LiteLLM 1.99

Apply the Python 3 prompt first. These rules cover the LiteLLM 1.99 Python SDK and proxy gateway. Apply proxy settings only when traffic actually traverses the proxy; direct completion(), acompletion(), and Router calls need their own application authorization and policy enforcement.

Version and runtime scope

• Deploy the proxy from the newest container image on this line, verified and pinned by digest, and lock PyPI installations separately in the lock file. LiteLLM ships some patches on a line only as container images, and its release notes and PyPI don't always agree on which artifacts exist, so check both for the release you deploy instead of assuming a PyPI install carries an image's fixes.
• On LiteLLM 1.99.0 through 1.99.4, which predate the 1.100.4 fix for GHSA-7hp6-4w63-5g45, set EXPERIMENTAL_UI_LOGIN=false explicitly on every proxy replica as containment for the affected authentication path, and limit who holds internal_user keys. Leaving it unset keeps that path enabled. This also disables CLI SSO and gateway logins; plan the move to a supported fixed line rather than treating containment as a complete repair.
• Choose a security-supported CPython minor compatible with the deployed integrations. Within the declared >=3.10,<3.15 range, use 3.11–3.14: 3.10 is end of life, and the package constraint excludes 3.15. Package installation compatibility is not interpreter security support. Lock the actual SDK dependencies and extras separately; a PyPI installation does not inherit the container's patched uv.lock resolutions.
• Verify the published