chore(deps): update dependency litellm to v1.84.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
litellm	1.83.0 → 1.84.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

LiteLLM: Server-Side Template Injection in /prompts/test endpoint

CVE-2026-42203 / GHSA-xqmj-j6mv-4862

More information

Details

Impact

The POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process.

The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets in the process environment (such as provider API keys or database credentials) and allow commands to be run on the host.

Proxy deployments running an affected version are in scope.

Patches

The issue is fixed in 1.83.7-stable. The fix switches the prompt template renderer to a sandboxed environment that blocks the attributes this attack relies on.

LiteLLM recommends upgrading to 1.83.7-stable or later.

Workarounds

If upgrading is not immediately possible:

1. Block POST /prompts/test at your reverse proxy or API gateway.
2. Review and rotate API keys that should not have access to prompt management routes.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-xqmj-j6mv-4862
• https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
• https://nvd.nist.gov/vuln/detail/CVE-2026-42203
• https://github.com/advisories/GHSA-xqmj-j6mv-4862

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM has SQL Injection in Proxy API key verification

CVE-2026-42208 / GHSA-r75f-5x8p-qvmc

More information

Details

Impact

A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path.

An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised access to the proxy and the credentials it manages.

Patches

Fixed in 1.83.7. The caller-supplied value is now always passed to the database as a separate parameter. Upgrade to 1.83.7 or later.

Workarounds

If upgrading is not immediately possible, set disable_error_logs: true under general_settings. This removes the path through which unauthenticated input reaches the vulnerable query.

References

• Patched release: v1.83.7-stable

Discovery Credit: Tencent YunDing Security Lab

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc
• https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
• https://nvd.nist.gov/vuln/detail/CVE-2026-42208
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42208
• https://github.com/advisories/GHSA-r75f-5x8p-qvmc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: Authenticated command execution via MCP stdio test endpoints

CVE-2026-42271 / GHSA-v4p8-mg3p-g94g

More information

Details

Impact

Two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.

The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host.

Patches

Fixed in 1.83.7. Both test endpoints now require the PROXY_ADMIN role, bringing them into line with the save endpoint.

Workarounds

If upgrading is not immediately possible, developers should block POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at their reverse proxy or API gateway.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g
• https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable
• https://nvd.nist.gov/vuln/detail/CVE-2026-42271
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271
• https://github.com/advisories/GHSA-v4p8-mg3p-g94g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM has a sandbox escape in custom-code guardrail

CVE-2026-40217 / GHSA-wxxx-gvqv-xp7p

More information

Details

Impact

The POST /guardrails/test_custom_code endpoint runs user-supplied Python inside a hand-rolled sandbox. The sandbox can be escaped using bytecode-level techniques, allowing arbitrary code execution in the proxy process — which runs as root in the default Docker image.

Reaching the endpoint requires a proxy-admin credential in default configurations.

Patches

Fixed in 1.83.11. The hand-rolled sandbox has been replaced with RestrictedPython. Upgrade to 1.83.11 or later.

Workarounds

If upgrading is not immediately possible, block POST /guardrails/test_custom_code at your reverse proxy or API gateway.

References

• Patched release: v1.83.10-stable

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-wxxx-gvqv-xp7p
• https://nvd.nist.gov/vuln/detail/CVE-2026-40217
• https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable
• https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm
• https://github.com/advisories/GHSA-wxxx-gvqv-xp7p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM: Authentication Bypass via Host Header Injection

CVE-2026-49468 / GHSA-4xpc-pv4p-pm3w

More information

Details

Impact

A Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes.

The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched.

Most deployments are not affected. The bypass is blocked by any upstream layer that validates or normalizes Host, such as:

• a CDN or WAF, such as Cloudflare
• a reverse proxy with server_name allowlists
• a host-based load balancer

LiteLLM Cloud customers are not affected.

Patches

Fixed in 1.84.0. Upgrade to 1.84.0 or later. No configuration change is required.

Workarounds

If upgrading is not immediately possible, place the proxy behind an upstream component that validates or normalizes the Host header before forwarding (a CDN/WAF, a reverse proxy with explicit server_name allowlists, or a cloud load balancer with host-based routing rules), or otherwise restrict network access to the proxy listener.

