Merge remote-tracking branch 'upstream/main' into feat/openguardrails-guardrail-integration

.circleci/requirements.txt

@@ -1,21 +0,0 @@
-# used by CI/CD testing
-openai==1.100.1
-python-dotenv
-tiktoken
-importlib_metadata
-cohere
-redis==5.2.1
-redisvl==0.4.1
-anthropic
-orjson==3.10.12 # fast /embedding responses
-pydantic==2.11.0
-google-cloud-aiplatform==1.43.0
-google-cloud-iam==2.19.1
-fastapi-sso==0.16.0 
-uvloop==0.21.0
-mcp==1.25.0    # for MCP server  
-semantic_router==0.1.10 # for auto-routing with litellm
-fastuuid==0.12.0
-responses==0.25.7  # for proxy client tests
-pytest-retry==1.6.3  # for automatic test retries
-litellm-proxy-extras  # for prisma migrations

.claude/settings.json

@@ -1,36 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(git show:*)",
-      "Bash(git worktree add:*)",
-      "Read(//Users/krrishdholakia/Documents/litellm/**)",
-      "Read(//Users/krrishdholakia/Documents/litellm-claude-code-guardrails/litellm/types/**)",
-      "Read(//Users/krrishdholakia/Documents/litellm-claude-code-guardrails/**)",
-      "Read(//Users/krrishdholakia/Documents/litellm-claude-code-guardrails/litellm/**)",
-      "Bash(python:*)",
-      "Bash(python -c \"\nimport sys; sys.path.insert\\(0, ''.''\\)\nfrom litellm.proxy.guardrails.guardrail_hooks.claude_code.guardrail import ClaudeCodeGuardrail, HOSTED_TOOL_PREFIXES\nprint\\(''HOSTED_TOOL_PREFIXES:'', HOSTED_TOOL_PREFIXES\\)\nprint\\(''ClaudeCodeGuardrail imported OK''\\)\n\")",
-      "Read(//Users/krrishdholakia/Documents/litellm-mcp-jwt-groups/litellm/proxy/**)",
-      "Read(//Users/krrishdholakia/Documents/litellm-mcp-jwt-groups/**)",
-      "Bash(poetry run pytest:*)",
-      "Bash(git add:*)",
-      "Bash(git commit:*)",
-      "Bash(poetry run python:*)",
-      "Bash(poetry run pip:*)",
-      "Bash(git reset:*)",
-      "Bash(git cherry-pick:*)",
-      "Bash(git checkout:*)",
-      "Read(//Users/krrishdholakia/Documents/litellm/litellm/proxy/guardrails/guardrail_hooks/**)",
-      "Read(//Users/krrishdholakia/Documents/**)",
-      "Bash(git -C /Users/krrishdholakia/Documents/litellm-mcp-user-permissions worktree list)",
-      "Bash(ls:*)"
-    ],
-    "additionalDirectories": [
-      "/Users/krrishdholakia/Documents/litellm-mcp-group-plan/plan",
-      "/Users/krrishdholakia/Documents/litellm-claude-code-guardrails/litellm/proxy/guardrails/guardrail_hooks/claude_code",
-      "/Users/krrishdholakia/Documents/litellm-claude-code-guardrails/litellm/types",
-      "/Users/krrishdholakia/Documents/litellm-claude-code-guardrails",
-      "/Users/krrishdholakia/Documents/litellm-mcp-jwt-groups/litellm/proxy",
-      "/Users/krrishdholakia/Documents/litellm-mcp-jwt-groups/tests/test_litellm/proxy/auth"
-    ]
-  }
-}

.devcontainer/post-create.sh

@@ -1,17 +1,17 @@
 #!/usr/bin/env bash
 set -e
 
-echo "[post-create] Installing poetry via pip"
-python -m pip install --upgrade pip
-python -m pip install poetry
+echo "[post-create] Installing uv"
+curl -LsSf https://astral.sh/uv/0.10.9/install.sh | env UV_NO_MODIFY_PATH=1 sh
+export PATH="$HOME/.local/bin:$PATH"
 
-echo "[post-create] Installing Python dependencies (poetry)"
-poetry install --with dev --extras proxy
+echo "[post-create] Installing Python dependencies (uv)"
+uv sync --frozen --group proxy-dev --extra proxy
 
 echo "[post-create] Generating Prisma client"
-poetry run prisma generate
+uv run --no-sync prisma generate
 
 echo "[post-create] Installing npm dependencies"
-cd ui/litellm-dashboard && npm install --no-audit --no-fund
+cd ui/litellm-dashboard && npm ci
 
-echo "[post-create] Done"
+echo "[post-create] Done"

.gitguardian.yaml

@@ -37,7 +37,7 @@ secret:
     - "docs/**"
     - "**/*.md"
     - "**/*.lock"
-    - "poetry.lock"
+    - "uv.lock"
     - "package-lock.json"
 
   # Ignore security incidents with the SHA256 of the occurrence (false positives)

.github/ISSUE_TEMPLATE/config.yml

@@ -1,7 +1,7 @@
 blank_issues_enabled: true
 contact_links:
   - name: Schedule Demo
-    url: https://calendly.com/d/cx9p-5yf-2nm/litellm-introductions
+    url: https://enterprise.litellm.ai/demo
     about: Speak directly with Krrish and Ishaan, the founders, to discuss issues, share feedback, or explore improvements for LiteLLM
   - name: Discord
     url: https://discord.com/invite/wuPM9dRgDw

.github/actions/helm-oci-chart-releaser/action.yml

@@ -41,32 +41,54 @@ runs:
   using: composite
   steps:
     - name: Helm | Setup
-      uses: azure/setup-helm@v4
+      uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
       with:
         version: v3.20.0
 
     - name: Helm | Login
       shell: bash
-      run: echo ${{ inputs.registry_password }} | helm registry login -u ${{ inputs.registry_username }} --password-stdin ${{ inputs.registry }}
+      env:
+        REGISTRY_PASSWORD: ${{ inputs.registry_password }}
+        REGISTRY_USERNAME: ${{ inputs.registry_username }}
+        REGISTRY: ${{ inputs.registry }}
+      run: echo "$REGISTRY_PASSWORD" | helm registry login -u "$REGISTRY_USERNAME" --password-stdin "$REGISTRY"
 
     - name: Helm | Dependency
       if: inputs.update_dependencies == 'true'
       shell: bash
-      run: helm dependency update ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }}
+      env:
+        CHART_PATH: ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }}
+      run: helm dependency update "$CHART_PATH"
 
     - name: Helm | Package
       shell: bash
-      run: helm package ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }} --version ${{ inputs.tag }} --app-version ${{ inputs.app_version }}
+      env:
+        CHART_PATH: ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }}
+        TAG: ${{ inputs.tag }}
+        APP_VERSION: ${{ inputs.app_version }}
+      run: helm package "$CHART_PATH" --version "$TAG" --app-version "$APP_VERSION"
 
     - name: Helm | Push
       shell: bash
-      run: helm push ${{ inputs.name }}-${{ inputs.tag }}.tgz oci://${{ inputs.registry }}/${{ inputs.repository }}
+      env:
+        NAME: ${{ inputs.name }}
+        TAG: ${{ inputs.tag }}
+        REGISTRY: ${{ inputs.registry }}
+        REPOSITORY: ${{ inputs.repository }}
+      run: helm push "${NAME}-${TAG}.tgz" "oci://${REGISTRY}/${REPOSITORY}"
 
     - name: Helm | Logout
       shell: bash
-      run: helm registry logout ${{ inputs.registry }}
+      env:
+        REGISTRY: ${{ inputs.registry }}
+      run: helm registry logout "$REGISTRY"
 
     - name: Helm | Output
       id: output
       shell: bash
-      run: echo "image=${{ inputs.registry }}/${{ inputs.repository }}/${{ inputs.name }}:${{ inputs.tag }}" >> $GITHUB_OUTPUT
+      env:
+        REGISTRY: ${{ inputs.registry }}
+        REPOSITORY: ${{ inputs.repository }}
+        NAME: ${{ inputs.name }}
+        TAG: ${{ inputs.tag }}
+      run: echo "image=${REGISTRY}/${REPOSITORY}/${NAME}:${TAG}" >> $GITHUB_OUTPUT

.github/codeql/codeql-config.yml

@@ -1,22 +1,21 @@
 name: "LiteLLM CodeQL config"
 
-# Use security-extended suite instead of security-and-quality to avoid
-# result sets > 2 GiB on this codebase that cause fatal OOM failures.
 queries:
-  - uses: security-extended
+  - uses: security-and-quality
 
-# These two queries are security queries included in security-extended that
-# individually produce result sets > 2 GiB on this codebase, causing fatal
-# OOM failures. Exclude them as a safety net until CI confirms they no longer
-# OOM; drop these exclusions in a follow-up once verified.
+# Known OOM queries on large Python codebases:
+# CodeQL builds a full data flow graph in memory. These two queries trace
+# sensitive data through every log call / regex pattern, causing combinatorial
+# path explosion on codebases with extensive logging like LiteLLM (>2 GiB
+# result sets). This is a known CodeQL scaling limitation, not a code issue.
+# Re-test periodically as CodeQL improves or the codebase refactors logging.
 query-filters:
   - exclude:
-      id: py/clear-text-logging-sensitive-data  # CWE-312 — > 2 GiB result set
+      id: py/clear-text-logging-sensitive-data  # CWE-312
   - exclude:
-      id: py/polynomial-redos                   # CWE-730 — > 2 GiB result set
+      id: py/polynomial-redos                   # CWE-730
 
 paths-ignore:
   - tests
   - docs
   - "**/*.md"
-  - litellm/proxy/_experimental/out

.github/dependabot.yaml

@@ -4,6 +4,9 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
+      semver-major-days: 14
     groups:
       github-actions:
         patterns:

.github/pull_request_template.md

@@ -32,6 +32,13 @@ If you're seeing a delay in your PR being merged, ping the LiteLLM Team on [Slac
 - [ ] **Merge / cherry-pick CI run**  
        Links:
 
+## Screenshots / Proof of Fix
+
+<!-- Include screenshots, screen recordings, or log output demonstrating that your changes work as expected.
+     For bug fixes: show reproduction before the fix and passing behavior after.
+     For new features: show the feature working end-to-end.
+     For UI changes: include before/after screenshots. -->
+
 ## Type
 
 <!-- Select the type of Pull Request -->

.github/workflows/_test-unit-base.yml

@@ -0,0 +1,135 @@
+name: _Unit Test Base (Reusable)
+
+on:
+  workflow_call:
+    inputs:
+      test-path:
+        description: "Pytest path(s) to run"
+        required: true
+        type: string
+      workers:
+        description: "Number of pytest-xdist workers"
+        required: false
+        type: number
+        default: 2
+      reruns:
+        description: "Number of reruns for flaky tests"
+        required: false
+        type: number
+        default: 2
+      timeout-minutes:
+        description: "Job timeout in minutes"
+        required: false
+        type: number
+        default: 20
+      max-failures:
+        description: "Stop after this many failures"
+        required: false
+        type: number
+        default: 10
+      artifact-name:
+        description: "Unique name for the coverage artifact (must be unique per run)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  run:
+    name: Run tests
+    runs-on: ubuntu-latest
+    timeout-minutes: ${{ inputs.timeout-minutes }}
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+
+      - name: Cache uv dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
+      - name: Install dependencies
+        run: |
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+
+      - name: Generate Prisma client
+        env:
+          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
+        run: |
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+
+      - name: Run tests
+        env:
+          TEST_PATH: ${{ inputs.test-path }}
+          MAX_FAILURES: ${{ inputs.max-failures }}
+          WORKERS: ${{ inputs.workers }}
+          RERUNS: ${{ inputs.reruns }}
+        run: |
+          uv run --no-sync pytest ${TEST_PATH:?} \
+            --tb=short -vv \
+            --maxfail="${MAX_FAILURES}" \
+            -n "${WORKERS}" \
+            --reruns "${RERUNS}" \
+            --reruns-delay 1 \
+            --dist=loadscope \
+            --durations=20 \
+            --cov=litellm \
+            --cov-report=xml:coverage.xml \
+            --cov-config=pyproject.toml
+
+      - name: Save coverage report
+        if: always()
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage.xml
+          retention-days: 1
+
+  upload-coverage:
+    name: Upload coverage to Codecov
+    needs: run
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Download coverage report
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage-reports
+          merge-multiple: true
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        with:
+          use_oidc: true
+          directory: coverage-reports
+          root_dir: ${{ github.workspace }}
+          fail_ci_if_error: false

.github/workflows/_test-unit-services-base.yml

@@ -0,0 +1,190 @@
+name: _Unit Test Services Base (Reusable)
+
+on:
+  workflow_call:
+    inputs:
+      test-path:
+        description: "Pytest path(s) to run"
+        required: true
+        type: string
+      workers:
+        description: "Number of pytest-xdist workers (0 = no parallelism)"
+        required: false
+        type: number
+        default: 2
+      reruns:
+        description: "Number of reruns for flaky tests"
+        required: false
+        type: number
+        default: 2
+      timeout-minutes:
+        description: "Job timeout in minutes"
+        required: false
+        type: number
+        default: 20
+      max-failures:
+        description: "Stop after this many failures"
+        required: false
+        type: number
+        default: 10
+      enable-postgres:
+        description: "Start a local Postgres service container and run Prisma migrations"
+        required: false
+        type: boolean
+        default: false
+      artifact-name:
+        description: "Unique name for the coverage artifact (must be unique per run)"
+        required: false
+        type: string
+        default: "run"
+    secrets:
+      DATABASE_URL:
+        required: false
+      POSTGRES_USER:
+        required: false
+      POSTGRES_PASSWORD:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  run:
+    name: Run tests
+    runs-on: ubuntu-latest
+    timeout-minutes: ${{ inputs.timeout-minutes }}
+    # Environment is derived from the enable-* flags, not caller-controllable.
+    # This prevents callers from passing arbitrary environment names to bypass secret scoping.
+    environment: >-
+      ${{
+        inputs.enable-postgres && 'integration-postgres' ||
+        ''
+      }}
+
+    services:
+      postgres:
+        image: postgres@sha256:705a5d5b5836f3fcba0d02c4d281e6a7dd9ed2dd4078640f08a1e1e9896e097d # postgres:14
+        env:
+          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
+          POSTGRES_DB: litellm_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+
+      - name: Cache uv dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-services-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-services-
+
+      - name: Install dependencies
+        run: |
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+
+      - name: Generate Prisma client
+        env:
+          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
+        run: |
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+
+      - name: Run Prisma migrations
+        if: ${{ inputs.enable-postgres }}
+        env:
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+        run: |
+          uv run --no-sync prisma db push --schema litellm/proxy/schema.prisma --accept-data-loss
+
+      - name: Run tests
+        env:
+          TEST_PATH: ${{ inputs.test-path }}
+          MAX_FAILURES: ${{ inputs.max-failures }}
+          WORKERS: ${{ inputs.workers }}
+          RERUNS: ${{ inputs.reruns }}
+          DATABASE_URL: ${{ inputs.enable-postgres && secrets.DATABASE_URL || '' }}
+        run: |
+          if [ "${WORKERS}" = "0" ]; then
+            uv run --no-sync pytest ${TEST_PATH:?} \
+              --tb=short -vv \
+              --maxfail="${MAX_FAILURES}" \
+              --reruns "${RERUNS}" \
+              --reruns-delay 1 \
+              --durations=20 \
+              --cov=litellm \
+              --cov-report=xml:coverage.xml \
+              --cov-config=pyproject.toml
+          else
+            uv run --no-sync pytest ${TEST_PATH:?} \
+              --tb=short -vv \
+              --maxfail="${MAX_FAILURES}" \
+              -n "${WORKERS}" \
+              --reruns "${RERUNS}" \
+              --reruns-delay 1 \
+              --dist=loadscope \
+              --durations=20 \
+              --cov=litellm \
+              --cov-report=xml:coverage.xml \
+              --cov-config=pyproject.toml
+          fi
+
+      - name: Save coverage report
+        if: always()
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage.xml
+          retention-days: 1
+
+  upload-coverage:
+    name: Upload coverage to Codecov
+    needs: run
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Download coverage report
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage-reports
+          merge-multiple: true
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        with:
+          use_oidc: true
+          directory: coverage-reports
+          root_dir: ${{ github.workspace }}
+          fail_ci_if_error: false

.github/workflows/auto_update_price_and_context_window.yml

@@ -2,21 +2,28 @@ name: Updates model_prices_and_context_window.json and Create Pull Request
 
 on:
   schedule:
-    - cron: "0 0 * * 0"  # Run every Sundays at midnight
+    - cron: "0 0 * * 0" # Run every Sundays at midnight
     #- cron: "0 0 * * *" # Run daily at midnight
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   auto_update_price_and_context_window:
     if: github.repository == 'BerriAI/litellm'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - name: Install Dependencies
-        run: |
-          pip install aiohttp
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
       - name: Update JSON Data
         run: |
-          python ".github/workflows/auto_update_price_and_context_window_file.py"
+          uv run --frozen --with 'aiohttp==3.13.3' python ".github/workflows/auto_update_price_and_context_window_file.py"
       - name: Create Pull Request
         run: |
           git add model_prices_and_context_window.json 
@@ -26,4 +33,4 @@ jobs:
             --head auto-update-price-and-context-window-$(date +'%Y-%m-%d') \
             --base main
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}

.github/workflows/check-schema-sync.yml

@@ -0,0 +1,58 @@
+name: Check Schema Sync
+
+on:
+  pull_request:
+    paths:
+      - 'schema.prisma'
+      - 'litellm/proxy/schema.prisma'
+      - 'litellm-proxy-extras/litellm_proxy_extras/schema.prisma'
+
+permissions:
+  contents: read
+
+jobs:
+  check-sync:
+    name: Verify schema.prisma copies match root
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout PR
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Reject symlinked schema files
+        run: |
+          for f in schema.prisma litellm/proxy/schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma; do
+            if [ -L "$f" ]; then
+              echo "::error file=$f::$f is a symlink, which is not allowed"
+              exit 1
+            fi
+          done
+
+      - name: Check all schemas match root
+        run: |
+          EXIT=0
+
+          diff schema.prisma litellm/proxy/schema.prisma || {
+            echo "::error file=litellm/proxy/schema.prisma::litellm/proxy/schema.prisma differs from root schema.prisma"
+            EXIT=1
+          }
+
+          diff schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma || {
+            echo "::error file=litellm-proxy-extras/litellm_proxy_extras/schema.prisma::litellm-proxy-extras/litellm_proxy_extras/schema.prisma differs from root schema.prisma"
+            EXIT=1
+          }
+
+          if [ "$EXIT" -ne 0 ]; then
+            echo ""
+            echo "Schema files are out of sync."
+            echo "The root schema.prisma is the source of truth."
+            echo ""
+            echo "To fix, run from the repo root:"
+            echo "  cp schema.prisma litellm/proxy/schema.prisma"
+            echo "  cp schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma"
+            exit 1
+          fi
+
+          echo "All schema copies are in sync with root."

.github/workflows/check_duplicate_issues.yml

@@ -12,7 +12,7 @@ jobs:
       contents: read
     steps:
       - name: Check for potential duplicates
-        uses: wow-actions/potential-duplicates@v1
+        uses: wow-actions/potential-duplicates@4d4ea0352e0383859279938e255179dd1dbb67b5 # v1.1.0
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           label: potential-duplicate
@@ -30,13 +30,14 @@ jobs:
 
       - name: Checkout close script
         if: github.event.action == 'opened'
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           sparse-checkout: .github/scripts
+          persist-credentials: false
 
       - name: Set up Python
         if: github.event.action == 'opened'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.11"
 

.github/workflows/codeql.yml

@@ -6,8 +6,8 @@ on:
   pull_request:
     branches: [main]
   schedule:
-    # Run weekly on Sundays at 04:00 UTC
-    - cron: "0 4 * * 0"
+    # Run daily at 04:00 UTC
+    - cron: "0 4 * * *"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -15,6 +15,7 @@ concurrency:
 
 jobs:
   analyze:
+    if: github.event_name != 'schedule' || github.repository == 'BerriAI/litellm'
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -37,16 +38,18 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/codspeed.yml

@@ -25,20 +25,30 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
-      - name: Install dependencies
-        run: |
-          pip install -e "."
-          pip install pytest pytest-codspeed==4.3.0
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
 
       - name: Run benchmarks
-        uses: CodSpeedHQ/action@v4
+        uses: CodSpeedHQ/action@1c8ae4843586d3ba879736b7f6b7b0c990757fab # v4.12.1
         with:
           mode: simulation
-          run: pytest tests/benchmarks/ --codspeed
+          run: >
+            env PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+            uv run --frozen --no-default-groups
+            --with pytest==8.3.5
+            --with pytest-codspeed==4.3.0
+            pytest
+            -p pytest_codspeed.plugin
+            tests/benchmarks/
+            --codspeed

.github/workflows/create-release.yml

@@ -0,0 +1,107 @@
+name: Create Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v1.83.0-stable)"
+        required: true
+        type: string
+      commit_hash:
+        description: "Full 40-char commit SHA to target"
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  release:
+    name: Create Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Validate inputs
+        env:
+          TAG: ${{ inputs.tag }}
+          COMMIT_HASH: ${{ inputs.commit_hash }}
+        run: |
+          if ! echo "${COMMIT_HASH}" | grep -qE '^[0-9a-f]{40}$'; then
+            echo "::error::commit_hash must be a full 40-character commit SHA"
+            exit 1
+          fi
+          if ! echo "${TAG}" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+'; then
+            echo "::error::tag must start with vX.Y.Z"
+            exit 1
+          fi
+
+      - name: Create release
+        env:
+          TAG: ${{ inputs.tag }}
+          COMMIT_HASH: ${{ inputs.commit_hash }}
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const tag = process.env.TAG;
+            const commitHash = process.env.COMMIT_HASH;
+
+            const cosignSection = [
+              `## Verify Docker Image Signature`,
+              ``,
+              `All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit \`0112e53\`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).`,
+              ``,
+              `**Verify using the pinned commit hash (recommended):**`,
+              ``,
+              `A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:`,
+              ``,
+              '```bash',
+              `cosign verify \\`,
+              `  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \\`,
+              `  ghcr.io/berriai/litellm:${tag}`,
+              '```',
+              ``,
+              `**Verify using the release tag (convenience):**`,
+              ``,
+              `Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:`,
+              ``,
+              '```bash',
+              `cosign verify \\`,
+              `  --key https://raw.githubusercontent.com/BerriAI/litellm/${tag}/cosign.pub \\`,
+              `  ghcr.io/berriai/litellm:${tag}`,
+              '```',
+              ``,
+              `Expected output:`,
+              ``,
+              '```',
+              `The following checks were performed on each of these signatures:`,
+              `  - The cosign claims were validated`,
+              `  - The signatures were verified against the specified public key`,
+              '```',
+              ``,
+              `---`,
+              ``,
+            ].join('\n');
+
+            try {
+              const response = await github.rest.repos.createRelease({
+                draft: true,
+                generate_release_notes: true,
+                target_commitish: commitHash,
+                name: tag,
+                owner: context.repo.owner,
+                prerelease: false,
+                repo: context.repo.repo,
+                tag_name: tag,
+              });
+
+              const updatedBody = cosignSection + (response.data.body ?? '');
+              await github.rest.repos.updateRelease({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                release_id: response.data.id,
+                body: updatedBody,
+                draft: false,
+              });
+            } catch (error) {
+              core.setFailed(error.message);
+            }

.github/workflows/create_daily_staging_branch.yml

@@ -2,18 +2,22 @@ name: Create Daily Staging Branch
 
 on:
   schedule:
-    - cron: '0 0,12 * * *'  # Runs every 12 hours at midnight and noon UTC
-  workflow_dispatch:  # Allow manual trigger
+    - cron: "0 0,12 * * *" # Runs every 12 hours at midnight and noon UTC
+  workflow_dispatch: # Allow manual trigger
 
 jobs:
   create-staging-branch:
+    if: github.repository == 'BerriAI/litellm'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Create daily staging branch
         env:
@@ -43,13 +47,17 @@ jobs:
           fi
 
   create-internal-dev-branch:
+    if: github.repository == 'BerriAI/litellm'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Create internal dev branch
         env:

