Merge branch 'main' into fix-redact

.circleci/requirements.txt

@@ -17,4 +17,5 @@ mcp==1.25.0    # for MCP server
 semantic_router==0.1.10 # for auto-routing with litellm
 fastuuid==0.12.0
 responses==0.25.7  # for proxy client tests
-pytest-retry==1.6.3  # for automatic test retries
+pytest-retry==1.6.3  # for automatic test retries
+litellm-proxy-extras  # for prisma migrations

.claude/settings.json

@@ -1,36 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(git show:*)",
-      "Bash(git worktree add:*)",
-      "Read(//Users/krrishdholakia/Documents/litellm/**)",
-      "Read(//Users/krrishdholakia/Documents/litellm-claude-code-guardrails/litellm/types/**)",
-      "Read(//Users/krrishdholakia/Documents/litellm-claude-code-guardrails/**)",
-      "Read(//Users/krrishdholakia/Documents/litellm-claude-code-guardrails/litellm/**)",
-      "Bash(python:*)",
-      "Bash(python -c \"\nimport sys; sys.path.insert\\(0, ''.''\\)\nfrom litellm.proxy.guardrails.guardrail_hooks.claude_code.guardrail import ClaudeCodeGuardrail, HOSTED_TOOL_PREFIXES\nprint\\(''HOSTED_TOOL_PREFIXES:'', HOSTED_TOOL_PREFIXES\\)\nprint\\(''ClaudeCodeGuardrail imported OK''\\)\n\")",
-      "Read(//Users/krrishdholakia/Documents/litellm-mcp-jwt-groups/litellm/proxy/**)",
-      "Read(//Users/krrishdholakia/Documents/litellm-mcp-jwt-groups/**)",
-      "Bash(poetry run pytest:*)",
-      "Bash(git add:*)",
-      "Bash(git commit:*)",
-      "Bash(poetry run python:*)",
-      "Bash(poetry run pip:*)",
-      "Bash(git reset:*)",
-      "Bash(git cherry-pick:*)",
-      "Bash(git checkout:*)",
-      "Read(//Users/krrishdholakia/Documents/litellm/litellm/proxy/guardrails/guardrail_hooks/**)",
-      "Read(//Users/krrishdholakia/Documents/**)",
-      "Bash(git -C /Users/krrishdholakia/Documents/litellm-mcp-user-permissions worktree list)",
-      "Bash(ls:*)"
-    ],
-    "additionalDirectories": [
-      "/Users/krrishdholakia/Documents/litellm-mcp-group-plan/plan",
-      "/Users/krrishdholakia/Documents/litellm-claude-code-guardrails/litellm/proxy/guardrails/guardrail_hooks/claude_code",
-      "/Users/krrishdholakia/Documents/litellm-claude-code-guardrails/litellm/types",
-      "/Users/krrishdholakia/Documents/litellm-claude-code-guardrails",
-      "/Users/krrishdholakia/Documents/litellm-mcp-jwt-groups/litellm/proxy",
-      "/Users/krrishdholakia/Documents/litellm-mcp-jwt-groups/tests/test_litellm/proxy/auth"
-    ]
-  }
-}

.github/ISSUE_TEMPLATE/config.yml

@@ -1,7 +1,7 @@
 blank_issues_enabled: true
 contact_links:
   - name: Schedule Demo
-    url: https://calendly.com/d/cx9p-5yf-2nm/litellm-introductions
+    url: https://enterprise.litellm.ai/demo
     about: Speak directly with Krrish and Ishaan, the founders, to discuss issues, share feedback, or explore improvements for LiteLLM
   - name: Discord
     url: https://discord.com/invite/wuPM9dRgDw

.github/actions/helm-oci-chart-releaser/action.yml

@@ -41,32 +41,54 @@ runs:
   using: composite
   steps:
     - name: Helm | Setup
-      uses: azure/setup-helm@v4
+      uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
       with:
         version: v3.20.0
 
     - name: Helm | Login
       shell: bash
-      run: echo ${{ inputs.registry_password }} | helm registry login -u ${{ inputs.registry_username }} --password-stdin ${{ inputs.registry }}
+      env:
+        REGISTRY_PASSWORD: ${{ inputs.registry_password }}
+        REGISTRY_USERNAME: ${{ inputs.registry_username }}
+        REGISTRY: ${{ inputs.registry }}
+      run: echo "$REGISTRY_PASSWORD" | helm registry login -u "$REGISTRY_USERNAME" --password-stdin "$REGISTRY"
 
     - name: Helm | Dependency
       if: inputs.update_dependencies == 'true'
       shell: bash
-      run: helm dependency update ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }}
+      env:
+        CHART_PATH: ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }}
+      run: helm dependency update "$CHART_PATH"
 
     - name: Helm | Package
       shell: bash
-      run: helm package ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }} --version ${{ inputs.tag }} --app-version ${{ inputs.app_version }}
+      env:
+        CHART_PATH: ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }}
+        TAG: ${{ inputs.tag }}
+        APP_VERSION: ${{ inputs.app_version }}
+      run: helm package "$CHART_PATH" --version "$TAG" --app-version "$APP_VERSION"
 
     - name: Helm | Push
       shell: bash
-      run: helm push ${{ inputs.name }}-${{ inputs.tag }}.tgz oci://${{ inputs.registry }}/${{ inputs.repository }}
+      env:
+        NAME: ${{ inputs.name }}
+        TAG: ${{ inputs.tag }}
+        REGISTRY: ${{ inputs.registry }}
+        REPOSITORY: ${{ inputs.repository }}
+      run: helm push "${NAME}-${TAG}.tgz" "oci://${REGISTRY}/${REPOSITORY}"
 
     - name: Helm | Logout
       shell: bash
-      run: helm registry logout ${{ inputs.registry }}
+      env:
+        REGISTRY: ${{ inputs.registry }}
+      run: helm registry logout "$REGISTRY"
 
     - name: Helm | Output
       id: output
       shell: bash
-      run: echo "image=${{ inputs.registry }}/${{ inputs.repository }}/${{ inputs.name }}:${{ inputs.tag }}" >> $GITHUB_OUTPUT
+      env:
+        REGISTRY: ${{ inputs.registry }}
+        REPOSITORY: ${{ inputs.repository }}
+        NAME: ${{ inputs.name }}
+        TAG: ${{ inputs.tag }}
+      run: echo "image=${REGISTRY}/${REPOSITORY}/${NAME}:${TAG}" >> $GITHUB_OUTPUT

.github/codeql/codeql-config.yml

@@ -1,12 +1,19 @@
 name: "LiteLLM CodeQL config"
 
-# Exclude queries that produce result sets > 2 GiB on this codebase,
-# causing 49+ minute runs that fail and block CI resources.
+# Use security-extended suite instead of security-and-quality to avoid
+# result sets > 2 GiB on this codebase that cause fatal OOM failures.
+queries:
+  - uses: security-extended
+
+# These two queries are security queries included in security-extended that
+# individually produce result sets > 2 GiB on this codebase, causing fatal
+# OOM failures. Exclude them as a safety net until CI confirms they no longer
+# OOM; drop these exclusions in a follow-up once verified.
 query-filters:
   - exclude:
-      id: py/clear-text-logging-sensitive-data  # CWE-312/CleartextLogging.ql — result set > 2 GiB
+      id: py/clear-text-logging-sensitive-data  # CWE-312 — > 2 GiB result set
   - exclude:
-      id: py/polynomial-redos                   # CWE-730/PolynomialReDoS.ql — result set > 2 GiB
+      id: py/polynomial-redos                   # CWE-730 — > 2 GiB result set
 
 paths-ignore:
   - tests

.github/dependabot.yaml

@@ -4,6 +4,9 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
+      semver-major-days: 14
     groups:
       github-actions:
         patterns:

.github/pull_request_template.md

@@ -11,6 +11,10 @@
 - [ ] My PR's scope is as isolated as possible, it only solves 1 specific problem
 - [ ] I have requested a Greptile review by commenting `@greptileai` and received a **Confidence Score of at least 4/5** before requesting a maintainer review
 
+## Delays in PR merge?
+
+If you're seeing a delay in your PR being merged, ping the LiteLLM Team on [Slack (#pr-review)](https://join.slack.com/t/litellmossslack/shared_invite/zt-3o7nkuyfr-p_kbNJj8taRfXGgQI1~YyA).
+
 ## CI (LiteLLM team)
 
 > **CI status guideline:**

.github/workflows/auto_update_price_and_context_window.yml

@@ -2,18 +2,24 @@ name: Updates model_prices_and_context_window.json and Create Pull Request
 
 on:
   schedule:
-    - cron: "0 0 * * 0"  # Run every Sundays at midnight
+    - cron: "0 0 * * 0" # Run every Sundays at midnight
     #- cron: "0 0 * * *" # Run daily at midnight
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   auto_update_price_and_context_window:
     if: github.repository == 'BerriAI/litellm'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
       - name: Install Dependencies
         run: |
-          pip install aiohttp
+          pip install 'aiohttp==3.13.3'
       - name: Update JSON Data
         run: |
           python ".github/workflows/auto_update_price_and_context_window_file.py"
@@ -26,4 +32,4 @@ jobs:
             --head auto-update-price-and-context-window-$(date +'%Y-%m-%d') \
             --base main
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}

.github/workflows/check_duplicate_issues.yml

@@ -12,7 +12,7 @@ jobs:
       contents: read
     steps:
       - name: Check for potential duplicates
-        uses: wow-actions/potential-duplicates@v1
+        uses: wow-actions/potential-duplicates@4d4ea0352e0383859279938e255179dd1dbb67b5 # v1.1.0
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           label: potential-duplicate
@@ -30,13 +30,14 @@ jobs:
 
       - name: Checkout close script
         if: github.event.action == 'opened'
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           sparse-checkout: .github/scripts
+          persist-credentials: false
 
       - name: Set up Python
         if: github.event.action == 'opened'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.11"
 

.github/workflows/codeql.yml

@@ -15,6 +15,7 @@ concurrency:
 
 jobs:
   analyze:
+    if: github.event_name != 'schedule' || github.repository == 'BerriAI/litellm'
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -34,21 +35,21 @@ jobs:
             build-mode: none
           - language: python
             build-mode: none
-          - language: ruby
-            build-mode: none
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/codspeed.yml

@@ -0,0 +1,46 @@
+name: CodSpeed Benchmarks
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  # Allow CodSpeed to trigger backtest performance analysis
+  # in order to generate initial data
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  benchmarks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          pip install -e "."
+          pip install pytest pytest-codspeed==4.3.0
+
+      - name: Run benchmarks
+        uses: CodSpeedHQ/action@1c8ae4843586d3ba879736b7f6b7b0c990757fab # v4.12.1
+        with:
+          mode: simulation
+          run: pytest tests/benchmarks/ --codspeed

