From bdf8ca747257053bd5118270bdc470f02e9ce96a Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Sun, 5 Apr 2026 01:44:10 -0700
Subject: [PATCH] chore: fixes

---
 .github/workflows/ghcr_deploy.yml             | 444 ------------------
 .github/workflows/ghcr_helm_deploy.yml        |  67 ---
 .github/workflows/interpret_load_test.py      | 139 ------
 .github/workflows/load_test.yml               |  59 ---
 .github/workflows/locustfile.py               |  28 --
 .github/workflows/main.yml                    |  34 --
 .github/workflows/publish-migrations.yml      | 207 --------
 .github/workflows/publish_enterprise.yml      |  94 ----
 .github/workflows/publish_proxy_extras.yml    |  74 ---
 .github/workflows/redeploy_proxy.py           |  20 -
 .github/workflows/regenerate-poetry-lock.yml  |  80 ----
 .github/workflows/reset_stable.yml            |  39 --
 .../workflows/run_llm_translation_tests.py    |   0
 .github/workflows/scorecard.yml               |   2 +-
 .github/workflows/simple_pypi_publish.yml     |  67 ---
 .pre-commit-config.yaml                       |  40 --
 .trivyignore                                  |  12 -
 ci_cd/.grype.yaml                             |  36 --
 ci_cd/publish-proxy-extras.sh                 |  19 -
 ci_cd/security_scans.sh                       | 262 -----------
 docker/build_admin_ui.sh                      |  15 +-
 docs/my-website/.trivyignore                  |   7 -
 scripts/install.sh                            |   4 +-
 ui/litellm-dashboard/.trivyignore             |   7 -
 ui/litellm-dashboard/build_ui.sh              |  16 +-
 ui/litellm-dashboard/build_ui_custom_path.sh  |  16 +-
 26 files changed, 44 insertions(+), 1744 deletions(-)
 delete mode 100644 .github/workflows/ghcr_deploy.yml
 delete mode 100644 .github/workflows/ghcr_helm_deploy.yml
 delete mode 100644 .github/workflows/interpret_load_test.py
 delete mode 100644 .github/workflows/load_test.yml
 delete mode 100644 .github/workflows/locustfile.py
 delete mode 100644 .github/workflows/main.yml
 delete mode 100644 .github/workflows/publish-migrations.yml
 delete mode 100644 .github/workflows/publish_enterprise.yml
 delete mode 100644 .github/workflows/publish_proxy_extras.yml
 delete mode 100644 .github/workflows/redeploy_proxy.py
 delete mode 100644 .github/workflows/regenerate-poetry-lock.yml
 delete mode 100644 .github/workflows/reset_stable.yml
 mode change 100755 => 100644 .github/workflows/run_llm_translation_tests.py
 delete mode 100644 .github/workflows/simple_pypi_publish.yml
 delete mode 100644 .pre-commit-config.yaml
 delete mode 100644 .trivyignore
 delete mode 100644 ci_cd/.grype.yaml
 delete mode 100644 ci_cd/publish-proxy-extras.sh
 delete mode 100755 ci_cd/security_scans.sh
 delete mode 100644 docs/my-website/.trivyignore
 delete mode 100644 ui/litellm-dashboard/.trivyignore

diff --git a/.github/workflows/ghcr_deploy.yml b/.github/workflows/ghcr_deploy.yml
deleted file mode 100644
index 344b0ec48ee..00000000000
--- a/.github/workflows/ghcr_deploy.yml
+++ /dev/null
@@ -1,444 +0,0 @@
-# this workflow is triggered by an API call when there is a new PyPI release of LiteLLM
-name: Build, Publish LiteLLM Docker Image. New Release
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "The tag version you want to build"
-        required: true
-      release_type:
-        description: "The release type you want to build. Can be 'latest', 'stable', 'dev', 'rc'"
-        type: string
-        default: "latest"
-      commit_hash:
-        description: "Commit hash"
-        required: true
-
-# Defines two custom environment variables for the workflow. Used for the Container registry domain, and a name for the Docker image that this workflow builds.
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-  CHART_NAME: litellm-helm
-
-# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
-jobs:
-  # print commit hash, tag, and release type
-  print:
-    runs-on: ubuntu-latest
-    steps:
-      - run: |
-          echo "Commit hash: ${{ github.event.inputs.commit_hash }}"
-          echo "Tag: ${{ github.event.inputs.tag }}"
-          echo "Release type: ${{ github.event.inputs.release_type }}"
-  docker-hub-deploy:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      -
-        name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      -
-        name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          tags: litellm/litellm:${{ github.event.inputs.tag || 'latest' }} 
-      -
-        name: Build and push litellm-database image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          file: ./docker/Dockerfile.database
-          tags: litellm/litellm-database:${{ github.event.inputs.tag || 'latest' }}
-      -
-        name: Build and push litellm-spend-logs image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          file: ./litellm-js/spend-logs/Dockerfile
-          tags: litellm/litellm-spend_logs:${{ github.event.inputs.tag || 'latest' }}
-      -
-        name: Build and push litellm-non_root image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          file: ./docker/Dockerfile.non_root
-          tags: litellm/litellm-non_root:${{ github.event.inputs.tag || 'latest' }}
-  build-and-push-image:
-    runs-on: ubuntu-latest
-    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-      # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-      # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
-      # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
-      # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
-      - name: Build and push Docker image
-        uses: docker/build-push-action@4976231911ebf5f32aad765192d35f942aa48cb8
-        with:
-          context: .
-          push: true
-          tags: |
-            ${{ steps.meta.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm:main-stable', env.REGISTRY) || '' }},
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm:{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-          labels: ${{ steps.meta.outputs.labels }}
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-  
-  build-and-push-image-ee:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for EE Dockerfile
-        id: meta-ee
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-
-      - name: Build and push EE Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
-        with:
-          context: .
-          file: Dockerfile
-          push: true
-          tags: |
-            ${{ steps.meta-ee.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta-ee.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm-ee:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm-ee:main-stable', env.REGISTRY) || '' }}
-          labels: ${{ steps.meta-ee.outputs.labels }}
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-   
-  build-and-push-image-database:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for database Dockerfile
-        id: meta-database
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-database
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-
-      - name: Build and push Database Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
-        with:
-          context: .
-          file: ./docker/Dockerfile.database
-          push: true
-          tags: |
-            ${{ steps.meta-database.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta-database.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm-database:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm-database:main-stable', env.REGISTRY) || '' }}
-          labels: ${{ steps.meta-database.outputs.labels }}
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-            
-  build-and-push-image-non_root:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for non_root Dockerfile
-        id: meta-non_root
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-non_root
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-
-      - name: Build and push non_root Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
-        with:
-          context: .
-          file: ./docker/Dockerfile.non_root
-          push: true
-          tags: |
-            ${{ steps.meta-non_root.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta-non_root.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm-non_root:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm-non_root:main-stable', env.REGISTRY) || '' }}
-          labels: ${{ steps.meta-non_root.outputs.labels }} 
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-  
-  build-and-push-image-spend-logs:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for spend-logs Dockerfile
-        id: meta-spend-logs
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-spend_logs
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-
-      - name: Build and push Database Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
-        with:
-          context: .
