diff --git a/pyproject.toml b/pyproject.toml
index e15bf1351dd8..d9ec313471e8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "litellm"
-version = "1.95.0"
+version = "1.106.0"
 description = "Library to easily interface with LLM API providers"
 readme = "README.md"
 requires-python = ">=3.10, <3.15"
@@ -15,17 +15,27 @@ dependencies = [
     # When changing a floor, verify it installs + imports on every supported
     # Python with: `uv pip install --resolution=lowest-direct .`
     "fastuuid>=0.14.0,<1.0",
-    "httpx>=0.28.0,<1.0",
+    "filelock>=3.16.1,<4.0",
+    "httpx[http2]>=0.28.0,<1.0",
     "openai>=2.20.0,<3.0.0",
     "python-dotenv>=1.0.0,<2.0",
-    "tiktoken>=0.8.0,<1.0",
+    "pyyaml>=6.0.3,<7.0",
+    "packaging>=24.0",
     "importlib-metadata>=8.0.0,<9.0",
+    "tiktoken>=0.8.0,<1.0; python_version < '3.14'",
+    "tiktoken>=0.12.0,<1.0; python_version >= '3.14'",
     "tokenizers>=0.21.0,<1.0",
+    "huggingface-hub>=0.34.0,<2.0",
     "click>=8.0.0,<9.0",
     "jinja2>=3.1.6,<4.0",
-    "aiohttp>=3.10,<4.0",
-    "pydantic>=2.10.0,<3.0.0",
+    "aiohttp>=3.14.2,<4.0",
+    "async-timeout>=4.0.3,<6.0; python_version < '3.11'",
+    "pydantic>=2.11.0,<3.0.0; python_version < '3.14'",
+    "pydantic>=2.12.0,<3.0.0; python_version >= '3.14'",
+    "pydantic-settings>=2.14.1,<3.0",
     "jsonschema>=4.0.0,<5.0",
+    "boto3>=1.43.1,<2.0",
+    "typing-extensions>=4.13.0,<5.0",
 ]
 
 [project.urls]
@@ -44,46 +54,60 @@ proxy = [
     "gunicorn>=23.0.0,<24.0",
     "uvicorn>=0.33.0,<1.0",
     "granian>=2.7.4,<3.0",
-    "uvloop>=0.21.0,<1.0; sys_platform != 'win32'",
+    "uvloop>=0.22.1,<1.0; sys_platform != 'win32'",
     "fastapi>=0.136.3,<1.0",
     "starlette>=1.0.1,<2.0",
     "backoff>=2.2.1,<3.0",
     "pyyaml>=6.0.3,<7.0",
     "rq>=2.7.0,<3.0",
     "orjson>=3.11.6,<4.0",
+    # redis-py's C response parser. It arrives with redis (via rq) either way; naming
+    # it here is what makes redis-py select _HiredisParser instead of the Python one.
+    "hiredis>=3.0.0,<4.0",
     "apscheduler>=3.11.2,<4.0",
     "fastapi-sso>=0.19.0,<1.0",
     "PyJWT>=2.13.0,<3.0",
     "python-multipart>=0.0.27,<1.0",
-    "cryptography>=48.0.1,<49.0",
+    "cryptography>=49.0.0,<51.0",
     "pynacl>=1.6.2,<2.0",
     "websockets>=15.0.1,<16.0",
     "boto3>=1.43.1,<2.0",
     "azure-identity>=1.25.2,<2.0",
     "azure-storage-blob>=12.28.0,<13.0",
-    "mcp>=1.28.1,<2.0",
-    "litellm-proxy-extras==0.4.81",
-    "litellm-enterprise==0.1.52",
-    "RestrictedPython>=8.1,<9.0",
+    "mcp>=2.2.0,<3",
+    "httpx2>=2.5.0,<3",
+    "pydantic>=2.12.0,<3",
+    "litellm-proxy-extras==0.4.106",
+    "litellm-enterprise==0.1.74",
+    "RestrictedPython>=8.5,<9.0",
     "rich>=13.9.4,<14.0",
     "InquirerPy>=0.3.4,<1.0",
+    "tomlkit>=0.13.3,<1.0",
     "polars>=1.38.1,<2.0",
     "soundfile>=0.12.1,<1.0",
     "pyroscope-io>=0.8.16,<1.0; sys_platform != 'win32'",
-    "pydantic-settings>=2.14.1,<3.0",
     "expression>=5.6.0,<6.0",
 ]
 # Thin client install for the `lite` CLI on developer laptops. The CLI's heavy
-# imports (fastapi, cryptography, ...) are all guarded, so it runs on the base
-# SDK plus just these four; none of the server runtime in `proxy` is pulled in.