.github/workflows/create_daily_staging_branch.yml

@@ -2,18 +2,22 @@ name: Create Daily Staging Branch
 
 on:
   schedule:
-    - cron: '0 0,12 * * *'  # Runs every 12 hours at midnight and noon UTC
-  workflow_dispatch:  # Allow manual trigger
+    - cron: "0 0,12 * * *" # Runs every 12 hours at midnight and noon UTC
+  workflow_dispatch: # Allow manual trigger
 
 jobs:
   create-staging-branch:
+    if: github.repository == 'BerriAI/litellm'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Create daily staging branch
         env:
@@ -41,3 +45,43 @@ jobs:
             git push origin $BRANCH_NAME
             echo "Successfully created and pushed branch: $BRANCH_NAME"
           fi
+
+  create-internal-dev-branch:
+    if: github.repository == 'BerriAI/litellm'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Create internal dev branch
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Configure Git user
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Generate branch name with MM_DD_YYYY format
+          BRANCH_NAME="litellm_internal_dev_$(date +'%m_%d_%Y')"
+          echo "Creating branch: $BRANCH_NAME"
+
+          # Fetch all branches
+          git fetch --all
+
+          # Check if the branch already exists
+          if git show-ref --verify --quiet refs/remotes/origin/$BRANCH_NAME; then
+            echo "Branch $BRANCH_NAME already exists. Skipping creation."
+          else
+            echo "Creating new branch: $BRANCH_NAME"
+            # Create the new branch from main
+            git checkout -b $BRANCH_NAME origin/main
+            # Push the new branch
+            git push origin $BRANCH_NAME
+            echo "Successfully created and pushed branch: $BRANCH_NAME"
+          fi

.github/workflows/ghcr_deploy.yml

@@ -1,443 +0,0 @@
-# this workflow is triggered by an API call when there is a new PyPI release of LiteLLM
-name: Build, Publish LiteLLM Docker Image. New Release
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "The tag version you want to build"
-        required: true
-      release_type:
-        description: "The release type you want to build. Can be 'latest', 'stable', 'dev', 'rc'"
-        type: string
-        default: "latest"
-      commit_hash:
-        description: "Commit hash"
-        required: true
-
-# Defines two custom environment variables for the workflow. Used for the Container registry domain, and a name for the Docker image that this workflow builds.
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-  CHART_NAME: litellm-helm
-
-# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
-jobs:
-  # print commit hash, tag, and release type
-  print:
-    runs-on: ubuntu-latest
-    steps:
-      - run: |
-          echo "Commit hash: ${{ github.event.inputs.commit_hash }}"
-          echo "Tag: ${{ github.event.inputs.tag }}"
-          echo "Release type: ${{ github.event.inputs.release_type }}"
-  docker-hub-deploy:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      -
-        name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      -
-        name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          tags: litellm/litellm:${{ github.event.inputs.tag || 'latest' }} 
-      -
-        name: Build and push litellm-database image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          file: ./docker/Dockerfile.database
-          tags: litellm/litellm-database:${{ github.event.inputs.tag || 'latest' }}
-      -
-        name: Build and push litellm-spend-logs image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          file: ./litellm-js/spend-logs/Dockerfile
-          tags: litellm/litellm-spend_logs:${{ github.event.inputs.tag || 'latest' }}
-      -
-        name: Build and push litellm-non_root image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          file: ./docker/Dockerfile.non_root
-          tags: litellm/litellm-non_root:${{ github.event.inputs.tag || 'latest' }}
-  build-and-push-image:
-    runs-on: ubuntu-latest
-    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-      # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-      # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
-      # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
-      # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
-      - name: Build and push Docker image
-        uses: docker/build-push-action@4976231911ebf5f32aad765192d35f942aa48cb8
-        with:
-          context: .
-          push: true
-          tags: |
-            ${{ steps.meta.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm:main-stable', env.REGISTRY) || '' }},
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm:{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-          labels: ${{ steps.meta.outputs.labels }}
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-  
-  build-and-push-image-ee:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for EE Dockerfile
-        id: meta-ee
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-
-      - name: Build and push EE Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
-        with:
-          context: .
-          file: Dockerfile
-          push: true
-          tags: |
-            ${{ steps.meta-ee.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta-ee.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm-ee:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm-ee:main-stable', env.REGISTRY) || '' }}
-          labels: ${{ steps.meta-ee.outputs.labels }}
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-   
-  build-and-push-image-database:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for database Dockerfile
-        id: meta-database
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-database
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-
-      - name: Build and push Database Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
-        with:
-          context: .
-          file: ./docker/Dockerfile.database
-          push: true
-          tags: |
-            ${{ steps.meta-database.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta-database.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm-database:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm-database:main-stable', env.REGISTRY) || '' }}
-          labels: ${{ steps.meta-database.outputs.labels }}
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-            
-  build-and-push-image-non_root:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for non_root Dockerfile
-        id: meta-non_root
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-non_root
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-
-      - name: Build and push non_root Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
-        with:
-          context: .
-          file: ./docker/Dockerfile.non_root
-          push: true
-          tags: |
-            ${{ steps.meta-non_root.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta-non_root.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm-non_root:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm-non_root:main-stable', env.REGISTRY) || '' }}
-          labels: ${{ steps.meta-non_root.outputs.labels }} 
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-  
-  build-and-push-image-spend-logs:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.commit_hash }}
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels) for spend-logs Dockerfile
-        id: meta-spend-logs
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-spend_logs
-      # Configure multi platform Docker builds
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@e0e4588fad221d38ee467c0bffd91115366dc0c5
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@edfb0fe6204400c56fbfd3feba3fe9ad1adfa345
-
-      - name: Build and push Database Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
-        with:
-          context: .
-          file: ./litellm-js/spend-logs/Dockerfile
-          push: true
-          tags: |
-            ${{ steps.meta-spend-logs.outputs.tags }}-${{ github.event.inputs.tag || 'latest' }},
-            ${{ steps.meta-spend-logs.outputs.tags }}-${{ github.event.inputs.release_type }}
-            ${{ (github.event.inputs.release_type == 'stable'  || github.event.inputs.release_type == 'rc') && format('{0}/berriai/litellm-spend_logs:main-{1}', env.REGISTRY, github.event.inputs.tag) || '' }},
-            ${{ github.event.inputs.release_type == 'stable' && format('{0}/berriai/litellm-spend_logs:main-stable', env.REGISTRY) || '' }}
-          platforms: local,linux/amd64,linux/arm64,linux/arm64/v8
-
-  run-observatory-tests:
-    if: github.event.inputs.release_type == 'rc' || github.event.inputs.release_type == 'stable'
-    needs: [docker-hub-deploy]
-    uses: ./.github/workflows/run_observatory_tests.yml
-    with:
-      tag: ${{ github.event.inputs.tag }}
-      commit_hash: ${{ github.event.inputs.commit_hash }}
-    secrets: inherit
-
-  build-and-push-helm-chart:
-    if: github.event.inputs.release_type  != 'dev'
-    needs: [docker-hub-deploy, build-and-push-image, build-and-push-image-database]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: lowercase github.repository_owner
-        run: |
-          echo "REPO_OWNER=`echo ${{github.repository_owner}} | tr '[:upper:]' '[:lower:]'`" >>${GITHUB_ENV}
-    
-      # Sync Helm chart version with LiteLLM release version (1-1 versioning)
-      # This allows users to easily map Helm chart versions to LiteLLM versions
-      # See: https://codefresh.io/docs/docs/ci-cd-guides/helm-best-practices/
-      - name: Calculate chart and app versions
-        id: chart_version
-        shell: bash
-        run: |
-          INPUT_TAG="${{ github.event.inputs.tag }}"
-          RELEASE_TYPE="${{ github.event.inputs.release_type }}"
-
-          # Chart version = LiteLLM version without 'v' prefix (Helm semver convention)
-          # v1.81.0 -> 1.81.0, v1.81.0.rc.1 -> 1.81.0.rc.1
-          CHART_VERSION="${INPUT_TAG#v}"
-
-          # Add suffix for 'latest' releases (rc already has suffix in tag)
-          if [ "$RELEASE_TYPE" = "latest" ]; then
-            CHART_VERSION="${CHART_VERSION}-latest"
-          fi
-
-          # App version = Docker tag (keeps 'v' prefix to match Docker image tags)
-          APP_VERSION="${INPUT_TAG}"
-
-          echo "version=${CHART_VERSION}" | tee -a $GITHUB_OUTPUT
-          echo "app_version=${APP_VERSION}" | tee -a $GITHUB_OUTPUT
-
-      - uses: ./.github/actions/helm-oci-chart-releaser
-        with:
-          name: ${{ env.CHART_NAME }}
-          repository: ${{ env.REPO_OWNER }}
-          tag: ${{ steps.chart_version.outputs.version }}
-          app_version: ${{ steps.chart_version.outputs.app_version }}
-          path: deploy/charts/${{ env.CHART_NAME }}
-          registry: ${{ env.REGISTRY }}
-          registry_username: ${{ github.actor }}
-          registry_password: ${{ secrets.GITHUB_TOKEN }}
-          update_dependencies: true
-
-  release:
-    name: "New LiteLLM Release"
-    needs: [docker-hub-deploy, build-and-push-image, build-and-push-image-database]
-
-    runs-on: "ubuntu-latest"
-   
-    steps:
-      - name: Display version
-        run: echo "Current version is ${{ github.event.inputs.tag }}"
-      - name: "Set Release Tag"
-        run: echo "RELEASE_TAG=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
-      - name: Display release tag
-        run: echo "RELEASE_TAG is $RELEASE_TAG"
-      - name: "Create release"
-        uses: "actions/github-script@v6"
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-          script: |
-            const commitHash = "${{ github.event.inputs.commit_hash}}";
-            console.log("Commit Hash:", commitHash); // Add this line for debugging
-            try {
-              const response = await github.rest.repos.createRelease({
-                draft: false,
-                generate_release_notes: true,
-                target_commitish: commitHash,
-                name: process.env.RELEASE_TAG,
-                owner: context.repo.owner,
-                prerelease: false,
-                repo: context.repo.repo,
-                tag_name: process.env.RELEASE_TAG,
-              });
-      
-              core.exportVariable('RELEASE_ID', response.data.id);
-              core.exportVariable('RELEASE_UPLOAD_URL', response.data.upload_url);
-            } catch (error) {
-              core.setFailed(error.message);
-            }
-      - name: Fetch Release Notes
-        id: release-notes
-        uses: actions/github-script@v6
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-          script: |
-            try {
-              const response = await github.rest.repos.getRelease({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                release_id: process.env.RELEASE_ID,
-              });
-              const formattedBody = JSON.stringify(response.data.body).slice(1, -1);
-              return formattedBody;
-            } catch (error) {
-              core.setFailed(error.message);
-            }
-        env:
-          RELEASE_ID: ${{ env.RELEASE_ID }}
-      - name: Github Releases To Discord
-        env:
-          WEBHOOK_URL: ${{ secrets.WEBHOOK_URL }}
-          REALEASE_TAG: ${{ env.RELEASE_TAG }}
-          RELEASE_NOTES: ${{ steps.release-notes.outputs.result }}
-        run: |
-          curl -H "Content-Type: application/json" -X POST -d '{
-            "content": "New LiteLLM release '"${RELEASE_TAG}"'",
-            "username": "Release Changelog",
-            "avatar_url": "https://cdn.discordapp.com/avatars/487431320314576937/bd64361e4ba6313d561d54e78c9e7171.png",
-            "embeds": [
-              {
-                "title": "Changelog for LiteLLM '"${RELEASE_TAG}"'",
-                "description": "'"${RELEASE_NOTES}"'",
-                "color": 2105893
-              }
-            ]
-          }' $WEBHOOK_URL
-