-          file: ./litellm-js/spend-logs/Dockerfile
-          push: true
-          tags: |
-            ${{ steps.meta-spend-logs.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta-spend-logs.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm-spend_logs:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm-spend_logs:main-stable', env.REGISTRY) || '' }}
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-
-  run-observatory-tests:
-    if: github.event.inputs.release_type == 'rc' || github.event.inputs.release_type == 'stable'
-    needs: [docker-hub-deploy]
-    uses: ./.github/workflows/run_observatory_tests.yml
-    with:
-      tag: ${{ github.event.inputs.tag }}
-      commit_hash: ${{ github.event.inputs.commit_hash }}
-    secrets: inherit
-
-  build-and-push-helm-chart:
-    if: github.event.inputs.release_type  != 'dev'
-    needs: [docker-hub-deploy, build-and-push-image, build-and-push-image-database]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: lowercase github.repository_owner
-        run: |
-          echo "REPO_OWNER=`echo ${{github.repository_owner}} | tr '[:upper:]' '[:lower:]'`" >>${GITHUB_ENV}
-    
-      # Sync Helm chart version with LiteLLM release version (1-1 versioning)
-      # This allows users to easily map Helm chart versions to LiteLLM versions
-      # See: https://codefresh.io/docs/docs/ci-cd-guides/helm-best-practices/
-      - name: Calculate chart and app versions
-        id: chart_version
-        shell: bash
-        run: |
-          INPUT_TAG="${{ github.event.inputs.tag }}"
-          RELEASE_TYPE="${{ github.event.inputs.release_type }}"
-
-          # Chart version = LiteLLM version without 'v' prefix (Helm semver convention)
-          # v1.81.0 -> 1.81.0, v1.81.0.rc.1 -> 1.81.0.rc.1
-          CHART_VERSION="${INPUT_TAG#v}"
-
-          # Add suffix for 'latest' releases (rc already has suffix in tag)
-          if [ "$RELEASE_TYPE" = "latest" ]; then
-            CHART_VERSION="${CHART_VERSION}-latest"
-          fi
-
-          # App version = Docker tag (keeps 'v' prefix to match Docker image tags)
-          APP_VERSION="${INPUT_TAG}"
-
-          echo "version=${CHART_VERSION}" | tee -a $GITHUB_OUTPUT
-          echo "app_version=${APP_VERSION}" | tee -a $GITHUB_OUTPUT
-
-      - uses: ./.github/actions/helm-oci-chart-releaser
-        with:
-          name: ${{ env.CHART_NAME }}
-          repository: ${{ env.REPO_OWNER }}
-          tag: ${{ steps.chart_version.outputs.version }}
-          app_version: ${{ steps.chart_version.outputs.app_version }}
-          path: deploy/charts/${{ env.CHART_NAME }}
-          registry: ${{ env.REGISTRY }}
-          registry_username: ${{ github.actor }}
-          registry_password: ${{ secrets.GITHUB_TOKEN }}
-          update_dependencies: true
-
-  release:
-    name: "New LiteLLM Release"
-    needs: [docker-hub-deploy, build-and-push-image, build-and-push-image-database]
-    permissions:
-      contents: write
-    runs-on: "ubuntu-latest"
-   
-    steps:
-      - name: Display version
-        run: echo "Current version is ${{ github.event.inputs.tag }}"
-      - name: "Set Release Tag"
-        run: echo "RELEASE_TAG=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
-      - name: Display release tag
-        run: echo "RELEASE_TAG is $RELEASE_TAG"
-      - name: "Create release"
-        uses: "actions/github-script@v6"
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-          script: |
-            const commitHash = "${{ github.event.inputs.commit_hash}}";
-            console.log("Commit Hash:", commitHash); // Add this line for debugging
-            try {
-              const response = await github.rest.repos.createRelease({
-                draft: false,
-                generate_release_notes: true,
-                target_commitish: commitHash,
-                name: process.env.RELEASE_TAG,
-                owner: context.repo.owner,
-                prerelease: false,
-                repo: context.repo.repo,
-                tag_name: process.env.RELEASE_TAG,
-              });
-      
-              core.exportVariable('RELEASE_ID', response.data.id);
-              core.exportVariable('RELEASE_UPLOAD_URL', response.data.upload_url);
-            } catch (error) {
-              core.setFailed(error.message);
-            }
-      - name: Fetch Release Notes
-        id: release-notes
-        uses: actions/github-script@v6
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-          script: |
-            try {
-              const response = await github.rest.repos.getRelease({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                release_id: process.env.RELEASE_ID,
-              });
-              const formattedBody = JSON.stringify(response.data.body).slice(1, -1);
-              return formattedBody;
-            } catch (error) {
-              core.setFailed(error.message);
-            }
-        env:
-          RELEASE_ID: ${{ env.RELEASE_ID }}
-      - name: Github Releases To Discord
-        env:
-          WEBHOOK_URL: ${{ secrets.WEBHOOK_URL }}
-          REALEASE_TAG: ${{ env.RELEASE_TAG }}
-          RELEASE_NOTES: ${{ steps.release-notes.outputs.result }}
-        run: |
-          curl -H "Content-Type: application/json" -X POST -d '{
-            "content": "New LiteLLM release '"${RELEASE_TAG}"'",
-            "username": "Release Changelog",
-            "avatar_url": "https://cdn.discordapp.com/avatars/487431320314576937/bd64361e4ba6313d561d54e78c9e7171.png",
-            "embeds": [
-              {
-                "title": "Changelog for LiteLLM '"${RELEASE_TAG}"'",
-                "description": "'"${RELEASE_NOTES}"'",
-                "color": 2105893
-              }
-            ]
-          }' $WEBHOOK_URL
-
diff --git a/.github/workflows/ghcr_helm_deploy.yml b/.github/workflows/ghcr_helm_deploy.yml
deleted file mode 100644
index 21b2eaafe19..00000000000
--- a/.github/workflows/ghcr_helm_deploy.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-# Standalone workflow to publish LiteLLM Helm Chart
-# Note: The main ghcr_deploy.yml workflow also publishes the Helm chart as part of a full release
-name: Build, Publish LiteLLM Helm Chart. New Release
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "LiteLLM version tag (e.g., v1.81.0)"
-        required: true
-
-# Defines two custom environment variables for the workflow. Used for the Container registry domain, and a name for the Docker image that this workflow builds.
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-  REPO_OWNER: ${{github.repository_owner}}
-
-# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
-jobs:        
-  build-and-push-helm-chart:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      
-      - name: lowercase github.repository_owner
-        run: |
-          echo "REPO_OWNER=`echo ${{github.repository_owner}} | tr '[:upper:]' '[:lower:]'`" >>${GITHUB_ENV}
-
-      # Sync Helm chart version with LiteLLM release version (1-1 versioning)
-      - name: Calculate chart and app versions
-        id: chart_version
-        shell: bash
-        run: |
-          INPUT_TAG="${{ github.event.inputs.tag }}"
-
-          # Chart version = LiteLLM version without 'v' prefix
-          # v1.81.0 -> 1.81.0
-          CHART_VERSION="${INPUT_TAG#v}"
-
-          # App version = Docker tag (keeps 'v' prefix)
-          APP_VERSION="${INPUT_TAG}"
-
-          echo "version=${CHART_VERSION}" | tee -a $GITHUB_OUTPUT
-          echo "app_version=${APP_VERSION}" | tee -a $GITHUB_OUTPUT
-
-      - name: Lint helm chart
-        run: helm lint deploy/charts/litellm-helm
-
-      - uses: ./.github/actions/helm-oci-chart-releaser
-        with:
-          name: litellm-helm
-          repository: ${{ env.REPO_OWNER }}
-          tag: ${{ steps.chart_version.outputs.version }}
-          app_version: ${{ steps.chart_version.outputs.app_version }}
-          path: deploy/charts/litellm-helm
-          registry: ${{ env.REGISTRY }}
-          registry_username: ${{ github.actor }}
-          registry_password: ${{ secrets.GITHUB_TOKEN }}
-          update_dependencies: true
-  
diff --git a/.github/workflows/interpret_load_test.py b/.github/workflows/interpret_load_test.py
deleted file mode 100644
index 348ff300fff..00000000000
--- a/.github/workflows/interpret_load_test.py
+++ /dev/null
@@ -1,139 +0,0 @@
-import csv
-import os
-from github import Github
-
-
-def interpret_results(csv_file):
-    with open(csv_file, newline="") as csvfile:
-        csvreader = csv.DictReader(csvfile)
-        rows = list(csvreader)
-        """
-        in this csv reader
-        - Create 1 new column "Status"
-        - if a row has a median response time < 300 and an average response time < 300, Status = "Passed ✅"
-        - if a row has a median response time >= 300 or an average response time >= 300, Status = "Failed ❌"
-        - Order the table in this order Name, Status, Median Response Time, Average Response Time, Requests/s,Failures/s, Min Response Time, Max Response Time, all other columns
-        """
-
-        # Add a new column "Status"
-        for row in rows:
-            median_response_time = float(
-                row["Median Response Time"].strip().rstrip("ms")
-            )
-            average_response_time = float(
-                row["Average Response Time"].strip().rstrip("s")
-            )
-
-            request_count = int(row["Request Count"])
-            failure_count = int(row["Failure Count"])
-
