chore(deps): update ghcr.io/berriai/litellm-non_root docker tag to v1.104.2

[renovate-wibrow]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/berriai/litellm-non_root (source)	final	minor	v1.95.0 → v1.104.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

BerriAI/litellm (ghcr.io/berriai/litellm-non_root)

v1.104.2

Compare Source

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.2

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.104.2/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.2

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• feat(decisions): backport /v1/systemone, OpenAI-format /v1/decisions and the OpenAI Decisions provider to stable/1.104.x for v1.104.2 (#​44236, #​45184, #​45214) by @​mateo-berri in #​45190

Full Changelog: BerriAI/litellm@v1.104.1...v1.104.2

v1.104.1

Compare Source

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.1

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.104.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.1

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• chore(release): refresh dependencies on stable/1.104.x and cut 1.104.1 by @​yuneng-berri in #​44777
• chore(docker): bump pgbouncer to 1.26.0 by @​devin-ai-integration[bot] in #​45012

Full Changelog: BerriAI/litellm@v1.104.0...v1.104.1

v1.104.0

Compare Source

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.104.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• build(deps): re-suppress GHSA-h7x2-h6g9-p789 in osv-scan, mlflow still has no fixed release by @​devin-ai-integration[bot] in #​41036
• feat(auth): add breached password detection to password policy by @​ojensen-berri in #​39321
• feat(auth): add self-service password change and plug plaintext password leaks by @​ojensen-berri in #​39562
• feat(auth): force password reset for breached or admin-set passwords by @​ojensen-berri in #​40107
• perf(proxy): serialize /model/info listing once with orjson by @​devin-ai-integration[bot] in #​41061
• fix(utils): stop wrapper_async submitting the sync success handler twice by @​devin-ai-integration[bot] in #​41058
• test(integration): native responses and messages cost cases by @​devin-ai-integration[bot] in #​42010
• fix(proxy): stop re-sending un-resendable spend batches from the Redis buffer by @​devin-ai-integration[bot] in #​41994
• fix(router): skip cooldown for background response cost poll 404s by @​devin-ai-integration[bot] in #​42046
• fix(router): stamp model_group when retrieving a batch, so batch tokens are attributable (internal copy of #​38499) by @​devin-ai-integration[bot] in #​42062
• test(mcp): restore scoped execution and credential isolation regressions by @​joshua-berri in #​42050
• feat(proxy)!: refuse to start with an unset, empty, or publicly known master key by @​ryan-crabbe-berri in #​42019
• docs: stop advertising sk-1234 as the master key in shipped configs and examples by @​ryan-crabbe-berri in #​42011
• test(logging): add autorouter estimate keys to the GCS pub/sub spend-log golden by @​devin-ai-integration[bot] in #​42061
• fix(router): add NotFoundErrorRetries so a retry policy can pin 404 retries by @​devin-ai-integration[bot] in #​42045
• chore(prices): sync OpenRouter prices: 2 models by @​berriai-litellm-provider-info-sync[bot] in #​42077
• fix(google_genai): forward response schema and tool parameters through the generateContent adapter by @​devin-ai-integration[bot] in #​42067
• test(e2e): restore MCP OAuth happy-path coverage (LIT-3467) by @​joshua-berri in #​42051
• fix(mcp): tools/call no longer 404s on a worker that has not served tools/list by @​devin-ai-integration[bot] in #​42072