.github/workflows/ghcr_helm_deploy.yml

@@ -1,67 +0,0 @@
-# Standalone workflow to publish LiteLLM Helm Chart
-# Note: The main ghcr_deploy.yml workflow also publishes the Helm chart as part of a full release
-name: Build, Publish LiteLLM Helm Chart. New Release
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "LiteLLM version tag (e.g., v1.81.0)"
-        required: true
-
-# Defines two custom environment variables for the workflow. Used for the Container registry domain, and a name for the Docker image that this workflow builds.
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-  REPO_OWNER: ${{github.repository_owner}}
-
-# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
-jobs:        
-  build-and-push-helm-chart:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      
-      - name: lowercase github.repository_owner
-        run: |
-          echo "REPO_OWNER=`echo ${{github.repository_owner}} | tr '[:upper:]' '[:lower:]'`" >>${GITHUB_ENV}
-
-      # Sync Helm chart version with LiteLLM release version (1-1 versioning)
-      - name: Calculate chart and app versions
-        id: chart_version
-        shell: bash
-        run: |
-          INPUT_TAG="${{ github.event.inputs.tag }}"
-
-          # Chart version = LiteLLM version without 'v' prefix
-          # v1.81.0 -> 1.81.0
-          CHART_VERSION="${INPUT_TAG#v}"
-
-          # App version = Docker tag (keeps 'v' prefix)
-          APP_VERSION="${INPUT_TAG}"
-
-          echo "version=${CHART_VERSION}" | tee -a $GITHUB_OUTPUT
-          echo "app_version=${APP_VERSION}" | tee -a $GITHUB_OUTPUT
-
-      - name: Lint helm chart
-        run: helm lint deploy/charts/litellm-helm
-
-      - uses: ./.github/actions/helm-oci-chart-releaser
-        with:
-          name: litellm-helm
-          repository: ${{ env.REPO_OWNER }}
-          tag: ${{ steps.chart_version.outputs.version }}
-          app_version: ${{ steps.chart_version.outputs.app_version }}
-          path: deploy/charts/litellm-helm
-          registry: ${{ env.REGISTRY }}
-          registry_username: ${{ github.actor }}
-          registry_password: ${{ secrets.GITHUB_TOKEN }}
-          update_dependencies: true
-  

.github/workflows/helm_unit_test.yml

@@ -6,22 +6,36 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   unit-test:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Set up Helm 3.11.1
-        uses: azure/setup-helm@v1
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
         with:
-          version: '3.11.1'
+          version: "3.11.1"
 
       - name: Install Helm Unit Test Plugin
         run: |
           helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.4.4
+      - name: Verify Helm Unit Test Plugin integrity
+        run: |
+          EXPECTED_SHA="e251ba198448629678ff2168e1a469249d998155"
+          PLUGIN_DIR="$(helm env HELM_PLUGINS)/helm-unittest"
+          ACTUAL_SHA="$(git -C "$PLUGIN_DIR" rev-parse HEAD)"
+          if [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then
+            echo "::error::Helm unittest plugin checksum mismatch! Expected $EXPECTED_SHA but got $ACTUAL_SHA"
+            exit 1
+          fi
+          echo "Helm unittest plugin integrity verified: $ACTUAL_SHA"
 
       - name: Run unit tests
-        run:
-          helm unittest -f 'tests/*.yaml' deploy/charts/litellm-helm
+        run: helm unittest -f 'tests/*.yaml' deploy/charts/litellm-helm

.github/workflows/interpret_load_test.py

@@ -1,139 +0,0 @@
-import csv
-import os
-from github import Github
-
-
-def interpret_results(csv_file):
-    with open(csv_file, newline="") as csvfile:
-        csvreader = csv.DictReader(csvfile)
-        rows = list(csvreader)
-        """
-        in this csv reader
-        - Create 1 new column "Status"
-        - if a row has a median response time < 300 and an average response time < 300, Status = "Passed ✅"
-        - if a row has a median response time >= 300 or an average response time >= 300, Status = "Failed ❌"
-        - Order the table in this order Name, Status, Median Response Time, Average Response Time, Requests/s,Failures/s, Min Response Time, Max Response Time, all other columns
-        """
-
-        # Add a new column "Status"
-        for row in rows:
-            median_response_time = float(
-                row["Median Response Time"].strip().rstrip("ms")
-            )
-            average_response_time = float(
-                row["Average Response Time"].strip().rstrip("s")
-            )
-
-            request_count = int(row["Request Count"])
-            failure_count = int(row["Failure Count"])
-
-            failure_percent = round((failure_count / request_count) * 100, 2)
-
-            # Determine status based on conditions
-            if (
-                median_response_time < 300
-                and average_response_time < 300
-                and failure_percent < 5
-            ):
-                row["Status"] = "Passed ✅"
-            else:
-                row["Status"] = "Failed ❌"
-
-        # Construct Markdown table header
-        markdown_table = "| Name | Status | Median Response Time (ms) | Average Response Time (ms) | Requests/s | Failures/s | Request Count | Failure Count | Min Response Time (ms) | Max Response Time (ms) |"
-        markdown_table += (
-            "\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |"
-        )
-
-        # Construct Markdown table rows
-        for row in rows:
-            markdown_table += f"\n| {row['Name']} | {row['Status']} | {row['Median Response Time']} | {row['Average Response Time']} | {row['Requests/s']} | {row['Failures/s']} | {row['Request Count']} | {row['Failure Count']} | {row['Min Response Time']} | {row['Max Response Time']} |"
-    print("markdown table: ", markdown_table)
-    return markdown_table
-
-
-def _get_docker_run_command_stable_release(release_version):
-    return f"""
-\n\n
-## Docker Run LiteLLM Proxy
-
-```
-docker run \\
--e STORE_MODEL_IN_DB=True \\
--p 4000:4000 \\
-ghcr.io/berriai/litellm:litellm_stable_release_branch-{release_version}
-```
-    """
-
-
-def _get_docker_run_command(release_version):
-    return f"""
-\n\n
-## Docker Run LiteLLM Proxy
-
-```
-docker run \\
--e STORE_MODEL_IN_DB=True \\
--p 4000:4000 \\
-ghcr.io/berriai/litellm:main-{release_version}
-```
-    """
-
-
-def get_docker_run_command(release_version):
-    if "stable" in release_version:
-        return _get_docker_run_command_stable_release(release_version)
-    else:
-        return _get_docker_run_command(release_version)
-
-
-if __name__ == "__main__":
-    return
-    csv_file = "load_test_stats.csv"  # Change this to the path of your CSV file
-    markdown_table = interpret_results(csv_file)
-
-    # Update release body with interpreted results
-    github_token = os.getenv("GITHUB_TOKEN")
-    g = Github(github_token)
-    repo = g.get_repo(
-        "BerriAI/litellm"
-    )  # Replace with your repository's username and name
-    latest_release = repo.get_latest_release()
-    print("got latest release: ", latest_release)
-    print(latest_release.title)
-    print(latest_release.tag_name)
-
-    release_version = latest_release.title
-
-    print("latest release body: ", latest_release.body)
-    print("markdown table: ", markdown_table)
-
-    # check if "Load Test LiteLLM Proxy Results" exists
-    existing_release_body = latest_release.body
-    if "Load Test LiteLLM Proxy Results" in latest_release.body:
-        # find the "Load Test LiteLLM Proxy Results" section and delete it
-        start_index = latest_release.body.find("Load Test LiteLLM Proxy Results")
-        existing_release_body = latest_release.body[:start_index]
-
-    docker_run_command = get_docker_run_command(release_version)
-    print("docker run command: ", docker_run_command)
-
-    new_release_body = (
-        existing_release_body
-        + docker_run_command
-        + "\n\n"
-        + "### Don't want to maintain your internal proxy? get in touch 🎉"
-        + "\nHosted Proxy Alpha: https://calendly.com/d/cx9p-5yf-2nm/litellm-introductions"
-        + "\n\n"
-        + "## Load Test LiteLLM Proxy Results"
-        + "\n\n"
-        + markdown_table
-    )
-    print("new release body: ", new_release_body)
-    try:
-        latest_release.update_release(
-            name=latest_release.tag_name,
-            message=new_release_body,
-        )
-    except Exception as e:
-        print(e)

.github/workflows/issue-keyword-labeler.yml

@@ -2,8 +2,8 @@ name: Issue Keyword Labeler
 
 on:
   issues:
-    types: 
-        - opened
+    types:
+      - opened
 
 jobs:
   scan-and-label:
@@ -13,7 +13,9 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Scan for provider keywords
         id: scan
@@ -24,7 +26,7 @@ jobs:
 
       - name: Ensure label exists
         if: steps.scan.outputs.found == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -51,7 +53,7 @@ jobs:
 
       - name: Add label to the issue
         if: steps.scan.outputs.found == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -61,4 +63,3 @@ jobs:
               issue_number: context.issue.number,
               labels: ['llm translation']
             });
-

.github/workflows/label-component.yml

@@ -12,7 +12,7 @@ jobs:
       issues: write
     steps:
       - name: Add component labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/llm-translation-testing.yml

@@ -4,38 +4,41 @@ on:
   workflow_dispatch:
     inputs:
       release_candidate_tag:
-        description: 'Release candidate tag/version'
+        description: "Release candidate tag/version"
         required: true
         type: string
   push:
     tags:
-      - 'v*-rc*'  # Triggers on release candidate tags like v1.0.0-rc1
-  
+      - "v*-rc*" # Triggers on release candidate tags like v1.0.0-rc1
+
+permissions:
+  contents: read
+
 jobs:
   run-llm-translation-tests:
     runs-on: ubuntu-latest
     timeout-minutes: 90
-    
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
+          persist-credentials: false
           ref: ${{ github.event.inputs.release_candidate_tag || github.ref }}
-      
+
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
-          python-version: '3.11'
-      
+          python-version: "3.11"
+
       - name: Install Poetry
-        uses: snok/install-poetry@v1
-        with:
-          version: latest
-          virtualenvs-create: true
-          virtualenvs-in-project: true
-      
-      - name: Cache Poetry dependencies
-        uses: actions/cache@v3
+        run: |
+          pip install 'poetry==2.3.2'
+          poetry config virtualenvs.create true
+          poetry config virtualenvs.in-project true
+
+      - name: Restore Poetry dependencies cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.0.0
         with:
           path: |
             ~/.cache/pypoetry
@@ -43,15 +46,15 @@ jobs:
           key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }}
           restore-keys: |
             ${{ runner.os }}-poetry-
-      
+
       - name: Install dependencies
         run: |
           poetry install --with dev
-          poetry run pip install pytest-xdist pytest-timeout
-      
+          poetry run pip install 'pytest-xdist==3.8.0' 'pytest-timeout==2.4.0'
+
       - name: Create test results directory
         run: mkdir -p test-results
-      
+
       - name: Run LLM Translation Tests
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -61,13 +64,14 @@ jobs:
           AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }}
           AZURE_API_BASE: ${{ secrets.AZURE_API_BASE }}
           AZURE_API_VERSION: ${{ secrets.AZURE_API_VERSION }}
-          # Add other API keys as needed
+          RC_TAG: ${{ github.event.inputs.release_candidate_tag || github.ref_name }}
+          COMMIT_SHA: ${{ github.sha }}
         run: |
           python .github/workflows/run_llm_translation_tests.py \
-            --tag "${{ github.event.inputs.release_candidate_tag || github.ref_name }}" \
-            --commit "${{ github.sha }}" \
+            --tag "$RC_TAG" \
+            --commit "$COMMIT_SHA" \
             || true  # Continue even if tests fail
-      
+
       - name: Display test summary
         if: always()
         run: |
@@ -79,9 +83,9 @@ jobs:
           else
             echo "Warning: Test report was not generated"
           fi
-      
+
       - name: Upload test artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: LLM-Translation-Artifact-${{ github.event.inputs.release_candidate_tag || github.ref_name }}