-            failure_percent = round((failure_count / request_count) * 100, 2)
-
-            # Determine status based on conditions
-            if (
-                median_response_time < 300
-                and average_response_time < 300
-                and failure_percent < 5
-            ):
-                row["Status"] = "Passed ✅"
-            else:
-                row["Status"] = "Failed ❌"
-
-        # Construct Markdown table header
-        markdown_table = "| Name | Status | Median Response Time (ms) | Average Response Time (ms) | Requests/s | Failures/s | Request Count | Failure Count | Min Response Time (ms) | Max Response Time (ms) |"
-        markdown_table += (
-            "\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |"
-        )
-
-        # Construct Markdown table rows
-        for row in rows:
-            markdown_table += f"\n| {row['Name']} | {row['Status']} | {row['Median Response Time']} | {row['Average Response Time']} | {row['Requests/s']} | {row['Failures/s']} | {row['Request Count']} | {row['Failure Count']} | {row['Min Response Time']} | {row['Max Response Time']} |"
-    print("markdown table: ", markdown_table)
-    return markdown_table
-
-
-def _get_docker_run_command_stable_release(release_version):
-    return f"""
-\n\n
-## Docker Run LiteLLM Proxy
-
-```
-docker run \\
--e STORE_MODEL_IN_DB=True \\
--p 4000:4000 \\
-ghcr.io/berriai/litellm:litellm_stable_release_branch-{release_version}
-```
-    """
-
-
-def _get_docker_run_command(release_version):
-    return f"""
-\n\n
-## Docker Run LiteLLM Proxy
-
-```
-docker run \\
--e STORE_MODEL_IN_DB=True \\
--p 4000:4000 \\
-ghcr.io/berriai/litellm:main-{release_version}
-```
-    """
-
-
-def get_docker_run_command(release_version):
-    if "stable" in release_version:
-        return _get_docker_run_command_stable_release(release_version)
-    else:
-        return _get_docker_run_command(release_version)
-
-
-if __name__ == "__main__":
-    return
-    csv_file = "load_test_stats.csv"  # Change this to the path of your CSV file
-    markdown_table = interpret_results(csv_file)
-
-    # Update release body with interpreted results
-    github_token = os.getenv("GITHUB_TOKEN")
-    g = Github(github_token)
-    repo = g.get_repo(
-        "BerriAI/litellm"
-    )  # Replace with your repository's username and name
-    latest_release = repo.get_latest_release()
-    print("got latest release: ", latest_release)
-    print(latest_release.title)
-    print(latest_release.tag_name)
-
-    release_version = latest_release.title
-
-    print("latest release body: ", latest_release.body)
-    print("markdown table: ", markdown_table)
-
-    # check if "Load Test LiteLLM Proxy Results" exists
-    existing_release_body = latest_release.body
-    if "Load Test LiteLLM Proxy Results" in latest_release.body:
-        # find the "Load Test LiteLLM Proxy Results" section and delete it
-        start_index = latest_release.body.find("Load Test LiteLLM Proxy Results")
-        existing_release_body = latest_release.body[:start_index]
-
-    docker_run_command = get_docker_run_command(release_version)
-    print("docker run command: ", docker_run_command)
-
-    new_release_body = (
-        existing_release_body
-        + docker_run_command
-        + "\n\n"
-        + "### Don't want to maintain your internal proxy? get in touch 🎉"
-        + "\nHosted Proxy Alpha: https://calendly.com/d/cx9p-5yf-2nm/litellm-introductions"
-        + "\n\n"
-        + "## Load Test LiteLLM Proxy Results"
-        + "\n\n"
-        + markdown_table
-    )
-    print("new release body: ", new_release_body)
-    try:
-        latest_release.update_release(
-            name=latest_release.tag_name,
-            message=new_release_body,
-        )
-    except Exception as e:
-        print(e)
diff --git a/.github/workflows/load_test.yml b/.github/workflows/load_test.yml
deleted file mode 100644
index cdaffa328c9..00000000000
--- a/.github/workflows/load_test.yml
+++ /dev/null
@@ -1,59 +0,0 @@
-name: Test Locust Load Test
-
-on:
-  workflow_run:
-    workflows: ["Build, Publish LiteLLM Docker Image. New Release"]
-    types:
-      - completed
-  workflow_dispatch:
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v1
-      - name: Setup Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: '3.x'
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install PyGithub
-      - name: re-deploy proxy
-        run: |
-          echo "Current working directory: $PWD"
-          ls
-          python ".github/workflows/redeploy_proxy.py"
-        env:
-          LOAD_TEST_REDEPLOY_URL1: ${{ secrets.LOAD_TEST_REDEPLOY_URL1 }}
-          LOAD_TEST_REDEPLOY_URL2: ${{ secrets.LOAD_TEST_REDEPLOY_URL2 }}
-        working-directory: ${{ github.workspace }}
-      - name: Run Load Test
-        id: locust_run
-        uses: BerriAI/locust-github-action@master
-        with:
-          LOCUSTFILE: ".github/workflows/locustfile.py"
-          URL:  "https://post-release-load-test-proxy.onrender.com/"
-          USERS: "20"
-          RATE: "20"
-          RUNTIME: "300s"
-      - name: Process Load Test Stats
-        run: |
-          echo "Current working directory: $PWD"
-          ls
-          python ".github/workflows/interpret_load_test.py"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        working-directory: ${{ github.workspace }}
-      - name: Upload CSV as Asset to Latest Release
-        uses: xresloader/upload-to-github-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          file: "load_test_stats.csv;load_test.html"
-          update_latest_release: true
-          tag_name: "load-test"
-          overwrite: true
\ No newline at end of file
diff --git a/.github/workflows/locustfile.py b/.github/workflows/locustfile.py
deleted file mode 100644
index 36dbeee9c48..00000000000
--- a/.github/workflows/locustfile.py
+++ /dev/null
@@ -1,28 +0,0 @@
-from locust import HttpUser, task, between
-
-
-class MyUser(HttpUser):
-    wait_time = between(1, 5)
-
-    @task
-    def chat_completion(self):
-        headers = {
-            "Content-Type": "application/json",
-            "Authorization": "Bearer sk-8N1tLOOyH8TIxwOLahhIVg",
-            # Include any additional headers you may need for authentication, etc.
-        }
-
-        # Customize the payload with "model" and "messages" keys
-        payload = {
-            "model": "fake-openai-endpoint",
-            "messages": [
-                {"role": "system", "content": "You are a chat bot."},
-                {"role": "user", "content": "Hello, how are you?"},
-            ],
-            # Add more data as necessary
-        }
-
-        # Make a POST request to the "chat/completions" endpoint
-        response = self.client.post("chat/completions", json=payload, headers=headers)
-
-        # Print or log the response if needed
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
deleted file mode 100644
index 23e4a06da9e..00000000000
--- a/.github/workflows/main.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-name: Publish Dev Release to PyPI
-
-on:
-  workflow_dispatch:
-  
-jobs:
-  publish-dev-release:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Set up Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: 3.8  # Adjust the Python version as needed
-
-      - name: Install dependencies
-        run: pip install toml twine
-
-      - name: Read version from pyproject.toml
-        id: read-version
-        run: |
-          version=$(python -c 'import toml; print(toml.load("pyproject.toml")["tool"]["commitizen"]["version"])')
-          printf "LITELLM_VERSION=%s" "$version" >> $GITHUB_ENV
-
-      - name: Check if version exists on PyPI
-        id: check-version
-        run: |
-          set -e
-          if twine check --repository-url https://pypi.org/simple/ "litellm==$LITELLM_VERSION" >/dev/null 2>&1; then
-            echo "Version $LITELLM_VERSION already exists on PyPI. Skipping publish."
-     
diff --git a/.github/workflows/publish-migrations.yml b/.github/workflows/publish-migrations.yml
deleted file mode 100644
index a5187cb2f55..00000000000
--- a/.github/workflows/publish-migrations.yml
+++ /dev/null
@@ -1,207 +0,0 @@
-name: Publish Prisma Migrations
-
-permissions:
-  contents: write
-  pull-requests: write
-
-on:
-  push:
-    paths:
-      - 'schema.prisma'  # Check root schema.prisma
-    branches:
-      - main
-
-jobs:
-  publish-migrations:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:14
-        env:
-          POSTGRES_DB: temp_db
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-      
-      # Add shadow database service
-      postgres_shadow:
-        image: postgres:14
-        env:
-          POSTGRES_DB: shadow_db
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-        ports:
-          - 5433:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.x'
-
-      - name: Install Dependencies
-        run: |
-          pip install prisma
-          pip install python-dotenv
-
-      - name: Generate Initial Migration if None Exists
-        env:
-          DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          SHADOW_DATABASE_URL: "postgresql://postgres:postgres@localhost:5433/shadow_db"
-        run: |
-          mkdir -p deploy/migrations
-          echo 'provider = "postgresql"' > deploy/migrations/migration_lock.toml
-          
-          if [ -z "$(ls -A deploy/migrations/2* 2>/dev/null)" ]; then
-            echo "No existing migrations found, creating baseline..."