+# imports are all guarded, so it runs on the base SDK plus these packages, and
+# none of the server runtime in `proxy` is pulled in. On Linux,
+# keyring reaches the Secret Service through secretstorage, which brings
+# cryptography with it.
 cli = [
     "rich>=13.9.4,<14.0",
     "pyyaml>=6.0.3,<7.0",
     "requests>=2.32.0,<3.0",
     "InquirerPy>=0.3.4,<1.0",
+    "keyring>=25.6.0,<26.0",
+    "tomlkit>=0.13.3,<1.0",
 ]
 extra_proxy = [
     "prisma>=0.11.0,<1.0",
+    # Used by ProxyExtrasDBManager.spend_logs_is_partitioned() to detect a
+    # partitioned LiteLLM_SpendLogs and keep schema reconciliation from
+    # fighting its composite primary key.
+    "psycopg>=3.2,<4.0",
+    "psycopg-binary>=3.2,<4.0",
     "azure-identity>=1.25.2,<2.0",
     "azure-keyvault-secrets>=4.10.0,<5.0",
     # Not in PyPI proxy extra.
@@ -99,6 +123,9 @@ utils = [
     "numpydoc>=1.8.0,<2.0",
 ]
 caching = ["diskcache>=5.6.3,<6.0"]
+mcp = ["mcp>=2.2.0,<3", "httpx2>=2.5.0,<3", "pydantic>=2.12.0,<3"]
+# Driver for the MongoDB Atlas vector store; Atlas Vector Search has no HTTP query API.
+# The floor is 4.9 because that is the release AsyncMongoClient landed in.
 # SAML SSO for the admin UI. python3-saml pulls in xmlsec/lxml, whose wheels
 # bundle the native libxmlsec1/libxml2 libraries, so no system packages are
 # required. Kept out of the base `proxy` extra so it stays optional.
@@ -112,6 +139,12 @@ grpc = [
     # Newest non-yanked release older than the 30-day cutoff.
     "grpcio==1.78.0",
 ]
+stt-vertex-chirp = [
+    # Google Cloud Speech-to-Text v2 streaming (gRPC) for Chirp models on
+    # /v1/realtime. Imported lazily inside the backend so litellm core stays
+    # usable without it.
+    "google-cloud-speech>=2.40.0,<3.0",
+]
 stt-nvidia-riva = [
     # NVIDIA Riva STT provider (gRPC). These are imported lazily inside the
     # provider handler so litellm core remains usable without them.
@@ -126,29 +159,31 @@ bedrock-realtime = [
     # InvokeModelWithBidirectionalStream API, which boto3 cannot do. This
     # experimental AWS SDK (with its smithy-* deps, pulled transitively)
     # provides the bidirectional stream; imported lazily in the realtime
-    # handler so litellm core stays usable without it.
-    "aws-sdk-bedrock-runtime>=0.7.0,<0.8.0; python_version >= '3.12'",
+    # handler so litellm core stays usable without it. The awscrt extra is
+    # required: the SDK's default aiohttp transport has no duplex streaming.