.github/workflows/ghcr_deploy.yml

@@ -1,444 +0,0 @@
-# this workflow is triggered by an API call when there is a new PyPI release of LiteLLM
-name: Build, Publish LiteLLM Docker Image. New Release
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "The tag version you want to build"
-        required: true
-      release_type:
-        description: "The release type you want to build. Can be 'latest', 'stable', 'dev', 'rc'"
-        type: string
-        default: "latest"
-      commit_hash:
-        description: "Commit hash"
-        required: true
-
-# Defines two custom environment variables for the workflow. Used for the Container registry domain, and a name for the Docker image that this workflow builds.
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-  CHART_NAME: litellm-helm
-
-# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
-jobs:
-  # print commit hash, tag, and release type
-  print:
-    runs-on: ubuntu-latest
-    steps:
-      - run: |
-          echo "Commit hash: ${{ github.event.inputs.commit_hash }}"
-          echo "Tag: ${{ github.event.inputs.tag }}"
-          echo "Release type: ${{ github.event.inputs.release_type }}"
-  docker-hub-deploy:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      -
-        name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      -
-        name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          tags: litellm/litellm:${{ github.event.inputs.tag || 'latest' }} 
-      -
-        name: Build and push litellm-database image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          file: ./docker/Dockerfile.database
-          tags: litellm/litellm-database:${{ github.event.inputs.tag || 'latest' }}
-      -
-        name: Build and push litellm-spend-logs image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          file: ./litellm-js/spend-logs/Dockerfile
-          tags: litellm/litellm-spend_logs:${{ github.event.inputs.tag || 'latest' }}
-      -
-        name: Build and push litellm-non_root image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          file: ./docker/Dockerfile.non_root
-          tags: litellm/litellm-non_root:${{ github.event.inputs.tag || 'latest' }}
-  build-and-push-image:
-    runs-on: ubuntu-latest
-    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-      # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-      # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
-      # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
-      # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
-      - name: Build and push Docker image
-        uses: docker/build-push-action@4976231911ebf5f32aad765192d35f942aa48cb8
-        with:
-          context: .
-          push: true
-          tags: |
-            ${{ steps.meta.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm:main-stable', env.REGISTRY) || '' }},
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm:{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-          labels: ${{ steps.meta.outputs.labels }}
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-  
-  build-and-push-image-ee:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for EE Dockerfile
-        id: meta-ee
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-
-      - name: Build and push EE Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
-        with:
-          context: .
-          file: Dockerfile
-          push: true
-          tags: |
-            ${{ steps.meta-ee.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta-ee.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm-ee:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm-ee:main-stable', env.REGISTRY) || '' }}
-          labels: ${{ steps.meta-ee.outputs.labels }}
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-   
-  build-and-push-image-database:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for database Dockerfile
-        id: meta-database
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-database
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-
-      - name: Build and push Database Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
-        with:
-          context: .
-          file: ./docker/Dockerfile.database
-          push: true
-          tags: |
-            ${{ steps.meta-database.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta-database.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm-database:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm-database:main-stable', env.REGISTRY) || '' }}
-          labels: ${{ steps.meta-database.outputs.labels }}
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-            
-  build-and-push-image-non_root:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for non_root Dockerfile
-        id: meta-non_root
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-non_root
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-
-      - name: Build and push non_root Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
-        with:
-          context: .
-          file: ./docker/Dockerfile.non_root
-          push: true
-          tags: |
-            ${{ steps.meta-non_root.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta-non_root.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm-non_root:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm-non_root:main-stable', env.REGISTRY) || '' }}
-          labels: ${{ steps.meta-non_root.outputs.labels }} 
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-  
-  build-and-push-image-spend-logs:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for spend-logs Dockerfile
-        id: meta-spend-logs
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-spend_logs
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-
-      - name: Build and push Database Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
-        with:
-          context: .
-          file: ./litellm-js/spend-logs/Dockerfile
-          push: true
-          tags: |
-            ${{ steps.meta-spend-logs.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta-spend-logs.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm-spend_logs:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm-spend_logs:main-stable', env.REGISTRY) || '' }}
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-
-  run-observatory-tests:
-    if: github.event.inputs.release_type == 'rc' || github.event.inputs.release_type == 'stable'
-    needs: [docker-hub-deploy]
-    uses: ./.github/workflows/run_observatory_tests.yml
-    with:
-      tag: ${{ github.event.inputs.tag }}
-      commit_hash: ${{ github.event.inputs.commit_hash }}
-    secrets: inherit
-
-  build-and-push-helm-chart:
-    if: github.event.inputs.release_type  != 'dev'
-    needs: [docker-hub-deploy, build-and-push-image, build-and-push-image-database]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: lowercase github.repository_owner
-        run: |
-          echo "REPO_OWNER=`echo ${{github.repository_owner}} | tr '[:upper:]' '[:lower:]'`" >>${GITHUB_ENV}
-    
-      # Sync Helm chart version with LiteLLM release version (1-1 versioning)
-      # This allows users to easily map Helm chart versions to LiteLLM versions
-      # See: https://codefresh.io/docs/docs/ci-cd-guides/helm-best-practices/
-      - name: Calculate chart and app versions
-        id: chart_version
-        shell: bash
-        run: |
-          INPUT_TAG="${{ github.event.inputs.tag }}"
-          RELEASE_TYPE="${{ github.event.inputs.release_type }}"
-
-          # Chart version = LiteLLM version without 'v' prefix (Helm semver convention)
-          # v1.81.0 -> 1.81.0, v1.81.0.rc.1 -> 1.81.0.rc.1
-          CHART_VERSION="${INPUT_TAG#v}"
-
-          # Add suffix for 'latest' releases (rc already has suffix in tag)
-          if [ "$RELEASE_TYPE" = "latest" ]; then
-            CHART_VERSION="${CHART_VERSION}-latest"
-          fi
-
-          # App version = Docker tag (keeps 'v' prefix to match Docker image tags)
-          APP_VERSION="${INPUT_TAG}"
-
-          echo "version=${CHART_VERSION}" | tee -a $GITHUB_OUTPUT
-          echo "app_version=${APP_VERSION}" | tee -a $GITHUB_OUTPUT
-
-      - uses: ./.github/actions/helm-oci-chart-releaser
-        with:
-          name: ${{ env.CHART_NAME }}
-          repository: ${{ env.REPO_OWNER }}
-          tag: ${{ steps.chart_version.outputs.version }}
-          app_version: ${{ steps.chart_version.outputs.app_version }}
-          path: deploy/charts/${{ env.CHART_NAME }}
-          registry: ${{ env.REGISTRY }}
-          registry_username: ${{ github.actor }}
-          registry_password: ${{ secrets.GITHUB_TOKEN }}
-          update_dependencies: true
-
-  release:
-    name: "New LiteLLM Release"
-    needs: [docker-hub-deploy, build-and-push-image, build-and-push-image-database]
-    permissions:
-      contents: write
-    runs-on: "ubuntu-latest"
-   
-    steps:
-      - name: Display version
-        run: echo "Current version is ${{ github.event.inputs.tag }}"
-      - name: "Set Release Tag"
-        run: echo "RELEASE_TAG=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
-      - name: Display release tag
-        run: echo "RELEASE_TAG is $RELEASE_TAG"
-      - name: "Create release"
-        uses: "actions/github-script@v6"
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-          script: |
-            const commitHash = "${{ github.event.inputs.commit_hash}}";
-            console.log("Commit Hash:", commitHash); // Add this line for debugging
-            try {
-              const response = await github.rest.repos.createRelease({
-                draft: false,
-                generate_release_notes: true,
-                target_commitish: commitHash,
-                name: process.env.RELEASE_TAG,
-                owner: context.repo.owner,
-                prerelease: false,
-                repo: context.repo.repo,
-                tag_name: process.env.RELEASE_TAG,
-              });
-      
-              core.exportVariable('RELEASE_ID', response.data.id);
-              core.exportVariable('RELEASE_UPLOAD_URL', response.data.upload_url);
-            } catch (error) {
-              core.setFailed(error.message);
-            }
-      - name: Fetch Release Notes
-        id: release-notes
-        uses: actions/github-script@v6
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-          script: |
-            try {
-              const response = await github.rest.repos.getRelease({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                release_id: process.env.RELEASE_ID,
-              });
-              const formattedBody = JSON.stringify(response.data.body).slice(1, -1);
-              return formattedBody;
-            } catch (error) {
-              core.setFailed(error.message);
-            }
-        env:
-          RELEASE_ID: ${{ env.RELEASE_ID }}
-      - name: Github Releases To Discord
-        env:
-          WEBHOOK_URL: ${{ secrets.WEBHOOK_URL }}
-          REALEASE_TAG: ${{ env.RELEASE_TAG }}
-          RELEASE_NOTES: ${{ steps.release-notes.outputs.result }}
-        run: |
-          curl -H "Content-Type: application/json" -X POST -d '{
-            "content": "New LiteLLM release '"${RELEASE_TAG}"'",
-            "username": "Release Changelog",
-            "avatar_url": "https://cdn.discordapp.com/avatars/487431320314576937/bd64361e4ba6313d561d54e78c9e7171.png",
-            "embeds": [
-              {
-                "title": "Changelog for LiteLLM '"${RELEASE_TAG}"'",
-                "description": "'"${RELEASE_NOTES}"'",
-                "color": 2105893
-              }
-            ]
-          }' $WEBHOOK_URL
-

.github/workflows/ghcr_helm_deploy.yml

@@ -1,67 +0,0 @@
-# Standalone workflow to publish LiteLLM Helm Chart
-# Note: The main ghcr_deploy.yml workflow also publishes the Helm chart as part of a full release
-name: Build, Publish LiteLLM Helm Chart. New Release
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "LiteLLM version tag (e.g., v1.81.0)"
-        required: true
-
-# Defines two custom environment variables for the workflow. Used for the Container registry domain, and a name for the Docker image that this workflow builds.
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-  REPO_OWNER: ${{github.repository_owner}}
-
-# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
-jobs:        
-  build-and-push-helm-chart:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      
-      - name: lowercase github.repository_owner
-        run: |
-          echo "REPO_OWNER=`echo ${{github.repository_owner}} | tr '[:upper:]' '[:lower:]'`" >>${GITHUB_ENV}
-
-      # Sync Helm chart version with LiteLLM release version (1-1 versioning)
-      - name: Calculate chart and app versions
-        id: chart_version
-        shell: bash
-        run: |
-          INPUT_TAG="${{ github.event.inputs.tag }}"
-
-          # Chart version = LiteLLM version without 'v' prefix
-          # v1.81.0 -> 1.81.0
-          CHART_VERSION="${INPUT_TAG#v}"
-
-          # App version = Docker tag (keeps 'v' prefix)
-          APP_VERSION="${INPUT_TAG}"
-
-          echo "version=${CHART_VERSION}" | tee -a $GITHUB_OUTPUT
-          echo "app_version=${APP_VERSION}" | tee -a $GITHUB_OUTPUT
-
-      - name: Lint helm chart
-        run: helm lint deploy/charts/litellm-helm
-
-      - uses: ./.github/actions/helm-oci-chart-releaser
-        with:
-          name: litellm-helm
-          repository: ${{ env.REPO_OWNER }}
-          tag: ${{ steps.chart_version.outputs.version }}
-          app_version: ${{ steps.chart_version.outputs.app_version }}
-          path: deploy/charts/litellm-helm
-          registry: ${{ env.REGISTRY }}
-          registry_username: ${{ github.actor }}
-          registry_password: ${{ secrets.GITHUB_TOKEN }}
-          update_dependencies: true
-  

.github/workflows/guard-main-branch.yml

@@ -0,0 +1,42 @@
+name: Guard main branch
+
+on:
+  pull_request:
+    branches:
+      - main
+  merge_group:
+
+permissions: {}
+
+# DO NOT RENAME the job's `name:` — it is referenced by GitHub branch
+# protection as a required status check on `main`. Renaming silently
+# breaks the gate.
+jobs:
+  guard:
+    name: Verify PR source branch
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Reject merge_group events
+        if: github.event_name == 'merge_group'
+        run: |
+          echo "::error::Merge queue is not supported for main. Disable merge queue or update this guard."
+          exit 1
+      - name: Check head branch name
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          BASE_REPO: ${{ github.repository }}
+        run: |
+          echo "PR head repo: $HEAD_REPO"
+          echo "PR head branch: $HEAD_REF"
+          if [ "$HEAD_REPO" != "$BASE_REPO" ]; then
+            echo "::error::PRs to main must originate from the canonical repository ($BASE_REPO), not a fork ($HEAD_REPO). External contributors should open PRs against the 'litellm_oss_branch' branch instead."
+            exit 1
+          fi
+          if [ "$HEAD_REF" = "litellm_internal_staging" ] || [[ "$HEAD_REF" == litellm_hotfix_?* ]]; then
+            echo "Allowed source branch."
+            exit 0
+          fi
+          echo "::error::PRs to main must originate from 'litellm_internal_staging' or a 'litellm_hotfix_*' branch. Got: '$HEAD_REF'. If this is a contribution, retarget the PR against 'litellm_oss_branch' instead."
+          exit 1

.github/workflows/helm_unit_test.yml

@@ -6,22 +6,36 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   unit-test:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Set up Helm 3.11.1
-        uses: azure/setup-helm@v1
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
         with:
-          version: '3.11.1'
+          version: "3.11.1"
 
       - name: Install Helm Unit Test Plugin
         run: |
           helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.4.4
+      - name: Verify Helm Unit Test Plugin integrity
+        run: |
+          EXPECTED_SHA="e251ba198448629678ff2168e1a469249d998155"
+          PLUGIN_DIR="$(helm env HELM_PLUGINS)/helm-unittest"
+          ACTUAL_SHA="$(git -C "$PLUGIN_DIR" rev-parse HEAD)"
+          if [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then
+            echo "::error::Helm unittest plugin checksum mismatch! Expected $EXPECTED_SHA but got $ACTUAL_SHA"
+            exit 1
+          fi
+          echo "Helm unittest plugin integrity verified: $ACTUAL_SHA"
 
       - name: Run unit tests
-        run:
-          helm unittest -f 'tests/*.yaml' deploy/charts/litellm-helm
+        run: helm unittest -f 'tests/*.yaml' deploy/charts/litellm-helm

.github/workflows/interpret_load_test.py

@@ -1,139 +0,0 @@
-import csv
-import os
-from github import Github
-
-
-def interpret_results(csv_file):
-    with open(csv_file, newline="") as csvfile:
-        csvreader = csv.DictReader(csvfile)
-        rows = list(csvreader)
-        """
-        in this csv reader
-        - Create 1 new column "Status"
-        - if a row has a median response time < 300 and an average response time < 300, Status = "Passed ✅"
-        - if a row has a median response time >= 300 or an average response time >= 300, Status = "Failed ❌"
-        - Order the table in this order Name, Status, Median Response Time, Average Response Time, Requests/s,Failures/s, Min Response Time, Max Response Time, all other columns
-        """
-
-        # Add a new column "Status"
-        for row in rows:
-            median_response_time = float(
-                row["Median Response Time"].strip().rstrip("ms")
-            )
-            average_response_time = float(
-                row["Average Response Time"].strip().rstrip("s")
-            )
-
-            request_count = int(row["Request Count"])
-            failure_count = int(row["Failure Count"])
-
-            failure_percent = round((failure_count / request_count) * 100, 2)
-
-            # Determine status based on conditions
-            if (
-                median_response_time < 300
-                and average_response_time < 300
-                and failure_percent < 5
-            ):
-                row["Status"] = "Passed ✅"
-            else:
-                row["Status"] = "Failed ❌"
-
-        # Construct Markdown table header
-        markdown_table = "| Name | Status | Median Response Time (ms) | Average Response Time (ms) | Requests/s | Failures/s | Request Count | Failure Count | Min Response Time (ms) | Max Response Time (ms) |"
-        markdown_table += (
-            "\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |"
-        )
-
-        # Construct Markdown table rows
-        for row in rows:
-            markdown_table += f"\n| {row['Name']} | {row['Status']} | {row['Median Response Time']} | {row['Average Response Time']} | {row['Requests/s']} | {row['Failures/s']} | {row['Request Count']} | {row['Failure Count']} | {row['Min Response Time']} | {row['Max Response Time']} |"
-    print("markdown table: ", markdown_table)
-    return markdown_table
-
-
-def _get_docker_run_command_stable_release(release_version):
-    return f"""
-\n\n
-## Docker Run LiteLLM Proxy
-
-```
-docker run \\
--e STORE_MODEL_IN_DB=True \\
--p 4000:4000 \\
-ghcr.io/berriai/litellm:litellm_stable_release_branch-{release_version}
-```
-    """
-
-
-def _get_docker_run_command(release_version):
-    return f"""
-\n\n
-## Docker Run LiteLLM Proxy
-
-```
-docker run \\
--e STORE_MODEL_IN_DB=True \\
--p 4000:4000 \\
-ghcr.io/berriai/litellm:main-{release_version}
-```
-    """
-
-
-def get_docker_run_command(release_version):
-    if "stable" in release_version:
-        return _get_docker_run_command_stable_release(release_version)
-    else:
-        return _get_docker_run_command(release_version)
-
-
-if __name__ == "__main__":
-    return
-    csv_file = "load_test_stats.csv"  # Change this to the path of your CSV file
-    markdown_table = interpret_results(csv_file)
-
-    # Update release body with interpreted results
-    github_token = os.getenv("GITHUB_TOKEN")
-    g = Github(github_token)
-    repo = g.get_repo(
-        "BerriAI/litellm"
-    )  # Replace with your repository's username and name
-    latest_release = repo.get_latest_release()
-    print("got latest release: ", latest_release)
-    print(latest_release.title)
-    print(latest_release.tag_name)
-
-    release_version = latest_release.title
-
-    print("latest release body: ", latest_release.body)
-    print("markdown table: ", markdown_table)
-
-    # check if "Load Test LiteLLM Proxy Results" exists
-    existing_release_body = latest_release.body
-    if "Load Test LiteLLM Proxy Results" in latest_release.body:
-        # find the "Load Test LiteLLM Proxy Results" section and delete it
-        start_index = latest_release.body.find("Load Test LiteLLM Proxy Results")
-        existing_release_body = latest_release.body[:start_index]
-
-    docker_run_command = get_docker_run_command(release_version)
-    print("docker run command: ", docker_run_command)
-
-    new_release_body = (
-        existing_release_body
-        + docker_run_command
-        + "\n\n"
-        + "### Don't want to maintain your internal proxy? get in touch 🎉"
-        + "\nHosted Proxy Alpha: https://calendly.com/d/cx9p-5yf-2nm/litellm-introductions"
-        + "\n\n"
-        + "## Load Test LiteLLM Proxy Results"
-        + "\n\n"
-        + markdown_table
-    )
-    print("new release body: ", new_release_body)
-    try:
-        latest_release.update_release(
-            name=latest_release.tag_name,
-            message=new_release_body,
-        )
-    except Exception as e:
-        print(e)

.github/workflows/issue-keyword-labeler.yml

@@ -2,8 +2,8 @@ name: Issue Keyword Labeler
 
 on:
   issues:
-    types: 
-        - opened
+    types:
+      - opened
 
 jobs:
   scan-and-label:
@@ -13,7 +13,9 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Scan for provider keywords
         id: scan
@@ -24,7 +26,7 @@ jobs:
 
       - name: Ensure label exists
         if: steps.scan.outputs.found == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -51,7 +53,7 @@ jobs:
 
       - name: Add label to the issue
         if: steps.scan.outputs.found == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -61,4 +63,3 @@ jobs:
               issue_number: context.issue.number,
               labels: ['llm translation']
             });
-

.github/workflows/label-component.yml

@@ -12,7 +12,7 @@ jobs:
       issues: write
     steps:
       - name: Add component labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/llm-translation-testing.yml

@@ -4,54 +4,56 @@ on:
   workflow_dispatch:
     inputs:
       release_candidate_tag:
-        description: 'Release candidate tag/version'
+        description: "Release candidate tag/version"
         required: true
         type: string
   push:
     tags:
-      - 'v*-rc*'  # Triggers on release candidate tags like v1.0.0-rc1
-  
+      - "v*-rc*" # Triggers on release candidate tags like v1.0.0-rc1
+
+permissions:
+  contents: read
+
 jobs:
   run-llm-translation-tests:
     runs-on: ubuntu-latest
     timeout-minutes: 90
-    
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
+          persist-credentials: false
           ref: ${{ github.event.inputs.release_candidate_tag || github.ref }}
-      
+
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
-          python-version: '3.11'
-      
-      - name: Install Poetry
-        uses: snok/install-poetry@v1
+          python-version: "3.11"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
-          version: latest
-          virtualenvs-create: true
-          virtualenvs-in-project: true
-      
-      - name: Cache Poetry dependencies
-        uses: actions/cache@v3
+          version: "0.10.9"
+          enable-cache: false
+
+      - name: Restore uv dependencies cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
-            ~/.cache/pypoetry
+            ~/.cache/uv
             .venv
-          key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }}
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
           restore-keys: |
-            ${{ runner.os }}-poetry-
-      
+            ${{ runner.os }}-uv-
+
       - name: Install dependencies
         run: |
-          poetry install --with dev
-          poetry run pip install pytest-xdist pytest-timeout
-      
+          uv sync --frozen
+
       - name: Create test results directory
         run: mkdir -p test-results
-      
+
       - name: Run LLM Translation Tests
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -61,13 +63,14 @@ jobs:
           AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }}
           AZURE_API_BASE: ${{ secrets.AZURE_API_BASE }}
           AZURE_API_VERSION: ${{ secrets.AZURE_API_VERSION }}
-          # Add other API keys as needed
+          RC_TAG: ${{ github.event.inputs.release_candidate_tag || github.ref_name }}
+          COMMIT_SHA: ${{ github.sha }}
         run: |
           python .github/workflows/run_llm_translation_tests.py \
-            --tag "${{ github.event.inputs.release_candidate_tag || github.ref_name }}" \
-            --commit "${{ github.sha }}" \
+            --tag "$RC_TAG" \
+            --commit "$COMMIT_SHA" \
             || true  # Continue even if tests fail
-      
+
       - name: Display test summary
         if: always()
         run: |
@@ -79,9 +82,9 @@ jobs:
           else
             echo "Warning: Test report was not generated"
           fi
-      
+
       - name: Upload test artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: LLM-Translation-Artifact-${{ github.event.inputs.release_candidate_tag || github.ref_name }}

.github/workflows/load_test.yml

@@ -1,59 +0,0 @@
-name: Test Locust Load Test
-
-on:
-  workflow_run:
-    workflows: ["Build, Publish LiteLLM Docker Image. New Release"]
-    types:
-      - completed
-  workflow_dispatch:
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v1
-      - name: Setup Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: '3.x'
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install PyGithub
-      - name: re-deploy proxy
-        run: |
-          echo "Current working directory: $PWD"
-          ls
-          python ".github/workflows/redeploy_proxy.py"
-        env:
-          LOAD_TEST_REDEPLOY_URL1: ${{ secrets.LOAD_TEST_REDEPLOY_URL1 }}
-          LOAD_TEST_REDEPLOY_URL2: ${{ secrets.LOAD_TEST_REDEPLOY_URL2 }}
-        working-directory: ${{ github.workspace }}
-      - name: Run Load Test
-        id: locust_run
-        uses: BerriAI/locust-github-action@master
-        with:
-          LOCUSTFILE: ".github/workflows/locustfile.py"
-          URL:  "https://post-release-load-test-proxy.onrender.com/"
-          USERS: "20"
-          RATE: "20"
-          RUNTIME: "300s"
-      - name: Process Load Test Stats
-        run: |
-          echo "Current working directory: $PWD"
-          ls
-          python ".github/workflows/interpret_load_test.py"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        working-directory: ${{ github.workspace }}
-      - name: Upload CSV as Asset to Latest Release
-        uses: xresloader/upload-to-github-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          file: "load_test_stats.csv;load_test.html"
-          update_latest_release: true
-          tag_name: "load-test"
-          overwrite: true

.github/workflows/locustfile.py

@@ -1,28 +0,0 @@
-from locust import HttpUser, task, between
-
-
-class MyUser(HttpUser):
-    wait_time = between(1, 5)
-
-    @task
-    def chat_completion(self):
-        headers = {
-            "Content-Type": "application/json",
-            "Authorization": "Bearer sk-8N1tLOOyH8TIxwOLahhIVg",
-            # Include any additional headers you may need for authentication, etc.
-        }
-
-        # Customize the payload with "model" and "messages" keys
-        payload = {
-            "model": "fake-openai-endpoint",
-            "messages": [
-                {"role": "system", "content": "You are a chat bot."},
-                {"role": "user", "content": "Hello, how are you?"},
-            ],
-            # Add more data as necessary
-        }
-
-        # Make a POST request to the "chat/completions" endpoint
-        response = self.client.post("chat/completions", json=payload, headers=headers)
-
-        # Print or log the response if needed

.github/workflows/main.yml

@@ -1,34 +0,0 @@
-name: Publish Dev Release to PyPI
-
-on:
-  workflow_dispatch:
-  
-jobs:
-  publish-dev-release:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Set up Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: 3.8  # Adjust the Python version as needed
-
-      - name: Install dependencies
-        run: pip install toml twine
-
-      - name: Read version from pyproject.toml
-        id: read-version
-        run: |
-          version=$(python -c 'import toml; print(toml.load("pyproject.toml")["tool"]["commitizen"]["version"])')
-          printf "LITELLM_VERSION=%s" "$version" >> $GITHUB_ENV
-
-      - name: Check if version exists on PyPI
-        id: check-version
-        run: |
-          set -e
-          if twine check --repository-url https://pypi.org/simple/ "litellm==$LITELLM_VERSION" >/dev/null 2>&1; then
-            echo "Version $LITELLM_VERSION already exists on PyPI. Skipping publish."
-     

.github/workflows/publish-migrations.yml

@@ -1,207 +0,0 @@
-name: Publish Prisma Migrations
-
-permissions:
-  contents: write
-  pull-requests: write
-
-on:
-  push:
-    paths:
-      - 'schema.prisma'  # Check root schema.prisma
-    branches:
-      - main
-
-jobs:
-  publish-migrations:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:14
-        env:
-          POSTGRES_DB: temp_db
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-      
-      # Add shadow database service
-      postgres_shadow:
-        image: postgres:14
-        env:
-          POSTGRES_DB: shadow_db
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-        ports:
-          - 5433:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.x'
-
-      - name: Install Dependencies
-        run: |
-          pip install prisma
-          pip install python-dotenv
-
-      - name: Generate Initial Migration if None Exists
-        env:
-          DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          SHADOW_DATABASE_URL: "postgresql://postgres:postgres@localhost:5433/shadow_db"
-        run: |
-          mkdir -p deploy/migrations
-          echo 'provider = "postgresql"' > deploy/migrations/migration_lock.toml
-          
-          if [ -z "$(ls -A deploy/migrations/2* 2>/dev/null)" ]; then
-            echo "No existing migrations found, creating baseline..."
-            VERSION=$(date +%Y%m%d%H%M%S)
-            mkdir -p deploy/migrations/${VERSION}_initial
-            
-            echo "Generating initial migration..."
-            # Save raw output for debugging
-            prisma migrate diff \
-              --from-empty \
-              --to-schema-datamodel schema.prisma \
-              --shadow-database-url "${SHADOW_DATABASE_URL}" \
-              --script > deploy/migrations/${VERSION}_initial/raw_migration.sql
-            
-            echo "Raw migration file content:"
-            cat deploy/migrations/${VERSION}_initial/raw_migration.sql
-            
-            echo "Cleaning migration file..."
-            # Clean the file
-            sed '/^Installing/d' deploy/migrations/${VERSION}_initial/raw_migration.sql > deploy/migrations/${VERSION}_initial/migration.sql
-            
-            # Verify the migration file
-            if [ ! -s deploy/migrations/${VERSION}_initial/migration.sql ]; then
-              echo "ERROR: Migration file is empty after cleaning"
-              echo "Original content was:"
-              cat deploy/migrations/${VERSION}_initial/raw_migration.sql
-              exit 1
-            fi
-            
-            echo "Final migration file content:"
-            cat deploy/migrations/${VERSION}_initial/migration.sql
-            
-            # Verify it starts with SQL
-            if ! head -n 1 deploy/migrations/${VERSION}_initial/migration.sql | grep -q "^--\|^CREATE\|^ALTER"; then
-              echo "ERROR: Migration file does not start with SQL command or comment"
-              echo "First line is:"
-              head -n 1 deploy/migrations/${VERSION}_initial/migration.sql
-              echo "Full content is:"
-              cat deploy/migrations/${VERSION}_initial/migration.sql
-              exit 1
-            fi
-            
-            echo "Initial migration generated at $(date -u)" > deploy/migrations/${VERSION}_initial/README.md
-          fi
-
-      - name: Compare and Generate Migration
-        if: success()
-        env:
-          DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          SHADOW_DATABASE_URL: "postgresql://postgres:postgres@localhost:5433/shadow_db"
-        run: |
-          # Create temporary migration workspace
-          mkdir -p temp_migrations
-          
-          # Copy existing migrations (will not fail if directory is empty)
-          cp -r deploy/migrations/* temp_migrations/ 2>/dev/null || true
-          
-          VERSION=$(date +%Y%m%d%H%M%S)
-          
-          # Generate diff against existing migrations or empty state
-          prisma migrate diff \
-            --from-migrations temp_migrations \
-            --to-schema-datamodel schema.prisma \
-            --shadow-database-url "${SHADOW_DATABASE_URL}" \
-            --script > temp_migrations/migration_${VERSION}.sql
-          
-          # Check if there are actual changes
-          if [ -s temp_migrations/migration_${VERSION}.sql ]; then
-            echo "Changes detected, creating new migration"
-            mkdir -p deploy/migrations/${VERSION}_schema_update
-            mv temp_migrations/migration_${VERSION}.sql deploy/migrations/${VERSION}_schema_update/migration.sql
-            echo "Migration generated at $(date -u)" > deploy/migrations/${VERSION}_schema_update/README.md
-          else
-            echo "No schema changes detected"
-            exit 0
-          fi
-
-      - name: Verify Migration
-        if: success()
-        env:
-          DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          SHADOW_DATABASE_URL: "postgresql://postgres:postgres@localhost:5433/shadow_db"
-        run: |
-          # Create test database
-          psql "${SHADOW_DATABASE_URL}" -c 'CREATE DATABASE migration_test;'
-          
-          # Apply all migrations in order to verify
-          for migration in deploy/migrations/*/migration.sql; do
-            echo "Applying migration: $migration"
-            psql "${SHADOW_DATABASE_URL}" -f $migration
-          done
-
-      # Add this step before create-pull-request to debug permissions
-      - name: Check Token Permissions
-        run: |
-          echo "Checking token permissions..."
-          curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
-               -H "Accept: application/vnd.github.v3+json" \
-               https://api.github.com/repos/BerriAI/litellm/collaborators
-          
-          echo "\nChecking if token can create PRs..."
-          curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
-               -H "Accept: application/vnd.github.v3+json" \
-               https://api.github.com/repos/BerriAI/litellm
-
-      # Add this debug step before git push
-      - name: Debug Changed Files
-        run: |
-          echo "Files staged for commit:"
-          git diff --name-status --staged
-          
-          echo "\nAll changed files:"
-          git status
-
-      - name: Create Pull Request
-        if: success()
-        uses: peter-evans/create-pull-request@v5
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: "chore: update prisma migrations"
-          title: "Update Prisma Migrations"
-          body: |
-            Auto-generated migration based on schema.prisma changes.
-            
-            Generated files:
-            - deploy/migrations/${VERSION}_schema_update/migration.sql
-            - deploy/migrations/${VERSION}_schema_update/README.md
-          branch: feat/prisma-migration-${{ env.VERSION }}
-          base: main
-          delete-branch: true
-
-      - name: Generate and Save Migrations
-        run: |
-          # Only add migration files
-          git add deploy/migrations/
-          git status  # Debug what's being committed
-          git commit -m "chore: update prisma migrations" 