-            VERSION=$(date +%Y%m%d%H%M%S)
-            mkdir -p deploy/migrations/${VERSION}_initial
-            
-            echo "Generating initial migration..."
-            # Save raw output for debugging
-            prisma migrate diff \
-              --from-empty \
-              --to-schema-datamodel schema.prisma \
-              --shadow-database-url "${SHADOW_DATABASE_URL}" \
-              --script > deploy/migrations/${VERSION}_initial/raw_migration.sql
-            
-            echo "Raw migration file content:"
-            cat deploy/migrations/${VERSION}_initial/raw_migration.sql
-            
-            echo "Cleaning migration file..."
-            # Clean the file
-            sed '/^Installing/d' deploy/migrations/${VERSION}_initial/raw_migration.sql > deploy/migrations/${VERSION}_initial/migration.sql
-            
-            # Verify the migration file
-            if [ ! -s deploy/migrations/${VERSION}_initial/migration.sql ]; then
-              echo "ERROR: Migration file is empty after cleaning"
-              echo "Original content was:"
-              cat deploy/migrations/${VERSION}_initial/raw_migration.sql
-              exit 1
-            fi
-            
-            echo "Final migration file content:"
-            cat deploy/migrations/${VERSION}_initial/migration.sql
-            
-            # Verify it starts with SQL
-            if ! head -n 1 deploy/migrations/${VERSION}_initial/migration.sql | grep -q "^--\|^CREATE\|^ALTER"; then
-              echo "ERROR: Migration file does not start with SQL command or comment"
-              echo "First line is:"
-              head -n 1 deploy/migrations/${VERSION}_initial/migration.sql
-              echo "Full content is:"
-              cat deploy/migrations/${VERSION}_initial/migration.sql
-              exit 1
-            fi
-            
-            echo "Initial migration generated at $(date -u)" > deploy/migrations/${VERSION}_initial/README.md
-          fi
-
-      - name: Compare and Generate Migration
-        if: success()
-        env:
-          DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          SHADOW_DATABASE_URL: "postgresql://postgres:postgres@localhost:5433/shadow_db"
-        run: |
-          # Create temporary migration workspace
-          mkdir -p temp_migrations
-          
-          # Copy existing migrations (will not fail if directory is empty)
-          cp -r deploy/migrations/* temp_migrations/ 2>/dev/null || true
-          
-          VERSION=$(date +%Y%m%d%H%M%S)
-          
-          # Generate diff against existing migrations or empty state
-          prisma migrate diff \
-            --from-migrations temp_migrations \
-            --to-schema-datamodel schema.prisma \
-            --shadow-database-url "${SHADOW_DATABASE_URL}" \
-            --script > temp_migrations/migration_${VERSION}.sql
-          
-          # Check if there are actual changes
-          if [ -s temp_migrations/migration_${VERSION}.sql ]; then
-            echo "Changes detected, creating new migration"
-            mkdir -p deploy/migrations/${VERSION}_schema_update
-            mv temp_migrations/migration_${VERSION}.sql deploy/migrations/${VERSION}_schema_update/migration.sql
-            echo "Migration generated at $(date -u)" > deploy/migrations/${VERSION}_schema_update/README.md
-          else
-            echo "No schema changes detected"
-            exit 0
-          fi
-
-      - name: Verify Migration
-        if: success()
-        env:
-          DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          SHADOW_DATABASE_URL: "postgresql://postgres:postgres@localhost:5433/shadow_db"
-        run: |
-          # Create test database
-          psql "${SHADOW_DATABASE_URL}" -c 'CREATE DATABASE migration_test;'
-          
-          # Apply all migrations in order to verify
-          for migration in deploy/migrations/*/migration.sql; do
-            echo "Applying migration: $migration"
-            psql "${SHADOW_DATABASE_URL}" -f $migration
-          done
-
-      # Add this step before create-pull-request to debug permissions
-      - name: Check Token Permissions
-        run: |
-          echo "Checking token permissions..."
-          curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
-               -H "Accept: application/vnd.github.v3+json" \
-               https://api.github.com/repos/BerriAI/litellm/collaborators
-          
-          echo "\nChecking if token can create PRs..."
-          curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
-               -H "Accept: application/vnd.github.v3+json" \
-               https://api.github.com/repos/BerriAI/litellm
-
-      # Add this debug step before git push
-      - name: Debug Changed Files
-        run: |
-          echo "Files staged for commit:"
-          git diff --name-status --staged
-          
-          echo "\nAll changed files:"
-          git status
-
-      - name: Create Pull Request
-        if: success()
-        uses: peter-evans/create-pull-request@v5
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: "chore: update prisma migrations"
-          title: "Update Prisma Migrations"
-          body: |
-            Auto-generated migration based on schema.prisma changes.
-            
-            Generated files:
-            - deploy/migrations/${VERSION}_schema_update/migration.sql
-            - deploy/migrations/${VERSION}_schema_update/README.md
-          branch: feat/prisma-migration-${{ env.VERSION }}
-          base: main
-          delete-branch: true
-
-      - name: Generate and Save Migrations
-        run: |
-          # Only add migration files
-          git add deploy/migrations/
-          git status  # Debug what's being committed
-          git commit -m "chore: update prisma migrations" 
diff --git a/.github/workflows/publish_enterprise.yml b/.github/workflows/publish_enterprise.yml
deleted file mode 100644
index 459a233cb71..00000000000
--- a/.github/workflows/publish_enterprise.yml
+++ /dev/null
@@ -1,94 +0,0 @@
-name: Publish litellm-enterprise to PyPI
-
-on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: "Version bump type"
-        required: true
-        default: "patch"
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    if: github.repository == 'BerriAI/litellm'
-    permissions:
-      contents: write
-      pull-requests: write
-    defaults:
-      run:
-        working-directory: enterprise
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install Poetry
-        run: pip install poetry
-
-      - name: Bump version
-        id: bump
-        run: |
-          OLD=$(poetry version -s)
-          poetry version ${{ github.event.inputs.bump }}
-          NEW=$(poetry version -s)
-          echo "old=$OLD" >> $GITHUB_OUTPUT
-          echo "new=$NEW" >> $GITHUB_OUTPUT
-
-      - name: Update version refs in root pyproject.toml and requirements.txt
-        run: |
-          OLD=${{ steps.bump.outputs.old }}
-          NEW=${{ steps.bump.outputs.new }}
-          sed -i "s/litellm-enterprise = {version = \"${OLD}\"/litellm-enterprise = {version = \"${NEW}\"/" ../pyproject.toml
-          sed -i "s/litellm-enterprise==${OLD}/litellm-enterprise==${NEW}/" ../requirements.txt
-
-      - name: Update poetry.lock
-        working-directory: .
-        run: poetry lock
-
-      - name: Build
-        run: poetry build
-
-      - name: Commit version bump and create PR
-        id: create-pr
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          cd ..
-          BRANCH="bump/enterprise-${{ steps.bump.outputs.new }}"
-          git checkout -b "$BRANCH"
-          git add enterprise/pyproject.toml pyproject.toml requirements.txt poetry.lock
-          git commit -m "bump: litellm-enterprise ${{ steps.bump.outputs.old }} → ${{ steps.bump.outputs.new }}"
-          git push origin "$BRANCH" --force
-          gh pr create \
-            --title "bump: litellm-enterprise ${{ steps.bump.outputs.old }} → ${{ steps.bump.outputs.new }}" \
-            --body "Version bump for litellm-enterprise. Merge to update main." \
-            --head "$BRANCH" \
-            --base main \
-          || true
-          PR_URL=$(gh pr list --head "$BRANCH" --json url -q '.[0].url')
-          echo "pr_url=$PR_URL" >> $GITHUB_OUTPUT
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-      - name: Enable auto-merge
-        run: |
-          gh pr merge "${{ steps.create-pr.outputs.pr_url }}" --auto --squash
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-      - name: Publish to PyPI
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_ENTERPRISE }}
-        run: |
-          pip install twine
-          twine upload dist/litellm_enterprise-${{ steps.bump.outputs.new }}*
diff --git a/.github/workflows/publish_proxy_extras.yml b/.github/workflows/publish_proxy_extras.yml
deleted file mode 100644
index fa30b153163..00000000000
--- a/.github/workflows/publish_proxy_extras.yml
+++ /dev/null
@@ -1,74 +0,0 @@
-name: Publish litellm-proxy-extras to PyPI
-
-on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: "Version bump type"
-        required: true
-        default: "patch"
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    if: github.repository == 'BerriAI/litellm'
-    permissions:
-      contents: write
-    defaults:
-      run:
-        working-directory: litellm-proxy-extras
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install Poetry
-        run: pip install poetry
-
-      - name: Bump version
-        id: bump
-        run: |
-          OLD=$(poetry version -s)
-          poetry version ${{ github.event.inputs.bump }}
-          NEW=$(poetry version -s)
-          echo "old=$OLD" >> $GITHUB_OUTPUT
-          echo "new=$NEW" >> $GITHUB_OUTPUT
-
-      - name: Update version refs in root pyproject.toml and requirements.txt
-        run: |
-          OLD=${{ steps.bump.outputs.old }}
-          NEW=${{ steps.bump.outputs.new }}
-          sed -i "s/litellm-proxy-extras = {version = \"${OLD}\"/litellm-proxy-extras = {version = \"${NEW}\"/" ../pyproject.toml
-          sed -i "s/litellm-proxy-extras==${OLD}/litellm-proxy-extras==${NEW}/" ../requirements.txt
-
-      - name: Update poetry.lock
-        working-directory: .
