LiteLLM 1.96

Apply the Python 3 prompt first. These rules cover the Python SDK and proxy gateway in LiteLLM 1.96.2, including virtual keys, administrative APIs, MCP, guardrails, routing, budgets, logging, and shared state.

Version and runtime scope

• On LiteLLM 1.96.0 through 1.96.2, which predate the 1.100.4 fix for GHSA-7hp6-4w63-5g45, set EXPERIMENTAL_UI_LOGIN=false explicitly on every proxy replica as containment for the affected login path. Leaving it unset does not disable that path. This also disables CLI SSO and gateway logins; restrict internal_user keys and operator routes while moving off this unsupported line.
• On 1.96.0, which predates the 1.96.2 fix for request-body routing and provider-credential exfiltration, the proxy's own request checks miss some top-level and all nested routing fields, so any authenticated caller can redirect a provider call and capture the proxy's stored provider credentials: block api_base, base_url, model_list, fallbacks, and provider credential fields, nested copies included, at a reverse proxy or API gateway in front of LiteLLM, and issue proxy keys only to trusted callers.
• PyPI has no LiteLLM 1.96.1, because a PyPI storage failure burned that number; don't write it into a requirement or lock file, and treat a 1.96.1 offered by any other package index as suspect.
• Run the 1.96 line on CPython 3.10 through 3.14, matching the >=3.10,<3.15 requirement the release declares.
• Treat 1.96 as outside LiteLLM's four-most-recent-stable-lines support window; migrate production deployments to a supported stable line instead of