.github/workflows/load_test.yml

@@ -1,59 +0,0 @@
-name: Test Locust Load Test
-
-on:
-  workflow_run:
-    workflows: ["Build, Publish LiteLLM Docker Image. New Release"]
-    types:
-      - completed
-  workflow_dispatch:
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v1
-      - name: Setup Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: '3.x'
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install PyGithub
-      - name: re-deploy proxy
-        run: |
-          echo "Current working directory: $PWD"
-          ls
-          python ".github/workflows/redeploy_proxy.py"
-        env:
-          LOAD_TEST_REDEPLOY_URL1: ${{ secrets.LOAD_TEST_REDEPLOY_URL1 }}
-          LOAD_TEST_REDEPLOY_URL2: ${{ secrets.LOAD_TEST_REDEPLOY_URL2 }}
-        working-directory: ${{ github.workspace }}
-      - name: Run Load Test
-        id: locust_run
-        uses: BerriAI/locust-github-action@master
-        with:
-          LOCUSTFILE: ".github/workflows/locustfile.py"
-          URL:  "https://post-release-load-test-proxy.onrender.com/"
-          USERS: "20"
-          RATE: "20"
-          RUNTIME: "300s"
-      - name: Process Load Test Stats
-        run: |
-          echo "Current working directory: $PWD"
-          ls
-          python ".github/workflows/interpret_load_test.py"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        working-directory: ${{ github.workspace }}
-      - name: Upload CSV as Asset to Latest Release
-        uses: xresloader/upload-to-github-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          file: "load_test_stats.csv;load_test.html"
-          update_latest_release: true
-          tag_name: "load-test"
-          overwrite: true

.github/workflows/locustfile.py

@@ -1,28 +0,0 @@
-from locust import HttpUser, task, between
-
-
-class MyUser(HttpUser):
-    wait_time = between(1, 5)
-
-    @task
-    def chat_completion(self):
-        headers = {
-            "Content-Type": "application/json",
-            "Authorization": "Bearer sk-8N1tLOOyH8TIxwOLahhIVg",
-            # Include any additional headers you may need for authentication, etc.
-        }
-
-        # Customize the payload with "model" and "messages" keys
-        payload = {
-            "model": "fake-openai-endpoint",
-            "messages": [
-                {"role": "system", "content": "You are a chat bot."},
-                {"role": "user", "content": "Hello, how are you?"},
-            ],
-            # Add more data as necessary
-        }
-
-        # Make a POST request to the "chat/completions" endpoint
-        response = self.client.post("chat/completions", json=payload, headers=headers)
-
-        # Print or log the response if needed

.github/workflows/main.yml

@@ -1,34 +0,0 @@
-name: Publish Dev Release to PyPI
-
-on:
-  workflow_dispatch:
-  
-jobs:
-  publish-dev-release:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Set up Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: 3.8  # Adjust the Python version as needed
-
-      - name: Install dependencies
-        run: pip install toml twine
-
-      - name: Read version from pyproject.toml
-        id: read-version
-        run: |
-          version=$(python -c 'import toml; print(toml.load("pyproject.toml")["tool"]["commitizen"]["version"])')
-          printf "LITELLM_VERSION=%s" "$version" >> $GITHUB_ENV
-
-      - name: Check if version exists on PyPI
-        id: check-version
-        run: |
-          set -e
-          if twine check --repository-url https://pypi.org/simple/ "litellm==$LITELLM_VERSION" >/dev/null 2>&1; then
-            echo "Version $LITELLM_VERSION already exists on PyPI. Skipping publish."
-     

.github/workflows/publish-migrations.yml

@@ -1,207 +0,0 @@
-name: Publish Prisma Migrations
-
-permissions:
-  contents: write
-  pull-requests: write
-
-on:
-  push:
-    paths:
-      - 'schema.prisma'  # Check root schema.prisma
-    branches:
-      - main
-
-jobs:
-  publish-migrations:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:14
-        env:
-          POSTGRES_DB: temp_db
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-      
-      # Add shadow database service
-      postgres_shadow:
-        image: postgres:14
-        env:
-          POSTGRES_DB: shadow_db
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-        ports:
-          - 5433:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.x'
-
-      - name: Install Dependencies
-        run: |
-          pip install prisma
-          pip install python-dotenv
-
-      - name: Generate Initial Migration if None Exists
-        env:
-          DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          SHADOW_DATABASE_URL: "postgresql://postgres:postgres@localhost:5433/shadow_db"
-        run: |
-          mkdir -p deploy/migrations
-          echo 'provider = "postgresql"' > deploy/migrations/migration_lock.toml
-          
-          if [ -z "$(ls -A deploy/migrations/2* 2>/dev/null)" ]; then
-            echo "No existing migrations found, creating baseline..."
-            VERSION=$(date +%Y%m%d%H%M%S)
-            mkdir -p deploy/migrations/${VERSION}_initial
-            
-            echo "Generating initial migration..."
-            # Save raw output for debugging
-            prisma migrate diff \
-              --from-empty \
-              --to-schema-datamodel schema.prisma \
-              --shadow-database-url "${SHADOW_DATABASE_URL}" \
-              --script > deploy/migrations/${VERSION}_initial/raw_migration.sql
-            
-            echo "Raw migration file content:"
-            cat deploy/migrations/${VERSION}_initial/raw_migration.sql
-            
-            echo "Cleaning migration file..."
-            # Clean the file
-            sed '/^Installing/d' deploy/migrations/${VERSION}_initial/raw_migration.sql > deploy/migrations/${VERSION}_initial/migration.sql
-            
-            # Verify the migration file
-            if [ ! -s deploy/migrations/${VERSION}_initial/migration.sql ]; then
-              echo "ERROR: Migration file is empty after cleaning"
-              echo "Original content was:"
-              cat deploy/migrations/${VERSION}_initial/raw_migration.sql
-              exit 1
-            fi
-            
-            echo "Final migration file content:"
-            cat deploy/migrations/${VERSION}_initial/migration.sql
-            
-            # Verify it starts with SQL
-            if ! head -n 1 deploy/migrations/${VERSION}_initial/migration.sql | grep -q "^--\|^CREATE\|^ALTER"; then
-              echo "ERROR: Migration file does not start with SQL command or comment"
-              echo "First line is:"
-              head -n 1 deploy/migrations/${VERSION}_initial/migration.sql
-              echo "Full content is:"
-              cat deploy/migrations/${VERSION}_initial/migration.sql
-              exit 1
-            fi
-            
-            echo "Initial migration generated at $(date -u)" > deploy/migrations/${VERSION}_initial/README.md
-          fi
-
-      - name: Compare and Generate Migration
-        if: success()
-        env:
-          DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          SHADOW_DATABASE_URL: "postgresql://postgres:postgres@localhost:5433/shadow_db"
-        run: |
-          # Create temporary migration workspace
-          mkdir -p temp_migrations
-          
-          # Copy existing migrations (will not fail if directory is empty)
-          cp -r deploy/migrations/* temp_migrations/ 2>/dev/null || true
-          
-          VERSION=$(date +%Y%m%d%H%M%S)
-          
-          # Generate diff against existing migrations or empty state
-          prisma migrate diff \
-            --from-migrations temp_migrations \
-            --to-schema-datamodel schema.prisma \
-            --shadow-database-url "${SHADOW_DATABASE_URL}" \
-            --script > temp_migrations/migration_${VERSION}.sql
-          
-          # Check if there are actual changes
-          if [ -s temp_migrations/migration_${VERSION}.sql ]; then
-            echo "Changes detected, creating new migration"
-            mkdir -p deploy/migrations/${VERSION}_schema_update
-            mv temp_migrations/migration_${VERSION}.sql deploy/migrations/${VERSION}_schema_update/migration.sql
-            echo "Migration generated at $(date -u)" > deploy/migrations/${VERSION}_schema_update/README.md
-          else
-            echo "No schema changes detected"
-            exit 0
-          fi
-
-      - name: Verify Migration
-        if: success()
-        env:
-          DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          DIRECT_URL: "postgresql://postgres:postgres@localhost:5432/temp_db"
-          SHADOW_DATABASE_URL: "postgresql://postgres:postgres@localhost:5433/shadow_db"
-        run: |
-          # Create test database
-          psql "${SHADOW_DATABASE_URL}" -c 'CREATE DATABASE migration_test;'
-          
-          # Apply all migrations in order to verify
-          for migration in deploy/migrations/*/migration.sql; do
-            echo "Applying migration: $migration"
-            psql "${SHADOW_DATABASE_URL}" -f $migration
-          done
-
-      # Add this step before create-pull-request to debug permissions
-      - name: Check Token Permissions
-        run: |
-          echo "Checking token permissions..."
-          curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
-               -H "Accept: application/vnd.github.v3+json" \
-               https://api.github.com/repos/BerriAI/litellm/collaborators
-          
-          echo "\nChecking if token can create PRs..."
-          curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
-               -H "Accept: application/vnd.github.v3+json" \
-               https://api.github.com/repos/BerriAI/litellm
-
-      # Add this debug step before git push
-      - name: Debug Changed Files
-        run: |
-          echo "Files staged for commit:"
-          git diff --name-status --staged
-          
-          echo "\nAll changed files:"
-          git status
-
-      - name: Create Pull Request
-        if: success()
-        uses: peter-evans/create-pull-request@v5
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: "chore: update prisma migrations"
-          title: "Update Prisma Migrations"
-          body: |
-            Auto-generated migration based on schema.prisma changes.
-            
-            Generated files:
-            - deploy/migrations/${VERSION}_schema_update/migration.sql
-            - deploy/migrations/${VERSION}_schema_update/README.md
-          branch: feat/prisma-migration-${{ env.VERSION }}
-          base: main
-          delete-branch: true
-
-      - name: Generate and Save Migrations
-        run: |
-          # Only add migration files
-          git add deploy/migrations/
-          git status  # Debug what's being committed
-          git commit -m "chore: update prisma migrations" 