-        run: poetry lock
-
-      - name: Build
-        run: poetry build
-
-      - name: Commit version bump
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          cd ..
-          git add litellm-proxy-extras/pyproject.toml pyproject.toml requirements.txt poetry.lock
-          git commit -m "bump: litellm-proxy-extras ${{ steps.bump.outputs.old }} → ${{ steps.bump.outputs.new }}"
-          git push
-
-      - name: Publish to PyPI
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_PUBLISH_PASSWORD }}
-        run: |
-          pip install twine
-          twine upload dist/litellm_proxy_extras-${{ steps.bump.outputs.new }}*
diff --git a/.github/workflows/redeploy_proxy.py b/.github/workflows/redeploy_proxy.py
deleted file mode 100644
index ed46bef73a2..00000000000
--- a/.github/workflows/redeploy_proxy.py
+++ /dev/null
@@ -1,20 +0,0 @@
-"""
-
-redeploy_proxy.py
-"""
-
-import os
-import requests
-import time
-
-# send a get request to this endpoint
-deploy_hook1 = os.getenv("LOAD_TEST_REDEPLOY_URL1")
-response = requests.get(deploy_hook1, timeout=20)
-
-
-deploy_hook2 = os.getenv("LOAD_TEST_REDEPLOY_URL2")
-response = requests.get(deploy_hook2, timeout=20)
-
-print("SENT GET REQUESTS to re-deploy proxy")
-print("sleeeping.... for 60s")
-time.sleep(60)
diff --git a/.github/workflows/regenerate-poetry-lock.yml b/.github/workflows/regenerate-poetry-lock.yml
deleted file mode 100644
index c0844f1c705..00000000000
--- a/.github/workflows/regenerate-poetry-lock.yml
+++ /dev/null
@@ -1,80 +0,0 @@
-name: Regenerate poetry.lock
-
-# Runs whenever pyproject.toml is merged into main (the most common cause of
-# the "pyproject.toml changed significantly since poetry.lock was last generated"
-# CI failure).  Can also be triggered manually.
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - pyproject.toml
-  workflow_dispatch:
-
-permissions:
-  contents: write       # needed to push the auto/regenerate-poetry-lock-* branch
-  pull-requests: write  # needed to open the PR and enable auto-merge
-
-jobs:
-  regenerate-lock:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install Poetry
-        run: pip install poetry
-
-      - name: Regenerate poetry.lock
-        run: poetry lock
-
-      - name: Check whether poetry.lock actually changed
-        id: diff
-        run: |
-          if git diff --quiet poetry.lock; then
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Open PR with the refreshed lock file
-        if: steps.diff.outputs.changed == 'true'
-        id: open-pr
-        run: |
-          BRANCH="auto/regenerate-poetry-lock-$(date +'%Y%m%d%H%M%S')"
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git checkout -b "$BRANCH"
-          git add poetry.lock
-          git commit -m "chore: regenerate poetry.lock to match pyproject.toml"
-          git push -f origin "$BRANCH"
-
-          cat > /tmp/pr-body.md << 'BODY'
-          Automated regeneration of `poetry.lock` after `pyproject.toml` was updated on `main`.
-
-          Fixes the recurring CI failure:
-          ```
-          pyproject.toml changed significantly since poetry.lock was last generated.
-          Run `poetry lock` to fix the lock file.
-          ```
-          BODY
-
-          PR_URL=$(gh pr create \
-            --title "chore: regenerate poetry.lock to match pyproject.toml" \
-            --body-file /tmp/pr-body.md \
-            --head "$BRANCH" \
-            --base main)
-          echo "pr_url=$PR_URL" >> "$GITHUB_OUTPUT"
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-      - name: Enable auto-merge
-        if: steps.diff.outputs.changed == 'true'
-        run: |
-          gh pr merge "${{ steps.open-pr.outputs.pr_url }}" --auto --squash
-        env:
-          GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/reset_stable.yml b/.github/workflows/reset_stable.yml
deleted file mode 100644
index f6fed672d47..00000000000
--- a/.github/workflows/reset_stable.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: Reset litellm_stable branch
-
-on:
-  release:
-    types: [published, created]
-jobs:
-  update-stable-branch:
-    if: ${{ startsWith(github.event.release.tag_name, 'v') && !endsWith(github.event.release.tag_name, '-stable') }}
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Reset litellm_stable_release_branch branch to the release commit
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Configure Git user
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          
-          # Fetch all branches and tags
-          git fetch --all
-
-          # Check if the litellm_stable_release_branch branch exists
-          if git show-ref --verify --quiet refs/remotes/origin/litellm_stable_release_branch; then
-            echo "litellm_stable_release_branch branch exists."
-            git checkout litellm_stable_release_branch
-          else
-            echo "litellm_stable_release_branch branch does not exist. Creating it."
-            git checkout -b litellm_stable_release_branch
-          fi
-
-          # Reset litellm_stable_release_branch branch to the release commit
-          git reset --hard $GITHUB_SHA
-
-          # Push the updated litellm_stable_release_branch branch
-          git push origin litellm_stable_release_branch --force
diff --git a/.github/workflows/run_llm_translation_tests.py b/.github/workflows/run_llm_translation_tests.py
old mode 100755
new mode 100644
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 7cd12bb219c..3a00064c3bd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -42,6 +42,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@c10b806170c8ee63ea24152429041b5624f0baf5 # v4.35.1
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/simple_pypi_publish.yml b/.github/workflows/simple_pypi_publish.yml
deleted file mode 100644
index e1830556819..00000000000
--- a/.github/workflows/simple_pypi_publish.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-name: Simple PyPI Publish
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version to publish (e.g., 1.74.10)'
-        required: true
-        type: string
-
-env:
-  TWINE_USERNAME: __token__
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    if: github.repository == 'BerriAI/litellm'
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.8'
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install toml build wheel twine
-
-      - name: Update version in pyproject.toml
-        run: |
-          python -c "
-          import toml
-          
-          with open('pyproject.toml', 'r') as f:
-              data = toml.load(f)
-          
-          data['tool']['poetry']['version'] = '${{ github.event.inputs.version }}'
-          
-          with open('pyproject.toml', 'w') as f:
-              toml.dump(data, f)
-          
-          print(f'Updated version to ${{ github.event.inputs.version }}')
-          "
-
-      - name: Copy model prices file
-        run: |
-          cp model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
-
-      - name: Build package
-        run: |
-          rm -rf build dist
-          python -m build
-
-      - name: Publish to PyPI
-        env:
-          TWINE_PASSWORD: ${{ secrets.PYPI_PUBLISH_PASSWORD }}
-        run: |
-          twine upload dist/*
-
-      - name: Output success
-        run: |
-          echo "✅ Successfully published litellm v${{ github.event.inputs.version }} to PyPI"
-          echo "📦 Package: https://pypi.org/project/litellm/${{ github.event.inputs.version }}/" 
\ No newline at end of file
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
deleted file mode 100644
index 2bc361bc48f..00000000000
--- a/.pre-commit-config.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-repos:
--   repo: local
-    hooks:
-    -   id: pyright
-        name: pyright
-        entry: pyright
-        language: system
-        types: [python]
-        files: ^(litellm/|litellm_proxy_extras/|enterprise/)
-    -   id: isort
-        name: isort
-        entry: isort
-        language: system
-        types: [python]
-        files: (litellm/|litellm_proxy_extras/|enterprise/).*\.py
-        exclude: ^litellm/__init__.py$