• chore(prices): sync OpenRouter prices: 7 models, 6 deprecated by @​berriai-litellm-provider-info-sync[bot] in #​42082
• fix(proxy): wait for the spend-log table before creating startup views by @​devin-ai-integration[bot] in #​41974
• fix(guardrails): scan each choice's tool-call arguments apart on n>1 streams and log why a rewrite was discarded by @​devin-ai-integration[bot] in #​40986
• chore(prices): sync OpenRouter prices: 1 model by @​berriai-litellm-provider-info-sync[bot] in #​42089
• chore(prices): sync OpenRouter prices: 1 model by @​berriai-litellm-provider-info-sync[bot] in #​42092
• chore: remove the dead telemetry flag from the SDK, proxy CLI and configs by @​devin-ai-integration[bot] in #​42071
• docs(tests): define the tier contract for unit, integration and e2e by @​devin-ai-integration[bot] in #​42099
• fix(proxy): coordinate v2 migration startup and qualify container recovery by @​yuneng-berri in #​40932
• ci(tests): wire tests/unit into CircleCI and keep draining GHA shards green by @​devin-ai-integration[bot] in #​42103
• test(unit): block external sockets at import time and add a socket policy regression test by @​devin-ai-integration[bot] in #​42113
• fix(ci): excuse retired test-quality rules in the budget ratchet by @​devin-ai-integration[bot] in #​42116
• test: migrate wave 1 phase 2 legacy unit tests to tests/unit by @​devin-ai-integration[bot] in #​42108
• test(llms): migrate bedrock, baseten and base_llm batch tests to tests/unit by @​devin-ai-integration[bot] in #​42110
• test(llms): migrate phase 6 provider unit tests to tests/unit by @​devin-ai-integration[bot] in #​42107
• test: migrate nvidia, oci, ocr, oobabooga and openai legacy tests to tests/unit by @​devin-ai-integration[bot] in #​42115
• test: migrate phase 9 legacy llm provider tests to tests/unit by @​devin-ai-integration[bot] in #​42117
• test(llms): migrate phase 7 provider unit tests to tests/unit by @​devin-ai-integration[bot] in #​42114
• test: migrate wave 1 phase 8 legacy llm tests to tests/unit by @​devin-ai-integration[bot] in #​42112
• test(llms): migrate phase 5 provider unit tests to tests/unit by @​devin-ai-integration[bot] in #​42109
• refactor(types): replace Any with proven types in 30 files by @​devin-ai-integration[bot] in #​42127
• test(unit): make every tests/unit directory a package so pytest collection is unique by @​devin-ai-integration[bot] in #​42135
• test(unit): migrate wave 1 phase 3 anthropic, apiserpent, azure and azure_ai legacy tests by @​devin-ai-integration[bot] in #​42118
• test: migrate openai, openai_like and openrouter legacy tests to tests/unit by @​devin-ai-integration[bot] in #​42128
• test: migrate phase 14 wave 2 provider tests to tests/unit by @​devin-ai-integration[bot] in #​42132
• test: migrate phase 16 legacy tests to tests/unit by @​devin-ai-integration[bot] in #​42131
• test: migrate wave 1 phase 1 legacy tests to tests/unit by @​devin-ai-integration[bot] in #​42123
• test: migrate phase 12 legacy llm provider tests to tests/unit by @​devin-ai-integration[bot] in #​42137
• test: migrate phase 15 legacy tests to tests/unit by @​devin-ai-integration[bot] in #​42136
• fix(proxy): enforce virtual key budgets for JEV test routing by @​devin-ai-integration[bot] in #​41879
• feat(fal_ai): add Seedance 2.5 / 2.0 video generation via fal queue API by @​devin-ai-integration[bot] in #​41980
• chore(prices): sync OpenRouter prices: 11 models by @​berriai-litellm-provider-info-sync[bot] in #​42096
• test: migrate legacy provider tests to tests/unit (wave 2, phase 13) by @​devin-ai-integration[bot] in #​42145
• chore(prices): sync OpenRouter prices: 2 models by @​berriai-litellm-provider-info-sync[bot] in #​42154