.github/workflows/publish_enterprise.yml

@@ -1,74 +0,0 @@
-name: Publish litellm-enterprise to PyPI
-
-on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: "Version bump type"
-        required: true
-        default: "patch"
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    if: github.repository == 'BerriAI/litellm'
-    permissions:
-      contents: write
-    defaults:
-      run:
-        working-directory: enterprise
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install Poetry
-        run: pip install poetry
-
-      - name: Bump version
-        id: bump
-        run: |
-          OLD=$(poetry version -s)
-          poetry version ${{ github.event.inputs.bump }}
-          NEW=$(poetry version -s)
-          echo "old=$OLD" >> $GITHUB_OUTPUT
-          echo "new=$NEW" >> $GITHUB_OUTPUT
-
-      - name: Update version refs in root pyproject.toml and requirements.txt
-        run: |
-          OLD=${{ steps.bump.outputs.old }}
-          NEW=${{ steps.bump.outputs.new }}
-          sed -i "s/litellm-enterprise = {version = \"${OLD}\"/litellm-enterprise = {version = \"${NEW}\"/" ../pyproject.toml
-          sed -i "s/litellm-enterprise==${OLD}/litellm-enterprise==${NEW}/" ../requirements.txt
-
-      - name: Update poetry.lock
-        working-directory: .
-        run: poetry lock
-
-      - name: Build
-        run: poetry build
-
-      - name: Commit version bump
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          cd ..
-          git add enterprise/pyproject.toml pyproject.toml requirements.txt poetry.lock
-          git commit -m "bump: litellm-enterprise ${{ steps.bump.outputs.old }} → ${{ steps.bump.outputs.new }}"
-          git push
-
-      - name: Publish to PyPI
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_ENTERPRISE }}
-        run: |
-          pip install twine
-          twine upload dist/litellm_enterprise-${{ steps.bump.outputs.new }}*

.github/workflows/publish_proxy_extras.yml

@@ -1,74 +0,0 @@
-name: Publish litellm-proxy-extras to PyPI
-
-on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: "Version bump type"
-        required: true
-        default: "patch"
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    if: github.repository == 'BerriAI/litellm'
-    permissions:
-      contents: write
-    defaults:
-      run:
-        working-directory: litellm-proxy-extras
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install Poetry
-        run: pip install poetry
-
-      - name: Bump version
-        id: bump
-        run: |
-          OLD=$(poetry version -s)
-          poetry version ${{ github.event.inputs.bump }}
-          NEW=$(poetry version -s)
-          echo "old=$OLD" >> $GITHUB_OUTPUT
-          echo "new=$NEW" >> $GITHUB_OUTPUT
-
-      - name: Update version refs in root pyproject.toml and requirements.txt
-        run: |
-          OLD=${{ steps.bump.outputs.old }}
-          NEW=${{ steps.bump.outputs.new }}
-          sed -i "s/litellm-proxy-extras = {version = \"${OLD}\"/litellm-proxy-extras = {version = \"${NEW}\"/" ../pyproject.toml
-          sed -i "s/litellm-proxy-extras==${OLD}/litellm-proxy-extras==${NEW}/" ../requirements.txt
-
-      - name: Update poetry.lock
-        working-directory: .
-        run: poetry lock
-
-      - name: Build
-        run: poetry build
-
-      - name: Commit version bump
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          cd ..
-          git add litellm-proxy-extras/pyproject.toml pyproject.toml requirements.txt poetry.lock
-          git commit -m "bump: litellm-proxy-extras ${{ steps.bump.outputs.old }} → ${{ steps.bump.outputs.new }}"
-          git push
-
-      - name: Publish to PyPI
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_PUBLISH_PASSWORD }}
-        run: |
-          pip install twine
-          twine upload dist/litellm_proxy_extras-${{ steps.bump.outputs.new }}*

.github/workflows/publish_to_pypi.yml

@@ -0,0 +1,136 @@
+name: Publish to PyPI
+
+on:
+  workflow_dispatch:
+
+jobs:
+  preflight-checks:
+    name: Preflight Checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    # No environment — read-only checks, no approval needed
+    outputs:
+      needs_publish: ${{ steps.check-litellm.outputs.needs_publish }}
+      version: ${{ steps.check-litellm.outputs.version }}
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Check litellm version on PyPI
+        id: check-litellm
+        run: |
+          VERSION=$(grep -m1 '^version' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Checking if litellm $VERSION exists on PyPI..."
+
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm/$VERSION/json")
+          if [ "$HTTP_STATUS" = "200" ]; then
+            echo "litellm $VERSION already exists on PyPI. Skipping publish."
+            echo "needs_publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "litellm $VERSION not found on PyPI. Publish needed."
+            echo "needs_publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Sanity check proxy-extras version
+        run: |
+          # Read pinned version from requirements.txt
+          REQ_VERSION=$(grep -oP 'litellm-proxy-extras==\K[0-9.]+' requirements.txt)
+          if [ -z "$REQ_VERSION" ]; then
+            echo "::error::Could not find litellm-proxy-extras version in requirements.txt"
+            exit 1
+          fi
+          echo "requirements.txt pins litellm-proxy-extras==$REQ_VERSION"
+
+          # Read pinned version from pyproject.toml dependency
+          PYPROJECT_VERSION=$(python3 -c "
+          import re
+          with open('pyproject.toml') as f:
+              content = f.read()
+          match = re.search(r'litellm-proxy-extras\s*=\s*\{version\s*=\s*\"([^\"]+)\"', content)
+          if match:
+              print(match.group(1).lstrip('^~>='))
+          else:
+              import sys
+              print('::error::Could not find litellm-proxy-extras dependency in pyproject.toml', file=sys.stderr)
+              sys.exit(1)
+          ")
+          echo "pyproject.toml pins litellm-proxy-extras version: $PYPROJECT_VERSION"
+
+          # Check that both pinned versions match
+          if [ "$REQ_VERSION" != "$PYPROJECT_VERSION" ]; then
+            echo "::error::Version mismatch: requirements.txt has $REQ_VERSION but pyproject.toml has $PYPROJECT_VERSION"
+            exit 1
+          fi
+
+          # Check that the pinned version exists on PyPI
+          echo "Checking if litellm-proxy-extras $REQ_VERSION exists on PyPI..."
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm-proxy-extras/$REQ_VERSION/json")
+          if [ "$HTTP_STATUS" != "200" ]; then
+            echo "::error::litellm-proxy-extras $REQ_VERSION is not published on PyPI yet. Publish it before releasing litellm."
+            exit 1
+          fi
+          echo "litellm-proxy-extras $REQ_VERSION exists on PyPI. Sanity check passed."
+
+  publish-litellm:
+    name: Publish litellm to PyPI
+    needs: preflight-checks
+    if: needs.preflight-checks.outputs.needs_publish == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      id-token: write
+      contents: read
+    environment: pypi-publish
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Copy model prices backup
+        run: cp model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
+
+      - name: Install build tools
+        run: python -m pip install --upgrade pip build==1.4.2
+
+      - name: Build package
+        run: |
+          rm -rf build dist
+          python -m build
+
+      - name: Verify build artifacts
+        env:
+          EXPECTED_VERSION: ${{ needs.preflight-checks.outputs.version }}
+        run: |
+          echo "Contents of dist/:"
+          ls -la dist/
+          # Ensure we have both sdist and wheel
+          ls dist/*.tar.gz
+          ls dist/*.whl
+          # Verify built version matches expected
+          ls dist/ | grep -q "litellm-${EXPECTED_VERSION}" || {
+            echo "::error::Built artifacts do not match expected version $EXPECTED_VERSION"
+            ls dist/
+            exit 1
+          }
+
+      - name: Validate package metadata
+        run: |
+          pip install twine==6.2.0
+          twine check dist/*
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

.github/workflows/read_pyproject_version.yml

@@ -3,7 +3,10 @@ name: Read Version from pyproject.toml
 on:
   push:
     branches:
-      - main  # Change this to the default branch of your repository
+      - main # Change this to the default branch of your repository
+
+permissions:
+  contents: read
 
 jobs:
   read-version:
@@ -11,20 +14,14 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
-          python-version: 3.8  # Adjust the Python version as needed
-
-      - name: Install dependencies
-        run: pip install toml
+          persist-credentials: false
 
       - name: Read version from pyproject.toml
         id: read-version
         run: |
-          version=$(python -c 'import toml; print(toml.load("pyproject.toml")["tool"]["commitizen"]["version"])')
+          version=$(grep -m1 '^version' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
           printf "LITELLM_VERSION=%s" "$version" >> $GITHUB_ENV
 
       - name: Display version

.github/workflows/redeploy_proxy.py

@@ -1,20 +0,0 @@
-"""
-
-redeploy_proxy.py
-"""
-
-import os
-import requests
-import time
-
-# send a get request to this endpoint
-deploy_hook1 = os.getenv("LOAD_TEST_REDEPLOY_URL1")
-response = requests.get(deploy_hook1, timeout=20)
-
-
-deploy_hook2 = os.getenv("LOAD_TEST_REDEPLOY_URL2")
-response = requests.get(deploy_hook2, timeout=20)
-
-print("SENT GET REQUESTS to re-deploy proxy")
-print("sleeeping.... for 60s")
-time.sleep(60)

.github/workflows/regenerate-poetry-lock.yml

@@ -1,80 +0,0 @@
-name: Regenerate poetry.lock
-
-# Runs whenever pyproject.toml is merged into main (the most common cause of
-# the "pyproject.toml changed significantly since poetry.lock was last generated"
-# CI failure).  Can also be triggered manually.
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - pyproject.toml
-  workflow_dispatch:
-
-permissions:
-  contents: write       # needed to push the auto/regenerate-poetry-lock-* branch
-  pull-requests: write  # needed to open the PR and enable auto-merge
-
-jobs:
-  regenerate-lock:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install Poetry
-        run: pip install poetry
-
-      - name: Regenerate poetry.lock
-        run: poetry lock
-
-      - name: Check whether poetry.lock actually changed
-        id: diff
-        run: |
-          if git diff --quiet poetry.lock; then
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Open PR with the refreshed lock file
-        if: steps.diff.outputs.changed == 'true'
-        id: open-pr
-        run: |
-          BRANCH="auto/regenerate-poetry-lock-$(date +'%Y%m%d%H%M%S')"
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git checkout -b "$BRANCH"
-          git add poetry.lock
-          git commit -m "chore: regenerate poetry.lock to match pyproject.toml"
-          git push -f origin "$BRANCH"
-
-          cat > /tmp/pr-body.md << 'BODY'
-          Automated regeneration of `poetry.lock` after `pyproject.toml` was updated on `main`.
-
-          Fixes the recurring CI failure:
-          ```
-          pyproject.toml changed significantly since poetry.lock was last generated.
-          Run `poetry lock` to fix the lock file.
-          ```
-          BODY
-
-          PR_URL=$(gh pr create \
-            --title "chore: regenerate poetry.lock to match pyproject.toml" \
-            --body-file /tmp/pr-body.md \
-            --head "$BRANCH" \
-            --base main)
-          echo "pr_url=$PR_URL" >> "$GITHUB_OUTPUT"
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-      - name: Enable auto-merge
-        if: steps.diff.outputs.changed == 'true'
-        run: |
-          gh pr merge "${{ steps.open-pr.outputs.pr_url }}" --auto --squash
-        env:
-          GH_TOKEN: ${{ github.token }}