-    -   id: black
-        name: black
-        entry: poetry run black
-        language: system
-        types: [python]
-        files: (litellm/|litellm_proxy_extras/).*\.py
--   repo: https://github.com/pycqa/flake8
-    rev: 7.0.0  # The version of flake8 to use
-    hooks:
-    -  id: flake8
-       exclude: ^litellm/tests/|^litellm/proxy/tests/|^litellm/tests/test_litellm/|^tests/test_litellm/|^tests/enterprise/
-       additional_dependencies: [flake8-print]
-       files: (litellm/|litellm_proxy_extras/|enterprise/).*\.py
--   repo: https://github.com/python-poetry/poetry
-    rev: 1.8.0
-    hooks:
-      - id: poetry-check
-        files: ^(pyproject.toml|litellm-proxy-extras/pyproject.toml)$
--   repo: local
-    hooks:
-    -   id: check-files-match
-        name: Check if files match
-        entry: python3 ci_cd/check_files_match.py
-        language: system
\ No newline at end of file
diff --git a/.trivyignore b/.trivyignore
deleted file mode 100644
index 0d04ecacdb5..00000000000
--- a/.trivyignore
+++ /dev/null
@@ -1,12 +0,0 @@
-# LiteLLM Trivy Ignore File
-# CVEs listed here are temporarily allowlisted pending fixes
-
-# Next.js vulnerabilities in UI dashboard (next@14.2.35)
-# Allowlisted: 2026-01-31, 7-day fix timeline
-# Fix: Upgrade to Next.js 15.5.10+ or 16.1.5+
-
-# HIGH: DoS via request deserialization
-GHSA-h25m-26qc-wcjf
-
-# MEDIUM: Image Optimizer DoS
-CVE-2025-59471
diff --git a/ci_cd/.grype.yaml b/ci_cd/.grype.yaml
deleted file mode 100644
index b9bc9db58f5..00000000000
--- a/ci_cd/.grype.yaml
+++ /dev/null
@@ -1,36 +0,0 @@
-ignore:
-  - vulnerability: CVE-2026-22184
-    reason: no fixed zlib package is available yet in the Wolfi repositories, so this is ignored temporarily until an upstream release exists
-  # Wolfi base image: Python 3.13 and Node from apk have no fixed builds in Wolfi yet / not applicable
-  - vulnerability: CVE-2025-55130
-    reason: Node in Wolfi apk; only used for Admin UI build/prisma
-  - vulnerability: CVE-2025-59465
-    reason: Node in Wolfi apk; only used for Admin UI build/prisma
-  - vulnerability: CVE-2025-55131
-    reason: Node in Wolfi apk; only used for Admin UI build/prisma
-  - vulnerability: CVE-2025-59466
-    reason: Node in Wolfi apk; only used for Admin UI build/prisma
-  - vulnerability: CVE-2026-21637
-    reason: Node in Wolfi apk; only used for Admin UI build/prisma
-  - vulnerability: CVE-2025-55132
-    reason: Node in Wolfi apk; only used for Admin UI build/prisma
-  - vulnerability: GHSA-hx9q-6w63-j58v
-    reason: orjson dumps recursion; allowlisted
-  - vulnerability: GHSA-73rr-hh4g-fpgx
-    reason: diff npm transitive dep; override in package.json, allowlisted
-  - vulnerability: CVE-2026-0865
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2025-15282
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2026-0672
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2025-15366
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2025-15367
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2025-11468
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2025-12781
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2026-1299
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
diff --git a/ci_cd/publish-proxy-extras.sh b/ci_cd/publish-proxy-extras.sh
deleted file mode 100644
index 6c83d1f9212..00000000000
--- a/ci_cd/publish-proxy-extras.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/bash
-
-# Exit on error
-set -e
-
-echo "🚀 Building and publishing litellm-proxy-extras"
-
-# Navigate to litellm-proxy-extras directory
-cd "$(dirname "$0")/../litellm-proxy-extras"
-
-# Build the package
-echo "📦 Building package..."
-poetry build
-
-# Publish to PyPI
-echo "🌎 Publishing to PyPI..."
-poetry publish
-
-echo "✅ Done! Package published successfully"
\ No newline at end of file
diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh
deleted file mode 100755
index 801b700f64f..00000000000
--- a/ci_cd/security_scans.sh
+++ /dev/null
@@ -1,262 +0,0 @@
-#!/bin/bash
-
-# Security Scans Script for LiteLLM
-# This script runs comprehensive security scans including Trivy and Grype
-
-set -e
-
-echo "Starting security scans for LiteLLM..."
-
-# Function to install Trivy and required tools
-install_trivy() {
-    echo "Installing Trivy and required tools..."
-    sudo apt-get update
-    sudo apt-get install -y wget apt-transport-https gnupg lsb-release jq curl bsdmainutils
-    wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
-    echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
-    sudo apt-get update
-    sudo apt-get install trivy
-    echo "Trivy and required tools installed successfully"
-}
-
-# Function to install Grype
-install_grype() {
-    echo "Installing Grype..."
-    curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sudo sh -s -- -b /usr/local/bin
-    echo "Grype installed successfully"
-}
-
-# Function to install ggshield
-install_ggshield() {
-    echo "Installing ggshield..."
-    pip3 install --upgrade pip
-    pip3 install ggshield
-    echo "ggshield installed successfully"
-}
-
-# # Function to run secret detection scans
-# run_secret_detection() {
-#     echo "Running secret detection scans..."
-    
-#     if ! command -v ggshield &> /dev/null; then
-#         install_ggshield
-#     fi
-    
-#     # Check if GITGUARDIAN_API_KEY is set (required for CI/CD)
-#     if [ -z "$GITGUARDIAN_API_KEY" ]; then
-#         echo "Warning: GITGUARDIAN_API_KEY environment variable is not set."
-#         echo "ggshield requires a GitGuardian API key to scan for secrets."
-#         echo "Please set GITGUARDIAN_API_KEY in your CI/CD environment variables."
-#         exit 1
-#     fi
-    
-#     echo "Scanning codebase for secrets..."
-#     echo "Note: Large codebases may take several minutes due to API rate limits (50 requests/minute on free plan)"
-#     echo "ggshield will automatically handle rate limits and retry as needed."
-#     echo "Binary files, cache files, and build artifacts are excluded via .gitguardian.yaml"
-    
-#     # Use --recursive for directory scanning and auto-confirm if prompted
-#     # .gitguardian.yaml will automatically exclude binary files, wheel files, etc.
-#     # GITGUARDIAN_API_KEY environment variable will be used for authentication
-#     echo y | ggshield secret scan path . --recursive || {
-#         echo ""
-#         echo "=========================================="
-#         echo "ERROR: Secret Detection Failed"
-#         echo "=========================================="
-#         echo "ggshield has detected secrets in the codebase."
-#         echo "Please review discovered secrets above, revoke any actively used secrets"
-#         echo "from underlying systems and make changes to inject secrets dynamically at runtime."
-#         echo ""
-#         echo "For more information, see: https://docs.gitguardian.com/secrets-detection/"
-#         echo "=========================================="
-#         echo ""
-#         exit 1
-#     }
-    
-#     echo "Secret detection scans completed successfully"
-# }
-
-# Function to run Trivy scans
-run_trivy_scans() {
-    echo "Running Trivy scans..."
-    
-    echo "Scanning LiteLLM Docs..."
-    trivy fs --ignorefile .trivyignore --scanners vuln --dependency-tree --exit-code 1 --severity HIGH,CRITICAL,MEDIUM ./docs/
-    
-    echo "Scanning LiteLLM UI..."
-    trivy fs --ignorefile .trivyignore --scanners vuln --dependency-tree --exit-code 1 --severity HIGH,CRITICAL,MEDIUM ./ui/
-    
-    echo "Trivy scans completed successfully"
-}
-
-# Function to build and scan Docker images with Grype
-run_grype_scans() {
-    echo "Running Grype scans..."
-    
-    # Temporarily add wheel files to .dockerignore for security scans
-    echo "Temporarily modifying .dockerignore to exclude problematic wheel files..."
-    cp .dockerignore .dockerignore.backup 2>/dev/null || touch .dockerignore.backup
-    echo "/*.whl" >> .dockerignore
-    
-    # Build and scan Dockerfile.database
-    echo "Building and scanning Dockerfile.database..."
-    docker build --no-cache -t litellm-database:latest -f ./docker/Dockerfile.database .