+    "aws-sdk-bedrock-runtime[awscrt]>=0.10.0,<0.12.0; python_version >= '3.12'",
 ]
 proxy-runtime = [
     # Historically bundled in the proxy Docker images via requirements.txt.
     # Keep these in a dedicated extra so uv-based images preserve the same
     # feature surface without forcing the base SDK install to grow.
     "google-cloud-aiplatform>=1.133.0,<2.0",
+    "google-cloud-speech>=2.40.0,<3.0",
     "google-genai>=1.37.0,<2.0",
     "anthropic[vertex]>=0.84.0,<1.0",
     "grpcio==1.78.0",
     "prometheus-client>=0.20.0,<1.0",
-    "langfuse>=2.59.7,<3.0",
-    "opentelemetry-api==1.28.0",
-    "opentelemetry-sdk==1.28.0",
-    "opentelemetry-exporter-otlp==1.28.0",
-    "opentelemetry-instrumentation-fastapi==0.49b0",
+    "langfuse>=4.7,<5.0",
+    "opentelemetry-api==1.33.1",
+    "opentelemetry-sdk==1.33.1",
+    "opentelemetry-exporter-otlp==1.33.1",
+    "opentelemetry-instrumentation-fastapi==0.54b1",
     "ddtrace>=4.8.2,<5.0",
     "sentry-sdk>=2.21.0,<3.0",
     "mangum>=0.17.0,<1.0",
     "azure-ai-contentsafety>=1.0.0,<2.0",
     "azure-storage-file-datalake>=12.20.0,<13.0",
-    "pypdf>=6.12.0,<7.0",
+    "pypdf>=6.16.1,<7.0",
     "llm-sandbox>=0.3.39,<1.0",
     "detect-secrets>=1.5.0,<2.0",
 ]
@@ -156,20 +191,22 @@ proxy-runtime = [
 [project.scripts]
 litellm = "litellm:run_server"
 lite = "litellm.proxy.client.cli:cli"
-litellm-proxy = "litellm.proxy.client.cli:cli"
+litellm-proxy = "litellm.proxy.client.cli:litellm_proxy_cli"
 
 [dependency-groups]
 dev = [
+    "numpy>=1.26.0,<3.0",
     "diff-cover==9.7.2",
-    "flake8==7.3.0",
+    "hypothesis==6.165.10",
+    "reportlab==5.0.1",
     "basedpyright==1.39.7",
+    "mypy==1.20.1",
+    "keyring==25.7.0",
     "pytest==9.0.3",
+    "pytest-socket==0.8.1",
+    "tomli==2.4.1; python_version < '3.11'",
     "pytest-mock==3.15.1",
     "pytest-asyncio==1.3.0",
-    "pytest-postgresql==7.0.2",
-    # pytest-postgresql imports psycopg v3 during pytest startup. Keep the base
-    # package and the binary wheel in the default dev environment so local
-    # pytest works without requiring a system libpq install.