.github/workflows/reset_stable.yml

@@ -1,39 +0,0 @@
-name: Reset litellm_stable branch
-
-on:
-  release:
-    types: [published, created]
-jobs:
-  update-stable-branch:
-    if: ${{ startsWith(github.event.release.tag_name, 'v') && !endsWith(github.event.release.tag_name, '-stable') }}
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Reset litellm_stable_release_branch branch to the release commit
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Configure Git user
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          
-          # Fetch all branches and tags
-          git fetch --all
-
-          # Check if the litellm_stable_release_branch branch exists
-          if git show-ref --verify --quiet refs/remotes/origin/litellm_stable_release_branch; then
-            echo "litellm_stable_release_branch branch exists."
-            git checkout litellm_stable_release_branch
-          else
-            echo "litellm_stable_release_branch branch does not exist. Creating it."
-            git checkout -b litellm_stable_release_branch
-          fi
-
-          # Reset litellm_stable_release_branch branch to the release commit
-          git reset --hard $GITHUB_SHA
-
-          # Push the updated litellm_stable_release_branch branch
-          git push origin litellm_stable_release_branch --force

.github/workflows/run_observatory_tests.yml

@@ -33,7 +33,9 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Validate tag input
         env:
@@ -49,11 +51,12 @@ jobs:
           TAG: ${{ inputs.tag }}
           AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }}
           AZURE_API_BASE: ${{ secrets.AZURE_API_BASE }}
+          WORKSPACE: ${{ github.workspace }}
         run: |
           docker run -d \
             --name litellm-rc \
             -p 4000:4000 \
-            -v "${{ github.workspace }}/.github/observatory/litellm_config.yaml:/app/config.yaml" \
+            -v "${WORKSPACE}/.github/observatory/litellm_config.yaml:/app/config.yaml" \
             -e LITELLM_MASTER_KEY="${LITELLM_MASTER_KEY}" \
             -e AZURE_API_KEY="${AZURE_API_KEY}" \
             -e AZURE_API_BASE="${AZURE_API_BASE}" \
@@ -77,8 +80,9 @@ jobs:
 
       - name: Start cloudflared tunnel
         run: |
-          # Install cloudflared
+          # Install cloudflared (pinned version + checksum)
           curl -sL https://github.com/cloudflare/cloudflared/releases/download/2025.2.1/cloudflared-linux-amd64 -o /usr/local/bin/cloudflared
+          echo "afdfadd1ef552e66bffc35246fe30a9bd578356d2d386de95585ccfc432472b8  /usr/local/bin/cloudflared" | sha256sum -c -
           chmod +x /usr/local/bin/cloudflared
 
           # Start a quick tunnel (no account needed) and capture the URL
@@ -103,11 +107,11 @@ jobs:
 
       - name: Verify tunnel connectivity
         run: |
-          echo "Testing tunnel at ${{ env.TUNNEL_URL }}..."
+          echo "Testing tunnel at ${TUNNEL_URL}..."
           # Quick tunnels need time for DNS propagation; retry to avoid
           # transient NXDOMAIN (curl exit code 6) on first attempt.
           for i in $(seq 1 10); do
-            if curl -sf "${{ env.TUNNEL_URL }}/health/liveliness" > /dev/null 2>&1; then
+            if curl -sf "${TUNNEL_URL}/health/liveliness" > /dev/null 2>&1; then
               echo "Tunnel is working (attempt $i)"
               exit 0
             fi
@@ -221,5 +225,5 @@ jobs:
       - name: Cleanup
         if: always()
         run: |
-          kill "${{ env.CLOUDFLARED_PID }}" 2>/dev/null || true
+          kill "$CLOUDFLARED_PID" 2>/dev/null || true
           docker rm -f litellm-rc 2>/dev/null || true

.github/workflows/scan_duplicate_issues.yml

@@ -21,14 +21,15 @@ jobs:
       contents: read
     steps:
       - name: Checkout scripts
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           sparse-checkout: .github/scripts
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
-          python-version: "3.11"
+          python-version: "3.13"
 
       - name: Scan for duplicate issues
         env:

.github/workflows/simple_pypi_publish.yml

@@ -1,67 +0,0 @@
-name: Simple PyPI Publish
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version to publish (e.g., 1.74.10)'
-        required: true
-        type: string
-
-env:
-  TWINE_USERNAME: __token__
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    if: github.repository == 'BerriAI/litellm'
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.8'
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install toml build wheel twine
-
-      - name: Update version in pyproject.toml
-        run: |
-          python -c "
-          import toml
-          
-          with open('pyproject.toml', 'r') as f:
-              data = toml.load(f)
-          
-          data['tool']['poetry']['version'] = '${{ github.event.inputs.version }}'
-          
-          with open('pyproject.toml', 'w') as f:
-              toml.dump(data, f)
-          
-          print(f'Updated version to ${{ github.event.inputs.version }}')
-          "
-
-      - name: Copy model prices file
-        run: |
-          cp model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
-
-      - name: Build package
-        run: |
-          rm -rf build dist
-          python -m build
-
-      - name: Publish to PyPI
-        env:
-          TWINE_PASSWORD: ${{ secrets.PYPI_PUBLISH_PASSWORD }}
-        run: |
-          twine upload dist/*
-
-      - name: Output success
-        run: |
-          echo "✅ Successfully published litellm v${{ github.event.inputs.version }} to PyPI"
-          echo "📦 Package: https://pypi.org/project/litellm/${{ github.event.inputs.version }}/" 

.github/workflows/stale.yml

@@ -2,19 +2,24 @@ name: "Stale Issue Management"
 
 on:
   schedule:
-    - cron: '0 0 * * *' # Runs daily at midnight UTC
+    - cron: "0 0 * * *" # Runs daily at midnight UTC
   workflow_dispatch:
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
+    if: github.repository == 'BerriAI/litellm'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # v8
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           stale-issue-message: "This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs."
           stale-pr-message: "This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs."
-          days-before-stale: 90        # Revert to 60 days
-          days-before-close: 7         # Revert to 7 days
+          days-before-stale: 90 # Revert to 60 days
+          days-before-close: 7 # Revert to 7 days
           stale-issue-label: "stale"
-          operations-per-run: 1000
+          operations-per-run: 1000

.github/workflows/test-linting.yml

@@ -2,7 +2,10 @@ name: LiteLLM Linting
 
 on:
   pull_request:
-    branches: [ main ]
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   lint:
@@ -10,69 +13,73 @@ jobs:
     timeout-minutes: 5
 
     steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-        clean: true
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+          clean: true
+          persist-credentials: false
 
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.12'
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
 
-    - name: Install Poetry
-      uses: snok/install-poetry@v1
+      - name: Install Poetry
+        run: pip install 'poetry==2.3.2'
 
-    - name: Clean Python cache
-      run: |
-        find . -type d -name "__pycache__" -exec rm -rf {} + || true
-        find . -name "*.pyc" -delete || true
+      - name: Clean Python cache
+        run: |
+          find . -type d -name "__pycache__" -exec rm -rf {} + || true
+          find . -name "*.pyc" -delete || true
 
-    - name: Install dependencies
-      run: |
-        poetry lock
-        poetry install --with dev
+      - name: Check poetry.lock is up to date
+        run: |
+          poetry check --lock || (echo "❌ poetry.lock is out of sync with pyproject.toml. Run 'poetry lock' locally and commit the result." && exit 1)
 
-    - name: Run Black formatting
-      run: |
-        cd litellm
-        poetry run black .
-        cd ..
+      - name: Install dependencies
+        run: |
+          poetry install --with dev
 
-    - name: Debug - Check file state
-      run: |
-        echo "Current branch:"
-        git branch --show-current
-        echo "Last 3 commits:"
-        git log --oneline -3
-        echo "File content around line 43:"
-        head -50 litellm/litellm_core_utils/custom_logger_registry.py | tail -10
-        
-    - name: Run Ruff linting
-      run: |
-        cd litellm
-        poetry run ruff check .
-        cd ..
+      - name: Check Black formatting
+        run: |
+          cd litellm
+          poetry run black --check --exclude '/enterprise/' .
+          cd ..
 
-    - name: Print OpenAI version
-      run: |
-        poetry run python -c "import openai; print(f'OpenAI version: {openai.__version__}')"
+      - name: Debug - Check file state
+        run: |
+          echo "Current branch:"
+          git branch --show-current
+          echo "Last 3 commits:"
+          git log --oneline -3
+          echo "File content around line 43:"
+          head -50 litellm/litellm_core_utils/custom_logger_registry.py | tail -10
 
-    - name: Run MyPy type checking
-      run: |
-        cd litellm
-        poetry run mypy . 
-        cd ..
+      - name: Run Ruff linting
+        run: |
+          cd litellm
+          poetry run ruff check .
+          cd ..
 
-    - name: Check for circular imports
-      run: |
-        cd litellm
-        poetry run python ../tests/documentation_tests/test_circular_imports.py
-        cd ..
+      - name: Print OpenAI version
+        run: |
+          poetry run python -c "import openai; print(f'OpenAI version: {openai.__version__}')"
 
-    - name: Check import safety
-      run: |
-        poetry run python -c "from litellm import *" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
+      - name: Run MyPy type checking
+        run: |
+          cd litellm
+          poetry run mypy . 
+          cd ..
+
+      - name: Check for circular imports
+        run: |
+          cd litellm
+          poetry run python ../tests/documentation_tests/test_circular_imports.py
+          cd ..
+
+      - name: Check import safety
+        run: |
+          poetry run python -c "from litellm import *" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
 
   secret-scan:
     runs-on: ubuntu-latest
@@ -81,27 +88,28 @@ jobs:
       contents: read
 
     steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.12'
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
 
-    - name: Run secret scan test
-      run: |
-        pip install pytest
-        pytest tests/litellm/test_no_hardcoded_secrets.py -v
+      - name: Run secret scan test
+        run: |
+          pip install 'pytest==9.0.2'
+          pytest tests/litellm/test_no_hardcoded_secrets.py -v
 
-    - name: Run ggshield secret scan
-      env:
-        GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
-      run: |
-        if [ -n "$GITGUARDIAN_API_KEY" ]; then
-          pip install ggshield
-          ggshield secret scan repo .
-        else
-          echo "GITGUARDIAN_API_KEY not set, skipping ggshield scan"
-        fi
+      - name: Run ggshield secret scan
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
+        run: |
+          if [ -n "$GITGUARDIAN_API_KEY" ]; then
+            pip install 'ggshield==1.48.0'
+            ggshield secret scan repo .
+          else
+            echo "GITGUARDIAN_API_KEY not set, skipping ggshield scan"
+          fi