-    grype litellm-database:latest --config ci_cd/.grype.yaml --fail-on critical
-    
-    # Build and scan main Dockerfile
-    echo "Building and scanning main Dockerfile..."
-    docker build --no-cache -t litellm:latest .
-    grype litellm:latest --config ci_cd/.grype.yaml --fail-on critical
-    
-    # Restore original .dockerignore
-    echo "Restoring original .dockerignore..."
-    mv .dockerignore.backup .dockerignore
-    
-    # Scan the locally built LiteLLM image for vulnerabilities with CVSS >= 4.0
-    echo "Scanning locally built LiteLLM image for high-severity vulnerabilities..."
-    echo "Using locally built image: litellm:latest"
-    
-    # Allowlist of CVEs to be ignored in failure threshold/reporting
-    # - CVE-2025-8869: Not applicable on Python >=3.13 (PEP 706 implemented); pip fallback unused; no OS-level fix
-    # - GHSA-4xh5-x5gv-qwph: GitHub Security Advisory alias for CVE-2025-8869
-    # - GHSA-5j98-mcp5-4vw2: glob CLI command injection via -c/--cmd; glob CLI is not used in the litellm runtime image,
-    #   and the vulnerable versions are pulled in only via OS-level/node tooling outside of our application code
-    ALLOWED_CVES=(
-        "CVE-2025-8869"
-        "GHSA-4xh5-x5gv-qwph"
-        "CVE-2025-8291" # no fix available as of Oct 11, 2025
-        "GHSA-5j98-mcp5-4vw2"
-        "CVE-2025-13836" # Python 3.13 HTTP response reading OOM/DoS - no fix available in base image
-        "CVE-2025-12084" # Python 3.13 xml.dom.minidom quadratic algorithm - no fix available in base image
-        "CVE-2025-60876" # BusyBox wget HTTP request splitting - no fix available in Chainguard Wolfi base image
-        "CVE-2026-0861" # Wolfi glibc still flagged even on 2.42-r5; upstream patched build unavailable yet
-        "CVE-2010-4756" # glibc glob DoS - awaiting patched Wolfi glibc build
-        "CVE-2019-1010022" # glibc stack guard bypass - awaiting patched Wolfi glibc build
-        "CVE-2019-1010023" # glibc ldd remap issue - awaiting patched Wolfi glibc build
-        "CVE-2019-1010024" # glibc ASLR mitigation bypass - awaiting patched Wolfi glibc build
-        "CVE-2019-1010025" # glibc pthread heap address leak - awaiting patched Wolfi glibc build
-        "CVE-2026-22184" # zlib untgz buffer overflow - untgz unused + no fixed Wolfi build yet
-        "GHSA-58pv-8j8x-9vj2" # jaraco.context path traversal - setuptools vendored only (v5.3.0), not used in application code (using v6.1.0+)
-        "GHSA-34x7-hfp2-rc4v" # node-tar hardlink path traversal - not applicable, tar CLI not exposed in application code
-        "GHSA-r6q2-hw4h-h46w" # node-tar not used by application runtime, Linux-only container, not affect by macOS APFS-specific exploit
-        "GHSA-8rrh-rw8j-w5fx" # wheel is from chainguard and will be handled by then TODO: Remove this after Chainguard updates the wheel
-        "CVE-2025-59465" # Node only used for Admin UI build/prisma
-        "CVE-2025-55131" # Node only used for Admin UI build/prisma
-        "CVE-2025-59466" # Node only used for Admin UI build/prisma
-        "CVE-2025-55130" # Node only used for Admin UI build/prisma
-        "CVE-2025-59467" # Node only used for Admin UI build/prisma
-        "CVE-2026-21637" # Node only used for Admin UI build/prisma
-        "CVE-2025-55132" # Node only used for Admin UI build/prisma
-        "GHSA-hx9q-6w63-j58v" # orjson dumps recursion; allowlisted
-        "CVE-2025-15281" # No fix available yet
-        "CVE-2026-0865" # No fix available yet
-        "CVE-2025-15282" # No fix available yet
-        "CVE-2026-0672" # No fix available yet
-        "CVE-2025-15366" # No fix available yet
-        "CVE-2025-15367" # No fix available yet
-        "CVE-2025-12781" # No fix available yet
-        "CVE-2025-11468" # No fix available yet
-        "CVE-2026-1299" # Python 3.13 email module header injection - not applicable, LiteLLM doesn't use BytesGenerator for email serialization
-        "CVE-2026-0775" # npm cli incorrect permission assignment - no fix available yet, npm is only used at build/prisma-generate time
-        "GHSA-3ppc-4f35-3m26" # minimatch ReDoS via repeated wildcards - from nodejs_wheel bundled npm, not used in application runtime code
-        "GHSA-83g3-92jg-28cx" # tar arbitrary file read/write via hardlink - from nodejs_wheel bundled npm, not used in application runtime code
-        "CVE-2026-25639" # axios - full fix requires 1.x major version bump; pinned to >=0.30.2 to clear other axios CVEs, upgrade to 1.x in follow-up
-        "CVE-2026-2297" # Python 3.13 SourcelessFileLoader audit hook bypass - no fix available in base image
-        "GHSA-qffp-2rhf-9h96" # tar hardlink path traversal - from nodejs_wheel bundled npm, not used in application runtime code
-        "CVE-2026-2673" # OpenSSL 3.6.1 TLS 1.3 key exchange group negotiation issue - no fix available yet
-        "CVE-2026-3644" # Python 3.13 vulnerability - no fix available in base image
-        "CVE-2026-4224" # Python 3.13 Expat parser stack overflow in ElementDeclHandler - no fix available in base image
-    )
-
-    # Build JSON array of allowlisted CVE IDs for jq
-    ALLOWED_IDS_JSON=$(printf '%s\n' "${ALLOWED_CVES[@]}" | jq -R . | jq -s .)
-
-    echo "Checking for vulnerabilities with CVSS score >= 4.0..."
-    echo "Allowlisted CVEs (ignored in threshold): ${ALLOWED_CVES[*]}"
-    echo ""
-    
-    # Show all high-severity vulnerabilities for transparency
-    TOTAL_HIGH_SEVERITY=$(grype litellm:latest -o json | jq -r '
-        .matches[]
-        | select(.vulnerability.cvss[]?.metrics.baseScore >= 4.0)
-        | .vulnerability.id' | wc -l)
-    
-    if [ "$TOTAL_HIGH_SEVERITY" -gt 0 ]; then
-        echo "Total vulnerabilities found with CVSS >= 4.0: $TOTAL_HIGH_SEVERITY"
-        echo ""
-        echo "All high-severity vulnerabilities (including allowlisted):"
-        grype litellm:latest -o json | jq --argjson allow "$ALLOWED_IDS_JSON" -r '
-        ["Package", "Version", "Vulnerability ID", "CVSS Score", "Allowlisted"],
-        (.matches[]
-          | select(.vulnerability.cvss[]?.metrics.baseScore >= 4.0)
-          | [.artifact.name, .artifact.version, .vulnerability.id, .vulnerability.cvss[0].metrics.baseScore, (if (.vulnerability.id as $id | $allow | index($id)) then "YES" else "NO" end)])
-        | @tsv' | column -t -s $'\t'
-        echo ""
-    fi
-
-    HIGH_SEVERITY_COUNT=$(grype litellm:latest -o json | jq --argjson allow "$ALLOWED_IDS_JSON" -r '
-        .matches[]
-        | select(.vulnerability.cvss[]?.metrics.baseScore >= 4.0)
-        | select((.vulnerability.id as $id | $allow | index($id) | not))
-        | .vulnerability.id' | wc -l)
-    
-    if [ "$HIGH_SEVERITY_COUNT" -gt 0 ]; then
-        echo ""
-        echo "=========================================="
-        echo "ERROR: Security Scan Failed"
-        echo "=========================================="
-        echo "Found $HIGH_SEVERITY_COUNT non-allowlisted vulnerabilities with CVSS score >= 4.0 in litellm:latest"
-        echo ""
-        echo "These vulnerabilities are NOT in the allowlist and must be addressed."