References

• Patched release: v1.84.0

Discovery Credit: Le The Thang (KCSC) and Kim Ngoc Chung (One Mount Group)

Severity

• CVSS Score: 9.5 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

• https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w
• https://github.com/BerriAI/litellm/releases/tag/v1.84.0
• https://github.com/advisories/GHSA-4xpc-pv4p-pm3w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit

CVE-2026-47101 / GHSA-qrc4-49gv-mv9m

More information

Details

LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-47101
• https://github.com/BerriAI/litellm/commit/2220f3076ac89bd2a2e3439acf57dcfbec2434c9
• https://github.com/BerriAI/litellm/commit/5190bd07eb23a037745d86328096f54378f1614a
• https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c
• https://gist.github.com/13ph03nix/9ec616e1fdc77b3673509c60206e827f
• https://github.com/BerriAI/litellm/releases/tag/v1.83.14-stable
• https://huntr.com/bounties/8e75edfb-ff05-4e63-bfca-2d93d03fb3b9
• https://www.vulncheck.com/advisories/litellm-privilege-escalation-via-api-key-generation
• https://www.obsidiansecurity.com/blog/litellm-privilege-escalation-rce
• https://github.com/advisories/GHSA-qrc4-49gv-mv9m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

LiteLLM allows a user to modify their own user_role via the /user/update endpoint

CVE-2026-47102 / GHSA-wpfp-gwwc-vwq6

More information

Details

LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this endpoint can set their role to proxy_admin, gaining full administrative access to LiteLLM including all users, teams, keys, models, and prompt history. Users with the org_admin role have legitimate access to this endpoint and can exploit this vulnerability without chaining any additional flaw.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-47102
• https://github.com/BerriAI/litellm/pull/25541
• https://github.com/BerriAI/litellm/commit/128d32d2494b759c5d15da3452452af4c6a34c01
• https://github.com/BerriAI/litellm/commit/e6f18ce75b111c9b93dc15c72894cbdeb53177ce
• https://gist.github.com/13ph03nix/9ec616e1fdc77b3673509c60206e827f
• https://github.com/BerriAI/litellm/releases/tag/v1.83.10-stable
• https://huntr.com/bounties/8e75edfb-ff05-4e63-bfca-2d93d03fb3b9
• https://www.vulncheck.com/advisories/litellm-privilege-escalation-via-user-update
• https://www.obsidiansecurity.com/blog/litellm-privilege-escalation-rce
• https://github.com/advisories/GHSA-wpfp-gwwc-vwq6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

BerriAI/litellm (litellm)

v1.84.0

⚠️ Heads up — this release contains breaking changes.
Read the full release notes here: v1.84.0 release notes