.github/workflows/test-litellm-matrix.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 # Cancel in-progress runs for the same PR
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -12,7 +15,7 @@ concurrency:
 jobs:
   test:
     runs-on: ubuntu-latest
-    timeout-minutes: 20  # Increased from 15 to 20
+    timeout-minutes: 20 # Increased from 15 to 20
     strategy:
       fail-fast: false
       matrix:
@@ -43,7 +46,7 @@ jobs:
           - name: "integrations"
             path: "tests/test_litellm/integrations"
             workers: 2
-            reruns: 3  # Integration tests tend to be flakier
+            reruns: 3 # Integration tests tend to be flakier
           - name: "core-utils"
             path: "tests/test_litellm/litellm_core_utils"
             workers: 2
@@ -117,18 +120,20 @@ jobs:
     name: test (${{ matrix.test-group.name }})
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
       - name: Install Poetry
-        uses: snok/install-poetry@v1
+        run: pip install 'poetry==2.3.2'
 
       - name: Cache Poetry dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.0.0
         with:
           path: |
             ~/.cache/pypoetry
@@ -144,7 +149,7 @@ jobs:
           poetry install --with dev,proxy-dev --extras "proxy semantic-router"
           # pytest-rerunfailures and pytest-xdist are in pyproject.toml dev dependencies
           poetry run pip install google-genai==1.22.0 \
-            google-cloud-aiplatform>=1.38 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core
+            google-cloud-aiplatform==1.115.0 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core==0.23.0
 
       - name: Setup litellm-enterprise
         run: |

.github/workflows/test-litellm-ui-build.yml

@@ -16,10 +16,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0
         with:
           node-version: "20"
           cache: "npm"

.github/workflows/test-litellm.yml

@@ -4,45 +4,50 @@ name: LiteLLM Mock Tests (folder - tests/test_litellm)
 # the same tests in parallel across 10 jobs for faster CI times.
 # Kept for manual debugging only.
 on:
-  workflow_dispatch:  # Manual trigger only
+  workflow_dispatch: # Manual trigger only
   # pull_request:
   #   branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 25
 
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
-    - name: Thank You Message
-      run: |
-        echo "### 🙏 Thank you for contributing to LiteLLM!" >> $GITHUB_STEP_SUMMARY
-        echo "Your PR is being tested now. We appreciate your help in making LiteLLM better!" >> $GITHUB_STEP_SUMMARY
+      - name: Thank You Message
+        run: |
+          echo "### 🙏 Thank you for contributing to LiteLLM!" >> $GITHUB_STEP_SUMMARY
+          echo "Your PR is being tested now. We appreciate your help in making LiteLLM better!" >> $GITHUB_STEP_SUMMARY
 
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.12'
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
 
-    - name: Install Poetry
-      uses: snok/install-poetry@v1
+      - name: Install Poetry
+        run: pip install 'poetry==2.3.2'
 
-    - name: Install dependencies
-      run: |
-        poetry lock
-        poetry install --with dev,proxy-dev --extras "proxy semantic-router"
-        poetry run pip install "pytest-retry==1.6.3"
-        poetry run pip install pytest-xdist
-        poetry run pip install "google-genai==1.22.0"
-        poetry run pip install "google-cloud-aiplatform>=1.38"
-        poetry run pip install "fastapi-offline==1.7.3"
-        poetry run pip install "python-multipart>=0.0.20"
-        poetry run pip install "openapi-core"
-    - name: Setup litellm-enterprise as local package
-      run: |
-        poetry run pip install --force-reinstall --no-deps -e enterprise/
-    - name: Run tests
-      run: |
-        poetry run pytest tests/test_litellm --tb=short -vv --maxfail=10 -n 4 --durations=50
+      - name: Install dependencies
+        run: |
+          poetry lock
+          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
+          poetry run pip install "pytest-retry==1.6.3"
+          poetry run pip install 'pytest-xdist==3.8.0'
+          poetry run pip install "google-genai==1.22.0"
+          poetry run pip install "google-cloud-aiplatform==1.115.0"
+          poetry run pip install "fastapi-offline==1.7.3"
+          poetry run pip install "python-multipart==0.0.22"
+          poetry run pip install "openapi-core==0.23.0"
+      - name: Setup litellm-enterprise as local package
+        run: |
+          poetry run pip install --force-reinstall --no-deps -e enterprise/
+      - name: Run tests
+        run: |
+          poetry run pytest tests/test_litellm --tb=short -vv --maxfail=10 -n 4 --durations=50

.github/workflows/test-mcp.yml

@@ -2,7 +2,10 @@ name: LiteLLM MCP Tests (folder - tests/mcp_tests)
 
 on:
   pull_request:
-    branches: [ main ]
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   test:
@@ -10,38 +13,40 @@ jobs:
     timeout-minutes: 25
 
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
-    - name: Thank You Message
-      run: |
-        echo "### 🙏 Thank you for contributing to LiteLLM!" >> $GITHUB_STEP_SUMMARY
-        echo "Your PR is being tested now. We appreciate your help in making LiteLLM better!" >> $GITHUB_STEP_SUMMARY
+      - name: Thank You Message
+        run: |
+          echo "### 🙏 Thank you for contributing to LiteLLM!" >> $GITHUB_STEP_SUMMARY
+          echo "Your PR is being tested now. We appreciate your help in making LiteLLM better!" >> $GITHUB_STEP_SUMMARY
 
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.12'
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
 
-    - name: Install Poetry
-      uses: snok/install-poetry@v1
+      - name: Install Poetry
+        run: pip install 'poetry==2.3.2'
 
-    - name: Install dependencies
-      run: |
-        poetry lock
-        poetry install --with dev,proxy-dev --extras "proxy semantic-router"
-        poetry run pip install "pytest==7.3.1"
-        poetry run pip install "pytest-retry==1.6.3"
-        poetry run pip install "pytest-cov==5.0.0"
-        poetry run pip install "pytest-asyncio==0.21.1"
-        poetry run pip install "respx==0.22.0"
-        poetry run pip install "pydantic==2.11.0"
-        poetry run pip install "mcp==1.25.0"
-        poetry run pip install pytest-xdist
+      - name: Install dependencies
+        run: |
+          poetry lock
+          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
+          poetry run pip install "pytest==7.3.1"
+          poetry run pip install "pytest-retry==1.6.3"
+          poetry run pip install "pytest-cov==5.0.0"
+          poetry run pip install "pytest-asyncio==0.21.1"
+          poetry run pip install "respx==0.22.0"
+          poetry run pip install "pydantic==2.11.0"
+          poetry run pip install "mcp==1.25.0"
+          poetry run pip install 'pytest-xdist==3.8.0'
 
-    - name: Setup litellm-enterprise as local package
-      run: |
-        poetry run pip install --force-reinstall --no-deps -e enterprise/
+      - name: Setup litellm-enterprise as local package
+        run: |
+          poetry run pip install --force-reinstall --no-deps -e enterprise/
 
-    - name: Run MCP tests
-      run: |
-        poetry run pytest tests/mcp_tests -x -vv -n 4 --cov=litellm --cov-report=xml --durations=5
+      - name: Run MCP tests
+        run: |
+          poetry run pytest tests/mcp_tests -x -vv -n 4 --cov=litellm --cov-report=xml --durations=5

.github/workflows/test-model-map.yaml

@@ -2,13 +2,18 @@ name: Validate model_prices_and_context_window.json
 
 on:
   pull_request:
-    branches: [ main ]
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   validate-model-prices-json:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Validate model_prices_and_context_window.json
         run: |

.github/workflows/test-proxy-e2e-azure-batches.yml

@@ -9,6 +9,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   proxy_e2e_azure_batches_tests:
     runs-on: ubuntu-latest
@@ -30,18 +33,20 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
       - name: Install Poetry
-        uses: snok/install-poetry@v1
+        run: pip install 'poetry==2.3.2'
 
       - name: Cache Poetry dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.0.0
         with:
           path: |
             ~/.cache/pypoetry
@@ -56,7 +61,7 @@ jobs:
         run: |
           poetry config virtualenvs.in-project true
           poetry install --with dev,proxy-dev --extras "proxy"
-          poetry run pip install psycopg2-binary uvicorn fastapi httpx tenacity
+          poetry run pip install psycopg2-binary==2.9.11 uvicorn==0.42.0 fastapi==0.135.2 httpx==0.28.1 tenacity==9.1.4
 
       - name: Setup litellm-enterprise
         run: |
@@ -87,4 +92,3 @@ jobs:
             --tb=short \
             --maxfail=3 \
             --durations=10
-

.github/workflows/test_server_root_path.yml

@@ -17,13 +17,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12
 
       - name: Build Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 #v6.14
         with:
           context: .
           file: ./docker/Dockerfile.non_root

.github/workflows/zizmor.yml

@@ -0,0 +1,31 @@
+name: GitHub Actions Security Analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2

.pre-commit-config.yaml

@@ -14,12 +14,12 @@ repos:
         types: [python]
         files: (litellm/|litellm_proxy_extras/|enterprise/).*\.py
         exclude: ^litellm/__init__.py$
-    # -   id: black
-    #     name: black
-    #     entry: poetry run black
-    #     language: system
-    #     types: [python]
-    #     files: (litellm/|litellm_proxy_extras/|enterprise/).*\.py
+    -   id: black
+        name: black
+        entry: poetry run black
+        language: system
+        types: [python]
+        files: (litellm/|litellm_proxy_extras/).*\.py
 -   repo: https://github.com/pycqa/flake8
     rev: 7.0.0  # The version of flake8 to use
     hooks:

.semgrep/rules/security/no-claude-directory.yml

@@ -0,0 +1,18 @@
+rules:
+  - id: no-claude-directory-committed
+    message: >
+      .claude/ directory must not be committed to the repository.
+      It contains local Claude Code settings (permissions, worktree paths) that are
+      developer-machine-specific and may expose internal paths or credentials.
+      Add .claude/ to .gitignore instead.
+    severity: ERROR
+    languages: [generic]
+    paths:
+      include:
+        - "/.claude/**"
+        - "/.claude/*"
+    pattern-regex: '[\s\S]+'
+    metadata:
+      category: security
+      tags: [supply-chain, secrets]
+      confidence: HIGH

AGENTS.md

@@ -212,6 +212,8 @@ When opening issues or pull requests, follow these templates:
 
    Using helpers like `supports_reasoning` (which read from `model_prices_and_context_window.json` / `get_model_info`) allows future model updates to "just work" without code changes.
 
+9. **Never close HTTP/SDK clients on cache eviction**: Do not add `close()`, `aclose()`, or `create_task(close_fn())` inside `LLMClientCache._remove_key()` or any cache eviction path. Evicted clients may still be held by in-flight requests; closing them causes `RuntimeError: Cannot send a request, as the client has been closed.` in production after the cache TTL (1 hour) expires. Connection cleanup is handled at shutdown by `close_litellm_async_clients()`. See PR #22247 for the full incident history.
+
 ## HELPFUL RESOURCES
 
 - Main documentation: https://docs.litellm.ai/
@@ -249,9 +251,11 @@ The proxy takes ~15-20 seconds to fully start (it runs Prisma migrations on boot
 See `CLAUDE.md` and the `Makefile` for standard commands. Key notes:
 
 - `psycopg-binary` must be installed (`poetry run pip install psycopg-binary`) because the pytest-postgresql plugin requires it and the lock file only includes `psycopg` (no binary).
+- `openapi-core` must be installed (`poetry run pip install openapi-core`) for the OpenAPI compliance tests in `tests/test_litellm/interactions/`.
 - The `--timeout` pytest flag is NOT available; don't pass it.
 - Unit tests: `poetry run pytest tests/test_litellm/ -x -vv -n 4`
 - Black `--check` may report pre-existing formatting issues; this does not block test runs.
+- If `poetry install` fails with "pyproject.toml changed significantly since poetry.lock was last generated", run `poetry lock` first to regenerate the lock file.
 