• chore(prices): sync OpenRouter prices: 5 models by @​berriai-litellm-provider-info-sync[bot] in #​42155
• chore(prices): sync OpenRouter prices: 2 models by @​berriai-litellm-provider-info-sync[bot] in #​42157
• fix(auth): reject deactivated JWT users and refresh cached status by @​joshua-berri in #​42064
• fix(mcp): explain missing public client dependencies by @​joshua-berri in #​42148
• chore(prices): sync OpenRouter prices: 2 models by @​berriai-litellm-provider-info-sync[bot] in #​42162
• chore(prices): sync OpenRouter prices: 3 models by @​berriai-litellm-provider-info-sync[bot] in #​42163
• chore(prices): sync OpenRouter prices: 2 models by @​berriai-litellm-provider-info-sync[bot] in #​42164
• chore(prices): sync OpenRouter prices: 1 model by @​berriai-litellm-provider-info-sync[bot] in #​42166
• chore(prices): sync OpenRouter prices: 3 models by @​berriai-litellm-provider-info-sync[bot] in #​42168
• refactor(rust): split token counter backends by @​devin-ai-integration[bot] in #​42165
• chore(prices): sync OpenRouter prices: 2 models by @​berriai-litellm-provider-info-sync[bot] in #​42169
• chore(prices): sync OpenRouter prices: 3 models by @​berriai-litellm-provider-info-sync[bot] in #​42175
• chore(prices): sync OpenRouter prices: 4 models by @​berriai-litellm-provider-info-sync[bot] in #​42178
• chore(prices): sync OpenRouter prices: 3 models by @​berriai-litellm-provider-info-sync[bot] in #​42179
• chore(prices): sync OpenRouter prices: 1 model by @​berriai-litellm-provider-info-sync[bot] in #​42182
• feat(rust): add typed secret managers and shared auth adapters by @​devin-ai-integration[bot] in #​42173
• chore(prices): sync OpenRouter prices: 2 models by @​berriai-litellm-provider-info-sync[bot] in #​42184
• chore(prices): sync OpenRouter prices: 2 models by @​berriai-litellm-provider-info-sync[bot] in #​42187
• chore(prices): sync OpenRouter prices: 2 models by @​berriai-litellm-provider-info-sync[bot] in #​42192
• fix(responses): forward safety_identifier through the chat completion bridge by @​devin-ai-integration[bot] in #​42193
• refactor(types): replace Any with proven types in 32 files by @​devin-ai-integration[bot] in #​42220
• chore(prices): sync OpenRouter prices: 2 models by @​berriai-litellm-provider-info-sync[bot] in #​42227
• fix(helm): render a fixed replicaCount on componentized deployments when HPA is disabled by @​devin-ai-integration[bot] in #​42207
• fix(proxy): return 422 instead of 429 for BudgetExceededError by @​devin-ai-integration[bot] in #​42097
• chore(prices): sync OpenRouter prices: 1 model by @​berriai-litellm-provider-info-sync[bot] in #​42234
• chore(prices): sync OpenRouter prices: 1 model by @​berriai-litellm-provider-info-sync[bot] in #​42240
• chore(prices): sync OpenRouter prices: 4 models by @​berriai-litellm-provider-info-sync[bot] in #​42243
• fix(a2a): send message/stream for Bedrock AgentCore streaming requests by @​devin-ai-integration[bot] in #​42239
• fix(registry): add MAI-Image-2.5-Pro pricing, fix Fireworks/Together entries, absorb verified open registry PRs, add Groq deprecation and Bedrock regional Qwen3 Next pricing by @​devin-ai-integration[bot] in #​34941
• fix(anthropic): forward safeguards and anthropic-beta unchanged on native /v1/messages by @​devin-ai-integration[bot] in #​42152
• chore(prices): sync OpenRouter prices: 4 models by @​berriai-litellm-provider-info-sync[bot] in #​42246
• chore(prices): sync OpenRouter prices: 3 models by @​berriai-litellm-provider-info-sync[bot] in #​42251
• chore(prices): sync Azure prices: 1 model, 1 deprecated by @​berriai-litellm-provider-info-sync[bot] in #​42249