.github/workflows/publish_enterprise.yml

@@ -1,94 +0,0 @@
-name: Publish litellm-enterprise to PyPI
-
-on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: "Version bump type"
-        required: true
-        default: "patch"
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    if: github.repository == 'BerriAI/litellm'
-    permissions:
-      contents: write
-      pull-requests: write
-    defaults:
-      run:
-        working-directory: enterprise
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install Poetry
-        run: pip install poetry
-
-      - name: Bump version
-        id: bump
-        run: |
-          OLD=$(poetry version -s)
-          poetry version ${{ github.event.inputs.bump }}
-          NEW=$(poetry version -s)
-          echo "old=$OLD" >> $GITHUB_OUTPUT
-          echo "new=$NEW" >> $GITHUB_OUTPUT
-
-      - name: Update version refs in root pyproject.toml and requirements.txt
-        run: |
-          OLD=${{ steps.bump.outputs.old }}
-          NEW=${{ steps.bump.outputs.new }}
-          sed -i "s/litellm-enterprise = {version = \"${OLD}\"/litellm-enterprise = {version = \"${NEW}\"/" ../pyproject.toml
-          sed -i "s/litellm-enterprise==${OLD}/litellm-enterprise==${NEW}/" ../requirements.txt
-
-      - name: Update poetry.lock
-        working-directory: .
-        run: poetry lock
-
-      - name: Build
-        run: poetry build
-
-      - name: Commit version bump and create PR
-        id: create-pr
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          cd ..
-          BRANCH="bump/enterprise-${{ steps.bump.outputs.new }}"
-          git checkout -b "$BRANCH"
-          git add enterprise/pyproject.toml pyproject.toml requirements.txt poetry.lock
-          git commit -m "bump: litellm-enterprise ${{ steps.bump.outputs.old }} → ${{ steps.bump.outputs.new }}"
-          git push origin "$BRANCH" --force
-          gh pr create \
-            --title "bump: litellm-enterprise ${{ steps.bump.outputs.old }} → ${{ steps.bump.outputs.new }}" \
-            --body "Version bump for litellm-enterprise. Merge to update main." \
-            --head "$BRANCH" \
-            --base main \
-          || true
-          PR_URL=$(gh pr list --head "$BRANCH" --json url -q '.[0].url')
-          echo "pr_url=$PR_URL" >> $GITHUB_OUTPUT
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-      - name: Enable auto-merge
-        run: |
-          gh pr merge "${{ steps.create-pr.outputs.pr_url }}" --auto --squash
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-      - name: Publish to PyPI
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_ENTERPRISE }}
-        run: |
-          pip install twine
-          twine upload dist/litellm_enterprise-${{ steps.bump.outputs.new }}*

.github/workflows/publish_proxy_extras.yml

@@ -1,74 +0,0 @@
-name: Publish litellm-proxy-extras to PyPI
-
-on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: "Version bump type"
-        required: true
-        default: "patch"
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    if: github.repository == 'BerriAI/litellm'
-    permissions:
-      contents: write
-    defaults:
-      run:
-        working-directory: litellm-proxy-extras
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install Poetry
-        run: pip install poetry
-
-      - name: Bump version
-        id: bump
-        run: |
-          OLD=$(poetry version -s)
-          poetry version ${{ github.event.inputs.bump }}
-          NEW=$(poetry version -s)
-          echo "old=$OLD" >> $GITHUB_OUTPUT
-          echo "new=$NEW" >> $GITHUB_OUTPUT
-
-      - name: Update version refs in root pyproject.toml and requirements.txt
-        run: |
-          OLD=${{ steps.bump.outputs.old }}
-          NEW=${{ steps.bump.outputs.new }}
-          sed -i "s/litellm-proxy-extras = {version = \"${OLD}\"/litellm-proxy-extras = {version = \"${NEW}\"/" ../pyproject.toml
-          sed -i "s/litellm-proxy-extras==${OLD}/litellm-proxy-extras==${NEW}/" ../requirements.txt
-
-      - name: Update poetry.lock
-        working-directory: .
-        run: poetry lock
-
-      - name: Build
-        run: poetry build
-
-      - name: Commit version bump
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          cd ..
-          git add litellm-proxy-extras/pyproject.toml pyproject.toml requirements.txt poetry.lock
-          git commit -m "bump: litellm-proxy-extras ${{ steps.bump.outputs.old }} → ${{ steps.bump.outputs.new }}"
-          git push
-
-      - name: Publish to PyPI
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_PUBLISH_PASSWORD }}
-        run: |
-          pip install twine
-          twine upload dist/litellm_proxy_extras-${{ steps.bump.outputs.new }}*

.github/workflows/publish_to_pypi.yml

@@ -0,0 +1,153 @@
+name: Publish to PyPI
+
+on:
+  workflow_dispatch:
+
+jobs:
+  preflight-checks:
+    name: Preflight Checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    # No environment — read-only checks, no approval needed
+    outputs:
+      needs_publish: ${{ steps.check-litellm.outputs.needs_publish }}
+      version: ${{ steps.check-litellm.outputs.version }}
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+          enable-cache: false
+
+      - name: Check litellm version on PyPI
+        id: check-litellm
+        run: |
+          VERSION=$(python - <<'PY'
+          import tomllib
+
+          with open("pyproject.toml", "rb") as f:
+              print(tomllib.load(f)["project"]["version"])
+          PY
+          )
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Checking if litellm $VERSION exists on PyPI..."
+
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm/$VERSION/json")
+          if [ "$HTTP_STATUS" = "200" ]; then
+            echo "litellm $VERSION already exists on PyPI. Skipping publish."
+            echo "needs_publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "litellm $VERSION not found on PyPI. Publish needed."
+            echo "needs_publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Sanity check proxy-extras version
+        run: |
+          # Read pinned version from project optional dependencies
+          PYPROJECT_VERSION=$(python3 - <<'PY'
+          import sys
+          import tomllib
+
+          with open("pyproject.toml", "rb") as f:
+              proxy_requirements = tomllib.load(f)["project"]["optional-dependencies"]["proxy"]
+
+          version = None
+          for requirement in proxy_requirements:
+              normalized = requirement.split(";", 1)[0].strip()
+              if not normalized.startswith("litellm-proxy-extras"):
+                  continue
+              parts = normalized.split("==", 1)
+              if len(parts) == 2 and parts[0].strip() == "litellm-proxy-extras":
+                  candidate = parts[1].strip()
+                  if candidate:
+                      version = candidate
+                      break
+
+          if version is None:
+              print(
+                  "::error::Could not find an exact litellm-proxy-extras pin in project.optional-dependencies.proxy",
+                  file=sys.stderr,
+              )
+              sys.exit(1)
+
+          print(version)
+          PY
+          )
+          echo "pyproject.toml pins litellm-proxy-extras version: $PYPROJECT_VERSION"
+
+          # Check that the pinned version exists on PyPI
+          echo "Checking if litellm-proxy-extras $PYPROJECT_VERSION exists on PyPI..."
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm-proxy-extras/$PYPROJECT_VERSION/json")
+          if [ "$HTTP_STATUS" != "200" ]; then
+            echo "::error::litellm-proxy-extras $PYPROJECT_VERSION is not published on PyPI yet. Publish it before releasing litellm."
+            exit 1
+          fi
+          echo "litellm-proxy-extras $PYPROJECT_VERSION exists on PyPI. Sanity check passed."
+
+  publish-litellm:
+    name: Publish litellm to PyPI
+    needs: preflight-checks
+    if: needs.preflight-checks.outputs.needs_publish == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      id-token: write
+      contents: read
+    environment: pypi-publish
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+          enable-cache: false
+
+      - name: Copy model prices backup
+        run: cp model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
+
+      - name: Build package
+        run: |
+          rm -rf build dist
+          uv build
+
+      - name: Verify build artifacts
+        env:
+          EXPECTED_VERSION: ${{ needs.preflight-checks.outputs.version }}
+        run: |
+          echo "Contents of dist/:"
+          ls -la dist/
+          # Ensure we have both sdist and wheel
+          ls dist/*.tar.gz
+          ls dist/*.whl
+          # Verify built version matches expected
+          ls dist/ | grep -q "litellm-${EXPECTED_VERSION}" || {
+            echo "::error::Built artifacts do not match expected version $EXPECTED_VERSION"
+            ls dist/
+            exit 1
+          }
+
+      - name: Validate package metadata
+        run: |
+          uv tool run --from 'twine==6.2.0' twine check dist/*
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

.github/workflows/read_pyproject_version.yml

@@ -3,7 +3,10 @@ name: Read Version from pyproject.toml
 on:
   push:
     branches:
-      - main  # Change this to the default branch of your repository
+      - main # Change this to the default branch of your repository
+
+permissions:
+  contents: read
 
 jobs:
   read-version:
@@ -11,20 +14,14 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
-          python-version: 3.8  # Adjust the Python version as needed
-
-      - name: Install dependencies
-        run: pip install toml
+          persist-credentials: false
 
       - name: Read version from pyproject.toml
         id: read-version
         run: |
-          version=$(python -c 'import toml; print(toml.load("pyproject.toml")["tool"]["commitizen"]["version"])')
+          version=$(grep -m1 '^version' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
           printf "LITELLM_VERSION=%s" "$version" >> $GITHUB_ENV
 
       - name: Display version

.github/workflows/redeploy_proxy.py

@@ -1,20 +0,0 @@
-"""
-
-redeploy_proxy.py
-"""
-
-import os
-import requests
-import time
-
-# send a get request to this endpoint
-deploy_hook1 = os.getenv("LOAD_TEST_REDEPLOY_URL1")
-response = requests.get(deploy_hook1, timeout=20)
-
-
-deploy_hook2 = os.getenv("LOAD_TEST_REDEPLOY_URL2")
-response = requests.get(deploy_hook2, timeout=20)
-
-print("SENT GET REQUESTS to re-deploy proxy")
-print("sleeeping.... for 60s")
-time.sleep(60)

.github/workflows/regenerate-poetry-lock.yml

@@ -1,80 +0,0 @@
-name: Regenerate poetry.lock
-
-# Runs whenever pyproject.toml is merged into main (the most common cause of
-# the "pyproject.toml changed significantly since poetry.lock was last generated"
-# CI failure).  Can also be triggered manually.
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - pyproject.toml
-  workflow_dispatch:
-
-permissions:
-  contents: write       # needed to push the auto/regenerate-poetry-lock-* branch
-  pull-requests: write  # needed to open the PR and enable auto-merge
-
-jobs:
-  regenerate-lock:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install Poetry
-        run: pip install poetry
-
-      - name: Regenerate poetry.lock
-        run: poetry lock
-
-      - name: Check whether poetry.lock actually changed
-        id: diff
-        run: |
-          if git diff --quiet poetry.lock; then
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Open PR with the refreshed lock file
-        if: steps.diff.outputs.changed == 'true'
-        id: open-pr
-        run: |
-          BRANCH="auto/regenerate-poetry-lock-$(date +'%Y%m%d%H%M%S')"
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git checkout -b "$BRANCH"
-          git add poetry.lock
-          git commit -m "chore: regenerate poetry.lock to match pyproject.toml"
-          git push -f origin "$BRANCH"
-
-          cat > /tmp/pr-body.md << 'BODY'
-          Automated regeneration of `poetry.lock` after `pyproject.toml` was updated on `main`.
-
-          Fixes the recurring CI failure:
-          ```
-          pyproject.toml changed significantly since poetry.lock was last generated.
-          Run `poetry lock` to fix the lock file.
-          ```
-          BODY
-
-          PR_URL=$(gh pr create \
-            --title "chore: regenerate poetry.lock to match pyproject.toml" \
-            --body-file /tmp/pr-body.md \
-            --head "$BRANCH" \
-            --base main)
-          echo "pr_url=$PR_URL" >> "$GITHUB_OUTPUT"
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-      - name: Enable auto-merge
-        if: steps.diff.outputs.changed == 'true'
-        run: |
-          gh pr merge "${{ steps.open-pr.outputs.pr_url }}" --auto --squash
-        env:
-          GH_TOKEN: ${{ github.token }}

.github/workflows/reset_stable.yml

@@ -1,39 +0,0 @@
-name: Reset litellm_stable branch
-
-on:
-  release:
-    types: [published, created]
-jobs:
-  update-stable-branch:
-    if: ${{ startsWith(github.event.release.tag_name, 'v') && !endsWith(github.event.release.tag_name, '-stable') }}
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Reset litellm_stable_release_branch branch to the release commit
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Configure Git user
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          
-          # Fetch all branches and tags
-          git fetch --all
-
-          # Check if the litellm_stable_release_branch branch exists
-          if git show-ref --verify --quiet refs/remotes/origin/litellm_stable_release_branch; then
-            echo "litellm_stable_release_branch branch exists."
-            git checkout litellm_stable_release_branch
-          else
-            echo "litellm_stable_release_branch branch does not exist. Creating it."
-            git checkout -b litellm_stable_release_branch
-          fi
-
-          # Reset litellm_stable_release_branch branch to the release commit
-          git reset --hard $GITHUB_SHA
-
-          # Push the updated litellm_stable_release_branch branch
-          git push origin litellm_stable_release_branch --force

.github/workflows/run_llm_translation_tests.py

@@ -325,7 +325,7 @@ def run_tests(test_path: str = "tests/llm_translation/",
     
     # Run pytest
     cmd = [
-        "poetry", "run", "pytest", test_path,
+        "uv", "run", "--no-sync", "pytest", test_path,
         f"--junitxml={junit_xml}",
         "-v",
         "--tb=short",
@@ -335,7 +335,7 @@ def run_tests(test_path: str = "tests/llm_translation/",
     
     # Add timeout if pytest-timeout is installed
     try:
-        subprocess.run(["poetry", "run", "python", "-c", "import pytest_timeout"], 
+        subprocess.run(["uv", "run", "--no-sync", "python", "-c", "import pytest_timeout"], 
                       capture_output=True, check=True)
         cmd.extend(["--timeout=300"])
     except:
@@ -436,4 +436,4 @@ if __name__ == "__main__":
         commit=args.commit
     )
     
-    sys.exit(exit_code)
+    sys.exit(exit_code)

.github/workflows/run_observatory_tests.yml

@@ -33,7 +33,9 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Validate tag input
         env:
@@ -49,11 +51,12 @@ jobs:
           TAG: ${{ inputs.tag }}
           AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }}
           AZURE_API_BASE: ${{ secrets.AZURE_API_BASE }}
+          WORKSPACE: ${{ github.workspace }}
         run: |
           docker run -d \
             --name litellm-rc \
             -p 4000:4000 \
-            -v "${{ github.workspace }}/.github/observatory/litellm_config.yaml:/app/config.yaml" \
+            -v "${WORKSPACE}/.github/observatory/litellm_config.yaml:/app/config.yaml" \
             -e LITELLM_MASTER_KEY="${LITELLM_MASTER_KEY}" \
             -e AZURE_API_KEY="${AZURE_API_KEY}" \
             -e AZURE_API_BASE="${AZURE_API_BASE}" \
@@ -77,8 +80,9 @@ jobs:
 
       - name: Start cloudflared tunnel
         run: |
-          # Install cloudflared
+          # Install cloudflared (pinned version + checksum)
           curl -sL https://github.com/cloudflare/cloudflared/releases/download/2025.2.1/cloudflared-linux-amd64 -o /usr/local/bin/cloudflared
+          echo "afdfadd1ef552e66bffc35246fe30a9bd578356d2d386de95585ccfc432472b8  /usr/local/bin/cloudflared" | sha256sum -c -
           chmod +x /usr/local/bin/cloudflared
 
           # Start a quick tunnel (no account needed) and capture the URL
@@ -103,11 +107,11 @@ jobs:
 
       - name: Verify tunnel connectivity
         run: |
-          echo "Testing tunnel at ${{ env.TUNNEL_URL }}..."
+          echo "Testing tunnel at ${TUNNEL_URL}..."
           # Quick tunnels need time for DNS propagation; retry to avoid
           # transient NXDOMAIN (curl exit code 6) on first attempt.
           for i in $(seq 1 10); do
-            if curl -sf "${{ env.TUNNEL_URL }}/health/liveliness" > /dev/null 2>&1; then
+            if curl -sf "${TUNNEL_URL}/health/liveliness" > /dev/null 2>&1; then
               echo "Tunnel is working (attempt $i)"
               exit 0
             fi
@@ -221,5 +225,5 @@ jobs:
       - name: Cleanup
         if: always()
         run: |
-          kill "${{ env.CLOUDFLARED_PID }}" 2>/dev/null || true
+          kill "$CLOUDFLARED_PID" 2>/dev/null || true
           docker rm -f litellm-rc 2>/dev/null || true

.github/workflows/scan_duplicate_issues.yml

@@ -21,14 +21,15 @@ jobs:
       contents: read
     steps:
       - name: Checkout scripts
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           sparse-checkout: .github/scripts
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
-          python-version: "3.11"
+          python-version: "3.13"
 
       - name: Scan for duplicate issues
         env:

.github/workflows/scorecard.yml

@@ -0,0 +1,47 @@
+name: Scorecard supply-chain security
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '27 12 * * 4'
+  push:
+    branches: ["main"]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    if: github.event.repository.default_branch == github.ref_name
+    permissions:
+      security-events: write
+      id-token: write
+      # Uncomment for private repos if needed:
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to code scanning
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        with:
+          sarif_file: results.sarif

.github/workflows/simple_pypi_publish.yml

@@ -1,67 +0,0 @@
-name: Simple PyPI Publish
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version to publish (e.g., 1.74.10)'
-        required: true
-        type: string
-
-env:
-  TWINE_USERNAME: __token__
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    if: github.repository == 'BerriAI/litellm'
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.8'
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install toml build wheel twine
-
-      - name: Update version in pyproject.toml
-        run: |
-          python -c "
-          import toml
-          
-          with open('pyproject.toml', 'r') as f:
-              data = toml.load(f)
-          
-          data['tool']['poetry']['version'] = '${{ github.event.inputs.version }}'
-          
-          with open('pyproject.toml', 'w') as f:
-              toml.dump(data, f)
-          
-          print(f'Updated version to ${{ github.event.inputs.version }}')
-          "
-
-      - name: Copy model prices file
-        run: |
-          cp model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
-
-      - name: Build package
-        run: |
-          rm -rf build dist
-          python -m build
-
-      - name: Publish to PyPI
-        env:
-          TWINE_PASSWORD: ${{ secrets.PYPI_PUBLISH_PASSWORD }}
-        run: |
-          twine upload dist/*
-
-      - name: Output success
-        run: |
-          echo "✅ Successfully published litellm v${{ github.event.inputs.version }} to PyPI"
-          echo "📦 Package: https://pypi.org/project/litellm/${{ github.event.inputs.version }}/" 

.github/workflows/stale.yml

@@ -2,19 +2,24 @@ name: "Stale Issue Management"
 
 on:
   schedule:
-    - cron: '0 0 * * *' # Runs daily at midnight UTC
+    - cron: "0 0 * * *" # Runs daily at midnight UTC
   workflow_dispatch:
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
+    if: github.repository == 'BerriAI/litellm'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # v8
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           stale-issue-message: "This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs."
           stale-pr-message: "This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs."
-          days-before-stale: 90        # Revert to 60 days
-          days-before-close: 7         # Revert to 7 days
+          days-before-stale: 90 # Revert to 60 days
+          days-before-close: 7 # Revert to 7 days
           stale-issue-label: "stale"
-          operations-per-run: 1000
+          operations-per-run: 1000

.github/workflows/sync-schema.yml

@@ -0,0 +1,73 @@
+name: Sync schema.prisma copies
+
+on:
+  pull_request:
+    paths:
+      - 'schema.prisma'
+
+# Scoped to ONLY the permissions needed:
+# - contents:write to push the sync commit to the PR branch
+# - pull-requests:read is implicit (needed to check out the PR)
+permissions:
+  contents: write
+
+jobs:
+  sync:
+    name: Copy root schema to proxy and proxy-extras
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    # Only run on PRs from branches in THIS repo (not forks).
+    # Fork PRs cannot push back to the head branch with GITHUB_TOKEN,
+    # and pull_request events from forks have read-only tokens anyway.
+    # Also reject PRs from branches named after protected branches to
+    # prevent pushing directly to main/master.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository
+      && github.head_ref != 'main'
+      && github.head_ref != 'master'
+    steps:
+      - name: Checkout PR branch by SHA
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          # Use the merge commit SHA for safety — github.head_ref is an
+          # attacker-controlled string (the branch name) and could contain
+          # unusual characters that cause unexpected git behavior.
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: true  # needed for git push
+
+      - name: Reject symlinked schema files
+        run: |
+          for f in schema.prisma litellm/proxy/schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma; do
+            if [ -L "$f" ]; then
+              echo "::error file=$f::$f is a symlink, which is not allowed"
+              exit 1
+            fi
+          done
+
+      - name: Copy root schema to other locations
+        run: |
+          cp schema.prisma litellm/proxy/schema.prisma
+          cp schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma
+
+      - name: Check for changes
+        id: diff
+        run: |
+          if git diff --quiet -- litellm/proxy/schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "Schemas already in sync. Nothing to do."
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "Schema copies need updating."
+          fi
+
+      - name: Commit synced schemas
+        if: steps.diff.outputs.changed == 'true'
+        run: |
+          # Push to the PR's head branch (need the branch name for git push).
+          # We checked out by SHA above for safety, so configure the push target explicitly.
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B "$GITHUB_HEAD_REF"
+          git add -- litellm/proxy/schema.prisma litellm-proxy-extras/litellm_proxy_extras/schema.prisma
+          git commit -m "chore: sync schema.prisma copies from root"
+          git push origin "HEAD:$GITHUB_HEAD_REF"

.github/workflows/test-linting.yml

@@ -2,7 +2,10 @@ name: LiteLLM Linting
 
 on:
   pull_request:
-    branches: [ main ]
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   lint:
@@ -10,72 +13,75 @@ jobs:
     timeout-minutes: 5
 
     steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-        clean: true
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+          clean: true
+          persist-credentials: false
 
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.12'
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
 
-    - name: Install Poetry
-      uses: snok/install-poetry@v1
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
 
-    - name: Clean Python cache
-      run: |
-        find . -type d -name "__pycache__" -exec rm -rf {} + || true
-        find . -name "*.pyc" -delete || true
+      - name: Clean Python cache
+        run: |
+          find . -type d -name "__pycache__" -exec rm -rf {} + || true
+          find . -name "*.pyc" -delete || true
 
-    - name: Check poetry.lock is up to date
-      run: |
-        poetry check --lock || (echo "❌ poetry.lock is out of sync with pyproject.toml. Run 'poetry lock' locally and commit the result." && exit 1)
+      - name: Check uv.lock is up to date
+        run: |
+          uv lock --check || (echo "❌ uv.lock is out of sync with pyproject.toml. Run 'uv lock' locally and commit the result." && exit 1)
 
-    - name: Install dependencies
-      run: |
-        poetry install --with dev
+      - name: Install dependencies
+        run: |
+          uv sync --frozen
 
-    - name: Check Black formatting
-      run: |
-        cd litellm
-        poetry run black --check --exclude '/enterprise/' .
-        cd ..
+      - name: Check Black formatting
+        run: |
+          cd litellm
+          uv run --no-sync black --check --exclude '/enterprise/' .
+          cd ..
 
-    - name: Debug - Check file state
-      run: |
-        echo "Current branch:"
-        git branch --show-current
-        echo "Last 3 commits:"
-        git log --oneline -3
-        echo "File content around line 43:"
-        head -50 litellm/litellm_core_utils/custom_logger_registry.py | tail -10
-        
-    - name: Run Ruff linting
-      run: |
-        cd litellm
-        poetry run ruff check .
-        cd ..
+      - name: Debug - Check file state
+        run: |
+          echo "Current branch:"
+          git branch --show-current
+          echo "Last 3 commits:"
+          git log --oneline -3
+          echo "File content around line 43:"
+          head -50 litellm/litellm_core_utils/custom_logger_registry.py | tail -10
 
-    - name: Print OpenAI version
-      run: |
-        poetry run python -c "import openai; print(f'OpenAI version: {openai.__version__}')"
+      - name: Run Ruff linting
+        run: |
+          cd litellm
+          uv run --no-sync ruff check .
+          cd ..
 
-    - name: Run MyPy type checking
-      run: |
-        cd litellm
-        poetry run mypy . 
-        cd ..
+      - name: Print OpenAI version
+        run: |
+          uv run --no-sync python -c "import openai; print(f'OpenAI version: {openai.__version__}')"
 
-    - name: Check for circular imports
-      run: |
-        cd litellm
-        poetry run python ../tests/documentation_tests/test_circular_imports.py
-        cd ..
+      - name: Run MyPy type checking
+        run: |
+          cd litellm
+          uv run --no-sync mypy .
+          cd ..
 