     "psycopg==3.3.3",
     "psycopg-binary==3.3.3",
     "pytest-xdist==3.8.0",
@@ -183,11 +220,11 @@ dev = [
     "types-PyYAML==6.0.12.20250915",
     "botocore-stubs==1.43.14",
     "types-boto3[bedrock,bedrock-agent,bedrock-runtime,kms,s3,sagemaker-runtime,sts]==1.43.30",
-    "opentelemetry-api==1.28.0",
-    "opentelemetry-sdk==1.28.0",
-    "opentelemetry-exporter-otlp==1.28.0",
-    "opentelemetry-instrumentation-fastapi==0.49b0",
-    "langfuse==2.59.7",
+    "opentelemetry-api==1.33.1",
+    "opentelemetry-sdk==1.33.1",
+    "opentelemetry-exporter-otlp==1.33.1",
+    "opentelemetry-instrumentation-fastapi==0.54b1",
+    "langfuse>=4.7,<5.0",
     "fastapi-offline==1.7.6",
     "fakeredis==2.34.1",
     "pytest-rerunfailures==15.1",
@@ -202,20 +239,28 @@ e2e-dev = [
     "playwright==1.61.0",
     "websockets>=15.0.1,<16.0",
     "locust==2.45.0",
-    "mcp>=1.28.1,<2.0",
+    "anthropic==0.84.0",
+    "psutil==7.2.2",
+    "mcp>=2.2.0,<3",
+]
+admin-mcp = [
+    "litellm-admin-mcp @ https://github.com/BerriAI/liteadmin-mcp/archive/d35ec9c19c117d4c50cc1eccf6ce1296aac25a1a.tar.gz#sha256=86b930f6706fb2da10d53d1798ee7fd14e44fb0afdef0da122cf0e6bb88fa2c3 ; python_version >= '3.12'",
 ]
 proxy-dev = [
+    { include-group = "admin-mcp" },
     "prisma==0.11.0",
     "hypercorn==0.17.3",
     "prometheus-client==0.20.0",
-    "opentelemetry-api==1.28.0",
-    "opentelemetry-sdk==1.28.0",
-    "opentelemetry-exporter-otlp==1.28.0",
-    "opentelemetry-instrumentation-fastapi==0.49b0",
+    "sentry-sdk==2.21.0",
+    "opentelemetry-api==1.33.1",
+    "opentelemetry-sdk==1.33.1",
+    "opentelemetry-exporter-otlp==1.33.1",
+    "opentelemetry-instrumentation-fastapi==0.54b1",
     "azure-identity==1.25.2",
     "a2a-sdk==1.1.0",
 ]
 ci = [
+    "psutil==7.2.2",
     # These are lazily imported at call sites; keep them out of core deps to
     # avoid bloating the base SDK install (google-generativeai pulls grpcio +
     # protobuf, Pillow is a compiled C extension).
@@ -231,7 +276,7 @@ ci = [
     "lunary==1.4.36; python_version == '3.10'",
     "lunary==1.4.37; python_version >= '3.11'",
     "logfire==4.6.0",
-    "traceloop-sdk==0.33.12",
+    "traceloop-sdk==0.34.0",
     "detect-secrets==1.5.0",
     "PyGithub==2.8.1",
     "aiodynamo==24.7",
@@ -242,19 +287,25 @@ ci = [
     "blockbuster==1.5.26",
     "beautifulsoup4==4.14.3",
     "pylint==4.0.5",
-    "langchain-mcp-adapters==0.2.1",
     "langchain-openai==1.1.14",
     "langgraph>=1.2.4,<1.3.0",
     "langgraph-prebuilt>=1.1.0,<1.3.0",
     "claude-agent-sdk==0.1.44",
+    "google-cloud-speech==2.40.0",
 ]
 healthcheck = [
     "httpx==0.28.1",
     "pyyaml==6.0.3",
 ]
+benchmarks = [
+    "pytest==9.0.3",
+    "pytest-codspeed==4.3.0",
+    "mcp>=2.2.0,<3",
+    "a2a-sdk==1.1.0",
+]
 
 [build-system]
-requires = ["maturin==1.9.4"]
+requires = ["maturin==1.15.0"]
 build-backend = "maturin"
 
 [tool.maturin]
@@ -262,10 +313,23 @@ manifest-path = "litellm-rust/crates/python-bridge/Cargo.toml"
 module-name = "litellm.rust_bridge._native"
 python-source = "."