• chore(prices): sync AWS Bedrock prices: 25 models [enrichment failed: AWS Bedrock, 66 held] by @​berriai-litellm-provider-info-sync[bot] in #​42250
• test(a2a): migrate a2a_protocol legacy tests to tests/unit (wave 3 phase 17) by @​devin-ai-integration[bot] in #​42160
• feat(proxy): default to the v2 migration resolver by @​yuneng-berri in #​42105
• feat(auto-router): configure heuristic v2 success threshold by @​tin-berri in #​42252
• chore(prices): sync Together AI prices: 2 models by @​berriai-litellm-provider-info-sync[bot] in #​42258
• chore(prices): sync OpenRouter prices: 6 models, 1 new by @​berriai-litellm-provider-info-sync[bot] in #​42253
• fix(key_generate): use the user's own budget as the ceiling for UI session personal keys by @​devin-ai-integration[bot] in #​41588
• feat(team): show whether a member follows the team default budget and allow resetting to it by @​devin-ai-integration[bot] in #​41906
• chore(prices): sync AWS Bedrock prices: 13 models, 1 new [1 with gaps, enrichment failed: AWS Bedrock, 38 held] by @​berriai-litellm-provider-info-sync[bot] in #​42254
• chore(prices): sync OpenRouter prices: 7 models by @​berriai-litellm-provider-info-sync[bot] in #​42261
• feat(proxy): add GET /utils/model_info to look up cost map info for unregistered models by @​devin-ai-integration[bot] in #​42121
• chore(prices): sync OpenRouter prices: 4 models by @​berriai-litellm-provider-info-sync[bot] in #​42265
• feat(xai): add grok-4.7 to the cost map by @​devin-ai-integration[bot] in #​42264
• ci(e2e): fix the stage-mirror batch reds and keep a redacted pytest log by @​devin-ai-integration[bot] in #​42143
• chore(prices): sync AWS Bedrock prices: 3 models [enrichment failed: AWS Bedrock, 32 held] by @​berriai-litellm-provider-info-sync[bot] in #​42269
• chore(prices): sync OpenRouter prices: 6 models by @​berriai-litellm-provider-info-sync[bot] in #​42270
• feat(fal_ai): add gpt-image-2.5 flare/sunburst, flux/dev and image edits by @​devin-ai-integration[bot] in #​42095
• feat(bedrock): add us.moonshotai.kimi-k3 pricing and fill the global Kimi K3 entry by @​devin-ai-integration[bot] in #​42271
• test(google): boot the unified Google proxy fixture with a real master key by @​yuneng-berri in #​42120
• feat(auto-router): add JEV classifier alongside LLM classifier by @​devin-ai-integration[bot] in #​41886
• fix(proxy): park requeued spend logs in Redis so they survive a pod restart during a DB outage by @​devin-ai-integration[bot] in #​42022
• fix(bedrock): forward anthropic-beta headers verbatim on the Claude platform messages path by @​devin-ai-integration[bot] in #​42275
• chore(prices): sync AWS Bedrock prices: 4 models [enrichment failed: AWS Bedrock, 26 held] by @​berriai-litellm-provider-info-sync[bot] in #​42279
• chore(prices): sync OpenRouter prices: 3 models by @​berriai-litellm-provider-info-sync[bot] in #​42280
• fix(azure_ai): bridge gpt-5.4+ function tools with reasoning to the Foundry Responses API by @​devin-ai-integration[bot] in #​42041
• fix: apply configured cache_control_injection_points beside client cache_control marks by @​devin-ai-integration[bot] in #​41956
• fix(token_counter): count replayed redacted_thinking blocks so prompt_caching keeps pinning by @​devin-ai-integration[bot] in #​42069
• fix(mcp): paginate prompt and resource discovery by @​devin-ai-integration[bot] in #​39189
• chore(prices): sync AWS Bedrock prices: 3 models [enrichment failed: AWS Bedrock, 18 held] by @​berriai-litellm-provider-info-sync[bot] in #​42290
• chore(prices): sync OpenRouter prices: 1 model by @​berriai-litellm-provider-info-sync[bot] in #​42289
• fix(router): keep prompt caching affinity when the breakpoint moves by @​devin-ai-integration[bot] in #​42080
