chore(deps): bump litellm from 1.95.0 to 1.96.2

[dependabot]

Bumps litellm from 1.95.0 to 1.96.2.

Release notes

Sourced from litellm's releases.

v1.96.2

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.96.2

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.96.2/cosign.pub \
  ghcr.io/berriai/litellm:v1.96.2

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• chore(release): backport proxy request-handling maintenance and refresh runtime deps for 1.96.1 by @​yuneng-berri in BerriAI/litellm#36494
• bump: version 1.96.1 → 1.96.2 (1.96.1 burned by the PyPI storage failure) by @​yuneng-berri in BerriAI/litellm#36570

Full Changelog: BerriAI/litellm@v1.96.0...v1.96.2

v1.96.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

... (truncated)

Commits

• 83d6d84 Merge pull request #36570 from BerriAI/litellm_bump_version_1_96_2
• 1f4685e chore: refresh uv.lock for 1.96.2
• 256c496 bump: version 1.96.1 → 1.96.2
• af094fa Merge pull request #36494 from BerriAI/litellm_backport_1_96_x_bp196
• dc6d1d8 chore: refresh uv.lock for 1.96.1
• 3605e38 bump: version 1.96.0 → 1.96.1
• 697fac9 chore(deps): drop the pypdf scanner exceptions cleared by 6.15.0
• 48d572b chore(deps): bump pypdf to 6.15.0
• 820f247 Merge pull request #36011 from BerriAI/litellm_maint_batch_2026_07
• 8843766 Merge pull request #36320 from BerriAI/litellm_/litellm-1-96-0-release-ui-48fbeb
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[overcut-ai]

Completed Working on "Code Review"

✅ Code review complete. No issues found - all changes look good! ✅

✅ Workflow completed successfully.

---

👉 View complete log

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/litellm	1.96.2	Unknown	Unknown

Scanned Files

• uv.lock

[Naseem77]

Superseded by #711, which combines the passing Dependabot updates into one PR.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[overcut-ai]

Completed Working on "Code Review"

✅ Review publishing complete. Review submitted: COMMENT. Total comments: 1 across 1 files.

✅ Workflow completed successfully.

---

👉 View complete log

[railway-app]

🚅 Deployed to the QueryWeaver-pr-698 environment in queryweaver

Service	Status	Web	Updated (UTC)
QueryWeaver	✅ Success (View Logs)	Web	Aug 17, 2026 at 8:45 am

[overcut-ai]

Review Summary

Findings by severity:

• BLOCKER: 0
• CRITICAL: 0
• MAJOR: 0
• MINOR: 1
• SUGGESTION: 0
• PRAISE: 0

Key theme:

• Dependency upgrade introduces a new transitive configuration-related package (pydantic-settings) without corresponding validation coverage in this PR.

Actionable next steps:

1. Add or run a targeted integration test for LiteLLM initialization using production-like environment variable sets.
2. Include unset/partial env-var scenarios to ensure configuration parsing and startup behavior remain stable after the upgrade.
3. Confirm test pass results in CI before merge.

[overcut-ai]

[minor]: The litellm lock entry now adds pydantic-settings, which can change environment-driven configuration resolution paths at runtime. There are no corresponding changes in this PR to validate QueryWeaver’s litellm integration under expected env var combinations, so this dependency bump carries unverified config behavior risk.

Add/execute a targeted integration test that initializes the litellm client with the project’s production-like environment variables (including unset/partial cases) to verify no regression in startup/config parsing after 1.96.2.

[Naseem77]

Dependency update checks are passing.