chore(release): backport five staged fixes into stable/1.87.x and cut 1.87.1

[mateo-berri]

Relevant issues

Backports five fixes that already merged on litellm_internal_staging but never reached the 1.87.x line. Each one is cherry-picked from the squashed commit that landed for its PR. This closes that gap and cuts 1.87.1

Linear ticket

N/A

What is included

Cherry-picked in merge order:

• fix(azure): preserve AD token refresh in v1 OpenAI client path #28627 fix(azure): preserve AD token refresh in the v1 OpenAI client path
• fix(proxy): map stripped batch body.model to proxy alias for auth #29264 fix(proxy): map a stripped batch body.model back to the proxy alias so key access checks pass
• fix(proxy): resolve managed video model ids for auth #29545 fix(proxy): resolve managed video model ids through the router before auth, budget, and key checks
• fix(key_generate): allow team members to create keys on org-scoped teams #29310 fix(key_generate): let team members create keys on org-scoped teams (regression since v1.84.0-rc.1)
• fix(vertex): strip output_config.effort for Vertex Claude models that reject it (Haiku 4.5) #29585 fix(vertex): strip output_config.effort for Vertex Claude models that reject it, such as Haiku 4.5

The last two commits are the version bump (1.87.0 to 1.87.1) and the matching uv.lock refresh

#29598 (passthrough duplicate logs) is deliberately excluded from this line. The fix works by setting the logging object stream flag so the streaming dedup guard fires, but that guard (has_dispatched_final_stream_success and _is_assembled_stream_success in litellm_logging.py) does not exist on 1.87.x, which branched separately from 1.86.x and carries a different passthrough logging path. Cherry-picking it here would be a no-op at best, so it is held back rather than applied blindly. The other four lines that do carry the guard (1.84.x, 1.85.x, 1.86.x, and the 1.88 rc) receive it

Pre-Submission checklist

• The cherry-picked PRs each carry their own tests
• My PR passes all unit tests on make test-unit
• Scope is limited to backporting already-merged fixes plus the release bump
• Greptile review requested

CI (LiteLLM team)

• Branch creation CI run
  Link:
• CI run for the last commit
  Link:
• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

These are backports of changes already merged, released, and validated on other lines; each linked PR carries its own proof and review

Type

Bug Fix
Infrastructure

Changes

See the commit list above. No new code beyond the cherry-picks, the version bump, and the lockfile refresh

[codecov]

Codecov Report

❌ Patch coverage is 28.26087% with 33 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
litellm/proxy/auth/auth_utils.py	10.00%	9 Missing ⚠️
...ai_partner_models/anthropic/output_params_utils.py	20.00%	8 Missing ⚠️
litellm/llms/azure/common_utils.py	56.25%	7 Missing ⚠️
litellm/proxy/hooks/batch_rate_limiter.py	0.00%	5 Missing ⚠️
...y/management_endpoints/key_management_endpoints.py	0.00%	2 Missing ⚠️
...rtex_ai_partner_models/anthropic/transformation.py	0.00%	1 Missing ⚠️
litellm/proxy/spend_tracking/budget_reservation.py	50.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[greptile-apps]

Greptile Summary

This release backport cherry-picks five targeted bug fixes from litellm_internal_staging into the stable/1.87.x line and cuts version 1.87.1. All five fixes have already been validated upstream and each carries its own tests.

• Azure (fix(azure): preserve AD token refresh in v1 OpenAI client path #28627): Preserves AD token refresh on the v1 OpenAI client path by passing azure_ad_token_provider (or azure_ad_token) as api_key; async provider is wrapped in asyncio.to_thread to avoid blocking the event loop. Cache-key derivation is updated to produce a stable, serializable string for callables instead of relying on the raw function repr.
• Proxy batch auth (fix(proxy): map stripped batch body.model to proxy alias for auth #29264): Maps the stripped body.model field (a provider ID after replace_model_in_jsonl) back to the proxy model_name via the router before can_key_call_model runs, fixing false-deny errors for batch requests.
• Managed video model auth (fix(proxy): resolve managed video model ids for auth #29545): Threads llm_router through the managed-resource-ID extraction chain so video model IDs are resolved to proxy aliases before auth, budget, and key checks.
• Key generation regression (fix(key_generate): allow team members to create keys on org-scoped teams #29310): Skips the org-membership validation when data.organization_id was inherited from the caller's team, unblocking team members from creating keys on org-scoped teams.
• Vertex Haiku effort param (fix(vertex): strip output_config.effort for Vertex Claude models that reject it (Haiku 4.5) #29585): Drops output_config.effort for Vertex Claude models that advertise no effort-level support (e.g. Haiku 4.5) while forwarding it for those that do (Opus/Sonnet 4.6+); gating delegates to AnthropicConfig._model_supports_effort_param which reads the model cost map rather than hardcoding model names.

Confidence Score: 4/5

All five cherry-picks are narrow, well-tested fixes with no structural changes; safe to merge as a patch release.

Each fix is a direct backport of an already-validated change. The auth and key-generation paths are touched, but the scope is limited — passing a router reference through existing call chains, and adding a single bypass condition tightly gated by team membership. Tests cover the happy path, the no-team case, and the mismatched-team-org case. The org-membership bypass in key_management_endpoints.py is logically sound and well-covered, sitting in a security-sensitive path but with no failing invariants found.

litellm/proxy/management_endpoints/key_management_endpoints.py — the new org-membership bypass; litellm/llms/azure/common_utils.py — the AD token provider cache-key construction and async wrapping.

Important Files Changed

Filename	Overview
litellm/llms/azure/common_utils.py	Preserves AD token refresh for v1 OpenAI client path; adds stable cache-key derivation for callables and hashes sensitive credential strings
litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/output_params_utils.py	Adds per-model gating for output_config.effort; delegates to AnthropicConfig._model_supports_effort_param which reads from model cost map, not hardcoded values
litellm/proxy/management_endpoints/key_management_endpoints.py	Fixes regression where team members on org-scoped teams could not generate keys; adds _org_inherited_from_team bypass for the org membership check
litellm/proxy/auth/auth_utils.py	Threads llm_router into managed resource ID resolution so video/character model IDs are resolved to proxy aliases before auth and budget checks
litellm/proxy/auth/user_api_key_auth.py	Passes llm_router to all _get_model_from_request_context call sites so model ID resolution is consistent throughout the auth builder
litellm/proxy/hooks/batch_rate_limiter.py	Maps stripped batch body.model back to proxy model_name via router before can_key_call_model check
litellm/proxy/spend_tracking/budget_reservation.py	Passes llm_router to get_model_from_request in both reserve_budget_for_request and estimate_request_max_cost
litellm/proxy/auth/auth_checks.py	Adds llm_router to common_checks call forwarded to _extract_model_candidates_from_request

_{Reviews (1): Last reviewed commit: "chore: update uv.lock for 1.87.1" | Re-trigger Greptile}