• feat(ui): show prompt caching requests and net savings by @​tin-berri in #​42055
• feat(bedrock_mantle): serve /v1/messages for Claude models on Mantle's native Anthropic Messages API by @​devin-ai-integration[bot] in #​42049
• feat(policy_engine): add default fallback policy attachments by @​devin-ai-integration[bot] in #​42119
• fix(mcp): handle split UTF-8 routing previews by @​devin-ai-integration[bot] in #​34919
• fix(bedrock): send s3BucketOwner on batch input and output data config by @​devin-ai-integration[bot] in #​42262
• feat(rust): scaffold cache foundation for Python parity by @​devin-ai-integration[bot] in #​42196
• fix(fal_ai): price images from the dimensions fal returns by @​devin-ai-integration[bot] in #​42282
• chore(prices): sync AWS Bedrock prices: 1 model [enrichment failed: AWS Bedrock, 16 held] by @​berriai-litellm-provider-info-sync[bot] in #​42298
• chore(prices): sync OpenRouter prices: 1 model by @​berriai-litellm-provider-info-sync[bot] in #​42297
• feat(fal_ai): add MiniMax H3 text-to-video and reference-to-video by @​devin-ai-integration[bot] in #​42286
• fix(ci): let the install smoke test boot its key-less proxy config by @​devin-ai-integration[bot] in #​42296
• fix: rename the mainland China brand to Qianwen AI Platform by @​devin-ai-integration[bot] in #​42284
• test(integration): endpoint, breakdown component and failure support in the cost harness by @​devin-ai-integration[bot] in #​41999
• test(integration): embeddings, rerank, completions and moderations cost cases by @​devin-ai-integration[bot] in #​42020
• chore(prices): sync OpenRouter prices: 4 models, 3 new by @​berriai-litellm-provider-info-sync[bot] in #​42305
• test(integration): audio, image and per-unit cost cases by @​devin-ai-integration[bot] in #​42024
• feat(ui): add upgrade banner with latest release changelog stats by @​kerry-berri in #​40429
• fix(fal_ai): surface fal errors in video status and content instead of completed and generic 500 by @​devin-ai-integration[bot] in #​42306
• test(integration): passthrough route cost cases by @​devin-ai-integration[bot] in #​42028
• fix(proxy): detach stored credential when model editor selects None by @​devin-ai-integration[bot] in #​42291
• fix(proxy): renew budget reservation counter TTL while the request is in flight by @​devin-ai-integration[bot] in #​40322
• chore(prices): sync OpenRouter prices: 1 model by @​berriai-litellm-provider-info-sync[bot] in #​42320
• test(integration): pricing dimension and provider reported cost cases by @​devin-ai-integration[bot] in #​42035
• fix(anthropic): forward Claude Code safeguards and dangerous-tool-use beta to Bedrock Invoke and Vertex on /v1/messages by @​devin-ai-integration[bot] in #​42288
• feat(edenai): add Eden AI provider across chat, Responses, Messages, embeddings, audio, images and video by @​hMED22 in #​41101
• feat(rust-cache): serve RedisClusterCache natively as a Redis topology by @​devin-ai-integration[bot] in #​42317
• test(integration): provider wire cost cases by @​devin-ai-integration[bot] in #​42052
• test(e2e): replace custom endpoints_client with provider SDK clients by @​mateo-berri in #​34358
• fix(mcp): keep oauth scopes in admin api credential redaction by @​devin-ai-integration[bot] in #​39805
• fix(otel v2): map OCR page markdown onto the generation output by @​devin-ai-integration[bot] in #​42267
• test(integration): proxy behaviour cost cases by @​devin-ai-integration[bot] in #​42060
• chore(prices): sync OpenRouter prices: 1 model by @​berriai-litellm-provider-info-sync[bot] in #​42333
• test(integration): batch and realtime cost cases by @​devin-ai-integration[bot] in #​42066