---

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.84.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.84.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.84.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• merge main by @​Sameerlite in #​25521
• merge litellm_internal_staging by @​Sameerlite in #​25949
• merge main by @​Sameerlite in #​26304
• merge main by @​Sameerlite in #​26379
• merge main by @​Sameerlite in #​26437
• fix(redis): cache GCP IAM token to prevent async event loop blocking by @​harish-berri in #​26441
• litellm oss branch by @​krrish-berri-2 in #​26386
• fix noma v2 deepcopy crashing in build scan payload - new PR by @​omriShukrun08 in #​26605
• fix(ui): use stored-credentials endpoint for tools fetch on MCP edit page by @​ryan-crabbe-berri in #​26002
• feat(proxy): add --timeout_worker_healthcheck flag for uvicorn worker triage by @​ryan-crabbe-berri in #​26622
• fix(ci): support CircleCI rerun failed tests for local_testing jobs by @​mateo-berri in #​26461
• docs: update pull_request_template to add Linear ticket mentioning by @​mateo-berri in #​26655
• fix(pricing): GPT-5.5 Pro Pricing by @​lmcdonald-godaddy in #​26651
• feat(proxy): Add cleanup job for expired LiteLLM dashboard session keys by @​milan-berri in #​26460
• fix(ui): move 'Store Prompts in Spend Logs' toggle to Admin Settings by @​ryan-crabbe-berri in #​26631
• fix(caching): preserve prompt_tokens_details through embedding cache round-trip by @​michelligabriele in #​26653
• feat(logging): add retry settings for generic API logger by @​milan-berri in #​26645
• fix(logging): backfill streaming hidden response cost by @​milan-berri in #​26606
• fix(vertex-ai): reuse anthropic messages config instances by @​Sameerlite in #​26099
• fix(vertex): preserve items on array branches in anyOf with null + de-flake test by @​yuneng-berri in #​26675
• fix(tests): replace deprecated Bedrock Claude 3.7 Sonnet model ID by @​ryan-crabbe-berri in #​26721
• [Fix] Cache LiteLLM_Config param reads in DualCache and batch by @​Michael-RZ-Berri in #​26469
• [Feat] Lazy-load optional feature routers on first request by @​Michael-RZ-Berri in #​26534
• [Fix] Unify cost calc in success_handler dict and typed branches by @​Michael-RZ-Berri in #​26629
• Revert "[Feat] Lazy-load optional feature routers on first request" by @​krrish-berri-2 in #​26727
• [Infra] Version Bump by @​yuneng-berri in #​26728
• [Infra] Promote Internal Staging to main by @​yuneng-berri in #​26731
• ci(release): accept PEP 440 tag forms in create-release workflow by @​yuneng-berri in #​26734
• [Feat] Add gpt-image-2 support (#​26644) by @​ishaan-berri in #​26705
• feat(provider): add AIHubMix as an OpenAI-compatible provider by @​xinrui-z in #​24294
• merge internal staging by @​Sameerlite in #​26737
• merge main by @​Sameerlite in #​26742
• merge mian by @​Sameerlite in #​26745
• fix(test): scope ERROR log assertion to LiteLLM logger in test_model_alias_map by @​mateo-berri in #​26741
• merge main by @​Sameerlite in #​26757
• fix(bedrock, anthropic): translate OpenAI file content on tool-result path by @​minznerjosh in #​26710
• remove /ui/chat page by @​ishaan-berri in #​26739
• fix: add optional TCP SO_KEEPALIVE support to aiohttp's TCPConnector by @​yassinkortam in #​26730
• feat(proxy): LiteLLM headers on Google native generateContent routes by @​Sameerlite in #​25500
• feat(vector-stores): support Bedrock retrievalConfiguration passthrough by @​Sameerlite in #​26685
• feat(mcp): opt-in short-ID tool prefix to keep MCP tool names under the 60-char limit by @​mateo-berri in #​26733
• fix(proxy): self-heal Prisma read paths + harden reconnect state machine by @​yuneng-berri in #​26756
• [Fix] Redact spend logs error message by @​Michael-RZ-Berri in #​26662
• [Feat]Add support for azure entra discovery endpoint by @​Sameerlite in #​26584
• [Fix] Proxy: reconnect Prisma DB without blocking the event loop by @​yuneng-berri in #​26225
• feat(proxy): durable agent workflow run tracking via /v1/workflows/runs by @​ishaan-berri in #​26793
• chore(auth): tighten clientside api_base handling by @​stuxf in #​26518
• fix: drop sensitive locals from re-raised error messages by @​ryan-crabbe-berri in #​26823
• test(vertex-batches): set is_redirect=False on mocked retrieve response by @​yuneng-berri in #​26844
• chore(vector-stores): redact credentials in list/info/update responses; gate update by per-store access by @​stuxf in #​26489
• chore(auth): substitute alias for master key on UserAPIKeyAuth by @​stuxf in #​26484
• fix(mcp): tighten public-route detection and OAuth2 fallback gating by @​stuxf in #​26463
• [Fix] Team member null budget fallback by @​Michael-RZ-Berri in #​26809
• fix(proxy): inherit caller identity in passthrough batch managed-object by @​ryan-crabbe-berri in #​26831
• fix(proxy/auth): tighten guardrail modification permission check by @​ryan-crabbe-berri in #​26821
• [Fix] CI/Tooling: Correct min-release-age value in .npmrc files by @​yuneng-berri in #​26850
• fix(bedrock): add 1-hour cache write pricing for Claude 4.5/4.6/4.7 (Global, US) by @​mateo-berri in #​26800
• feat(proxy): add team-level search provider credentials by @​Sameerlite in #​26691