-    - name: Check import safety
-      run: |
-        poetry run python -c "from litellm import *" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
+      - name: Check for circular imports
+        run: |
+          cd litellm
+          uv run --no-sync python ../tests/documentation_tests/test_circular_imports.py
+          cd ..
+
+      - name: Check import safety
+        run: |
+          uv run --no-sync python -c "from litellm import *" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
 
   secret-scan:
     runs-on: ubuntu-latest
@@ -84,27 +90,31 @@ jobs:
       contents: read
 
     steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.12'
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
 
-    - name: Run secret scan test
-      run: |
-        pip install pytest
-        pytest tests/litellm/test_no_hardcoded_secrets.py -v
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
 
-    - name: Run ggshield secret scan
-      env:
-        GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
-      run: |
-        if [ -n "$GITGUARDIAN_API_KEY" ]; then
-          pip install ggshield
-          ggshield secret scan repo .
-        else
-          echo "GITGUARDIAN_API_KEY not set, skipping ggshield scan"
-        fi
+      - name: Run secret scan test
+        run: |
+          uv run --frozen --with 'pytest==9.0.2' pytest tests/litellm/test_no_hardcoded_secrets.py -v
+
+      - name: Run ggshield secret scan
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
+        run: |
+          if [ -n "$GITGUARDIAN_API_KEY" ]; then
+            uv tool run --from 'ggshield==1.48.0' ggshield secret scan repo .
+          else
+            echo "GITGUARDIAN_API_KEY not set, skipping ggshield scan"
+          fi

.github/workflows/test-litellm-matrix.yml

@@ -1,166 +0,0 @@
-name: LiteLLM Unit Tests (Matrix)
-
-on:
-  pull_request:
-    branches: [main]
-
-# Cancel in-progress runs for the same PR
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20  # Increased from 15 to 20
-    strategy:
-      fail-fast: false
-      matrix:
-        test-group:
-          # tests/test_litellm split by subdirectory (~560 files total)
-          # Vertex AI tests separated for better isolation (prevent auth/env pollution)
-          - name: "llms-vertex"
-            path: "tests/test_litellm/llms/vertex_ai"
-            workers: 1
-            reruns: 2
-          - name: "llms-other"
-            path: "tests/test_litellm/llms --ignore=tests/test_litellm/llms/vertex_ai"
-            workers: 2
-            reruns: 2
-          # tests/test_litellm/proxy split by subdirectory (~180 files total)
-          - name: "proxy-guardrails"
-            path: "tests/test_litellm/proxy/guardrails tests/test_litellm/proxy/management_endpoints tests/test_litellm/proxy/management_helpers"
-            workers: 2
-            reruns: 2
-          - name: "proxy-core"
-            path: "tests/test_litellm/proxy/auth tests/test_litellm/proxy/client tests/test_litellm/proxy/db tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine"
-            workers: 2
-            reruns: 2
-          - name: "proxy-misc"
-            path: "tests/test_litellm/proxy/_experimental tests/test_litellm/proxy/agent_endpoints tests/test_litellm/proxy/anthropic_endpoints tests/test_litellm/proxy/common_utils tests/test_litellm/proxy/discovery_endpoints tests/test_litellm/proxy/experimental tests/test_litellm/proxy/google_endpoints tests/test_litellm/proxy/health_endpoints tests/test_litellm/proxy/image_endpoints tests/test_litellm/proxy/middleware tests/test_litellm/proxy/openai_files_endpoint tests/test_litellm/proxy/pass_through_endpoints tests/test_litellm/proxy/prompts tests/test_litellm/proxy/public_endpoints tests/test_litellm/proxy/response_api_endpoints tests/test_litellm/proxy/spend_tracking tests/test_litellm/proxy/ui_crud_endpoints tests/test_litellm/proxy/vector_store_endpoints tests/test_litellm/proxy/test_*.py"
-            workers: 2
-            reruns: 2
-          - name: "integrations"
-            path: "tests/test_litellm/integrations"
-            workers: 2
-            reruns: 3  # Integration tests tend to be flakier
-          - name: "core-utils"
-            path: "tests/test_litellm/litellm_core_utils"
-            workers: 2
-            reruns: 1
-          - name: "other-1"
-            # responses (5942) + caching (1723) + types (819) ≈ 8.5k lines
-            path: "tests/test_litellm/responses tests/test_litellm/caching tests/test_litellm/types"
-            workers: 2
-            reruns: 2
-          - name: "other-2"
-            # enterprise (3062) + google_genai (2511) + router_utils (1982) ≈ 7.6k lines
-            path: "tests/test_litellm/enterprise tests/test_litellm/google_genai tests/test_litellm/router_utils"
-            workers: 2
-            reruns: 2
-          - name: "other-3"
-            # remaining dirs ≈ 8.0k lines
-            path: "tests/test_litellm/router_strategy tests/test_litellm/secret_managers tests/test_litellm/a2a_protocol tests/test_litellm/anthropic_interface tests/test_litellm/completion_extras tests/test_litellm/containers tests/test_litellm/experimental_mcp_client tests/test_litellm/images tests/test_litellm/interactions tests/test_litellm/passthrough tests/test_litellm/vector_stores"
-            workers: 2
-            reruns: 2
-          - name: "root"
-            path: "tests/test_litellm/test_*.py"
-            workers: 2
-            reruns: 2
-          # tests/proxy_unit_tests split alphabetically (~48 files total)
-          - name: "proxy-unit-a1"
-            # test_[a-j]*.py: jwt (1564) + auth_checks (978) + google_gemini (478) + e2e_pod_lock (437) + rest
-            path: "tests/proxy_unit_tests/test_[a-j]*.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-a2"
-            # test_[k-o]*.py: key_generate_prisma (4346) + key_generate_dynamodb + models_fallback
-            path: "tests/proxy_unit_tests/test_[k-o]*.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b1"
-            # lighter config/utility proxy tests (prisma, project, prompt, proxy_[c-r]*)
-            path: "tests/proxy_unit_tests/test_prisma*.py tests/proxy_unit_tests/test_project*.py tests/proxy_unit_tests/test_prompt*.py tests/proxy_unit_tests/test_proxy_[c-r]*.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b2"
-            # proxy_server.py alone (2750 lines) - isolated to avoid blocking smaller tests
-            path: "tests/proxy_unit_tests/test_proxy_server.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b3"
-            # proxy_server_* (618) + proxy_setting_guardrails (71) - smaller server-related tests
-            path: "tests/proxy_unit_tests/test_proxy_server_*.py tests/proxy_unit_tests/test_proxy_setting_guardrails.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b4"
-            # proxy_utils.py alone (2339 lines) - isolated to avoid blocking token counter
-            path: "tests/proxy_unit_tests/test_proxy_utils.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b5"
-            # proxy_token_counter (1279) - runs independently from utils
-            path: "tests/proxy_unit_tests/test_proxy_token_counter.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b6"
-            # test_[r-t]*.py: response_polling (1399) + search_api_logging (202) + server_root (64) + skills_db (261) + realtime_cache (62)
-            path: "tests/proxy_unit_tests/test_[r-t]*.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b7"
-            # test_[u-z]*.py: user_api_key_auth (1136) + zero_cost (590) + update_spend (305) + unit_test_* (206) + ui_path (157)
-            path: "tests/proxy_unit_tests/test_[u-z]*.py"
-            workers: 2
-            reruns: 1
-
-    name: test (${{ matrix.test-group.name }})
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-
-      - name: Install Poetry
-        uses: snok/install-poetry@v1
-
-      - name: Cache Poetry dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cache/pypoetry
-            ~/.cache/pip
-            .venv
-          key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-poetry-
-
-      - name: Install dependencies
-        run: |
-          poetry config virtualenvs.in-project true
-          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
-          # pytest-rerunfailures and pytest-xdist are in pyproject.toml dev dependencies
-          poetry run pip install google-genai==1.22.0 \
-            google-cloud-aiplatform>=1.38 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core
-
-      - name: Setup litellm-enterprise
-        run: |
-          poetry run pip install --force-reinstall --no-deps -e enterprise/
-
-      - name: Generate Prisma client
-        run: |
-          poetry run prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Run tests - ${{ matrix.test-group.name }}
-        run: |
-          poetry run pytest ${{ matrix.test-group.path }} \
-            --tb=short -vv \
-            --maxfail=10 \
-            -n ${{ matrix.test-group.workers }} \
-            --reruns ${{ matrix.test-group.reruns }} \
-            --reruns-delay 1 \
-            --dist=loadscope \
-            --durations=20

.github/workflows/test-litellm-ui-build.yml

@@ -16,17 +16,19 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0
         with:
           node-version: "20"
           cache: "npm"
           cache-dependency-path: ui/litellm-dashboard/package-lock.json
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
 
       - name: Build
         run: npm run build

.github/workflows/test-litellm.yml

@@ -4,45 +4,42 @@ name: LiteLLM Mock Tests (folder - tests/test_litellm)
 # the same tests in parallel across 10 jobs for faster CI times.
 # Kept for manual debugging only.
 on:
-  workflow_dispatch:  # Manual trigger only
+  workflow_dispatch: # Manual trigger only
   # pull_request:
   #   branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 25
 
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
-    - name: Thank You Message
-      run: |
-        echo "### 🙏 Thank you for contributing to LiteLLM!" >> $GITHUB_STEP_SUMMARY
-        echo "Your PR is being tested now. We appreciate your help in making LiteLLM better!" >> $GITHUB_STEP_SUMMARY
+      - name: Thank You Message
+        run: |
+          echo "### 🙏 Thank you for contributing to LiteLLM!" >> $GITHUB_STEP_SUMMARY
+          echo "Your PR is being tested now. We appreciate your help in making LiteLLM better!" >> $GITHUB_STEP_SUMMARY
 
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.12'
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
 
-    - name: Install Poetry
-      uses: snok/install-poetry@v1
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
 
-    - name: Install dependencies
-      run: |
-        poetry lock
-        poetry install --with dev,proxy-dev --extras "proxy semantic-router"
-        poetry run pip install "pytest-retry==1.6.3"
-        poetry run pip install pytest-xdist
-        poetry run pip install "google-genai==1.22.0"
-        poetry run pip install "google-cloud-aiplatform>=1.38"
-        poetry run pip install "fastapi-offline==1.7.3"
-        poetry run pip install "python-multipart>=0.0.20"
-        poetry run pip install "openapi-core"
-    - name: Setup litellm-enterprise as local package
-      run: |
-        poetry run pip install --force-reinstall --no-deps -e enterprise/
-    - name: Run tests
-      run: |
-        poetry run pytest tests/test_litellm --tb=short -vv --maxfail=10 -n 4 --durations=50
+      - name: Install dependencies
+        run: |
+          uv lock --check
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+      - name: Run tests
+        run: |
+          uv run --no-sync pytest tests/test_litellm --tb=short -vv --maxfail=10 -n 4 --durations=50

.github/workflows/test-mcp.yml

@@ -2,7 +2,10 @@ name: LiteLLM MCP Tests (folder - tests/mcp_tests)
 
 on:
   pull_request:
-    branches: [ main ]
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   test:
@@ -10,38 +13,30 @@ jobs:
     timeout-minutes: 25
 
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
-    - name: Thank You Message
-      run: |
-        echo "### 🙏 Thank you for contributing to LiteLLM!" >> $GITHUB_STEP_SUMMARY
-        echo "Your PR is being tested now. We appreciate your help in making LiteLLM better!" >> $GITHUB_STEP_SUMMARY
+      - name: Thank You Message
+        run: |
+          echo "### 🙏 Thank you for contributing to LiteLLM!" >> $GITHUB_STEP_SUMMARY
+          echo "Your PR is being tested now. We appreciate your help in making LiteLLM better!" >> $GITHUB_STEP_SUMMARY
 
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.12'
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
 
-    - name: Install Poetry
-      uses: snok/install-poetry@v1
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
 
-    - name: Install dependencies
-      run: |
-        poetry lock
-        poetry install --with dev,proxy-dev --extras "proxy semantic-router"
-        poetry run pip install "pytest==7.3.1"
-        poetry run pip install "pytest-retry==1.6.3"
-        poetry run pip install "pytest-cov==5.0.0"
-        poetry run pip install "pytest-asyncio==0.21.1"
-        poetry run pip install "respx==0.22.0"
-        poetry run pip install "pydantic==2.11.0"
-        poetry run pip install "mcp==1.25.0"
-        poetry run pip install pytest-xdist
+      - name: Install dependencies
+        run: |
+          uv lock --check
+          uv sync --frozen --group proxy-dev --extra proxy --extra semantic-router
 
-    - name: Setup litellm-enterprise as local package
-      run: |
-        poetry run pip install --force-reinstall --no-deps -e enterprise/
-
-    - name: Run MCP tests
-      run: |
-        poetry run pytest tests/mcp_tests -x -vv -n 4 --cov=litellm --cov-report=xml --durations=5
+      - name: Run MCP tests
+        run: |
+          uv run --no-sync pytest tests/mcp_tests -x -vv -n 4 --cov=litellm --cov-report=xml --durations=5

.github/workflows/test-model-map.yaml

@@ -2,13 +2,18 @@ name: Validate model_prices_and_context_window.json
 
 on:
   pull_request:
-    branches: [ main ]
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   validate-model-prices-json:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Validate model_prices_and_context_window.json
         run: |

.github/workflows/test-proxy-e2e-azure-batches.yml

@@ -1,90 +0,0 @@
-name: Proxy E2E Azure Batches Tests
-
-on:
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  proxy_e2e_azure_batches_tests:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-
-    services:
-      postgres:
-        image: postgres:15
-        env:
-          POSTGRES_USER: llmproxy
-          POSTGRES_PASSWORD: dbpassword9090
-          POSTGRES_DB: litellm
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-
-      - name: Install Poetry
-        uses: snok/install-poetry@v1
-
-      - name: Cache Poetry dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cache/pypoetry
-            ~/.cache/pip
-            .venv
-          key: ${{ runner.os }}-poetry-e2e-batches-${{ hashFiles('poetry.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-poetry-e2e-batches-
-            ${{ runner.os }}-poetry-
-
-      - name: Install dependencies
-        run: |
-          poetry config virtualenvs.in-project true
-          poetry install --with dev,proxy-dev --extras "proxy"
-          poetry run pip install psycopg2-binary uvicorn fastapi httpx tenacity
-
-      - name: Setup litellm-enterprise
-        run: |
-          poetry run pip install --force-reinstall --no-deps -e enterprise/
-
-      - name: Generate Prisma client
-        run: |
-          poetry run prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Run Prisma migrations
-        env:
-          DATABASE_URL: postgresql://llmproxy:dbpassword9090@localhost:5432/litellm
-        run: |
-          cd litellm/proxy
-          poetry run prisma migrate deploy --schema schema.prisma
-          cd ../..
-
-      - name: Run Azure Batch E2E Tests
-        env:
-          DATABASE_URL: postgresql://llmproxy:dbpassword9090@localhost:5432/litellm
-          USE_LOCAL_LITELLM: "true"
-          USE_MOCK_MODELS: "true"
-          USE_STATE_TRACKER: "true"
-          LITELLM_LOG: DEBUG
-        run: |
-          poetry run pytest tests/proxy_e2e_azure_batches_tests/test_proxy_e2e_azure_batches.py \
-            -vv -s -k "test_e2e_managed_batch" \
-            --tb=short \
-            --maxfail=3 \
-            --durations=10
-

.github/workflows/test-unit-core-utils.yml

@@ -0,0 +1,23 @@
+name: "Unit Tests: Core Utilities"
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  core-utils:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: "tests/test_litellm/litellm_core_utils"
+      workers: 2
+      reruns: 1
+      artifact-name: core-utils

.github/workflows/test-unit-documentation.yml

@@ -0,0 +1,60 @@
+name: "Unit Tests: Documentation Validation"
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  documentation:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+
+      - name: Cache uv dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
+      - name: Install dependencies
+        run: |
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+
+      - name: Generate Prisma client
+        env:
+          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
+        run: |
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+
+      # Run the same documentation tests that CircleCI ran (as direct Python scripts)
+      - name: Run documentation validation tests
+        run: |
+          uv run --no-sync python ./tests/documentation_tests/test_env_keys.py
+          uv run --no-sync python ./tests/documentation_tests/test_router_settings.py
+          uv run --no-sync python ./tests/documentation_tests/test_api_docs.py
+          uv run --no-sync python ./tests/documentation_tests/test_circular_imports.py

.github/workflows/test-unit-enterprise-routing.yml

@@ -0,0 +1,27 @@
+name: "Unit Tests: Enterprise, Google GenAI & Routing"
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  enterprise-routing:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: >-
+        tests/test_litellm/enterprise
+        tests/test_litellm/google_genai
+        tests/test_litellm/router_utils
+        tests/test_litellm/router_strategy
+      workers: 2
+      reruns: 2
+      artifact-name: enterprise-routing

.github/workflows/test-unit-integrations.yml

@@ -0,0 +1,23 @@
+name: "Unit Tests: Integrations (Callbacks & Logging)"
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  integrations:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: "tests/test_litellm/integrations"
+      workers: 2
+      reruns: 3
+      artifact-name: integrations

.github/workflows/test-unit-llm-providers.yml

@@ -0,0 +1,39 @@
+name: "Unit Tests: LLM Provider Transformations"
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  vertex-ai:
+    name: Vertex AI
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: "tests/test_litellm/llms/vertex_ai"
+      workers: 1
+      reruns: 2
+      artifact-name: llm-vertex-ai
+
+  other-providers:
+    name: All Other Providers
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: "tests/test_litellm/llms --ignore=tests/test_litellm/llms/vertex_ai"
+      workers: 2
+      reruns: 2
+      artifact-name: llm-other-providers

.github/workflows/test-unit-misc.yml

@@ -0,0 +1,34 @@
+name: "Unit Tests: MCP, Secrets, Containers & Misc"
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  misc:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: >-
+        tests/test_litellm/secret_managers
+        tests/test_litellm/a2a_protocol
+        tests/test_litellm/anthropic_interface
+        tests/test_litellm/completion_extras
+        tests/test_litellm/containers
+        tests/test_litellm/experimental_mcp_client
+        tests/test_litellm/images
+        tests/test_litellm/interactions
+        tests/test_litellm/passthrough
+        tests/test_litellm/vector_stores
+        tests/test_litellm/test_*.py
+      workers: 2
+      reruns: 2
+      artifact-name: misc

.github/workflows/test-unit-proxy-auth.yml

@@ -0,0 +1,23 @@
+name: "Unit Tests: Proxy Auth & Key Management"
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  proxy-auth:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: "tests/test_litellm/proxy/auth tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine tests/test_litellm/proxy/client"
+      workers: 2
+      reruns: 2
+      artifact-name: proxy-auth

.github/workflows/test-unit-proxy-db.yml

@@ -0,0 +1,49 @@
+name: "Unit Tests: Proxy DB Operations"
+
+# Uses DATABASE_URL secret — only runs on trusted branches, not PRs.
+on:
+  push:
+    branches: [main, "litellm_*"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  proxy-db:
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Key generation tests must NOT run in parallel (event loop conflicts with logging worker)
+          - test-group: key-generation
+            test-path: "tests/proxy_unit_tests/test_key_generate_prisma.py"
+            workers: 0
+            timeout: 30
+          - test-group: auth-checks
+            test-path: "tests/proxy_unit_tests/test_auth_checks.py tests/proxy_unit_tests/test_user_api_key_auth.py"
+            workers: 8
+            timeout: 20
+          - test-group: remaining
+            test-path: "tests/proxy_unit_tests --ignore=tests/proxy_unit_tests/test_key_generate_prisma.py --ignore=tests/proxy_unit_tests/test_auth_checks.py --ignore=tests/proxy_unit_tests/test_user_api_key_auth.py"
+            workers: 8
+            timeout: 30
+    uses: ./.github/workflows/_test-unit-services-base.yml
+    with:
+      test-path: ${{ matrix.test-path }}
+      workers: ${{ matrix.workers }}
+      reruns: 2
+      timeout-minutes: ${{ matrix.timeout }}
+      enable-postgres: true
+      artifact-name: proxy-db-${{ matrix.test-group }}
+    secrets:
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}
+      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}

.github/workflows/test-unit-proxy-endpoints.yml

@@ -0,0 +1,38 @@
+name: "Unit Tests: Proxy API Endpoints"
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  proxy-endpoints:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: >-
+        tests/test_litellm/proxy/management_endpoints
+        tests/test_litellm/proxy/guardrails
+        tests/test_litellm/proxy/management_helpers
+        tests/test_litellm/proxy/anthropic_endpoints
+        tests/test_litellm/proxy/google_endpoints
+        tests/test_litellm/proxy/openai_files_endpoint
+        tests/test_litellm/proxy/response_api_endpoints
+        tests/test_litellm/proxy/image_endpoints
+        tests/test_litellm/proxy/vector_store_endpoints
+        tests/test_litellm/proxy/agent_endpoints
+        tests/test_litellm/proxy/discovery_endpoints
+        tests/test_litellm/proxy/health_endpoints
+        tests/test_litellm/proxy/public_endpoints
+        tests/test_litellm/proxy/prompts
+        tests/test_litellm/proxy/ui_crud_endpoints
+      workers: 2
+      reruns: 2
+      artifact-name: proxy-endpoints

.github/workflows/test-unit-proxy-infra.yml

@@ -0,0 +1,31 @@
+name: "Unit Tests: Proxy Infrastructure"
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  proxy-infra:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: >-
+        tests/test_litellm/proxy/db
+        tests/test_litellm/proxy/middleware
+        tests/test_litellm/proxy/spend_tracking
+        tests/test_litellm/proxy/pass_through_endpoints
+        tests/test_litellm/proxy/_experimental
+        tests/test_litellm/proxy/experimental
+        tests/test_litellm/proxy/common_utils
+        tests/test_litellm/proxy/test_*.py
+      workers: 2
+      reruns: 2
+      artifact-name: proxy-infra

.github/workflows/test-unit-proxy-legacy.yml

@@ -0,0 +1,89 @@
+name: "Unit Tests: Proxy Legacy Tests"
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        test-group:
+          - name: "auth-and-jwt"
+            path: "tests/proxy_unit_tests/test_[a-j]*.py"
+          - name: "key-generation"
+            path: "tests/proxy_unit_tests/test_[k-o]*.py"
+          - name: "proxy-config"
+            path: "tests/proxy_unit_tests/test_prisma*.py tests/proxy_unit_tests/test_project*.py tests/proxy_unit_tests/test_prompt*.py tests/proxy_unit_tests/test_proxy_[c-r]*.py"
+          - name: "proxy-server"
+            path: "tests/proxy_unit_tests/test_proxy_server.py"
+          - name: "proxy-server-extras"
+            path: "tests/proxy_unit_tests/test_proxy_server_*.py tests/proxy_unit_tests/test_proxy_setting_guardrails.py"
+          - name: "proxy-utils"
+            path: "tests/proxy_unit_tests/test_proxy_utils.py"
+          - name: "proxy-token-counter"
+            path: "tests/proxy_unit_tests/test_proxy_token_counter.py"
+          - name: "proxy-response-and-misc"
+            path: "tests/proxy_unit_tests/test_[r-t]*.py"
+          - name: "proxy-user-auth-and-spend"
+            path: "tests/proxy_unit_tests/test_[u-z]*.py"
+
+    name: ${{ matrix.test-group.name }}
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+
+      - name: Cache uv dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
+      - name: Install dependencies
+        run: |
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+
+      - name: Generate Prisma client
+        env:
+          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
+        run: |
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+
+      - name: Run tests - ${{ matrix.test-group.name }}
+        env:
+          TEST_PATH: ${{ matrix.test-group.path }}
+        run: |
+          uv run --no-sync pytest ${TEST_PATH} \
+            --tb=short -vv \
+            --maxfail=10 \
+            -n 2 \
+            --reruns 1 \
+            --reruns-delay 1 \
+            --dist=loadscope \
+            --durations=20

.github/workflows/test-unit-responses-caching-types.yml

@@ -0,0 +1,23 @@
+name: "Unit Tests: Responses, Caching & Types"
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  responses-caching-types:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: "tests/test_litellm/responses tests/test_litellm/caching tests/test_litellm/types"
+      workers: 2
+      reruns: 2
+      artifact-name: responses-caching-types

.github/workflows/test-unit-security.yml

@@ -0,0 +1,30 @@
+name: "Unit Tests: Security"
+
+# Uses DATABASE_URL secret — only runs on trusted branches, not PRs.
+on:
+  push:
+    branches: [main, "litellm_*"]
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  security:
+    uses: ./.github/workflows/_test-unit-services-base.yml
+    with:
+      test-path: "tests/proxy_security_tests/"
+      workers: 1
+      reruns: 2
+      timeout-minutes: 20
+      enable-postgres: true
+      artifact-name: security
+    secrets:
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}
+      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}

.github/workflows/test_server_root_path.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   test-server-root-path:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
 
     strategy:
       matrix:
@@ -17,13 +17,21 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Free up disk space
+        run: |
+          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/boost
+          sudo apt-get clean
+          df -h /
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12
 
       - name: Build Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 #v6.14
         with:
           context: .
           file: ./docker/Dockerfile.non_root

.github/workflows/zizmor.yml

@@ -0,0 +1,31 @@
+name: GitHub Actions Security Analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2

.gitignore

@@ -72,8 +72,7 @@ tests/local_testing/log.txt
 .codegpt
 litellm/proxy/_new_new_secret_config.yaml
 litellm/proxy/custom_guardrail.py
-.mypy_cache/*
-.mypy_cache/*
+**/.mypy_cache/
 litellm/proxy/application.log
 tests/llm_translation/vertex_test_account.json
 tests/llm_translation/test_vertex_key.json

.npmrc

@@ -0,0 +1,5 @@
+# Supply-chain hardening
+# Packages needing lifecycle scripts: npm rebuild <pkg>
+ignore-scripts=true
+# Protects local npm install only — npm ci (used in CI) ignores this
+min-release-age=3d

.pre-commit-config.yaml

@@ -1,40 +0,0 @@
-repos:
--   repo: local
-    hooks:
-    -   id: pyright
-        name: pyright
-        entry: pyright
-        language: system
-        types: [python]
-        files: ^(litellm/|litellm_proxy_extras/|enterprise/)
-    -   id: isort
-        name: isort
-        entry: isort
-        language: system
-        types: [python]
-        files: (litellm/|litellm_proxy_extras/|enterprise/).*\.py
-        exclude: ^litellm/__init__.py$
-    -   id: black
-        name: black
-        entry: poetry run black
-        language: system
-        types: [python]
-        files: (litellm/|litellm_proxy_extras/).*\.py
--   repo: https://github.com/pycqa/flake8
-    rev: 7.0.0  # The version of flake8 to use
-    hooks:
-    -  id: flake8
-       exclude: ^litellm/tests/|^litellm/proxy/tests/|^litellm/tests/test_litellm/|^tests/test_litellm/|^tests/enterprise/
-       additional_dependencies: [flake8-print]
-       files: (litellm/|litellm_proxy_extras/|enterprise/).*\.py
--   repo: https://github.com/python-poetry/poetry
-    rev: 1.8.0
-    hooks:
-      - id: poetry-check
-        files: ^(pyproject.toml|litellm-proxy-extras/pyproject.toml)$
--   repo: local
-    hooks:
-    -   id: check-files-match
-        name: Check if files match
-        entry: python3 ci_cd/check_files_match.py
-        language: system

.semgrep/rules/security/no-claude-directory.yml

@@ -0,0 +1,18 @@
+rules:
+  - id: no-claude-directory-committed
+    message: >
+      .claude/ directory must not be committed to the repository.
+      It contains local Claude Code settings (permissions, worktree paths) that are
+      developer-machine-specific and may expose internal paths or credentials.
+      Add .claude/ to .gitignore instead.
+    severity: ERROR
+    languages: [generic]
+    paths:
+      include:
+        - "/.claude/**"
+        - "/.claude/*"
+    pattern-regex: '[\s\S]+'
+    metadata:
+      category: security
+      tags: [supply-chain, secrets]
+      confidence: HIGH

.trivyignore

@@ -1,12 +0,0 @@
-# LiteLLM Trivy Ignore File
-# CVEs listed here are temporarily allowlisted pending fixes
-
-# Next.js vulnerabilities in UI dashboard (next@14.2.35)
-# Allowlisted: 2026-01-31, 7-day fix timeline
-# Fix: Upgrade to Next.js 15.5.10+ or 16.1.5+
-
-# HIGH: DoS via request deserialization
-GHSA-h25m-26qc-wcjf
-
-# MEDIUM: Image Optimizer DoS
-CVE-2025-59471

AGENTS.md

@@ -51,7 +51,9 @@ LiteLLM is a unified interface for 100+ LLMs that:
 
 ### MAKING CODE CHANGES FOR THE UI (IGNORE FOR BACKEND)
 
-1. **Tremor is DEPRECATED, do not use Tremor components in new features/changes**
+1. **Always use `antd` for new UI components — Tremor is DEPRECATED**
+   - We are migrating off of `@tremor/react`. Do not introduce new `Badge`, `Text`, `Card`, `Grid`, `Title`, or other imports from `@tremor/react` in any new or modified file.
+   - Use `antd` equivalents: `Tag` for labels, plain `<span>`/`<div>` with Tailwind classes (or `Typography.Text`) for text, `Card` from `antd`, etc. Note that `antd` has no `"yellow"` Tag color — use `"gold"` for amber/yellow.
    - The only exception is the Tremor Table component and its required Tremor Table sub components.
 
