chore(deps): bump berriai/litellm from v1.84.4 to v1.101.0

[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps berriai/litellm from v1.84.4 to v1.101.0.

Release notes

Sourced from berriai/litellm's releases.

v1.101.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.101.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.101.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.101.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• fix(proxy): emit timing headers and overhead for /v1/messages and /v1/responses by @​yucheng-berri in BerriAI/litellm#38840
• fix(tests): derive the no-cache-read-rate savings baseline from the model map by @​tin-berri in BerriAI/litellm#38863
• chore(typing): clear Any seams across 47 files, ratchet basedpyright ceilings -3,302 by @​mateo-berri in BerriAI/litellm#37778
• chore(typing): clear 1.2k basedpyright Any errors across 16 hotspot files by @​mateo-berri in BerriAI/litellm#36722
• feat(bedrock): honor streaming buffer/sampling config for unbuffered post_call scans by @​mateo-berri in BerriAI/litellm#38722
• feat(cli): set ENABLE_TOOL_SEARCH=true for lite claude by @​mateo-berri in BerriAI/litellm#38942
• fix(proxy): deliver budget alerts on webhook-only alerting and accept ALERTING_WEBHOOK_URL by @​devin-ai-integration[bot] in BerriAI/litellm#38441
• docs(claude.md): require tests to check behavior, not code structure by @​ryan-crabbe-berri in BerriAI/litellm#38772
• chore(newrelic): cover static default_team_settings per-team routing by @​yucheng-berri in BerriAI/litellm#38857
• fix: update stale source URLs and deprecation dates in model cost map by @​devin-ai-integration[bot] in BerriAI/litellm#38801
• feat(ci): close duplicate issues after a 3-day grace period by @​mubashir1osmani in BerriAI/litellm#38381
• docs(proxy): clarify spend semantics on /v2/user/info and /user/daily/activity by @​devin-ai-integration[bot] in BerriAI/litellm#38883
• fix(guardrails): configure Prompt Security file timeout policy by @​davida-ps in BerriAI/litellm#38083
• fix(bedrock): stop duplicating Converse config blocks inside inferenceConfig by @​mateo-berri in BerriAI/litellm#38993
• fix(guardrails): exclude images from HiddenLayer v1 scans by @​Ashton-Sidhu in BerriAI/litellm#29210

... (truncated)

Commits

• 18243cd Merge pull request #40886 from BerriAI/litellm_backport_redis_chaos_rc_1_101_0
• abfb2cf test(load): backport Redis chaos qualification to rc/1.101.0 (#40482)
• c1a834b fix(caching): backport Redis breaker recovery guards to rc/1.101.0 (#40624)
• ca4a613 fix(redis): backport quiet breaker refusals to rc/1.101.0 (#40620)
• c324a2b perf(proxy): backport pipelined spend counters to rc/1.101.0 (#40371)
• 912a3f8 Merge pull request #40346 from BerriAI/litellm_backport_40335_rc_1_101_0
• bcddffc fix(otel): backport auth spans and callback merge to rc/1.101.0
• f0b6d66 Merge pull request #40325 from BerriAI/litellm_backport_37667_rc_1_101_0
• f41fc71 Merge pull request #40324 from BerriAI/litellm_backport_40312_rc_1_101_0
• b6e73cc feat(team): backport team admin callbacks to rc/1.101.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[subpath]

@noahpodgurski @FieldMarshallObvious @ti3x This is actually pretty cool!
The CI caught a regression 🎉

In v1.84.4: TPM enforcement only tracks actual accumulated usage after each call. A call is admitted as long as current usage hasn't crossed the limit yet. So basically if we have TPM 100 and a call have 200 tokens in the current version it will be allowed but next call will be blocked for the remaining of the minute.

In the new v1.101.0: they've added a pre-flight check that compares the requested max_tokens against remaining quota, before any usage happens. If max_tokens alone exceeds the limit, it's rejected immediately: the 200 Tokens call will be rejected with TPM 100

WDYT? We could modify the test and accept that new behavior