• Litellm oss staging by @​Sameerlite in #​26759
• fix(proxy/batches): forward model to retrieve_batch for bedrock by @​sruthi-sixt-26 in #​26814
• fix(passthrough): track spend for interrupted Bedrock streams by @​mateo-berri in #​26719
• merge main by @​Sameerlite in #​26855
• Litellm oss staging by @​Sameerlite in #​26852
• chore(team): audit-log team-callback admin mutations by @​stuxf in #​26859
• chore(team): close authz bypass via the available-team check by @​stuxf in #​26854
• chore(auth): harden invite-link onboarding token flow by @​stuxf in #​26843
• chore(mcp): tighten OAuth root endpoint resolution by @​stuxf in #​26840
• fix: validate aws region name by @​yassin-berriai in #​26906
• fix: drop milvus dbName and partitionNames from MILVUS_OPTIONAL_PARAMS by @​yassin-berriai in #​26910
• [Feat / Fix] Lazy loaded imports, lazy loaded front page by @​Michael-RZ-Berri in #​26802
• chore(proxy): harden request control fields by @​stuxf in #​26862
• chore(proxy): block env callback refs in key metadata by @​stuxf in #​26851
• chore(mcp): encrypt user-scoped MCP credentials at rest by @​stuxf in #​26836
• chore(mcp): SSRF guard on OAuth metadata discovery follow-up fetches by @​stuxf in #​26849
• [Fix] Replace subprocess startup-import diff with static source scan by @​Michael-RZ-Berri in #​26934
• chore(passthrough): default auth=True and drop enterprise gate on the safe option by @​stuxf in #​26827
• chore(proxy): contain UI_LOGO_PATH / LITELLM_FAVICON_URL on unauthenticated asset endpoints by @​stuxf in #​26815
• chore(cli): tighten CLI SSO session flow by @​stuxf in #​26835
• [Test] Proxy E2E: Opt In To Client Mock Response For Model Access Tests by @​yuneng-berri in #​26941
• [Fix] Responses API: Omit Empty Body On DELETE by @​yuneng-berri in #​26949
• Run pre_call_hook on Google generateContent endpoints by @​Michael-RZ-Berri in #​26914
• [Fix] Refresh Redis TTL on counter writes, skip stale in-memory in Redis by @​Michael-RZ-Berri in #​26829
• Add pagination controls to model health status by @​shivamrawat1 in #​26826
• feat(vertex_ai): propagate metadata labels to embedding, Imagen, rerank by @​Sameerlite in #​25499
• fix(anthropic): json response_format + user tools non-streaming by @​Sameerlite in #​26222
• [Infra] Bump Versions by @​yuneng-berri in #​26961
• [Infra] Promote Internal Staging to main by @​yuneng-berri in #​26962
• [Infra] Promote internal staging to main by @​yuneng-berri in #​27245
• fix(proxy): point /metrics 401 at the opt-out flag by @​yuneng-berri in #​27505
• fix(proxy): bound budget reservation per request (backport of #​27509 to 1.84.0rc2) by @​yuneng-berri in #​27539
• build(packaging): relax core runtime pins to ranges (rc2 backport of #​27241) by @​yuneng-berri in #​27545
• build(packaging): raise jinja2 floor to 3.1.6 (rc2 backport of #​27552) by @​yuneng-berri in #​27554
• cherry-pick: OpenAPI MCP extra_headers (#​27383) onto litellm_1.84.0rc2 by @​milan-berri in #​27768
• fix(proxy): always merge caller-supplied tags into request metadata by @​yuneng-berri in #​27789
• cherry-pick: reject bare str at file-input sinks (#​27762) onto litellm_1.84.0rc2 by @​yuneng-berri in #​27794
• [Fix] Lazy feature loading under SERVER_ROOT_PATH returns 404 (backport of #​27812) by @​yuneng-berri in #​27818
• [Fix] Backport /key/regenerate ownership-rebind + premium-gate guards (#​27793) by @​yuneng-berri in #​27819
• fix(proxy): expose db status on public /health/readiness (backport #​27866) by @​yuneng-berri in #​27868
• fix(ui): fetch version + debug flag from /health/readiness/details (backport #​27896) by @​yuneng-berri in #​27899
• [Infra] Build UI by @​yuneng-berri in #​27901
• chore(proxy): backport #​27898 + #​27801 to 1.84.0rc2 by @​yuneng-berri in #​27902
• fix: backport #​27892 to litellm_1.84.0rc2 by @​yuneng-berri in #​27903
• fix: backport #​27878 to litellm_1.84.0rc2 by @​yuneng-berri in #​27904
• chore: backport #​27908 to litellm_1.84.0rc2 by @​yuneng-berri in #​27909

New Contributors

• @​omriShukrun08 made their first contribution in #​26605
• @​xinrui-z made their first contribution in #​24294
• @​minznerjosh made their first contribution in #​26710
• @​yassinkortam made their first contribution in #​26730
• @​sruthi-sixt-26 made their first contribution in #​26814

Full Changelog: BerriAI/litellm@v1.83.14-stable.patch.3...v1.84.0

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

For team members: test commit e3ca177 in internal GitLab

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unittests	97.38% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

For team members: test commit e3ca177 in internal GitLab

[github-actions]

For team members: test commit 8ed886d in internal GitLab

[github-actions]

For team members: test commit 3e2e194 in internal GitLab

[github-actions]

For team members: test commit d21bbcf in internal GitLab

[owtaylor]

This got updated to renovate to an upgrade to 1.85. 1.85 is noisy unless you have botocore installed (and unnecessarily slow to import if you do)

BerriAI/litellm#28175

While the warnings are harmless, I think we'll hold off on this for a bit - the security issues are not relevant to us.