• fix(proxy): keep config-defined deployments when a config read returns no model_list by @​devin-ai-integration[bot] in #​41505
• feat(rust): add CyberArk Conjur secret manager backend by @​devin-ai-integration[bot] in #​42303
• fix(rust): preserve Python settings semantics at the native boundary by @​devin-ai-integration[bot] in #​42300
• fix(alerting): deliver every distinct alert queued in one flush window by @​devin-ai-integration[bot] in #​42314
• fix(bedrock): keep batch S3 credentials out of chat requests and debug logs by @​devin-ai-integration[bot] in #​42312
• fix(proxy): evict the cached user row when SCIM or /user/delete removes a user by @​devin-ai-integration[bot] in #​42315
• fix(auth): fail closed when the team membership lookup hits a db outage by @​devin-ai-integration[bot] in #​42036
• test(migrations): cover the release-to-release upgrade path by @​yuneng-berri in #​42294
• feat(rust): add Azure Key Vault secret manager backend by @​devin-ai-integration[bot] in #​42309
• feat(rust): native Azure Blob response cache backend by @​devin-ai-integration[bot] in #​42321
• chore(prices): sync AWS Bedrock prices: 6 models [enrichment failed: AWS Bedrock, 4 held] by @​berriai-litellm-provider-info-sync[bot] in #​42338
• chore(prices): sync OpenRouter prices: 3 models by @​berriai-litellm-provider-info-sync[bot] in #​42337
• refactor(types): remove 1,173 Any errors across 169 backend files by @​mateo-berri in #​40251
• fix(responses): stream one lifecycle across MCP auto-execute rounds by @​Atharva-Kanherkar in #​40121
• fix(responses): stop agentic follow-up from passing request params twice by @​chopratejas in #​41560
• fix(streaming): keep an explicit provider prompt_tokens=0 or completion_tokens=0 in streamed usage by @​devin-ai-integration[bot] in #​42323
• fix(router): walk every entry of a fallback list after a mid-stream failure by @​devin-ai-integration[bot] in #​42283
• refactor(mcp): extract explicit operation context and dispatch by @​joshua-berri in #​42292
• test: fix stale budget-status and bad-database-url assertions by @​yuneng-berri in #​42339
• chore(prices): sync OpenRouter prices: 3 models by @​berriai-litellm-provider-info-sync[bot] in #​42349
• fix(responses): patch custom_tool_call_output in place on guardrail write-back by @​chopratejas in #​41561
• feat(rust): add native disk cache backend by @​devin-ai-integration[bot] in #​42311
• feat(auth): breached password detection, self-service change-password and forced password reset by @​devin-ai-integration[bot] in #​42278
• feat(docker): add a quickstart compose file served from the product repo by @​yuneng-berri in #​42326
• fix(xai): accept max_completion_tokens as a supported param by @​devin-ai-integration[bot] in #​42353
• feat(rust): add native GCS object-store cache backend by @​devin-ai-integration[bot] in #​42325
• feat(rust): add HashiCorp Vault secret manager crate by @​devin-ai-integration[bot] in #​42308
• fix(proxy): apply DB-stored callback redaction settings before logger init by @​devin-ai-integration[bot] in #​42122
• fix(mcp): keep server lists stable across refreshes by @​devin-ai-integration[bot] in #​41074
• chore(prices): sync OpenRouter prices: 4 models, 3 deprecated by @​berriai-litellm-provider-info-sync[bot] in #​42357
• feat(rust): add native S3 cache backend by @​devin-ai-integration[bot] in #​42313
• feat(xiaomi_mimo): add mimo-v2.6-pro and mimo-v2.6-flash cost map rows with live e2e coverage by @​devin-ai-integration[bot] in #​42362
• fix(bedrock): add bare moonshotai.kimi-k3 cost map entry by @​devin-ai-integration[bot] in #​42363
• feat(cache): add native Valkey semantic cache backend by @​devin-ai-integration[bot] in #​42316