 2. **Use Common Components as much as possible**:
@@ -121,7 +123,7 @@ LiteLLM supports MCP for agent workflows:
 
 ## RUNNING SCRIPTS
 
-Use `poetry run python script.py` to run Python scripts in the project environment (for non-test files).
+Use `uv run python script.py` to run Python scripts in the project environment (for non-test files).
 
 ## GITHUB TEMPLATES
 
@@ -232,16 +234,16 @@ When opening issues or pull requests, follow these templates:
 
 ### Environment
 
-- Poetry is installed in `~/.local/bin`; the update script ensures it is on `PATH`.
+- uv is installed in `~/.local/bin`; the update script ensures it is on `PATH`.
 - Python 3.12, Node 22 are pre-installed.
-- The virtual environment lives under `~/.cache/pypoetry/virtualenvs/`.
+- The project virtual environment lives under `.venv/`.
 
 ### Running the proxy server
 
 Start the proxy with a config file:
 
 ```bash
-poetry run litellm --config dev_config.yaml --port 4000
+uv run litellm --config dev_config.yaml --port 4000
 ```
 
 The proxy takes ~15-20 seconds to fully start (it runs Prisma migrations on boot). Wait for `/health` to return before sending requests. Without a PostgreSQL `DATABASE_URL`, the proxy connects to a default Neon dev database embedded in the `litellm-proxy-extras` package.
@@ -250,17 +252,16 @@ The proxy takes ~15-20 seconds to fully start (it runs Prisma migrations on boot
 
 See `CLAUDE.md` and the `Makefile` for standard commands. Key notes:
 
-- `psycopg-binary` must be installed (`poetry run pip install psycopg-binary`) because the pytest-postgresql plugin requires it and the lock file only includes `psycopg` (no binary).
-- `openapi-core` must be installed (`poetry run pip install openapi-core`) for the OpenAPI compliance tests in `tests/test_litellm/interactions/`.
+- `uv sync --group proxy-dev --extra proxy` installs the Prisma and proxy-side test dependencies used by the standard local workflow.
 - The `--timeout` pytest flag is NOT available; don't pass it.
-- Unit tests: `poetry run pytest tests/test_litellm/ -x -vv -n 4`
-- Black `--check` may report pre-existing formatting issues; this does not block test runs.
-- If `poetry install` fails with "pyproject.toml changed significantly since poetry.lock was last generated", run `poetry lock` first to regenerate the lock file.
+- Unit tests: `uv run pytest tests/test_litellm/ -x -vv -n 4`
+- **Before committing, always run `uv run black .` to format your code.** Black formatting is enforced in CI.
+- If `uv sync` fails because the lockfile is outdated, run `uv lock` and retry.
 
 ### Lint
 
 ```bash
-cd litellm && poetry run ruff check .
+cd litellm && uv run ruff check .
 ```
 
 Ruff is the primary fast linter. For the full lint suite (including mypy, black, circular imports), run `make lint` per `CLAUDE.md`.
@@ -271,4 +272,4 @@ Ruff is the primary fast linter. For the full lint suite (including mypy, black,
 - The proxy at port 4000 serves a **pre-built** static UI from `litellm/proxy/_experimental/out/`. After making UI code changes, you must run `npm run build` in the dashboard directory and copy the output: `cp -r ui/litellm-dashboard/out/* litellm/proxy/_experimental/out/` for the proxy to serve the updated UI.
 - SVGs used as provider logos (loaded via `<img>` tags) must NOT use `fill="currentColor"` — replace with an explicit color like `#000000` or use the `-color` variant from lobehub icons, since CSS color inheritance does not work inside `<img>` elements.
 - Provider logos live in `ui/litellm-dashboard/public/assets/logos/` (source) and `litellm/proxy/_experimental/out/assets/logos/` (pre-built). Both locations must have the file for it to work in dev and proxy-served modes.
-- UI Vitest tests: `cd ui/litellm-dashboard && npx vitest run`
+- UI Vitest tests: `cd ui/litellm-dashboard && npx vitest run`

CLAUDE.md

@@ -7,7 +7,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 ### Installation
 - `make install-dev` - Install core development dependencies
 - `make install-proxy-dev` - Install proxy development dependencies with full feature set
-- `make install-test-deps` - Install all test dependencies
+- `make install-test-deps` - Install the full local test environment and generate the Prisma client
 
 ### Testing
 - `make test` - Run all tests
@@ -20,13 +20,14 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - `make format` - Apply Black code formatting
 - `make lint-ruff` - Run Ruff linting only
 - `make lint-mypy` - Run MyPy type checking only
+- **Before committing, always run `uv run black .` to format your code.** Black formatting is enforced in CI.
 
 ### Single Test Files
-- `poetry run pytest tests/path/to/test_file.py -v` - Run specific test file
-- `poetry run pytest tests/path/to/test_file.py::test_function -v` - Run specific test
+- `uv run pytest tests/path/to/test_file.py -v` - Run specific test file
+- `uv run pytest tests/path/to/test_file.py::test_function -v` - Run specific test
 
 ### Running Scripts
-- `poetry run python script.py` - Run Python scripts (use for non-test files)
+- `uv run python script.py` - Run Python scripts (use for non-test files)
 
 ### GitHub Issue & PR Templates
 When contributing to the project, use the appropriate templates:
@@ -108,6 +109,9 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components:
 ### UI / Backend Consistency
 - When wiring a new UI entity type to an existing backend endpoint, verify the backend API contract (single value vs. array, required vs. optional params) and ensure the UI controls match — e.g., use a single-select dropdown when the backend accepts a single value, not a multi-select
 
+### UI Component Library
+- **Always use `antd` for new UI components** — we are migrating off of `@tremor/react`. Do not introduce new `Badge`, `Text`, `Card`, `Grid`, `Title`, or other imports from `@tremor/react` in any new or modified file. Use `antd` equivalents: `Tag` for labels, plain `<span>`/`<div>` with Tailwind classes (or `Typography.Text`) for text, `Card` from `antd`, etc. Note that `antd` has no `"yellow"` Tag color — use `"gold"` for amber/yellow.
+
 ### MCP OAuth / OpenAPI Transport Mapping
 - `TRANSPORT.OPENAPI` is a UI-only concept. The backend only accepts `"http"`, `"sse"`, or `"stdio"`. Always map it to `"http"` before any API call (including pre-OAuth temp-session calls).
 - FastAPI validation errors return `detail` as an array of `{loc, msg, type}` objects. Error extractors must handle: array (map `.msg`), string, nested `{error: string}`, and fallback.
@@ -150,6 +154,14 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components:
 - Optional features enabled via environment variables
 - Separate licensing and authentication for enterprise features
 
+### CI Supply-Chain Safety
+- **Never pipe a remote script into a shell** (`curl ... | bash`, `wget ... | sh`). Download the artifact to a file, verify its SHA-256 checksum, then install.
+- **Pin every external tool to a specific version** with a full URL (not `latest` or `stable`). Unversioned downloads silently change under you.
+- **Verify checksums for all downloaded binaries.** Use the provider's official `.sha256` / `.sha256sum` sidecar file when available; otherwise compute and hardcode the digest.
+- **Prefer reusable CircleCI commands** (`commands:` section) so a tool is installed and verified in exactly one place, then referenced everywhere with `- install_<tool>` or `- wait_for_service`.
+- **Don't add tools just because they were there before.** Audit whether an external dependency is still needed. If it can be replaced with a shell one-liner or a tool already in the image, remove it.
+- These rules apply to every download in CI: binaries, install scripts, language version managers, package repos. No exceptions.
+
 ### HTTP Client Cache Safety
 - **Never close HTTP/SDK clients on cache eviction.** `LLMClientCache._remove_key()` must not call `close()`/`aclose()` on evicted clients — they may still be used by in-flight requests. Doing so causes `RuntimeError: Cannot send a request, as the client has been closed.` after the 1-hour TTL expires. Cleanup happens at shutdown via `close_litellm_async_clients()`.
 

CONTRIBUTING.md

@@ -122,9 +122,17 @@ Run all unit tests (uses parallel execution for speed):
 make test-unit
 ```
 
+If you're running broader test suites, proxy tests, or anything that touches PostgreSQL-backed fixtures/plugins, install the full local test environment first:
+
+```bash
+make install-test-deps
+```
+
+This syncs the locked test environment used across the repo, including `psycopg` v3 plus `psycopg-binary` (used by `pytest-postgresql`), `psycopg2-binary` (used by some proxy E2E tests), and a generated Prisma client for DB-backed proxy tests, so pytest startup matches CI without manual package installs.
+
 Run specific test files:
 ```bash
-poetry run pytest tests/test_litellm/test_your_file.py -v
+uv run pytest tests/test_litellm/test_your_file.py -v
 ```
 
 ### Running Linting and Formatting Checks
@@ -149,6 +157,19 @@ Apply formatting (auto-fixes issues):
 make format
 ```
 
+> **Black formatting is enforced in CI.** All PRs must pass the Black formatting check.
+>
+> - **AI coding agents** (Claude Code, Copilot, Cursor, etc.): `AGENTS.md` and `CLAUDE.md` instruct agents to run `poetry run black .` before committing.
+> - **VS Code users**: Install the [Black Formatter extension](https://marketplace.visualstudio.com/items?itemName=ms-python.black-formatter) and enable format-on-save:
+>   ```json
+>   {
+>     "[python]": {
+>       "editor.defaultFormatter": "ms-python.black-formatter",
+>       "editor.formatOnSave": true
+>     }
+>   }
+>   ```
+
 ### CI Compatibility
 
 To ensure your changes will pass CI, run the exact same checks locally:
@@ -172,7 +193,7 @@ Run `make help` to see all available commands:
 make help                       # Show all available commands
 make install-dev               # Install development dependencies
 make install-proxy-dev         # Install proxy development dependencies
-make install-test-deps         # Install test dependencies (for running tests)
+make install-test-deps         # Install the full local test environment
 make format                    # Apply Black code formatting
 make format-check              # Check Black formatting (matches CI)
 make lint                      # Run all linting checks
@@ -234,7 +255,7 @@ To run the proxy server locally:
 make install-proxy-dev
 
 # Start the proxy server
-poetry run litellm --config your_config.yaml
+uv run litellm --config your_config.yaml
 ```
 
 ### Docker Development
@@ -319,4 +340,4 @@ Looking for ideas? Check out:
 - 🧪 Test coverage improvements
 - 🔌 New LLM provider integrations
 
-Thank you for contributing to LiteLLM! 🚀 
+Thank you for contributing to LiteLLM! 🚀 

Dockerfile

@@ -1,59 +1,77 @@
 # Base image for building
-ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
 
 # Runtime image
-ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
+ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
+
+FROM $UV_IMAGE AS uvbin
 
 # Builder stage
 FROM $LITELLM_BUILD_IMAGE AS builder
 
-# Set the working directory to /app
 WORKDIR /app
-
 USER root
 
-# Install build dependencies
-RUN apk add --no-cache bash gcc py3-pip python3 python3-dev openssl openssl-dev
+COPY --from=uvbin /uv /usr/local/bin/uv
+COPY --from=uvbin /uvx /usr/local/bin/uvx
 
-RUN python -m pip install build
+RUN apk add --no-cache \
+    bash \
+    gcc \
+    python3 \
+    python3-dev \
+    openssl \
+    openssl-dev \
+    nodejs \
+    npm \
+    libsndfile
 
-# Copy the current directory contents into the container at /app
+ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+    UV_PROJECT_ENVIRONMENT=/app/.venv \
+    UV_LINK_MODE=copy \
+    XDG_CACHE_HOME=/app/.cache \
+    PATH="/app/.venv/bin:${PATH}"
+
+# Copy dependency metadata first for layer caching
+COPY pyproject.toml uv.lock ./
+COPY enterprise/pyproject.toml enterprise/
+COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
+
+# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
+RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
+    --extra proxy \
+    --extra proxy-runtime \
+    --extra extra_proxy \
+    --extra semantic-router \
+    --python python3
+
+# Copy full source tree
 COPY . .
 
-# Build Admin UI
-# Convert Windows line endings to Unix and make executable
+# Build Admin UI before final sync
 RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
 
-# Build the package
-RUN rm -rf dist/* && python -m build
+# Install project and workspace packages (fast - deps already cached)
+RUN uv sync --frozen --no-default-groups --no-editable \
+    --extra proxy \
+    --extra proxy-runtime \
+    --extra extra_proxy \
+    --extra semantic-router \
+    --python python3
 
-# There should be only one wheel file now, assume the build only creates one
-RUN ls -1 dist/*.whl | head -1
+RUN prisma generate --schema=./schema.prisma
 
-# Install the package
-RUN pip install dist/*.whl
-
-# install dependencies as wheels
-RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
-
-# ensure pyjwt is used, not jwt
-RUN pip uninstall jwt -y
-RUN pip uninstall PyJWT -y
-RUN pip install PyJWT==2.12.0 --no-cache-dir
+RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
+    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
 
 # Runtime stage
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
 
-# Ensure runtime stage runs as root
 USER root
 
-# Install runtime dependencies (libsndfile needed for audio processing on ARM64)
-RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
-    npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
-    # SECURITY FIX: npm bundles tar, glob, and brace-expansion at multiple nested
-    # levels inside its dependency tree. `npm install -g <pkg>` only creates a
-    # SEPARATE global package, it does NOT replace npm's internal copies.
-    # We must find and replace EVERY copy inside npm's directory.
+RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile supervisor && \
+    npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     GLOBAL="$(npm root -g)" && \
     find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -70,73 +88,24 @@ RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile
     find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
     done && \
-    # SECURITY FIX: patch npm's own package.json metadata so scanners see the
-    # actual installed versions instead of the stale declared dependencies.
     find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
         sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \
     npm cache clean --force && \
-    # Remove the apk-tracked npm so its stale SBOM metadata (tar 7.5.9) is
-    # no longer visible to image scanners.  The globally installed npm@latest
-    # at /usr/local/lib/node_modules/npm/ remains fully functional.
     { apk del --no-cache npm 2>/dev/null || true; }
 
 WORKDIR /app
-# Copy the current directory contents into the container at /app
-COPY . .
-RUN ls -la /app
+ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+    XDG_CACHE_HOME=/app/.cache \
+    PATH="/app/.venv/bin:${PATH}"
 
-# Copy the built wheel from the builder stage to the runtime stage; assumes only one wheel file is present
-COPY --from=builder /app/dist/*.whl .
-COPY --from=builder /wheels/ /wheels/
+COPY --from=builder /app /app
 
-# Install the built wheel using pip; again using a wildcard if it's the only file
-RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl && rm -rf /wheels
-
-# Replace the nodejs-wheel-binaries bundled node with the system node (fixes CVE-2025-55130)
-RUN NODEJS_WHEEL_NODE=$(find /usr/lib -path "*/nodejs_wheel/bin/node" 2>/dev/null) && \
-    if [ -n "$NODEJS_WHEEL_NODE" ]; then cp /usr/bin/node "$NODEJS_WHEEL_NODE"; fi
-
-# Remove test files and keys from dependencies
-RUN find /usr/lib -type f -path "*/tornado/test/*" -delete && \
-    find /usr/lib -type d -path "*/tornado/test" -delete
-
-# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
-# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
-# Patch every copy of tar, glob, and brace-expansion inside that tree.
-RUN GLOBAL="$(npm root -g)" && \
-    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
-    find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
-    done && \
-    find /usr/lib -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
-    done && \
-    find /usr/lib -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
-    done && \
-    find /usr/lib -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
-    done && \
-    find /usr/lib -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
-    done
-
-# Install semantic_router and aurelio-sdk using script
-# Convert Windows line endings to Unix and make executable
-RUN sed -i 's/\r$//' docker/install_auto_router.sh && chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh
-
-# Generate prisma client using the correct schema
-RUN prisma generate --schema=./litellm/proxy/schema.prisma
-# Convert Windows line endings to Unix for entrypoint scripts
-RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
-RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
+RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \
+    find /app/.venv -type d -path "*/tornado/test" -delete
 
 EXPOSE 4000/tcp
 
-RUN apk add --no-cache supervisor
 COPY docker/supervisord.conf /etc/supervisord.conf
 
 ENTRYPOINT ["docker/prod_entrypoint.sh"]
-
-# Append "--detailed_debug" to the end of CMD to view detailed debug logs
 CMD ["--port", "4000"]

GEMINI.md

@@ -22,11 +22,11 @@ This file provides guidance to Gemini when working with code in this repository.
 - `make lint-mypy` - Run MyPy type checking only
 
 ### Single Test Files
-- `poetry run pytest tests/path/to/test_file.py -v` - Run specific test file
-- `poetry run pytest tests/path/to/test_file.py::test_function -v` - Run specific test
+- `uv run pytest tests/path/to/test_file.py -v` - Run specific test file
+- `uv run pytest tests/path/to/test_file.py::test_function -v` - Run specific test
 
 ### Running Scripts
-- `poetry run python script.py` - Run Python scripts (use for non-test files)
+- `uv run python script.py` - Run Python scripts (use for non-test files)
 
 ### GitHub Issue & PR Templates
 When contributing to the project, use the appropriate templates:
@@ -105,4 +105,4 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components:
 ### Enterprise Features
 - Enterprise-specific code in `enterprise/` directory
 - Optional features enabled via environment variables
-- Separate licensing and authentication for enterprise features
+- Separate licensing and authentication for enterprise features

Makefile

@@ -15,7 +15,7 @@ help:
 	@echo "  make install-proxy-dev  - Install proxy development dependencies"
 	@echo "  make install-dev-ci     - Install dev dependencies (CI-compatible, pins OpenAI)"
 	@echo "  make install-proxy-dev-ci - Install proxy dev dependencies (CI-compatible)"
-	@echo "  make install-test-deps  - Install test dependencies"
+	@echo "  make install-test-deps  - Install the full local test environment"
 	@echo "  make install-helm-unittest - Install helm unittest plugin"
 	@echo "  make format             - Apply Black code formatting"
 	@echo "  make format-check       - Check Black code formatting (matches CI)"
@@ -40,49 +40,44 @@ help:
 	@echo "  make test-integration   - Run integration tests"
 	@echo "  make test-unit-helm     - Run helm unit tests"
 
-# Keep PIP simple for edge cases:
-PIP := $(shell command -v pip > /dev/null 2>&1 && echo "pip" || echo "python3 -m pip")
+UV := uv
+UV_RUN := $(UV) run --no-sync
 
 # Show info
 info:
-	@echo "PIP: $(PIP)"
+	@echo "UV: $(UV)"
 
 # Installation targets
 install-dev:
-	poetry install --with dev
+	$(UV) sync --frozen
 
 install-proxy-dev:
-	poetry install --with dev,proxy-dev --extras proxy
+	$(UV) sync --frozen --group proxy-dev --extra proxy
 
 # CI-compatible installations (matches GitHub workflows exactly)
 install-dev-ci:
-	$(PIP) install openai==2.8.0
-	poetry install --with dev
-	$(PIP) install openai==2.8.0
+	$(UV) sync --frozen
 
 install-proxy-dev-ci:
-	poetry install --with dev,proxy-dev --extras proxy
-	$(PIP) install openai==2.8.0
+	$(UV) sync --frozen --group proxy-dev --extra proxy
 
 install-test-deps: install-proxy-dev
-	poetry run $(PIP) install "pytest-retry==1.6.3"
-	poetry run $(PIP) install pytest-xdist
-	poetry run $(PIP) install openapi-core
-	cd enterprise && poetry run $(PIP) install -e . && cd ..
+	$(UV) sync --frozen --all-groups --all-extras
+	$(UV_RUN) prisma generate --schema litellm/proxy/schema.prisma
 
 install-helm-unittest:
 	helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.4.4 || echo "ignore error if plugin exists"
 
 # Formatting
 format: install-dev
-	cd litellm && poetry run black . && cd ..
+	cd litellm && $(UV_RUN) black . && cd ..
 
 format-check: install-dev
-	cd litellm && poetry run black --check . && cd ..
+	cd litellm && $(UV_RUN) black --check . && cd ..
 
 # Linting targets
 lint-ruff: install-dev
-	cd litellm && poetry run ruff check . && cd ..
+	cd litellm && $(UV_RUN) ruff check . && cd ..
 
 # faster linter for developing ...
 # inspiration from:
@@ -96,37 +91,36 @@ lint-format-changed: install-dev
 			$$start = $$1; $$count = $$2 || 1; $$end = $$start + $$count - 1; \
 			print "$$file:$$start:1-$$end:999\n"; \
 		}' | \
-	while read range; do \
-		file="$${range%%:*}"; \
-		lines="$${range#*:}"; \
-		echo "Formatting $$file (lines $$lines)"; \
-		poetry run ruff format --range "$$lines" "$$file"; \
-	done
+		while read range; do \
+			file="$${range%%:*}"; \
+			lines="$${range#*:}"; \
+			echo "Formatting $$file (lines $$lines)"; \
+			$(UV_RUN) ruff format --range "$$lines" "$$file"; \
+		done
 
 lint-ruff-dev: install-dev
 	@tmpfile=$$(mktemp /tmp/ruff-dev.XXXXXX) && \
 	cd litellm && \
-	(poetry run ruff check . --output-format=pylint || true) > "$$tmpfile" && \
-	poetry run diff-quality --violations=pylint "$$tmpfile" --compare-branch=origin/main && \
+	($(UV_RUN) ruff check . --output-format=pylint || true) > "$$tmpfile" && \
+	$(UV_RUN) diff-quality --violations=pylint "$$tmpfile" --compare-branch=origin/main && \
 	cd .. ; \
 	rm -f "$$tmpfile"
 
 lint-ruff-FULL-dev: install-dev
 	@files=$$(git diff --name-only origin/main -- '*.py'); \
-	if [ -n "$$files" ]; then echo "$$files" | xargs poetry run ruff check; \
+	if [ -n "$$files" ]; then echo "$$files" | xargs $(UV_RUN) ruff check; \
 	else echo "No changed .py files to check."; fi
 
 lint-mypy: install-dev
-	poetry run $(PIP) install types-requests types-setuptools types-redis types-PyYAML
-	cd litellm && poetry run mypy . --ignore-missing-imports && cd ..
+	cd litellm && $(UV_RUN) mypy . --ignore-missing-imports && cd ..
 
 lint-black: format-check
 
 check-circular-imports: install-dev
-	cd litellm && poetry run python ../tests/documentation_tests/test_circular_imports.py && cd ..
+	cd litellm && $(UV_RUN) python ../tests/documentation_tests/test_circular_imports.py && cd ..
 
 check-import-safety: install-dev
-	@poetry run python -c "from litellm import *; print('[from litellm import *] OK! no issues!');" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
+	@$(UV_RUN) python -c "from litellm import *; print('[from litellm import *] OK! no issues!');" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
 
 # Combined linting (matches test-linting.yml workflow)
 lint: format-check lint-ruff lint-mypy check-circular-imports check-import-safety
@@ -135,46 +129,46 @@ lint: format-check lint-ruff lint-mypy check-circular-imports check-import-safet
 lint-dev: lint-format-changed lint-mypy check-circular-imports check-import-safety
 
 # Testing targets
-test:
-	poetry run pytest tests/
+test: install-test-deps
+	$(UV_RUN) pytest tests/
 
 test-unit: install-test-deps
-	poetry run pytest tests/test_litellm -x -vv -n 4
+	$(UV_RUN) pytest tests/test_litellm -x -vv -n 4
 
 # Matrix test targets (matching CI workflow groups)
 test-unit-llms: install-test-deps
-	poetry run pytest tests/test_litellm/llms --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/test_litellm/llms --tb=short -vv -n 4 --durations=20
 
 test-unit-proxy-guardrails: install-test-deps
-	poetry run pytest tests/test_litellm/proxy/guardrails tests/test_litellm/proxy/management_endpoints tests/test_litellm/proxy/management_helpers --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/test_litellm/proxy/guardrails tests/test_litellm/proxy/management_endpoints tests/test_litellm/proxy/management_helpers --tb=short -vv -n 4 --durations=20
 
 test-unit-proxy-core: install-test-deps
-	poetry run pytest tests/test_litellm/proxy/auth tests/test_litellm/proxy/client tests/test_litellm/proxy/db tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/test_litellm/proxy/auth tests/test_litellm/proxy/client tests/test_litellm/proxy/db tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine --tb=short -vv -n 4 --durations=20
 
 test-unit-proxy-misc: install-test-deps
-	poetry run pytest tests/test_litellm/proxy/_experimental tests/test_litellm/proxy/agent_endpoints tests/test_litellm/proxy/anthropic_endpoints tests/test_litellm/proxy/common_utils tests/test_litellm/proxy/discovery_endpoints tests/test_litellm/proxy/experimental tests/test_litellm/proxy/google_endpoints tests/test_litellm/proxy/health_endpoints tests/test_litellm/proxy/image_endpoints tests/test_litellm/proxy/middleware tests/test_litellm/proxy/openai_files_endpoint tests/test_litellm/proxy/pass_through_endpoints tests/test_litellm/proxy/prompts tests/test_litellm/proxy/public_endpoints tests/test_litellm/proxy/response_api_endpoints tests/test_litellm/proxy/spend_tracking tests/test_litellm/proxy/ui_crud_endpoints tests/test_litellm/proxy/vector_store_endpoints tests/test_litellm/proxy/test_*.py --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/test_litellm/proxy/_experimental tests/test_litellm/proxy/agent_endpoints tests/test_litellm/proxy/anthropic_endpoints tests/test_litellm/proxy/common_utils tests/test_litellm/proxy/discovery_endpoints tests/test_litellm/proxy/experimental tests/test_litellm/proxy/google_endpoints tests/test_litellm/proxy/health_endpoints tests/test_litellm/proxy/image_endpoints tests/test_litellm/proxy/middleware tests/test_litellm/proxy/openai_files_endpoint tests/test_litellm/proxy/pass_through_endpoints tests/test_litellm/proxy/prompts tests/test_litellm/proxy/public_endpoints tests/test_litellm/proxy/response_api_endpoints tests/test_litellm/proxy/spend_tracking tests/test_litellm/proxy/ui_crud_endpoints tests/test_litellm/proxy/vector_store_endpoints tests/test_litellm/proxy/test_*.py --tb=short -vv -n 4 --durations=20
 
 test-unit-integrations: install-test-deps
-	poetry run pytest tests/test_litellm/integrations --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/test_litellm/integrations --tb=short -vv -n 4 --durations=20
 
 test-unit-core-utils: install-test-deps
-	poetry run pytest tests/test_litellm/litellm_core_utils --tb=short -vv -n 2 --durations=20
+	$(UV_RUN) pytest tests/test_litellm/litellm_core_utils --tb=short -vv -n 2 --durations=20
 
 test-unit-other: install-test-deps
-	poetry run pytest tests/test_litellm/caching tests/test_litellm/responses tests/test_litellm/secret_managers tests/test_litellm/vector_stores tests/test_litellm/a2a_protocol tests/test_litellm/anthropic_interface tests/test_litellm/completion_extras tests/test_litellm/containers tests/test_litellm/enterprise tests/test_litellm/experimental_mcp_client tests/test_litellm/google_genai tests/test_litellm/images tests/test_litellm/interactions tests/test_litellm/passthrough tests/test_litellm/router_strategy tests/test_litellm/router_utils tests/test_litellm/types --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/test_litellm/caching tests/test_litellm/responses tests/test_litellm/secret_managers tests/test_litellm/vector_stores tests/test_litellm/a2a_protocol tests/test_litellm/anthropic_interface tests/test_litellm/completion_extras tests/test_litellm/containers tests/test_litellm/enterprise tests/test_litellm/experimental_mcp_client tests/test_litellm/google_genai tests/test_litellm/images tests/test_litellm/interactions tests/test_litellm/passthrough tests/test_litellm/router_strategy tests/test_litellm/router_utils tests/test_litellm/types --tb=short -vv -n 4 --durations=20
 
 test-unit-root: install-test-deps
-	poetry run pytest tests/test_litellm/test_*.py --tb=short -vv -n 4 --durations=20
+	$(UV_RUN) pytest tests/test_litellm/test_*.py --tb=short -vv -n 4 --durations=20
 
 # Proxy unit tests (tests/proxy_unit_tests split alphabetically)
 test-proxy-unit-a: install-test-deps
-	poetry run pytest tests/proxy_unit_tests/test_[a-o]*.py --tb=short -vv -n 2 --durations=20
+	$(UV_RUN) pytest tests/proxy_unit_tests/test_[a-o]*.py --tb=short -vv -n 2 --durations=20
 
 test-proxy-unit-b: install-test-deps
-	poetry run pytest tests/proxy_unit_tests/test_[p-z]*.py --tb=short -vv -n 2 --durations=20
+	$(UV_RUN) pytest tests/proxy_unit_tests/test_[p-z]*.py --tb=short -vv -n 2 --durations=20
 
-test-integration:
-	poetry run pytest tests/ -k "not test_litellm"
+test-integration: install-test-deps
+	$(UV_RUN) pytest tests/ -k "not test_litellm"
 
 test-unit-helm: install-helm-unittest
 	helm unittest -f 'tests/*.yaml' deploy/charts/litellm-helm
@@ -188,6 +182,6 @@ test-llm-translation-single: install-test-deps
 	@echo "Running single LLM translation test file..."
 	@if [ -z "$(FILE)" ]; then echo "Usage: make test-llm-translation-single FILE=test_filename.py"; exit 1; fi
 	@mkdir -p test-results
-	poetry run pytest tests/llm_translation/$(FILE) \
+	$(UV_RUN) pytest tests/llm_translation/$(FILE) \
 		--junitxml=test-results/junit.xml \
 		-v --tb=short --maxfail=100 --timeout=300

README.md

@@ -2,20 +2,24 @@
         🚅 LiteLLM
     </h1>
     <p align="center">
-        <p align="center">Call 100+ LLMs in OpenAI format. [Bedrock, Azure, OpenAI, VertexAI, Anthropic, Groq, etc.]
+        <p align="center">LiteLLM AI Gateway
         </p>
+        <p align="center">Open Source AI Gateway for 100+ LLMs. Self-hosted. Enterprise-ready. Call any LLM in OpenAI format.</p>
         <p align="center">
         <a href="https://render.com/deploy?repo=https://github.com/BerriAI/litellm" target="_blank" rel="nofollow"><img src="https://render.com/images/deploy-to-render-button.svg" alt="Deploy to Render"></a>
-        <a href="https://railway.app/template/HLP0Ub?referralCode=jch2ME">
-          <img src="https://railway.app/button.svg" alt="Deploy on Railway">
+        <a href="https://railway.com/deploy/RhvhdC?referralCode=7mRv9K&utm_medium=integration&utm_source=template&utm_campaign=generic">
+          <img src="https://railway.com/button.svg" alt="Deploy on Railway">
         </a>
         </p>
     </p>
-<h4 align="center"><a href="https://docs.litellm.ai/docs/simple_proxy" target="_blank">LiteLLM Proxy Server (AI Gateway)</a> | <a href="https://docs.litellm.ai/docs/enterprise#hosted-litellm-proxy" target="_blank"> Hosted Proxy</a> | <a href="https://docs.litellm.ai/docs/enterprise"target="_blank">Enterprise Tier</a></h4>
+<h4 align="center"><a href="https://docs.litellm.ai/docs/simple_proxy" target="_blank">LiteLLM Proxy Server (AI Gateway)</a> | <a href="https://docs.litellm.ai/docs/enterprise#hosted-litellm-proxy" target="_blank"> Hosted Proxy</a> | <a href="https://litellm.ai/enterprise"target="_blank">Enterprise Tier</a> | <a href="https://www.litellm.ai/ai-gateway" target="_blank">Website</a></h4>
 <h4 align="center">
     <a href="https://pypi.org/project/litellm/" target="_blank">
         <img src="https://img.shields.io/pypi/v/litellm.svg" alt="PyPI Version">
     </a>
+    <a href="https://github.com/BerriAI/litellm" target="_blank">
+        <img src="https://img.shields.io/github/stars/BerriAI/litellm.svg?style=social" alt="GitHub Stars">
+    </a>
     <a href="https://www.ycombinator.com/companies/berriai">
         <img src="https://img.shields.io/badge/Y%20Combinator-W23-orange?style=flat-square" alt="Y Combinator W23">
     </a>
@@ -35,8 +39,45 @@
 
 <img width="2688" height="1600" alt="Group 7154 (1)" src="https://github.com/user-attachments/assets/c5ee0412-6fb5-4fb6-ab5b-bafae4209ca6" />
 
+---
 
-## Use LiteLLM for
+## What is LiteLLM
+
+LiteLLM is an open source AI Gateway that gives you a single, unified interface to call 100+ LLM providers — OpenAI, Anthropic, Gemini, Bedrock, Azure, and more — using the OpenAI format.
+
+Use it as a **Python SDK** for direct library integration, or deploy the **AI Gateway (Proxy Server)** as a centralized service for your team or organization.
+
+[**Jump to LiteLLM Proxy (LLM Gateway) Docs**](https://docs.litellm.ai/docs/simple_proxy) <br>
+[**Jump to Supported LLM Providers**](https://docs.litellm.ai/docs/providers)
+
+---
+
+## Why LiteLLM
+
+Managing LLM calls across providers gets complicated fast — different SDKs, auth patterns, request formats, and error types for every model. LiteLLM removes that friction:
+
+- **Unified API** — one interface for 100+ LLMs, no provider-specific SDK juggling
+- **Drop-in OpenAI compatibility** — swap providers without rewriting your code
+- **Production-ready gateway** — virtual keys, spend tracking, guardrails, load balancing, and an admin dashboard out of the box
+- **8ms P95 latency** at 1k RPS ([benchmarks](https://docs.litellm.ai/docs/benchmarks))
+
+### OSS Adopters
+
+<table>
+  <tr>
+    <td><img height="60" alt="Stripe" src="https://github.com/user-attachments/assets/f7296d4f-9fbd-460d-9d05-e4df31697c4b" /></td>
+    <td><img height="60" alt="image" src="https://github.com/user-attachments/assets/436fca71-988b-40bb-b5fe-8450c80fdbd0" /></td>
+    <td><img height="60" alt="Google ADK" src="https://github.com/user-attachments/assets/caf270a2-5aee-45c4-8222-41a2070c4f19" /></td>
+    <td><img height="60" alt="Greptile" src="https://github.com/user-attachments/assets/0be4bd8a-7cfa-48d3-9090-f415fe948280" /></td>
+    <td><img height="60" alt="OpenHands" src="https://github.com/user-attachments/assets/a6150c4c-149e-4cae-888b-8b92be6e003f" /></td>
+    <td><h2>Netflix</h2></td>
+    <td><img height="60" alt="OpenAI Agents SDK" src="https://github.com/user-attachments/assets/c02f7be0-8c2e-4d27-aea7-7c024bfaebc0" /></td>
+  </tr>
+</table>
+
+---
+
+## Features
 
 <details open>
 <summary><b>LLMs</b> - Call 100+ LLMs (Python SDK + AI Gateway)</summary>
@@ -46,7 +87,7 @@
 ### Python SDK
 
