v1.97.1

## Docker-only release

**This release ships container images only. There is no PyPI package for `1.97.1`.**

`pip install litellm==1.97.1` will not resolve — install the images below, or stay on `1.97.0` on PyPI. The git tag and this release exist so the images are traceable to an exact commit.

| Image | Tags |
|---|---|
| `ghcr.io/berriai/litellm` · `docker.io/litellm/litellm` | `1.97.1`, `v1.97.1` |
| `ghcr.io/berriai/litellm-database` · `docker.io/litellm/litellm-database` | `1.97.1`, `v1.97.1` |
| `ghcr.io/berriai/litellm-non_root` · `docker.io/litellm/litellm-non_root` | `1.97.1`, `v1.97.1` |

This is a maintenance patch on the 1.97 line. It refreshes base-image and dependency pins to clear known CVEs and makes no change to LiteLLM behavior. The rolling `latest` and `main-stable` image tags are deliberately **not** moved by this release and continue to point at the newest stable line.

---
## Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.97.1
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.97.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.97.1
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
## What's Changed
* chore(deps): refresh stale dependency pins and cut 1.97.1 by @yuneng-berri in https://github.com/BerriAI/litellm/pull/39200
* fix(docker): pin apk python to 3.13 and bump wolfi-base on stable/1.97.x (cherry-pick #38917 + #38973) by @yuneng-berri in https://github.com/BerriAI/litellm/pull/39212


**Full Changelog**: https://github.com/BerriAI/litellm/compare/v1.97.0...v1.97.1