• fix(logging_worker): make flush() survive an event loop change by @​devin-ai-integration[bot] in #​42355
• fix(auth): let jwt team_allowed_routes paths grant auth=true passthrough by @​ryan-crabbe-berri in #​42346
• fix(rust): declare _CacheTestHandle.valkey_semantic in native stub by @​devin-ai-integration[bot] in #​42364
• chore(prices): sync OpenRouter prices: 2 models by @​berriai-litellm-provider-info-sync[bot] in #​42365
• feat(ui): add internal-user savings and auto-router usage by @​tin-berri in #​42026
• test(model_management): cover actor edges and wildcard models by @​yuneng-berri in #​41769
• feat(ui): expose remaining complexity router advanced settings by @​devin-ai-integration[bot] in #​42293
• test(ui): cover dashboard form journeys by @​yuneng-berri in #​41773
• test(router): cover legacy lowest TPM selection by @​yuneng-berri in #​41795
• feat(proxy): report the source of alerting, UI and router settings on read by @​yuneng-berri in #​41788
• fix(proxy): record aborted outcome when spend-log cleanup is cancelled at shutdown by @​yucheng-berri in #​41213
• fix(router): make context-window escalation opt-in by @​tin-berri in #​41872
• feat(cache): serve Redis Semantic caches natively in Rust by @​devin-ai-integration[bot] in #​42319
• fix(cli): preserve newer installed status lines during setup by @​tin-berri in #​42356
• chore(prices): sync OpenRouter prices: 4 models by @​berriai-litellm-provider-info-sync[bot] in #​42371
• feat(agents): attach access groups to agents and enforce them for models, MCP servers and agent calls by @​devin-ai-integration[bot] in #​41634
• fix(guardrails): run key-attached guardrails on /v1/videos by @​devin-ai-integration[bot] in #​42354
• fix(azure): propagate asyncio.CancelledError instead of raising a 500 by @​devin-ai-integration[bot] in #​42295
• test(e2e): cover chat and responses registry gaps by @​yuneng-berri in #​41794
• feat(cache): serve QdrantSemanticCache natively from Rust by @​devin-ai-integration[bot] in #​42324
• chore(prices): sync OpenRouter prices: 4 models by @​berriai-litellm-provider-info-sync[bot] in #​42377
• feat(ui): show Capability and FUSE v2 routing forecasts by @​tin-berri in #​42057
• fix(cache): keep native Redis semantic binding and Qdrant batch writes after merge by @​devin-ai-integration[bot] in #​42379
• feat(ui): add per-user breakdown to team usage export by @​devin-ai-integration[bot] in #​42367
• feat(jwt-key-mapping): accept token_id as an alternative to the plaintext key by @​Louis-Vauterin in #​39578
• fix(openrouter): remove the retired stealth/union-alpha model from the cost map by @​devin-ai-integration[bot] in #​42386
• feat(pricing): add xai grok-4.20 aliases and image token prices from /v1/language-models by @​devin-ai-integration[bot] in #​42384
• test(proxy): isolate the agent read-through singleton between unknown-agent tests by @​devin-ai-integration[bot] in #​42389
• fix(mcp): return camelCase tool keys from /v1/mcp/tools after the SDK 2 upgrade by @​devin-ai-integration[bot] in #​42352
• fix(logging): price terminal Responses stream events from their inner response by @​devin-ai-integration[bot] in #​42385
• fix(bedrock): send every Mantle beta in the anthropic-beta header on the bedrock/mantle route by @​devin-ai-integration[bot] in #​42376
• fix(bedrock): sign batch S3 requests with s3_access_key_id and s3_secret_access_key by @​devin-ai-integration[bot] in #​42342
• feat(fal_ai): add flux-lora-depth image edits and moondream3 chat completions by @​devin-ai-integration[bot] in #​42334
• feat(proxy): opt-in litellm_call_id

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.