 ```shell
-pip install litellm
+uv add litellm
 ```
 
 ```python
@@ -68,7 +109,7 @@ response = completion(model="anthropic/claude-sonnet-4-20250514", messages=[{"ro
 [**Getting Started - E2E Tutorial**](https://docs.litellm.ai/docs/proxy/docker_quick_start) - Setup virtual keys, make your first request
 
 ```shell
-pip install 'litellm[proxy]'
+uv tool install 'litellm[proxy]'
 litellm --model gpt-4o
 ```
 
@@ -219,62 +260,7 @@ curl -X POST 'http://0.0.0.0:4000/v1/chat/completions' \
 
 </details>
 
----
-
-## How to use LiteLLM
-
-You can use LiteLLM through either the Proxy Server or Python SDK. Both gives you a unified interface to access multiple LLMs (100+ LLMs). Choose the option that best fits your needs:
-
-<table style={{width: '100%', tableLayout: 'fixed'}}>
-<thead>
-<tr>
-<th style={{width: '14%'}}></th>
-<th style={{width: '43%'}}><strong><a href="https://docs.litellm.ai/docs/simple_proxy">LiteLLM AI Gateway</a></strong></th>
-<th style={{width: '43%'}}><strong><a href="https://docs.litellm.ai/docs/">LiteLLM Python SDK</a></strong></th>
-</tr>
-</thead>
-<tbody>
-<tr>
-<td style={{width: '14%'}}><strong>Use Case</strong></td>
-<td style={{width: '43%'}}>Central service (LLM Gateway) to access multiple LLMs</td>
-<td style={{width: '43%'}}>Use LiteLLM directly in your Python code</td>
-</tr>
-<tr>
-<td style={{width: '14%'}}><strong>Who Uses It?</strong></td>
-<td style={{width: '43%'}}>Gen AI Enablement / ML Platform Teams</td>
-<td style={{width: '43%'}}>Developers building LLM projects</td>
-</tr>
-<tr>
-<td style={{width: '14%'}}><strong>Key Features</strong></td>
-<td style={{width: '43%'}}>Centralized API gateway with authentication and authorization, multi-tenant cost tracking and spend management per project/user, per-project customization (logging, guardrails, caching), virtual keys for secure access control, admin dashboard UI for monitoring and management</td>
-<td style={{width: '43%'}}>Direct Python library integration in your codebase, Router with retry/fallback logic across multiple deployments (e.g. Azure/OpenAI) - <a href="https://docs.litellm.ai/docs/routing">Router</a>, application-level load balancing and cost tracking, exception handling with OpenAI-compatible errors, observability callbacks (Lunary, MLflow, Langfuse, etc.)</td>
-</tr>
-</tbody>
-</table>
-
-LiteLLM Performance: **8ms P95 latency** at 1k RPS (See benchmarks [here](https://docs.litellm.ai/docs/benchmarks))
-
-[**Jump to LiteLLM Proxy (LLM Gateway) Docs**](https://docs.litellm.ai/docs/simple_proxy) <br>
-[**Jump to Supported LLM Providers**](https://docs.litellm.ai/docs/providers)
-
-**Stable Release:** Use docker images with the `-stable` tag. These have undergone 12 hour load tests, before being published. [More information about the release cycle here](https://docs.litellm.ai/docs/proxy/release_cycle)
-
-Support for more providers. Missing a provider or LLM Platform, raise a [feature request](https://github.com/BerriAI/litellm/issues/new?assignees=&labels=enhancement&projects=&template=feature_request.yml&title=%5BFeature%5D%3A+).
-
-## OSS Adopters 
-
-<table>
-  <tr>
-    <td><img height="60" alt="Stripe" src="https://github.com/user-attachments/assets/f7296d4f-9fbd-460d-9d05-e4df31697c4b" /></td>
-    <td><img height="60" alt="Google ADK" src="https://github.com/user-attachments/assets/caf270a2-5aee-45c4-8222-41a2070c4f19" /></td>
-    <td><img height="60" alt="Greptile" src="https://github.com/user-attachments/assets/0be4bd8a-7cfa-48d3-9090-f415fe948280" /></td>
-    <td><img height="60" alt="OpenHands" src="https://github.com/user-attachments/assets/a6150c4c-149e-4cae-888b-8b92be6e003f" /></td>
-    <td><h2>Netflix</h2></td>
-    <td><img height="60" alt="OpenAI Agents SDK" src="https://github.com/user-attachments/assets/c02f7be0-8c2e-4d27-aea7-7c024bfaebc0" /></td>
-  </tr>
-</table>
-
-## Supported Providers ([Website Supported Models](https://models.litellm.ai/) | [Docs](https://docs.litellm.ai/docs/providers))
+### Supported Providers ([Website Supported Models](https://models.litellm.ai/) | [Docs](https://docs.litellm.ai/docs/providers))
 
 | Provider                                                                            | `/chat/completions` | `/messages` | `/responses` | `/embeddings` | `/image/generations` | `/audio/transcriptions` | `/audio/speech` | `/moderations` | `/batches` | `/rerank` |
 |-------------------------------------------------------------------------------------|---------------------|-------------|--------------|---------------|----------------------|-------------------------|-----------------|----------------|-----------|-----------|
@@ -381,28 +367,94 @@ Support for more providers. Missing a provider or LLM Platform, raise a [feature
 
 [**Read the Docs**](https://docs.litellm.ai/docs/)
 
-## Run in Developer mode
-### Services
+---
+
+## Get Started
+
+You can use LiteLLM through either the Proxy Server or Python SDK. Both give you a unified interface to access multiple LLMs (100+ LLMs). Choose the option that best fits your needs:
+
+<table style={{width: '100%', tableLayout: 'fixed'}}>
+<thead>
+<tr>
+<th style={{width: '14%'}}></th>
+<th style={{width: '43%'}}><strong><a href="https://docs.litellm.ai/docs/simple_proxy">LiteLLM AI Gateway</a></strong></th>
+<th style={{width: '43%'}}><strong><a href="https://docs.litellm.ai/docs/">LiteLLM Python SDK</a></strong></th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td style={{width: '14%'}}><strong>Use Case</strong></td>
+<td style={{width: '43%'}}>Central service (LLM Gateway) to access multiple LLMs</td>
+<td style={{width: '43%'}}>Use LiteLLM directly in your Python code</td>
+</tr>
+<tr>
+<td style={{width: '14%'}}><strong>Who Uses It?</strong></td>
+<td style={{width: '43%'}}>Gen AI Enablement / ML Platform Teams</td>
+<td style={{width: '43%'}}>Developers building LLM projects</td>
+</tr>
+<tr>
+<td style={{width: '14%'}}><strong>Key Features</strong></td>
+<td style={{width: '43%'}}>Centralized API gateway with authentication and authorization, multi-tenant cost tracking and spend management per project/user, per-project customization (logging, guardrails, caching), virtual keys for secure access control, admin dashboard UI for monitoring and management</td>
+<td style={{width: '43%'}}>Direct Python library integration in your codebase, Router with retry/fallback logic across multiple deployments (e.g. Azure/OpenAI) - <a href="https://docs.litellm.ai/docs/routing">Router</a>, application-level load balancing and cost tracking, exception handling with OpenAI-compatible errors, observability callbacks (Lunary, MLflow, Langfuse, etc.)</td>
+</tr>
+</tbody>
+</table>
+
+**Stable Release:** Use docker images with the `-stable` tag. These have undergone 12 hour load tests, before being published. [More information about the release cycle here](https://docs.litellm.ai/docs/proxy/release_cycle)
+
+Support for more providers. Missing a provider or LLM Platform, raise a [feature request](https://github.com/BerriAI/litellm/issues/new?assignees=&labels=enhancement&projects=&template=feature_request.yml&title=%5BFeature%5D%3A+).
+
+### Run in Developer Mode
+#### Services
 1. Setup .env file in root
 2. Run dependant services `docker-compose up db prometheus`
 
-### Backend
+#### Backend
 1. (In root) create virtual environment `python -m venv .venv`
 2. Activate virtual environment `source .venv/bin/activate`
-3. Install dependencies `pip install -e ".[all]"`
-4. `pip install prisma`
+3. Install dependencies `uv sync --all-extras --group proxy-dev`
+4. `uv run prisma generate`
 5. `prisma generate`
 6. Start proxy backend `python litellm/proxy/proxy_cli.py`
 
-### Frontend
+#### Frontend
 1. Navigate to `ui/litellm-dashboard`
 2. Install dependencies `npm install`
 3. Run `npm run dev` to start the dashboard
 
+### Verify Docker Image Signatures
+
+All LiteLLM Docker images published to GHCR are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).
+
+**Verify using the pinned commit hash (recommended):**
+
+A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:
+
+```bash
+cosign verify \
+  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
+  ghcr.io/berriai/litellm:<release-tag>
+```
+
+**Verify using a release tag (convenience):**
+
+Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
+
+```bash
+cosign verify \
+  --key https://raw.githubusercontent.com/BerriAI/litellm/<release-tag>/cosign.pub \
+  ghcr.io/berriai/litellm:<release-tag>
+```
+
+Replace `<release-tag>` with the version you are deploying (e.g. `v1.83.0-stable`).
+
+---
+
 # Enterprise
 For companies that need better security, user management and professional support
 
-[Talk to founders](https://calendly.com/d/cx9p-5yf-2nm/litellm-introductions)
+[Get an Enterprise License](https://litellm.ai/enterprise)
+[Talk to founders](https://enterprise.litellm.ai/demo)
 
 This covers:
 - ✅ **Features under the [LiteLLM Commercial License](https://docs.litellm.ai/docs/proxy/enterprise):**
@@ -418,7 +470,7 @@ We welcome contributions to LiteLLM! Whether you're fixing bugs, adding features
 
