build(deps): keep pynacl in the proxy-dev group so legacy ciphertext fixtures run on every CI shard

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pyproject.toml

@@ -256,6 +256,7 @@ proxy-dev = [
     "opentelemetry-instrumentation-fastapi==0.49b0",
     "azure-identity==1.25.2",
     "a2a-sdk==1.1.0",
+    "pynacl>=1.6.2,<2.0",
 ]
 ci = [
     # These are lazily imported at call sites; keep them out of core deps to

tests/test_litellm/proxy/_experimental/mcp_server/test_db_credentials.py

@@ -4,7 +4,7 @@ Tests for the encrypted-at-rest persistence of MCP user credentials.
 The ``LiteLLM_MCPUserCredentials.credential_b64`` column previously stored
 both BYOK API keys and OAuth2 access tokens as plain ``urlsafe_b64encode``
 of the raw value, leaving credentials readable from any DB read. The fix
-runs every write through ``encrypt_value_helper`` (nacl SecretBox) and
+runs every write through ``encrypt_value_helper`` (AES-256-GCM by default) and
 keeps a plain-base64 fallback on read so existing rows continue to work.
 """
 

uv.lock

@@ -4744,6 +4744,7 @@ proxy-dev = [
     { name = "opentelemetry-sdk" },
     { name = "prisma" },
     { name = "prometheus-client" },
+    { name = "pynacl" },
 ]
 
 [package.metadata]
@@ -4957,6 +4958,7 @@ proxy-dev = [
     { name = "opentelemetry-sdk", specifier = "==1.28.0" },
     { name = "prisma", specifier = "==0.11.0" },
     { name = "prometheus-client", specifier = "==0.20.0" },
+    { name = "pynacl", specifier = ">=1.6.2,<2.0" },
 ]
 
 [[package]]