml
+++ b/.github/workflows/guard-main-branch.yml
@@ -25,8 +25,15 @@ jobs:
       - name: Check head branch name
         env:
           HEAD_REF: ${{ github.head_ref }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          BASE_REPO: ${{ github.repository }}
         run: |
+          echo "PR head repo: $HEAD_REPO"
           echo "PR head branch: $HEAD_REF"
+          if [ "$HEAD_REPO" != "$BASE_REPO" ]; then
+            echo "::error::PRs to main must originate from the canonical repository ($BASE_REPO), not a fork ($HEAD_REPO)."
+            exit 1
+          fi
           if [ "$HEAD_REF" = "litellm_internal_staging" ] || [[ "$HEAD_REF" == litellm_hotfix_?* ]]; then
             echo "Allowed source branch."
             exit 0

From 38f8d7a008b33addfbc9cee8678149549b4c9d11 Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Tue, 14 Apr 2026 18:41:59 -0700
Subject: [PATCH 4/4] Point contributors toward litellm_oss_branch in guard
 error messages

---
 .github/workflows/guard-main-branch.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/guard-main-branch.yml b/.github/workflows/guard-main-branch.yml
index 3a84380e711..1c1ce0de079 100644
--- a/.github/workflows/guard-main-branch.yml
+++ b/.github/workflows/guard-main-branch.yml
@@ -31,12 +31,12 @@ jobs:
           echo "PR head repo: $HEAD_REPO"
           echo "PR head branch: $HEAD_REF"
           if [ "$HEAD_REPO" != "$BASE_REPO" ]; then
-            echo "::error::PRs to main must originate from the canonical repository ($BASE_REPO), not a fork ($HEAD_REPO)."
+            echo "::error::PRs to main must originate from the canonical repository ($BASE_REPO), not a fork ($HEAD_REPO). External contributors should open PRs against the 'litellm_oss_branch' branch instead."
             exit 1
           fi
           if [ "$HEAD_REF" = "litellm_internal_staging" ] || [[ "$HEAD_REF" == litellm_hotfix_?* ]]; then
             echo "Allowed source branch."
             exit 0
           fi
-          echo "::error::PRs to main must originate from 'litellm_internal_staging' or a 'litellm_hotfix_*' branch. Got: '$HEAD_REF'."
+          echo "::error::PRs to main must originate from 'litellm_internal_staging' or a 'litellm_hotfix_*' branch. Got: '$HEAD_REF'. If this is a contribution, retarget the PR against 'litellm_oss_branch' instead."
           exit 1