 ## Quick Start for Contributors
 
-This requires poetry to be installed.
+This requires uv to be installed.
 
 ```bash
 git clone https://github.com/BerriAI/litellm.git
@@ -452,13 +504,8 @@ All these checks must pass before your PR can be merged.
 - [Schedule Demo 👋](https://calendly.com/d/4mp-gd3-k5k/berriai-1-1-onboarding-litellm-hosted-version)
 - [Community Discord 💭](https://discord.gg/wuPM9dRgDw)
 - [Community Slack 💭](https://www.litellm.ai/support)
-- Our numbers 📞 +1 (770) 8783-106 / ‭+1 (412) 618-6238‬
 - Our emails ✉️ ishaan@berri.ai / krrish@berri.ai
 
-# Why did we build this
-
-- **Need for simplicity**: Our code started to get extremely complicated managing & translating calls between Azure, OpenAI and Cohere.
-
 # Contributors
 
 <!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
@@ -473,4 +520,3 @@ All these checks must pass before your PR can be merged.
 <a href="https://github.com/BerriAI/litellm/graphs/contributors">
   <img src="https://contrib.rocks/image?repo=BerriAI/litellm" />
 </a>
-

ci_cd/.grype.yaml

@@ -1,36 +0,0 @@
-ignore:
-  - vulnerability: CVE-2026-22184
-    reason: no fixed zlib package is available yet in the Wolfi repositories, so this is ignored temporarily until an upstream release exists
-  # Wolfi base image: Python 3.13 and Node from apk have no fixed builds in Wolfi yet / not applicable
-  - vulnerability: CVE-2025-55130
-    reason: Node in Wolfi apk; only used for Admin UI build/prisma
-  - vulnerability: CVE-2025-59465
-    reason: Node in Wolfi apk; only used for Admin UI build/prisma
-  - vulnerability: CVE-2025-55131
-    reason: Node in Wolfi apk; only used for Admin UI build/prisma
-  - vulnerability: CVE-2025-59466
-    reason: Node in Wolfi apk; only used for Admin UI build/prisma
-  - vulnerability: CVE-2026-21637
-    reason: Node in Wolfi apk; only used for Admin UI build/prisma
-  - vulnerability: CVE-2025-55132
-    reason: Node in Wolfi apk; only used for Admin UI build/prisma
-  - vulnerability: GHSA-hx9q-6w63-j58v
-    reason: orjson dumps recursion; allowlisted
-  - vulnerability: GHSA-73rr-hh4g-fpgx
-    reason: diff npm transitive dep; override in package.json, allowlisted
-  - vulnerability: CVE-2026-0865
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2025-15282
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2026-0672
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2025-15366
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2025-15367
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2025-11468
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2025-12781
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet
-  - vulnerability: CVE-2026-1299
-    reason: Python 3.13 in Wolfi base; no fixed apk build yet

ci_cd/publish-proxy-extras.sh

@@ -1,19 +0,0 @@
-#!/bin/bash
-
-# Exit on error
-set -e
-
-echo "🚀 Building and publishing litellm-proxy-extras"
-
-# Navigate to litellm-proxy-extras directory
-cd "$(dirname "$0")/../litellm-proxy-extras"
-
-# Build the package
-echo "📦 Building package..."
-poetry build
-
-# Publish to PyPI
-echo "🌎 Publishing to PyPI..."
-poetry publish
-
-echo "✅ Done! Package published successfully"

ci_cd/security_scans.sh

@@ -1,262 +0,0 @@
-#!/bin/bash
-
-# Security Scans Script for LiteLLM
-# This script runs comprehensive security scans including Trivy and Grype
-
-set -e
-
-echo "Starting security scans for LiteLLM..."
-
-# Function to install Trivy and required tools
-install_trivy() {
-    echo "Installing Trivy and required tools..."
-    sudo apt-get update
-    sudo apt-get install -y wget apt-transport-https gnupg lsb-release jq curl bsdmainutils
-    wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
-    echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
-    sudo apt-get update
-    sudo apt-get install trivy
-    echo "Trivy and required tools installed successfully"
-}
-
-# Function to install Grype
-install_grype() {
-    echo "Installing Grype..."
-    curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sudo sh -s -- -b /usr/local/bin
-    echo "Grype installed successfully"
-}
-
-# Function to install ggshield
-install_ggshield() {
-    echo "Installing ggshield..."
-    pip3 install --upgrade pip
-    pip3 install ggshield
-    echo "ggshield installed successfully"
-}
-
-# # Function to run secret detection scans
-# run_secret_detection() {
-#     echo "Running secret detection scans..."
-    
-#     if ! command -v ggshield &> /dev/null; then
-#         install_ggshield
-#     fi
-    
-#     # Check if GITGUARDIAN_API_KEY is set (required for CI/CD)
-#     if [ -z "$GITGUARDIAN_API_KEY" ]; then
-#         echo "Warning: GITGUARDIAN_API_KEY environment variable is not set."
-#         echo "ggshield requires a GitGuardian API key to scan for secrets."
-#         echo "Please set GITGUARDIAN_API_KEY in your CI/CD environment variables."
-#         exit 1
-#     fi
-    
-#     echo "Scanning codebase for secrets..."
-#     echo "Note: Large codebases may take several minutes due to API rate limits (50 requests/minute on free plan)"
-#     echo "ggshield will automatically handle rate limits and retry as needed."
-#     echo "Binary files, cache files, and build artifacts are excluded via .gitguardian.yaml"
-    
-#     # Use --recursive for directory scanning and auto-confirm if prompted
-#     # .gitguardian.yaml will automatically exclude binary files, wheel files, etc.
-#     # GITGUARDIAN_API_KEY environment variable will be used for authentication
-#     echo y | ggshield secret scan path . --recursive || {
-#         echo ""
-#         echo "=========================================="
-#         echo "ERROR: Secret Detection Failed"
-#         echo "=========================================="
-#         echo "ggshield has detected secrets in the codebase."
-#         echo "Please review discovered secrets above, revoke any actively used secrets"
-#         echo "from underlying systems and make changes to inject secrets dynamically at runtime."
-#         echo ""
-#         echo "For more information, see: https://docs.gitguardian.com/secrets-detection/"
-#         echo "=========================================="
-#         echo ""
-#         exit 1
-#     }
-    
-#     echo "Secret detection scans completed successfully"
-# }
-
-# Function to run Trivy scans
-run_trivy_scans() {
-    echo "Running Trivy scans..."
-    
-    echo "Scanning LiteLLM Docs..."
-    trivy fs --ignorefile .trivyignore --scanners vuln --dependency-tree --exit-code 1 --severity HIGH,CRITICAL,MEDIUM ./docs/
-    
-    echo "Scanning LiteLLM UI..."
-    trivy fs --ignorefile .trivyignore --scanners vuln --dependency-tree --exit-code 1 --severity HIGH,CRITICAL,MEDIUM ./ui/
-    
-    echo "Trivy scans completed successfully"
-}
-
-# Function to build and scan Docker images with Grype
-run_grype_scans() {
-    echo "Running Grype scans..."
-    
-    # Temporarily add wheel files to .dockerignore for security scans
-    echo "Temporarily modifying .dockerignore to exclude problematic wheel files..."
-    cp .dockerignore .dockerignore.backup 2>/dev/null || touch .dockerignore.backup
-    echo "/*.whl" >> .dockerignore
-    
-    # Build and scan Dockerfile.database
-    echo "Building and scanning Dockerfile.database..."
-    docker build --no-cache -t litellm-database:latest -f ./docker/Dockerfile.database .
-    grype litellm-database:latest --config ci_cd/.grype.yaml --fail-on critical
-    
-    # Build and scan main Dockerfile
-    echo "Building and scanning main Dockerfile..."
-    docker build --no-cache -t litellm:latest .
-    grype litellm:latest --config ci_cd/.grype.yaml --fail-on critical
-    
-    # Restore original .dockerignore
-    echo "Restoring original .dockerignore..."
-    mv .dockerignore.backup .dockerignore
-    
-    # Scan the locally built LiteLLM image for vulnerabilities with CVSS >= 4.0
-    echo "Scanning locally built LiteLLM image for high-severity vulnerabilities..."
-    echo "Using locally built image: litellm:latest"
-    
-    # Allowlist of CVEs to be ignored in failure threshold/reporting
-    # - CVE-2025-8869: Not applicable on Python >=3.13 (PEP 706 implemented); pip fallback unused; no OS-level fix
-    # - GHSA-4xh5-x5gv-qwph: GitHub Security Advisory alias for CVE-2025-8869
-    # - GHSA-5j98-mcp5-4vw2: glob CLI command injection via -c/--cmd; glob CLI is not used in the litellm runtime image,
-    #   and the vulnerable versions are pulled in only via OS-level/node tooling outside of our application code
-    ALLOWED_CVES=(
-        "CVE-2025-8869"
-        "GHSA-4xh5-x5gv-qwph"
-        "CVE-2025-8291" # no fix available as of Oct 11, 2025
-        "GHSA-5j98-mcp5-4vw2"
-        "CVE-2025-13836" # Python 3.13 HTTP response reading OOM/DoS - no fix available in base image
-        "CVE-2025-12084" # Python 3.13 xml.dom.minidom quadratic algorithm - no fix available in base image
-        "CVE-2025-60876" # BusyBox wget HTTP request splitting - no fix available in Chainguard Wolfi base image
-        "CVE-2026-0861" # Wolfi glibc still flagged even on 2.42-r5; upstream patched build unavailable yet
-        "CVE-2010-4756" # glibc glob DoS - awaiting patched Wolfi glibc build
-        "CVE-2019-1010022" # glibc stack guard bypass - awaiting patched Wolfi glibc build
-        "CVE-2019-1010023" # glibc ldd remap issue - awaiting patched Wolfi glibc build
-        "CVE-2019-1010024" # glibc ASLR mitigation bypass - awaiting patched Wolfi glibc build
-        "CVE-2019-1010025" # glibc pthread heap address leak - awaiting patched Wolfi glibc build
-        "CVE-2026-22184" # zlib untgz buffer overflow - untgz unused + no fixed Wolfi build yet
-        "GHSA-58pv-8j8x-9vj2" # jaraco.context path traversal - setuptools vendored only (v5.3.0), not used in application code (using v6.1.0+)
-        "GHSA-34x7-hfp2-rc4v" # node-tar hardlink path traversal - not applicable, tar CLI not exposed in application code
-        "GHSA-r6q2-hw4h-h46w" # node-tar not used by application runtime, Linux-only container, not affect by macOS APFS-specific exploit
-        "GHSA-8rrh-rw8j-w5fx" # wheel is from chainguard and will be handled by then TODO: Remove this after Chainguard updates the wheel
-        "CVE-2025-59465" # Node only used for Admin UI build/prisma
-        "CVE-2025-55131" # Node only used for Admin UI build/prisma
-        "CVE-2025-59466" # Node only used for Admin UI build/prisma
-        "CVE-2025-55130" # Node only used for Admin UI build/prisma
-        "CVE-2025-59467" # Node only used for Admin UI build/prisma
-        "CVE-2026-21637" # Node only used for Admin UI build/prisma
-        "CVE-2025-55132" # Node only used for Admin UI build/prisma
-        "GHSA-hx9q-6w63-j58v" # orjson dumps recursion; allowlisted
-        "CVE-2025-15281" # No fix available yet
-        "CVE-2026-0865" # No fix available yet
-        "CVE-2025-15282" # No fix available yet
-        "CVE-2026-0672" # No fix available yet
-        "CVE-2025-15366" # No fix available yet
-        "CVE-2025-15367" # No fix available yet
-        "CVE-2025-12781" # No fix available yet
-        "CVE-2025-11468" # No fix available yet
-        "CVE-2026-1299" # Python 3.13 email module header injection - not applicable, LiteLLM doesn't use BytesGenerator for email serialization
-        "CVE-2026-0775" # npm cli incorrect permission assignment - no fix available yet, npm is only used at build/prisma-generate time
-        "GHSA-3ppc-4f35-3m26" # minimatch ReDoS via repeated wildcards - from nodejs_wheel bundled npm, not used in application runtime code
-        "GHSA-83g3-92jg-28cx" # tar arbitrary file read/write via hardlink - from nodejs_wheel bundled npm, not used in application runtime code
-        "CVE-2026-25639" # axios - full fix requires 1.x major version bump; pinned to >=0.30.2 to clear other axios CVEs, upgrade to 1.x in follow-up
-        "CVE-2026-2297" # Python 3.13 SourcelessFileLoader audit hook bypass - no fix available in base image
-        "GHSA-qffp-2rhf-9h96" # tar hardlink path traversal - from nodejs_wheel bundled npm, not used in application runtime code
-        "CVE-2026-2673" # OpenSSL 3.6.1 TLS 1.3 key exchange group negotiation issue - no fix available yet
-        "CVE-2026-3644" # Python 3.13 vulnerability - no fix available in base image
-        "CVE-2026-4224" # Python 3.13 Expat parser stack overflow in ElementDeclHandler - no fix available in base image
-    )
-
-    # Build JSON array of allowlisted CVE IDs for jq
-    ALLOWED_IDS_JSON=$(printf '%s\n' "${ALLOWED_CVES[@]}" | jq -R . | jq -s .)
-
-    echo "Checking for vulnerabilities with CVSS score >= 4.0..."
-    echo "Allowlisted CVEs (ignored in threshold): ${ALLOWED_CVES[*]}"
-    echo ""
-    
-    # Show all high-severity vulnerabilities for transparency
-    TOTAL_HIGH_SEVERITY=$(grype litellm:latest -o json | jq -r '
-        .matches[]
-        | select(.vulnerability.cvss[]?.metrics.baseScore >= 4.0)
-        | .vulnerability.id' | wc -l)
-    
-    if [ "$TOTAL_HIGH_SEVERITY" -gt 0 ]; then
-        echo "Total vulnerabilities found with CVSS >= 4.0: $TOTAL_HIGH_SEVERITY"
-        echo ""
-        echo "All high-severity vulnerabilities (including allowlisted):"
-        grype litellm:latest -o json | jq --argjson allow "$ALLOWED_IDS_JSON" -r '
-        ["Package", "Version", "Vulnerability ID", "CVSS Score", "Allowlisted"],
-        (.matches[]
-          | select(.vulnerability.cvss[]?.metrics.baseScore >= 4.0)
-          | [.artifact.name, .artifact.version, .vulnerability.id, .vulnerability.cvss[0].metrics.baseScore, (if (.vulnerability.id as $id | $allow | index($id)) then "YES" else "NO" end)])
-        | @tsv' | column -t -s $'\t'
-        echo ""
-    fi
-
-    HIGH_SEVERITY_COUNT=$(grype litellm:latest -o json | jq --argjson allow "$ALLOWED_IDS_JSON" -r '
-        .matches[]
-        | select(.vulnerability.cvss[]?.metrics.baseScore >= 4.0)
-        | select((.vulnerability.id as $id | $allow | index($id) | not))
-        | .vulnerability.id' | wc -l)
-    
-    if [ "$HIGH_SEVERITY_COUNT" -gt 0 ]; then
-        echo ""
-        echo "=========================================="
-        echo "ERROR: Security Scan Failed"
-        echo "=========================================="
-        echo "Found $HIGH_SEVERITY_COUNT non-allowlisted vulnerabilities with CVSS score >= 4.0 in litellm:latest"
-        echo ""
-        echo "These vulnerabilities are NOT in the allowlist and must be addressed."
-        echo "Current allowlisted CVEs: ${ALLOWED_CVES[*]}"
-        echo ""
-        echo "Detailed vulnerability report:"
-        echo ""
-        grype litellm:latest -o json | jq --argjson allow "$ALLOWED_IDS_JSON" -r '
-        ["Package", "Version", "Vulnerability ID", "CVSS Score", "Severity", "Fix Version", "Description"],
-        (.matches[]
-          | select(.vulnerability.cvss[]?.metrics.baseScore >= 4.0)
-          | select((.vulnerability.id as $id | $allow | index($id) | not))
-          | [.artifact.name, .artifact.version, .vulnerability.id, .vulnerability.cvss[0].metrics.baseScore, .vulnerability.severity, (.vulnerability.fix.versions[0] // "No fix available"), .vulnerability.description])
-        | @tsv' | column -t -s $'\t'
-        echo ""
-        echo "=========================================="
-        echo "Action Required:"
-        echo "=========================================="
-        echo "1. If a fix is available, update the package to the fixed version"
-        echo "2. If the vulnerability is not applicable or has no fix:"
-        echo "   - Add the CVE/GHSA ID to ALLOWED_CVES array in ci_cd/security_scans.sh"
-        echo "   - Add a comment explaining why it's safe to ignore"
-        echo ""
-        echo "Note: Some vulnerabilities may have multiple IDs (CVE-XXXX and GHSA-XXXX)."
-        echo "Add all relevant IDs to the allowlist if they refer to the same issue."
-        echo "=========================================="
-        echo ""
-        exit 1
-    else
-        echo "No high-severity vulnerabilities (CVSS >= 4.0) found in litellm:latest"
-    fi
-    
-    echo "Grype scans completed successfully"
-}
-
-# Main execution
-main() {
-    echo "Installing security scanning tools..."
-    install_trivy
-    install_grype
-    
-    # echo "Running secret detection scans..."
-    # run_secret_detection
-    
-    echo "Running filesystem vulnerability scans..."
-    run_trivy_scans
-    
-    echo "Running Docker image vulnerability scans..."
-    run_grype_scans
-    
-    echo "All security scans completed successfully!"
-}
-
-# Execute main function
-main "$@"

codecov.yaml

@@ -17,6 +17,9 @@ component_management:
     - component_id: "Proxy_Authentication"
       paths:
         - "*/proxy/auth/**"
+    - component_id: "Enterprise"
+      paths:
+        - "enterprise/**"
 comment:
   layout: "header, diff, flags, components"  # show component info in the PR comment
 

cookbook/ai_coding_tool_guides/claude_code_quickstart/guide.md

@@ -230,7 +230,7 @@ model_list:
   # AWS Bedrock
   - model_name: claude-bedrock
     litellm_params:
-      model: bedrock/anthropic.claude-3-5-sonnet-20241022-v2:0
+      model: bedrock/us.anthropic.claude-haiku-4-5-20251001-v1:0
       aws_access_key_id: os.environ/AWS_ACCESS_KEY_ID
       aws_secret_access_key: os.environ/AWS_SECRET_ACCESS_KEY
       aws_region_name: us-east-1

cookbook/benchmark/readme.md

@@ -178,4 +178,4 @@ Benchmark Results for 'When will BerriAI IPO?':
 ```
 
 ## Support 
-**🤝 Schedule a 1-on-1 Session:** Book a [1-on-1 session](https://calendly.com/d/cx9p-5yf-2nm/litellm-introductions) with Krrish and Ishaan, the founders, to discuss any issues, provide feedback, or explore how we can improve LiteLLM for you.
+**🤝 Schedule a 1-on-1 Session:** Book a [1-on-1 session](https://enterprise.litellm.ai/demo) with Krrish and Ishaan, the founders, to discuss any issues, provide feedback, or explore how we can improve LiteLLM for you.

cookbook/codellama-server/README.MD

@@ -143,7 +143,6 @@ All responses from the server are returned in the following format (for all LLM
 
 - [Our calendar 👋](https://calendly.com/d/4mp-gd3-k5k/berriai-1-1-onboarding-litellm-hosted-version)
 - [Community Discord 💭](https://discord.gg/wuPM9dRgDw)
-- Our numbers 📞 +1 (770) 8783-106 / +1 (412) 618-6238
 - Our emails ✉️ ishaan@berri.ai / krrish@berri.ai
 
 ## Roadmap

cookbook/litellm-ollama-docker-image/requirements.txt

@@ -1 +1 @@
-litellm==1.61.15
+litellm==1.83.5

cookbook/litellm_proxy_server/readme.md

@@ -164,7 +164,6 @@ All responses from the server are returned in the following format (for all LLM
 
 - [Our calendar 👋](https://calendly.com/d/4mp-gd3-k5k/berriai-1-1-onboarding-litellm-hosted-version)
 - [Community Discord 💭](https://discord.gg/wuPM9dRgDw)
-- Our numbers 📞 +1 (770) 8783-106 / +1 (412) 618-6238
 - Our emails ✉️ ishaan@berri.ai / krrish@berri.ai
 
 ## Roadmap

cookbook/misc/RELEASE_NOTES_GENERATION_INSTRUCTIONS.md

@@ -9,6 +9,32 @@ This document provides comprehensive instructions for AI agents to generate rele
 3. **Previous Version Commit Hash** - To compare model pricing changes
 4. **Reference Release Notes** - Use recent stable releases (v1.76.3-stable, v1.77.2-stable) as templates for consistent formatting
 
+### Resolving Staging PRs
+
+The GitHub release page (e.g. `https://github.com/BerriAI/litellm/releases/tag/v1.83.3-stable`) does **not** list the real changelog directly. The "What's Changed" section contains **staging PRs** that each bundle many individual commits/PRs. For example:
+
+- `Litellm oss staging 03 14 2026 by @RheagalFire in #23686`
+- `Litellm ryan march 16 by @ryan-crabbe in #23822`
+
+To get the real changelog, you MUST click into each staging PR (e.g. `#23686`, `#23822`), open its **Commits** tab, and extract every underlying commit/PR (look for the `(#NNNNN)` suffix on commit titles). Those underlying PRs — not the staging PRs — are what get categorized in the release notes. Never treat a staging PR title as a single changelog entry.
+
+**IMPORTANT — staging PRs are not the complete source.** Some PRs land on the release branch *before* the staging PRs and are therefore not reachable via `gh api /pulls/<staging>/commits`. GitHub's auto-generated "What's Changed" on the release page also misses these. To catch every PR in the release, you MUST additionally walk the full git log range between the previous release's commit and this release's commit:
+
+```bash
+git fetch origin --tags
+git log <prev_release_commit>..<this_release_commit> --oneline | grep -oE '#[0-9]+' | sort -u
+```
+
+Union the PR set from the staging-PR walk with the PR set from `git log`. Any PR in `git log` but missing from your staging-expanded set is almost certainly a content PR that merged directly to the release branch — fetch its title/body with `gh pr view <N>` and categorize it. Do not trust the GH release body or the staging PRs alone as the authoritative list.
+
+**Sanity check for new contributors.** The GH release body's "New Contributors" list is a *floor*, not authoritative. For every PR author who appears in the release (including underlying PRs from staging and PRs found only via `git log`), verify whether they are a first-time contributor by running:
+
+```bash
+gh api "search/issues?q=is:pr+author:<login>+repo:BerriAI/litellm+is:merged&sort=created&order=asc" --jq '.items[0] | {n:.number, merged:.closed_at}'
+```
+
+If the author's earliest merged PR number matches a PR in this release window, they are a new contributor. If their earliest merged PR predates the previous release tag, they are not. Do not copy the GH release body's list blindly — it can both miss contributors (PRs that merged via an older dev branch) and falsely include contributors whose "first" PR in this window was not actually their first ever.
+
 ## Step-by-Step Process
 
 ### 1. Initial Setup and Analysis

cookbook/misc/test_responses_api.py

@@ -20,7 +20,7 @@ base64_image = encode_image(image_path)
 
 
 response = client.responses.create(
-    model="bedrock/us.anthropic.claude-3-5-sonnet-20241022-v2:0",
+    model="bedrock/us.anthropic.claude-haiku-4-5-20251001-v1:0",
     input=[
         {
             "role": "user",
@@ -43,7 +43,7 @@ print("sleeping for 20 seconds...")
 time.sleep(20)
 print("making follow up request for existing id")
 response2 = client.responses.create(
-    model="bedrock/us.anthropic.claude-3-5-sonnet-20241022-v2:0",
+    model="bedrock/us.anthropic.claude-haiku-4-5-20251001-v1:0",
     previous_response_id=response.id,
     input="ok, and what objects are in the image?"
 )

cosign.pub

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKi4ivqGpE231OGH50PKbqy1Y1Kkb
+POJC8+i2Wko82gBOUCe3M0Vw86H/4rhUhfoYEti4gdJ9wZbYmK0I2EE96g==
+-----END PUBLIC KEY-----

deploy/Dockerfile.ghcr_base

@@ -1,5 +1,5 @@
 # Use the provided base image
-FROM ghcr.io/berriai/litellm:main-latest
+FROM ghcr.io/berriai/litellm:main-latest@sha256:7c311546c25e7bb6e8cafede9fcd3d0d622ac636b5c9418befaa32e85dfb0186
 
 # Set the working directory to /app
 WORKDIR /app

docker/Dockerfile.alpine

@@ -1,57 +1,68 @@
 # Base image for building
-ARG LITELLM_BUILD_IMAGE=python:3.11-alpine
+ARG LITELLM_BUILD_IMAGE=python:3.11-alpine@sha256:f07e2ace46f560f09a6eeec7b4913b80ee99546e749ef82342a419a326620856
 
 # Runtime image
-ARG LITELLM_RUNTIME_IMAGE=python:3.11-alpine
+ARG LITELLM_RUNTIME_IMAGE=python:3.11-alpine@sha256:f07e2ace46f560f09a6eeec7b4913b80ee99546e749ef82342a419a326620856
+ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
+
+FROM $UV_IMAGE AS uvbin
 
-# Builder stage
 FROM $LITELLM_BUILD_IMAGE AS builder
 
-# Set the working directory to /app
 WORKDIR /app
 
-# Install build dependencies
-RUN apk add --no-cache gcc python3-dev musl-dev
+COPY --from=uvbin /uv /usr/local/bin/uv
+COPY --from=uvbin /uvx /usr/local/bin/uvx
 
-RUN pip install --upgrade pip && \
-    pip install build
+RUN apk add --no-cache gcc python3-dev musl-dev nodejs npm libsndfile
 
-# Copy the current directory contents into the container at /app
+ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+    UV_PROJECT_ENVIRONMENT=/app/.venv \
+    UV_LINK_MODE=copy \
+    XDG_CACHE_HOME=/app/.cache \
+    PATH="/app/.venv/bin:${PATH}"
+
+# Copy dependency metadata first for layer caching
+COPY pyproject.toml uv.lock ./
+COPY enterprise/pyproject.toml enterprise/
+COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
+
+# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
+RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
+    --extra proxy \
+    --extra proxy-runtime \
+    --extra extra_proxy \
+    --extra semantic-router \
+    --python python3
+
+# Copy full source tree
 COPY . .
 
-# Build the package
-RUN rm -rf dist/* && python -m build
+# Install project and workspace packages (fast - deps already cached)
+RUN uv sync --frozen --no-default-groups --no-editable \
+    --extra proxy \
+    --extra proxy-runtime \
+    --extra extra_proxy \
+    --extra semantic-router \
+    --python python3
 
-# There should be only one wheel file now, assume the build only creates one
-RUN ls -1 dist/*.whl | head -1
+RUN prisma generate --schema=./schema.prisma
 
-# Install the package
-RUN pip install dist/*.whl
+RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
+    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
 
-# install dependencies as wheels
-RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
-
-# Runtime stage
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
 
-# Update dependencies and clean up, install libsndfile for audio processing
-RUN apk upgrade --no-cache && apk add --no-cache libsndfile
+RUN apk upgrade --no-cache && apk add --no-cache libsndfile nodejs npm
 
 WORKDIR /app
+ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+    XDG_CACHE_HOME=/app/.cache \
+    PATH="/app/.venv/bin:${PATH}"
 
-# Copy the built wheel from the builder stage to the runtime stage; assumes only one wheel file is present
-COPY --from=builder /app/dist/*.whl .
-COPY --from=builder /wheels/ /wheels/
-
-# Install the built wheel using pip; again using a wildcard if it's the only file
-RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl && rm -rf /wheels
-
-# Convert Windows line endings to Unix for entrypoint scripts
-RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
-RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
+COPY --from=builder /app /app
 
 EXPOSE 4000/tcp
 
-# Set your entrypoint and command
 ENTRYPOINT ["docker/prod_entrypoint.sh"]
 CMD ["--port", "4000"]

docker/Dockerfile.custom_ui

@@ -1,4 +1,5 @@
 # Use the provided base image
+# NOTE: This is a dev/branch-specific tag. Update digest when the base image is rebuilt.
 FROM ghcr.io/berriai/litellm:litellm_fwd_server_root_path-dev
 
 # Set the working directory to /app
@@ -18,8 +19,8 @@ RUN apt-get update && apt-get upgrade -y \
         libxslt1.1 \
         libgnutls30 \
         libc6 && \
-    apt-get install -y nodejs npm && \
-    npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
+    apt-get install -y --no-install-recommends nodejs npm && \
+    npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     GLOBAL="$(npm root -g)" && \
     find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -51,7 +52,7 @@ ENV UI_BASE_PATH="/prod/ui"
 
 # Build the UI with the specified UI_BASE_PATH
 WORKDIR /app/ui/litellm-dashboard
-RUN npm install
+RUN npm ci
 RUN UI_BASE_PATH=$UI_BASE_PATH npm run build
 
 # Create the destination directory
@@ -70,8 +71,16 @@ WORKDIR /app
 RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
 RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
 
+# Run as non-root user
+RUN groupadd --gid 1000 appuser && useradd --uid 1000 --gid 1000 --no-create-home appuser \
+    && chown -R appuser:appuser /app
+USER appuser
+
 # Expose the necessary port
 EXPOSE 4000/tcp
 
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:4000/health')"]
+
 # Override the CMD instruction with your desired command and arguments
 CMD ["--port", "4000", "--config", "config.yaml", "--detailed_debug"]

docker/Dockerfile.database

@@ -1,56 +1,75 @@
 # Base image for building
-ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
 
 # Runtime image
-ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base
-# Builder stage
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
+ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
+
+FROM $UV_IMAGE AS uvbin
+
 FROM $LITELLM_BUILD_IMAGE AS builder
 
-# Set the working directory to /app
 WORKDIR /app
-
 USER root
 
-# Install build dependencies
+COPY --from=uvbin /uv /usr/local/bin/uv
+COPY --from=uvbin /uvx /usr/local/bin/uvx
+
 RUN apk add --no-cache \
     bash \
     gcc \
-    py3-pip \
     python3 \
     python3-dev \
     openssl \
-    openssl-dev
+    openssl-dev \
+    nodejs \
+    npm \
+    libsndfile
 
-RUN python -m pip install build
+ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+    UV_PROJECT_ENVIRONMENT=/app/.venv \
+    UV_LINK_MODE=copy \
+    XDG_CACHE_HOME=/app/.cache \
+    PATH="/app/.venv/bin:${PATH}"
 
-# Copy the current directory contents into the container at /app
+# Copy dependency metadata first for layer caching
+COPY pyproject.toml uv.lock ./
+COPY enterprise/pyproject.toml enterprise/
+COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
+
+# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
+RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
+    --extra proxy \
+    --extra proxy-runtime \
+    --extra extra_proxy \
+    --extra semantic-router \
+    --python python3
+
+# Copy full source tree
 COPY . .
 
-# Build Admin UI
-# Convert Windows line endings to Unix and make executable
+# Build Admin UI before final sync
 RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
 
-# Build the package
-RUN rm -rf dist/* && python -m build
+# Install project and workspace packages (fast - deps already cached)
+RUN uv sync --frozen --no-default-groups --no-editable \
+    --extra proxy \
+    --extra proxy-runtime \
+    --extra extra_proxy \
+    --extra semantic-router \
+    --python python3
 
-# There should be only one wheel file now, assume the build only creates one
-RUN ls -1 dist/*.whl | head -1
+RUN prisma generate --schema=./schema.prisma
 
-# Install the package
-RUN pip install dist/*.whl
+RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
+    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
 
-# install dependencies as wheels
-RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
-
-# Runtime stage
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
 
-# Ensure runtime stage runs as root
 USER root
 
-# Install runtime dependencies
-RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
-    npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
+RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile supervisor && \
+    npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     GLOBAL="$(npm root -g)" && \
     find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -73,66 +92,18 @@ RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile
     { apk del --no-cache npm 2>/dev/null || true; }
 
 WORKDIR /app
-# Copy the current directory contents into the container at /app
-COPY . .
-RUN ls -la /app
+ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+    XDG_CACHE_HOME=/app/.cache \
+    PATH="/app/.venv/bin:${PATH}"
 
-# Copy the built wheel from the builder stage to the runtime stage; assumes only one wheel file is present
-COPY --from=builder /app/dist/*.whl .
-COPY --from=builder /wheels/ /wheels/
+COPY --from=builder /app /app
 
-# Install the built wheel using pip; again using a wildcard if it's the only file
-RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl && rm -rf /wheels
+RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \
+    find /app/.venv -type d -path "*/tornado/test" -delete
 
-# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
-# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
-# Patch every copy of tar, glob, and brace-expansion inside that tree.
-RUN GLOBAL="$(npm root -g)" && \
-    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
-    find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
-    done && \
-    find /usr/lib -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
-    done && \
-    find /usr/lib -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
-    done && \
-    find /usr/lib -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
-    done && \
-    find /usr/lib -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
-    done
-
-# Install semantic_router and aurelio-sdk using script
-# Convert Windows line endings to Unix and make executable
-RUN sed -i 's/\r$//' docker/install_auto_router.sh && chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh
-
-# ensure pyjwt is used, not jwt
-RUN pip uninstall jwt -y
-RUN pip uninstall PyJWT -y
-RUN pip install PyJWT==2.12.0 --no-cache-dir
-
-# Build Admin UI (runtime stage)
-# Convert Windows line endings to Unix and make executable
-RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
-
-# Generate prisma client
-RUN prisma generate
-# Convert Windows line endings to Unix for entrypoint scripts
-RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
-RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
 EXPOSE 4000/tcp
 
-RUN apk add --no-cache supervisor
 COPY docker/supervisord.conf /etc/supervisord.conf
 
-# # Set your entrypoint and command
-
-
 ENTRYPOINT ["docker/prod_entrypoint.sh"]
-
-# Append "--detailed_debug" to the end of CMD to view detailed debug logs 
-# CMD ["--port", "4000", "--detailed_debug"]
 CMD ["--port", "4000"]

docker/Dockerfile.dev

@@ -1,61 +1,72 @@
 # Base image for building
-ARG LITELLM_BUILD_IMAGE=python:3.11-slim
+ARG LITELLM_BUILD_IMAGE=python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
 
 # Runtime image
-ARG LITELLM_RUNTIME_IMAGE=python:3.11-slim
+ARG LITELLM_RUNTIME_IMAGE=python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
+ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
+
+FROM $UV_IMAGE AS uvbin
 
-# Builder stage
 FROM $LITELLM_BUILD_IMAGE AS builder
 
-# Set the working directory to /app
 WORKDIR /app
-
 USER root
 
-# Install build dependencies in one layer
+COPY --from=uvbin /uv /usr/local/bin/uv
+COPY --from=uvbin /uvx /usr/local/bin/uvx
+
 RUN apt-get update && apt-get install -y --no-install-recommends \
     gcc \
+    g++ \
     python3-dev \
     libssl-dev \
     pkg-config \
-    && rm -rf /var/lib/apt/lists/* \
-    && pip install --upgrade pip build
+    nodejs \
+    npm \
+    && rm -rf /var/lib/apt/lists/*
 
-# Copy requirements first for better layer caching
-COPY requirements.txt .
+ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+    UV_PROJECT_ENVIRONMENT=/app/.venv \
+    UV_LINK_MODE=copy \
+    XDG_CACHE_HOME=/app/.cache \
+    PATH="/app/.venv/bin:${PATH}"
 
-# Install Python dependencies with cache mount for faster rebuilds
-RUN --mount=type=cache,target=/root/.cache/pip \
-    pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
+# Copy dependency metadata first for layer caching
+COPY pyproject.toml uv.lock ./
+COPY enterprise/pyproject.toml enterprise/
+COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
 
-# Fix JWT dependency conflicts early
-RUN pip uninstall jwt -y || true && \
-    pip uninstall PyJWT -y || true && \
-    pip install PyJWT==2.12.0 --no-cache-dir
+# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
+RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
+    --extra proxy \
+    --extra proxy-runtime \
+    --extra extra_proxy \
+    --extra semantic-router \
+    --python python
 
-# Copy only necessary files for build
-COPY pyproject.toml README.md schema.prisma poetry.lock ./
-COPY litellm/ ./litellm/
-COPY enterprise/ ./enterprise/
-COPY docker/ ./docker/
+# Copy full source tree
+COPY . .
 