 bindings = "pyo3"
-include = ["litellm/proxy/_experimental/out/**"]
+features = ["extension-module"]
+profile = "release"
+editable-profile = "dev"
+include = [
+    "litellm/proxy/_experimental/out/**",
+    "litellm/router_strategy/complexity_router/artifacts/*.json",
+    "litellm/router_strategy/complexity_router/fuse_presets.json",
+    "litellm/proxy/model_insights_tasks.json",
+    "litellm/proxy/common_utils/codex_base_instructions.md",
+    "litellm/proxy/common_utils/codex_bundled_models_0.159.3.json",
+    "litellm/proxy/lens/prompts/*.md",
+]
 exclude = [
     "litellm/proxy/enterprise",
     "litellm/proxy/enterprise/**",
+    "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/guardrail_benchmarks",
+    "litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/guardrail_benchmarks/**",
     "**/__pycache__",
     "**/__pycache__/**",
     "**/.pytest_cache",
@@ -275,9 +339,17 @@ exclude = [
 ]
 
 [tool.uv]
+cache-keys = [
+    { file = "pyproject.toml" },
+    { file = "rust-toolchain.toml" },
+    { file = ".cargo/config.toml" },
+    { file = "litellm-rust/Cargo.lock" },
+    { file = "litellm-rust/Cargo.toml" },
+    { file = "litellm-rust/crates/**/*" },
+]
 constraint-dependencies = [
-    "tornado>=6.5.6",
-    "aiohttp>=3.14.1,<4.0",
+    "tornado>=6.5.8",
+    "aiohttp>=3.14.2,<4.0",
     "packaging>=24.0",
     "soupsieve>=2.8.4",
     "httplib2>=0.32.0",
@@ -286,6 +358,7 @@ constraint-dependencies = [
 override-dependencies = [
     # a2a-sdk 1.x requires packaging>=24.0; lunary 1.4.x still caps at <24.0.
     "packaging>=24.0",
+    "cryptography>=50.0.0,<51.0",
 ]
 default-groups = ["dev"]
 required-version = ">=0.10.9"
@@ -298,11 +371,8 @@ litellm-enterprise = { workspace = true }
 [tool.uv.workspace]
 members = ["enterprise", "litellm-proxy-extras"]
 
-[tool.isort]
-profile = "black"
-
 [tool.commitizen]
-version = "1.95.0"
+version = "1.106.0"
 version_files = [
     "pyproject.toml:^version",
 ]
@@ -314,6 +384,7 @@ markers = [
     "asyncio: mark test as an asyncio test",
     "limit_leaks: mark test with memory limit for leak detection (e.g., '40 MB')",
     "no_parallel: mark test to run sequentially (not in parallel) - typically for memory measurement tests",
+    "requires_rust_extension: public Python contract requiring an enabled, compiled Rust extension",
 ]
 filterwarnings = [
     # Suppress Pydantic serializer warnings from mock server responses (non-critical for memory tests)
@@ -333,9 +404,13 @@ filterwarnings = [
 paths_to_mutate = [
     "litellm/proxy/management_endpoints/",
 ]
+# Only the unit tier that maps to paths_to_mutate. mutmut times and
+# coverage-maps this whole set once before mutating, so a tier that needs a
+# seeded database (tests/proxy_behavior/) kills the run before it starts, and
+# a mutation score is only meaningful against the tests that claim to cover
+# the mutated code anyway.
 tests_dir = [
-    "tests/test_litellm/proxy/management_endpoints/",
-    "tests/proxy_behavior/management/",
+    "tests/unit/proxy/management_endpoints/",
 ]
 also_copy = [
     "litellm/",
@@ -352,10 +427,16 @@ mutate_only_covered_lines = true
 # - rerunning a "failed" test on a mutant would mask which mutants are killed
 #   vs. survive, so reruns are wrong for mutation testing regardless.
 # - xdist is unnecessary inside mutmut (mutmut handles its own parallelism).
+# test_saml_sso.py cannot run inside mutmut's mutants/ sandbox: the copied tree
+# re-imports cryptography's hash classes under a second identity, so x509 .sign()
+# rejects the SHA256 instance the fixture builds with "Algorithm must be a
+# registered hash algorithm". Nothing to do with mutation coverage, and one
+# erroring test is enough to end the stats phase before any mutant runs.
 pytest_add_cli_args = [
-    "-p", "no:retry",
+    "-p", "no:pytest-retry",
     "-p", "no:rerunfailures",
     "-p", "no:xdist",
+    "--ignore=tests/unit/proxy/management_endpoints/test_saml_sso.py",
 ]
 
 [tool.coverage.run]