-        echo "Current allowlisted CVEs: ${ALLOWED_CVES[*]}"
-        echo ""
-        echo "Detailed vulnerability report:"
-        echo ""
-        grype litellm:latest -o json | jq --argjson allow "$ALLOWED_IDS_JSON" -r '
-        ["Package", "Version", "Vulnerability ID", "CVSS Score", "Severity", "Fix Version", "Description"],
-        (.matches[]
-          | select(.vulnerability.cvss[]?.metrics.baseScore >= 4.0)
-          | select((.vulnerability.id as $id | $allow | index($id) | not))
-          | [.artifact.name, .artifact.version, .vulnerability.id, .vulnerability.cvss[0].metrics.baseScore, .vulnerability.severity, (.vulnerability.fix.versions[0] // "No fix available"), .vulnerability.description])
-        | @tsv' | column -t -s $'\t'
-        echo ""
-        echo "=========================================="
-        echo "Action Required:"
-        echo "=========================================="
-        echo "1. If a fix is available, update the package to the fixed version"
-        echo "2. If the vulnerability is not applicable or has no fix:"
-        echo "   - Add the CVE/GHSA ID to ALLOWED_CVES array in ci_cd/security_scans.sh"
-        echo "   - Add a comment explaining why it's safe to ignore"
-        echo ""
-        echo "Note: Some vulnerabilities may have multiple IDs (CVE-XXXX and GHSA-XXXX)."
-        echo "Add all relevant IDs to the allowlist if they refer to the same issue."
-        echo "=========================================="
-        echo ""
-        exit 1
-    else
-        echo "No high-severity vulnerabilities (CVSS >= 4.0) found in litellm:latest"
-    fi
-    
-    echo "Grype scans completed successfully"
-}
-
-# Main execution
-main() {
-    echo "Installing security scanning tools..."
-    install_trivy
-    install_grype
-    
-    # echo "Running secret detection scans..."
-    # run_secret_detection
-    
-    echo "Running filesystem vulnerability scans..."
-    run_trivy_scans
-    
-    echo "Running Docker image vulnerability scans..."
-    run_grype_scans
-    
-    echo "All security scans completed successfully!"
-}
-
-# Execute main function
-main "$@"
diff --git a/docker/build_admin_ui.sh b/docker/build_admin_ui.sh
index 5373ad0e3d9..efb2bac3535 100755
--- a/docker/build_admin_ui.sh
+++ b/docker/build_admin_ui.sh
@@ -40,11 +40,22 @@ else
         exit 1
     fi
 fi
-curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
+NVM_VERSION="v0.40.4"
+NVM_CHECKSUM="4b7412c49960c7d31e8df72da90c1fb5b8cccb419ac99537b737028d497aba4f"
+NVM_SCRIPT=$(mktemp)
+trap 'rm -f "$NVM_SCRIPT"' EXIT
+curl -fsSL "https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_VERSION}/install.sh" -o "$NVM_SCRIPT"
+if command -v sha256sum &>/dev/null; then
+  echo "${NVM_CHECKSUM}  ${NVM_SCRIPT}" | sha256sum -c -
+elif command -v shasum &>/dev/null; then
+  echo "${NVM_CHECKSUM}  ${NVM_SCRIPT}" | shasum -a 256 -c -
+else
+  echo "No sha256 tool found; cannot verify nvm checksum"; exit 1
+fi || { echo "nvm checksum verification failed"; exit 1; }
+bash "$NVM_SCRIPT"
 source ~/.nvm/nvm.sh
 nvm install v18.17.0
 nvm use v18.17.0
-npm install -g npm
 
 # copy _enterprise.json from this directory to /ui/litellm-dashboard, and rename it to ui_colors.json
 cp enterprise/enterprise_ui/enterprise_colors.json ui/litellm-dashboard/ui_colors.json
diff --git a/docs/my-website/.trivyignore b/docs/my-website/.trivyignore
deleted file mode 100644
index 977504f2670..00000000000
--- a/docs/my-website/.trivyignore
+++ /dev/null
@@ -1,7 +0,0 @@
-# js-yaml CVE-2025-64718
-# This vulnerability is not applicable because we've forced js-yaml to version 4.1.1
-# via npm overrides in package.json. Trivy incorrectly reports this based on
-# dependency requirements in the lockfile, but the actual installed version is 4.1.1.
-# Verified with: npm list js-yaml
-CVE-2025-64718
-
diff --git a/scripts/install.sh b/scripts/install.sh
index b9912287b70..03ae31cd18b 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -83,8 +83,8 @@ echo ""
 header "Installing litellm[proxy]…"
 echo ""
 
-"$PYTHON_BIN" -m pip install --upgrade "${LITELLM_PACKAGE}" \
-  || die "pip install failed. Try manually: $PYTHON_BIN -m pip install '${LITELLM_PACKAGE}'"
+"$PYTHON_BIN" -m pip install --only-binary :all: --upgrade "${LITELLM_PACKAGE}" \
+  || die "pip install failed. Try manually: $PYTHON_BIN -m pip install --only-binary :all: '${LITELLM_PACKAGE}'"
 
 # ── find the litellm binary installed by pip for this Python ───────────────
 # sysconfig.get_path('scripts') is where pip puts console scripts — reliable
diff --git a/ui/litellm-dashboard/.trivyignore b/ui/litellm-dashboard/.trivyignore
deleted file mode 100644
index 977504f2670..00000000000
--- a/ui/litellm-dashboard/.trivyignore
+++ /dev/null
@@ -1,7 +0,0 @@
-# js-yaml CVE-2025-64718
-# This vulnerability is not applicable because we've forced js-yaml to version 4.1.1
-# via npm overrides in package.json. Trivy incorrectly reports this based on
-# dependency requirements in the lockfile, but the actual installed version is 4.1.1.
-# Verified with: npm list js-yaml
-CVE-2025-64718
-
diff --git a/ui/litellm-dashboard/build_ui.sh b/ui/litellm-dashboard/build_ui.sh
index cd6ec901904..aa346c12edc 100755
--- a/ui/litellm-dashboard/build_ui.sh
+++ b/ui/litellm-dashboard/build_ui.sh
@@ -2,8 +2,20 @@
 
 # Check if nvm is not installed
 if ! command -v nvm &> /dev/null; then
-  # Install nvm
-  curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
+  # Install nvm with checksum verification
+  NVM_VERSION="v0.40.4"
+  NVM_CHECKSUM="4b7412c49960c7d31e8df72da90c1fb5b8cccb419ac99537b737028d497aba4f"
+  NVM_SCRIPT=$(mktemp)
+  trap 'rm -f "$NVM_SCRIPT"' EXIT
+  curl -fsSL "https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_VERSION}/install.sh" -o "$NVM_SCRIPT"
+  if command -v sha256sum &>/dev/null; then
+    echo "${NVM_CHECKSUM}  ${NVM_SCRIPT}" | sha256sum -c -
+  elif command -v shasum &>/dev/null; then
+    echo "${NVM_CHECKSUM}  ${NVM_SCRIPT}" | shasum -a 256 -c -
+  else
+    echo "No sha256 tool found; cannot verify nvm checksum"; exit 1
+  fi || { echo "nvm checksum verification failed"; exit 1; }
+  bash "$NVM_SCRIPT"
 
   # Source nvm script in the current session
   export NVM_DIR="$HOME/.nvm"
diff --git a/ui/litellm-dashboard/build_ui_custom_path.sh b/ui/litellm-dashboard/build_ui_custom_path.sh
index f947f87d3b7..a92927f8ea7 100755
--- a/ui/litellm-dashboard/build_ui_custom_path.sh
+++ b/ui/litellm-dashboard/build_ui_custom_path.sh
@@ -12,8 +12,20 @@ UI_BASE_PATH="$1"
 
 # Check if nvm is not installed
 if ! command -v nvm &> /dev/null; then
-    # Install nvm
-    curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
+    # Install nvm with checksum verification
+    NVM_VERSION="v0.40.4"
+    NVM_CHECKSUM="4b7412c49960c7d31e8df72da90c1fb5b8cccb419ac99537b737028d497aba4f"
+    NVM_SCRIPT=$(mktemp)
+    trap 'rm -f "$NVM_SCRIPT"' EXIT
+    curl -fsSL "https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_VERSION}/install.sh" -o "$NVM_SCRIPT"
+    if command -v sha256sum &>/dev/null; then
+      echo "${NVM_CHECKSUM}  ${NVM_SCRIPT}" | sha256sum -c -
+    elif command -v shasum &>/dev/null; then
+      echo "${NVM_CHECKSUM}  ${NVM_SCRIPT}" | shasum -a 256 -c -
+    else
+      echo "No sha256 tool found; cannot verify nvm checksum"; exit 1
+    fi || { echo "nvm checksum verification failed"; exit 1; }
+    bash "$NVM_SCRIPT"
 
     # Source nvm script in the current session
     export NVM_DIR="$HOME/.nvm"