-# Build Admin UI once
-# Convert Windows line endings to Unix and make executable
+# Build Admin UI before final sync
 RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
 
-# Build the package
-RUN rm -rf dist/* && python -m build
+# Install project and workspace packages (fast - deps already cached)
+RUN uv sync --frozen --no-default-groups --no-editable \
+    --extra proxy \
+    --extra proxy-runtime \
+    --extra extra_proxy \
+    --extra semantic-router \
+    --python python
 
-# Install the built package
-RUN pip install dist/*.whl
+RUN prisma generate --schema=./schema.prisma
+
+RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
+    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
 
-# Runtime stage
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
 
-# Ensure runtime stage runs as root
 USER root
 
-# Install only runtime dependencies
 RUN apt-get update && apt-get upgrade -y \
         libxml2 \
         libexpat1 \
@@ -71,11 +82,11 @@ RUN apt-get update && apt-get upgrade -y \
         libc6 \
     && apt-get install -y --no-install-recommends \
         libssl3 \
-    libatomic1 \
-    nodejs \
-    npm \
+        libatomic1 \
+        nodejs \
+        npm \
     && rm -rf /var/lib/apt/lists/* \
-    && npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
+    && npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
     && GLOBAL="$(npm root -g)" \
     && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
           rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -98,53 +109,13 @@ RUN apt-get update && apt-get upgrade -y \
     && apt-get purge -y npm
 
 WORKDIR /app
+ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+    XDG_CACHE_HOME=/app/.cache \
+    PATH="/app/.venv/bin:${PATH}"
 
-# Copy only necessary runtime files
-COPY docker/entrypoint.sh docker/prod_entrypoint.sh ./docker/
-COPY litellm/ ./litellm/
-COPY pyproject.toml README.md schema.prisma poetry.lock ./
-
-# Copy pre-built wheels and install everything at once
-COPY --from=builder /wheels/ /wheels/
-COPY --from=builder /app/dist/*.whl .
-
-# Install all dependencies in one step with no-cache for smaller image
-RUN pip install --no-cache-dir *.whl /wheels/* --no-index --find-links=/wheels/ && \
-    rm -f *.whl && \
-    rm -rf /wheels
-
-# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
-# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
-# Patch every copy of tar, glob, and brace-expansion inside that tree.
-RUN GLOBAL="$(npm root -g)" && \
-    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
-    find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
-    done && \
-    find /usr/lib -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
-    done && \
-    find /usr/lib -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
-    done && \
-    find /usr/lib -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
-    done && \
-    find /usr/lib -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
-    done
-
-# Generate prisma client and set permissions
-# Convert Windows line endings to Unix for entrypoint scripts
-RUN prisma generate && \
-    sed -i 's/\r$//' docker/entrypoint.sh && \
-    sed -i 's/\r$//' docker/prod_entrypoint.sh && \
-    chmod +x docker/entrypoint.sh && \
-    chmod +x docker/prod_entrypoint.sh
+COPY --from=builder /app /app
 
 EXPOSE 4000/tcp
 
 ENTRYPOINT ["docker/prod_entrypoint.sh"]
-
-# Append "--detailed_debug" to the end of CMD to view detailed debug logs 
-CMD ["--port", "4000"]
+CMD ["--port", "4000"]

docker/Dockerfile.health_check

@@ -1,16 +1,30 @@
-FROM python:3.11-slim
+ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
+FROM $UV_IMAGE AS uvbin
+
+FROM python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
 
 WORKDIR /app
 
-# Copy health check script and requirements
+# Copy the uv binary and the health check script.
+COPY --from=uvbin /uv /usr/local/bin/uv
+COPY pyproject.toml uv.lock /app/
 COPY scripts/health_check/health_check_client.py /app/health_check_client.py
-COPY scripts/health_check/health_check_requirements.txt /app/requirements.txt
 
-# Install dependencies
-RUN pip install --no-cache-dir -r requirements.txt
+# Resolve and install the health-check dependencies from the project lockfile
+# so the runtime image stays self-contained and reproducible.
+RUN uv export --frozen --no-default-groups --only-group healthcheck --no-emit-project --no-hashes --output-file /tmp/health-check-requirements.txt \
+  && uv pip install --system -r /tmp/health-check-requirements.txt \
+  && rm /tmp/health-check-requirements.txt \
+  && rm /app/pyproject.toml /app/uv.lock \
+  && chmod +x /app/health_check_client.py
 
-# Make script executable
-RUN chmod +x /app/health_check_client.py
+# Run as non-root user
+RUN groupadd --gid 1000 appuser && useradd --uid 1000 --gid 1000 --no-create-home appuser
+USER appuser
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+  CMD ["python", "/app/health_check_client.py", "--help"]
 
 # Set entrypoint
 ENTRYPOINT ["python", "/app/health_check_client.py"]

docker/Dockerfile.non_root

@@ -1,56 +1,99 @@
 # Base images
-ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base
-ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base
+ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
+ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
 ARG PROXY_EXTRAS_SOURCE=published
+ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
+
+FROM $UV_IMAGE AS uvbin
 
-# -----------------
-# Builder Stage
-# -----------------
 FROM $LITELLM_BUILD_IMAGE AS builder
 ARG PROXY_EXTRAS_SOURCE
 WORKDIR /app
 USER root
 
-# Install build dependencies with retry logic (includes node for UI build)
+COPY --from=uvbin /uv /usr/local/bin/uv
+COPY --from=uvbin /uvx /usr/local/bin/uvx
+
 RUN for i in 1 2 3; do \
     apk add --no-cache \
-    python3 \
-    python3-dev \
-    py3-pip \
-    clang \
-    llvm \
-    lld \
-    gcc \
-    linux-headers \
-    build-base \
-    bash \
-    nodejs \
-    npm && break || sleep 5; \
-    done \
-  && pip install --no-cache-dir --upgrade pip build
+      python3 \
+      python3-dev \
+      clang \
+      llvm \
+      lld \
+      gcc \
+      linux-headers \
+      build-base \
+      bash \
+      coreutils \
+      curl \
+      openssl \
+      openssl-dev \
+      nodejs \
+      npm \
+      libsndfile && break || sleep 5; \
+    done
 
-# Cache Python dependencies
-COPY requirements.txt .
-RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt \
-  && pip wheel --no-cache-dir --wheel-dir=/wheels/ "semantic_router==0.1.11" "aurelio-sdk==0.0.19" "PyJWT==2.12.0"
+ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
+    UV_LINK_MODE=copy \
+    NVM_DIR=/root/.nvm \
+    PATH="/root/.nvm/versions/node/v20.20.2/bin:/app/.venv/bin:${PATH}" \
+    LITELLM_NON_ROOT=true \
+    PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+    PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" \
+    XDG_CACHE_HOME=/app/.cache
 
-# Copy source after dependency layers
+# Copy dependency metadata first for layer caching
+COPY pyproject.toml uv.lock ./
+COPY enterprise/pyproject.toml enterprise/
+COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
+
+# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
+RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
+    --extra proxy \
+    --extra proxy-runtime \
+    --extra extra_proxy \
+    --extra semantic-router \
+    --python python3
+
+# Copy full source tree
 COPY . .
 
 # Set non-root flag for build time consistency
 ENV LITELLM_NON_ROOT=true
 
-# Build Admin UI using the upstream command order while keeping a single RUN layer
-RUN mkdir -p /var/lib/litellm/ui && \
-    npm install -g npm@latest && npm cache clean --force && \
+# Build Admin UI once and stage the static output for the runtime image.
+# NOTE: .npmrc files (which may set ignore-scripts=true and min-release-age=3d)
+# are temporarily renamed during npm install/ci so they don't block lifecycle
+# scripts needed by the build. This is safe because npm ci installs from
+# package-lock.json with pinned versions + integrity hashes.
+RUN mkdir -p /var/lib/litellm/ui /var/lib/litellm/assets && \
+    ([ -f /app/.npmrc ] && mv /app/.npmrc /app/.npmrc.bak || true) && \
+    NVM_VERSION="v0.40.4" && \
+    NVM_CHECKSUM="4b7412c49960c7d31e8df72da90c1fb5b8cccb419ac99537b737028d497aba4f" && \
+    NODE_VERSION="v20.20.2" && \
+    NVM_SCRIPT="/tmp/install-nvm.sh" && \
+    curl -fsSL "https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_VERSION}/install.sh" -o "$NVM_SCRIPT" && \
+    echo "${NVM_CHECKSUM}  ${NVM_SCRIPT}" | sha256sum -c - && \
+    bash "$NVM_SCRIPT" && \
+    export NVM_DIR="$HOME/.nvm" && \
+    . "$NVM_DIR/nvm.sh" && \
+    nvm install "${NODE_VERSION}" && \
+    nvm use "${NODE_VERSION}" && \
+    npm install -g npm@11.12.1 && \
+    npm install -g node-gyp@12.2.0 && \
+    ln -sf "$(npm root -g)/node-gyp" "$(npm root -g)/npm/node_modules/node-gyp" && \
+    npm cache clean --force && \
     cd /app/ui/litellm-dashboard && \
     if [ -f "/app/enterprise/enterprise_ui/enterprise_colors.json" ]; then \
       cp /app/enterprise/enterprise_ui/enterprise_colors.json ./ui_colors.json; \
     fi && \
-    npm install --legacy-peer-deps && \
+    ([ -f .npmrc ] && mv .npmrc .npmrc.bak || true) && \
+    npm ci --no-audit --no-fund && \
+    ([ -f .npmrc.bak ] && mv .npmrc.bak .npmrc || true) && \
+    ([ -f /app/.npmrc.bak ] && mv /app/.npmrc.bak /app/.npmrc || true) && \
     npm run build && \
     cp -r /app/ui/litellm-dashboard/out/* /var/lib/litellm/ui/ && \
-    mkdir -p /var/lib/litellm/assets && \
     cp /app/litellm/proxy/logo.jpg /var/lib/litellm/assets/logo.jpg && \
     ( cd /var/lib/litellm/ui && \
       for html_file in *.html; do \
@@ -63,172 +106,106 @@ RUN mkdir -p /var/lib/litellm/ui && \
       touch .litellm_ui_ready ) && \
     cd /app/ui/litellm-dashboard && rm -rf ./out
 
-# Build litellm wheel and place it in wheels dir (replace any PyPI wheels)
-RUN rm -rf dist/* && python -m build && \
-  rm -f /wheels/litellm-*.whl && \
-  cp dist/*.whl /wheels/
-
-# Optionally build local litellm-proxy-extras wheel
-RUN if [ "$PROXY_EXTRAS_SOURCE" = "local" ]; then \
-      cd /app/litellm-proxy-extras && rm -rf dist && python -m build && \
-      cp dist/*.whl /wheels/; \
+RUN if [ "$PROXY_EXTRAS_SOURCE" = "published" ]; then \
+      uv sync --frozen --no-default-groups --no-editable \
+        --extra proxy \
+        --extra proxy-runtime \
+        --extra extra_proxy \
+        --extra semantic-router \
+        --python python3 \
+        --no-sources-package litellm-proxy-extras; \
+    else \
+      uv sync --frozen --no-default-groups --no-editable \
+        --extra proxy \
+        --extra proxy-runtime \
+        --extra extra_proxy \
+        --extra semantic-router \
+        --python python3; \
     fi
 
-# Pre-cache Prisma binaries in the builder stage
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/usr/lib/python3.13/site-packages/nodejs/bin:${PATH}"
-
-RUN pip install --no-cache-dir prisma==0.11.0 nodejs-wheel-binaries==24.13.1 \
-    && mkdir -p /app/.cache/npm
-
-RUN NPM_CONFIG_CACHE=/app/.cache/npm \
-    python -c "import prisma.cli.prisma as p; p.ensure_cached()"
-
-RUN prisma generate && \
+RUN mkdir -p /app/.cache/npm && \
+    prisma generate --schema=./schema.prisma && \
     prisma --version && \
     prisma migrate diff --from-empty --to-schema-datamodel ./schema.prisma --script > /dev/null 2>&1 || true
 
-# -----------------
-# Runtime Stage
-# -----------------
+RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
+    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
+
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
 ARG PROXY_EXTRAS_SOURCE
 WORKDIR /app
 USER root
 
-# Install runtime dependencies with retry
 RUN for i in 1 2 3; do \
     apk upgrade --no-cache && break || sleep 5; \
-    done \
-  && for i in 1 2 3; do \
-    apk add --no-cache python3 py3-pip bash openssl tzdata nodejs npm supervisor && break || sleep 5; \
-    done \
-  && apk upgrade --no-cache nodejs \
-  && npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
-  && GLOBAL="$(npm root -g)" \
-  && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
-     done \
-  && find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
-     done \
-  && find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
-     done \
-  && find "$GLOBAL/npm" -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
-     done \
-  && find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
-     done \
-  && find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
-        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null \
-  && npm cache clean --force \
-  && { apk del --no-cache npm 2>/dev/null || true; }
+    done && \
+    for i in 1 2 3; do \
+      apk add --no-cache python3 bash openssl tzdata nodejs npm supervisor libsndfile && break || sleep 5; \
+    done && \
+    apk upgrade --no-cache nodejs && \
+    npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
+    GLOBAL="$(npm root -g)" && \
+    find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
+      rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+    done && \
+    find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
+      rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+    done && \
+    find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
+      rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+    done && \
+    find "$GLOBAL/npm" -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
+      rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
+    done && \
+    find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
+      rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
+    done && \
+    find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
+      sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \
+    npm cache clean --force && \
+    { apk del --no-cache npm 2>/dev/null || true; }
 
-# Copy artifacts from builder
-COPY --from=builder /app/requirements.txt /app/requirements.txt
-COPY --from=builder /app/docker/entrypoint.sh /app/docker/prod_entrypoint.sh /app/docker/
-COPY --from=builder /app/docker/supervisord.conf /etc/supervisord.conf
-COPY --from=builder /app/schema.prisma /app/
-# Copy prisma_migration.py for Helm migrations job compatibility
-COPY --from=builder /app/litellm/proxy/prisma_migration.py /app/litellm/proxy/prisma_migration.py
-COPY --from=builder /wheels/ /wheels/
+COPY --from=builder /app /app
 COPY --from=builder /var/lib/litellm/ui /var/lib/litellm/ui
 COPY --from=builder /var/lib/litellm/assets /var/lib/litellm/assets
-COPY --from=builder /app/.cache /app/.cache
-COPY --from=builder /app/litellm-proxy-extras /app/litellm-proxy-extras
-COPY --from=builder \
-  /usr/lib/python3.13/site-packages/nodejs* \
-  /usr/lib/python3.13/site-packages/prisma* \
-  /usr/lib/python3.13/site-packages/tomlkit* \
-  /usr/lib/python3.13/site-packages/nodeenv* \
-  /usr/lib/python3.13/site-packages/
-COPY --from=builder /usr/bin/prisma /usr/bin/prisma
+COPY --from=builder /app/docker/supervisord.conf /etc/supervisord.conf
 
-# Final runtime environment configuration
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+ENV PATH="/app/.venv/bin:${PATH}" \
+    PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
     PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" \
     HOME=/app \
     LITELLM_NON_ROOT=true \
-    XDG_CACHE_HOME=/app/.cache
-
-# Install packages from wheels and optional extras without network
-RUN pip install --no-index --find-links=/wheels/ -r requirements.txt && \
-    pip install --no-index --find-links=/wheels/ /wheels/litellm-*-py3-none-any.whl && \
-    pip install --no-index --find-links=/wheels/ --no-deps semantic_router==0.1.11 && \
-    pip install --no-index --find-links=/wheels/ aurelio-sdk==0.0.19 && \
-    if [ "$PROXY_EXTRAS_SOURCE" = "local" ]; then \
-      if ls /wheels/litellm_proxy_extras-*.whl >/dev/null 2>&1; then \
-        pip install --no-index --find-links=/wheels/ /wheels/litellm_proxy_extras-*.whl; \
-      else \
-        echo "litellm_proxy_extras wheel not found; skipping local install"; \
-      fi; \
-    fi
-
-# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
-# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
-# Patch every copy of tar, glob, and brace-expansion inside that tree.
-RUN GLOBAL="$(npm root -g)" && \
-    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
-    find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
-    done && \
-    find /usr/lib -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
-    done && \
-    find /usr/lib -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
-    done && \
-    find /usr/lib -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
-    done && \
-    find /usr/lib -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
-        rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
-    done
-
-# Permissions, cleanup, and Prisma prep
-# Convert Windows line endings to Unix for entrypoint scripts
-RUN sed -i 's/\r$//' docker/entrypoint.sh && \
-    sed -i 's/\r$//' docker/prod_entrypoint.sh && \
-    chmod +x docker/entrypoint.sh docker/prod_entrypoint.sh && \
-    mkdir -p /nonexistent /.npm /var/lib/litellm/assets /var/lib/litellm/ui && \
-    chown -R nobody:nogroup /app /var/lib/litellm/ui /var/lib/litellm/assets /nonexistent /.npm && \
-    pip uninstall jwt -y || true && \
-    pip uninstall PyJWT -y || true && \
-    pip install --no-index --find-links=/wheels/ PyJWT==2.12.0 --no-cache-dir && \
-    rm -rf /wheels && \
-    PRISMA_PATH=$(python -c "import os, prisma; print(os.path.dirname(prisma.__file__))") && \
-    chown -R nobody:nogroup $PRISMA_PATH && \
-    LITELLM_PKG_MIGRATIONS_PATH="$(python -c 'import os, litellm_proxy_extras; print(os.path.dirname(litellm_proxy_extras.__file__))' 2>/dev/null || echo '')/migrations" && \
-    [ -n "$LITELLM_PKG_MIGRATIONS_PATH" ] && chown -R nobody:nogroup $LITELLM_PKG_MIGRATIONS_PATH && \
-    LITELLM_PROXY_EXTRAS_PATH=$(python -c "import os, litellm_proxy_extras; print(os.path.dirname(litellm_proxy_extras.__file__))" 2>/dev/null || echo "") && \
-    chgrp -R 0 $PRISMA_PATH /var/lib/litellm/ui /var/lib/litellm/assets && \
-    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chgrp -R 0 $LITELLM_PROXY_EXTRAS_PATH || true && \
-    chmod -R g=u $PRISMA_PATH /var/lib/litellm/ui /var/lib/litellm/assets && \
-    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g=u $LITELLM_PROXY_EXTRAS_PATH || true && \
-    chmod -R g+w $PRISMA_PATH /var/lib/litellm/ui /var/lib/litellm/assets && \
-    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g+w $LITELLM_PROXY_EXTRAS_PATH || true && \
-    chmod -R g+rX $PRISMA_PATH && \
-    chmod -R g+rX /app/.cache && \
-    mkdir -p /tmp/.npm /nonexistent /.npm
-
-# Switch to non-root user for runtime
-USER nobody
-
-# Generate Prisma client as nobody user to ensure correct file ownership
-RUN prisma generate
-
-# Prisma runtime knobs for offline containers
-ENV PRISMA_SKIP_POSTINSTALL_GENERATE=1 \
+    XDG_CACHE_HOME=/app/.cache \
+    PRISMA_SKIP_POSTINSTALL_GENERATE=1 \
     PRISMA_HIDE_UPDATE_MESSAGE=1 \
     PRISMA_ENGINES_CHECKSUM_IGNORE_MISSING=1 \
     NPM_CONFIG_CACHE=/app/.cache/npm \
     NPM_CONFIG_PREFER_OFFLINE=true \
     PRISMA_OFFLINE_MODE=true
 
+RUN sed -i 's/\r$//' docker/entrypoint.sh && \
+    sed -i 's/\r$//' docker/prod_entrypoint.sh && \
+    chmod +x docker/entrypoint.sh docker/prod_entrypoint.sh && \
+    mkdir -p /nonexistent /.npm /var/lib/litellm/assets /var/lib/litellm/ui /tmp/.npm && \
+    chown -R nobody:nogroup /app /var/lib/litellm/ui /var/lib/litellm/assets /nonexistent /.npm /tmp/.npm && \
+    PRISMA_PATH=$(python -c "import os, prisma; print(os.path.dirname(prisma.__file__))") && \
+    chown -R nobody:nogroup "$PRISMA_PATH" && \
+    LITELLM_PKG_MIGRATIONS_PATH="$(python -c 'import os, litellm_proxy_extras; print(os.path.dirname(litellm_proxy_extras.__file__))' 2>/dev/null || echo '')/migrations" && \
+    [ -n "$LITELLM_PKG_MIGRATIONS_PATH" ] && chown -R nobody:nogroup "$LITELLM_PKG_MIGRATIONS_PATH" || true && \
+    LITELLM_PROXY_EXTRAS_PATH=$(python -c "import os, litellm_proxy_extras; print(os.path.dirname(litellm_proxy_extras.__file__))" 2>/dev/null || echo "") && \
+    chgrp -R 0 "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \
+    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chgrp -R 0 "$LITELLM_PROXY_EXTRAS_PATH" || true && \
+    chmod -R g=u "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \
+    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g=u "$LITELLM_PROXY_EXTRAS_PATH" || true && \
+    chmod -R g+w "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \
+    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g+w "$LITELLM_PROXY_EXTRAS_PATH" || true && \
+    chmod -R g+rX "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets /app/.cache
+
+USER nobody
+
+RUN prisma generate --schema=./schema.prisma
+
 EXPOSE 4000/tcp
+
 ENTRYPOINT ["/app/docker/prod_entrypoint.sh"]
 CMD ["--port", "4000"]

docker/README.md

@@ -13,19 +13,19 @@ To build and run the application, you will use the `docker-compose.yml` file loc
 
 ### 1. Set the Master Key
 
-The application requires a `MASTER_KEY` for signing and validating tokens. You must set this key as an environment variable before running the application.
+The application requires a `LITELLM_MASTER_KEY` for signing and validating tokens. You must set this key as an environment variable before running the application.
 
 Create a `.env` file in the root of the project and add the following line:
 
 ```
-MASTER_KEY=your-secret-key
+LITELLM_MASTER_KEY=your-secret-key
 ```
 
 Replace `your-secret-key` with a strong, randomly generated secret.
 
 ### 2. Build and Run the Containers
 
-Once you have set the `MASTER_KEY`, you can build and run the containers using the following command:
+Once you have set the `LITELLM_MASTER_KEY`, you can build and run the containers using the following command:
 
 ```bash
 docker compose up -d --build
@@ -89,4 +89,4 @@ This command should succeed (showing engine versions) even with `--network none`
 ## Troubleshooting
 
 -   **`build_admin_ui.sh: not found`**: This error can occur if the Docker build context is not set correctly. Ensure that you are running the `docker-compose` command from the root of the project.
--   **`Master key is not initialized`**: This error means the `MASTER_key` environment variable is not set. Make sure you have created a `.env` file in the project root with the `MASTER_KEY` defined.
+-   **`Master key is not initialized`**: This error means the `LITELLM_MASTER_KEY` environment variable is not set. Make sure you have created a `.env` file in the project root with the `LITELLM_MASTER_KEY` defined.

docker/build_admin_ui.sh

@@ -40,11 +40,22 @@ else
         exit 1
     fi
 fi
-curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash
+NVM_VERSION="v0.40.4"
+NVM_CHECKSUM="4b7412c49960c7d31e8df72da90c1fb5b8cccb419ac99537b737028d497aba4f"
+NVM_SCRIPT=$(mktemp)
+trap 'rm -f "$NVM_SCRIPT"' EXIT
+curl -fsSL "https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_VERSION}/install.sh" -o "$NVM_SCRIPT"
+if command -v sha256sum &>/dev/null; then
+  echo "${NVM_CHECKSUM}  ${NVM_SCRIPT}" | sha256sum -c -
+elif command -v shasum &>/dev/null; then
+  echo "${NVM_CHECKSUM}  ${NVM_SCRIPT}" | shasum -a 256 -c -
+else
+  echo "No sha256 tool found; cannot verify nvm checksum"; exit 1
+fi || { echo "nvm checksum verification failed"; exit 1; }
+bash "$NVM_SCRIPT"
 source ~/.nvm/nvm.sh
 nvm install v18.17.0
 nvm use v18.17.0
-npm install -g npm
 
 # copy _enterprise.json from this directory to /ui/litellm-dashboard, and rename it to ui_colors.json
 cp enterprise/enterprise_ui/enterprise_colors.json ui/litellm-dashboard/ui_colors.json