 ### Lint
 

CLAUDE.md

@@ -91,6 +91,10 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components:
 - Async/await patterns throughout
 - Type hints required for all public APIs
 - **Avoid imports within methods** — place all imports at the top of the file (module-level). Inline imports inside functions/methods make dependencies harder to trace and hurt readability. The only exception is avoiding circular imports where absolutely necessary.
+- **Use dict spread for immutable copies** — prefer `{**original, "key": new_value}` over `dict(obj)` + mutation. The spread produces the final dict in one step and makes intent clear.
+- **Guard at resolution time** — when resolving an optional value through a fallback chain (`a or b or ""`), raise immediately if the resolved result being empty is an error. Don't pass empty strings or sentinel values downstream for the callee to deal with.
+- **Extract complex comprehensions to named helpers** — a set/dict comprehension that calls into the DB or manager (e.g. "which of these server IDs are OAuth2?") belongs in a named helper function, not inline in the caller.
+- **FastAPI parameter declarations** — mark required query/form params with `= Query(...)` / `= Form(...)` explicitly when other params in the same handler are optional. Mixing `str` (required) with `Optional[str] = None` in the same signature causes silent 422s when the required param is missing.
 
 ### Testing Strategy
 - Unit tests in `tests/test_litellm/`
@@ -98,10 +102,28 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components:
 - Proxy tests in `tests/proxy_unit_tests/`
 - Load tests in `tests/load_tests/`
 - **Always add tests when adding new entity types or features** — if the existing test file covers other entity types, add corresponding tests for the new one
+- **Keep monkeypatch stubs in sync with real signatures** — when a function gains a new optional parameter, update every `fake_*` / `stub_*` in tests that patch it to also accept that kwarg (even as `**kwargs`). Stale stubs fail with `unexpected keyword argument` and mask real bugs.
+- **Test all branches of name→ID resolution** — when adding server/resource lookup that resolves names to UUIDs, test: (1) name resolves and UUID is allowed, (2) name resolves but UUID is not allowed, (3) name does not resolve at all. The silent-fallback path is where access-control bugs hide.
 
 ### UI / Backend Consistency
 - When wiring a new UI entity type to an existing backend endpoint, verify the backend API contract (single value vs. array, required vs. optional params) and ensure the UI controls match — e.g., use a single-select dropdown when the backend accepts a single value, not a multi-select
 
+### MCP OAuth / OpenAPI Transport Mapping
+- `TRANSPORT.OPENAPI` is a UI-only concept. The backend only accepts `"http"`, `"sse"`, or `"stdio"`. Always map it to `"http"` before any API call (including pre-OAuth temp-session calls).
+- FastAPI validation errors return `detail` as an array of `{loc, msg, type}` objects. Error extractors must handle: array (map `.msg`), string, nested `{error: string}`, and fallback.
+- When an MCP server already has `authorization_url` stored, skip OAuth discovery (`_discovery_metadata`) — the server URL for OpenAPI MCPs is the spec file, not the API base, and fetching it causes timeouts.
+- `client_id` should be optional in the `/authorize` endpoint — if the server has a stored `client_id` in credentials, use that. Never require callers to re-supply it.
+
+### MCP Credential Storage
+- OAuth credentials and BYOK credentials share the `litellm_mcpusercredentials` table, distinguished by a `"type"` field in the JSON payload (`"oauth2"` vs plain string).
+- When deleting OAuth credentials, check type before deleting to avoid accidentally deleting a BYOK credential for the same `(user_id, server_id)` pair.
+- Always pass the raw `expires_at` timestamp to the client — never set it to `None` for expired credentials. Let the frontend compute the "Expired" display state from the timestamp.
+- Use `RecordNotFoundError` (not bare `except Exception`) when catching "already deleted" in credential delete endpoints.
+
+### Browser Storage Safety (UI)
+- Never write LiteLLM access tokens or API keys to `localStorage` — use `sessionStorage` only. `localStorage` survives browser close and is readable by any injected script (XSS).
+- Shared utility functions (e.g. `extractErrorMessage`) belong in `src/utils/` — never define them inline in hooks or duplicate them across files.
+
 ### Database Migrations
 - Prisma handles schema migrations
 - Migration files auto-generated with `prisma migrate dev`
@@ -110,12 +132,27 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components:
 ### Proxy database access
 - **Do not write raw SQL** for proxy DB operations. Use Prisma model methods instead of `execute_raw` / `query_raw`.
 - Use the generated client: `prisma_client.db.<model>` (e.g. `litellm_tooltable`, `litellm_usertable`) with `.upsert()`, `.find_many()`, `.find_unique()`, `.update()`, `.update_many()` as appropriate. This avoids schema/client drift, keeps code testable with simple mocks, and matches patterns used in spend logs and other proxy code.
+- **No N+1 queries.** Never query the DB inside a loop. Batch-fetch with `{"in": ids}` and distribute in-memory.
+- **Batch writes.** Use `create_many`/`update_many`/`delete_many` instead of individual calls (these return counts only; `update_many`/`delete_many` no-op silently on missing rows). When multiple separate writes target the same table (e.g. in `batch_()`), order by primary key to avoid deadlocks.
+- **Push work to the DB.** Filter, sort, group, and aggregate in SQL, not Python. Verify Prisma generates the expected SQL — e.g. prefer `group_by` over `find_many(distinct=...)` which does client-side processing.
+- **Bound large result sets.** Prisma materializes full results in memory. For results over ~10 MB, paginate with `take`/`skip` or `cursor`/`take`, always with an explicit `order`. Prefer cursor-based pagination (`skip` is O(n)). Don't paginate naturally small result sets.
+- **Limit fetched columns on wide tables.** Use `select` to fetch only needed fields — returns a partial object, so downstream code must not access unselected fields.
+- **Check index coverage.** For new or modified queries, check `schema.prisma` for a supporting index. Prefer extending an existing index (e.g. `@@index([a])` → `@@index([a, b])`) over adding a new one, unless it's a `@@unique`. Only add indexes for large/frequent queries.
+- **Keep schema files in sync.** Apply schema changes to all `schema.prisma` copies (`schema.prisma`, `litellm/proxy/`, `litellm-proxy-extras/`, `litellm-js/spend-logs/` for SpendLogs) with a migration under `litellm-proxy-extras/litellm_proxy_extras/migrations/`.
+
+### Setup Wizard (`litellm/setup_wizard.py`)
+- The wizard is implemented as a single `SetupWizard` class with `@staticmethod` methods — keep it that way. No module-level functions except `run_setup_wizard()` (the public entrypoint) and pure helpers (color, ANSI).
+- Use `litellm.utils.check_valid_key(model, api_key)` for credential validation — never roll a custom completion call.
+- Do not hardcode provider env-key names or model lists that already exist in the codebase. Add a `test_model` field to each provider entry to drive `check_valid_key`; set it to `None` for providers that can't be validated with a single API key (Azure, Bedrock, Ollama).
 
 ### Enterprise Features
 - Enterprise-specific code in `enterprise/` directory
 - Optional features enabled via environment variables
 - Separate licensing and authentication for enterprise features
 
+### HTTP Client Cache Safety
+- **Never close HTTP/SDK clients on cache eviction.** `LLMClientCache._remove_key()` must not call `close()`/`aclose()` on evicted clients — they may still be used by in-flight requests. Doing so causes `RuntimeError: Cannot send a request, as the client has been closed.` after the 1-hour TTL expires. Cleanup happens at shutdown via `close_litellm_async_clients()`.
+
 ### Troubleshooting: DB schema out of sync after proxy restart
 `litellm-proxy-extras` runs `prisma migrate deploy` on startup using **its own** bundled migration files, which may lag behind schema changes in the current worktree. Symptoms: `Unknown column`, `Invalid prisma invocation`, or missing data on new fields.
 
@@ -124,4 +161,4 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components:
 **Fix options:**
 1. **Create a Prisma migration** (permanent) — run `prisma migrate dev --name <description>` in the worktree. The generated file will be picked up by `prisma migrate deploy` on next startup.
 2. **Apply manually for local dev** — `psql -d litellm -c "ALTER TABLE ... ADD COLUMN IF NOT EXISTS ..."` after each proxy start. Fine for dev, not for production.
-3. **Update litellm-proxy-extras** — if the package is installed from PyPI, its migration directory must include the new file. Either update the package or run the migration manually until the next release ships it.
+3. **Update litellm-proxy-extras** — if the package is installed from PyPI, its migration directory must include the new file. Either update the package or run the migration manually until the next release ships it.

Dockerfile

@@ -39,7 +39,7 @@ RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
 # ensure pyjwt is used, not jwt
 RUN pip uninstall jwt -y
 RUN pip uninstall PyJWT -y
-RUN pip install PyJWT==2.9.0 --no-cache-dir
+RUN pip install PyJWT==2.12.0 --no-cache-dir
 
 # Runtime stage
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
@@ -49,7 +49,7 @@ USER root
 
 # Install runtime dependencies (libsndfile needed for audio processing on ARM64)
 RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
-    npm install -g npm@latest tar@7.5.8 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
+    npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     # SECURITY FIX: npm bundles tar, glob, and brace-expansion at multiple nested
     # levels inside its dependency tree. `npm install -g <pkg>` only creates a
     # SEPARATE global package, it does NOT replace npm's internal copies.
@@ -70,7 +70,15 @@ RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile
     find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
     done && \
-    npm cache clean --force
+    # SECURITY FIX: patch npm's own package.json metadata so scanners see the
+    # actual installed versions instead of the stale declared dependencies.
+    find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
+        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \
+    npm cache clean --force && \
+    # Remove the apk-tracked npm so its stale SBOM metadata (tar 7.5.9) is
+    # no longer visible to image scanners.  The globally installed npm@latest
+    # at /usr/local/lib/node_modules/npm/ remains fully functional.
+    { apk del --no-cache npm 2>/dev/null || true; }
 
 WORKDIR /app
 # Copy the current directory contents into the container at /app
@@ -96,6 +104,7 @@ RUN find /usr/lib -type f -path "*/tornado/test/*" -delete && \
 # npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
 # Patch every copy of tar, glob, and brace-expansion inside that tree.
 RUN GLOBAL="$(npm root -g)" && \
+    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
     find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
     done && \

README.md

@@ -28,6 +28,9 @@
     <a href="https://www.litellm.ai/support">
         <img src="https://img.shields.io/static/v1?label=Chat%20on&message=Slack&color=black&logo=Slack&style=flat-square" alt="Slack">
     </a>
+    <a href="https://codspeed.io/BerriAI/litellm?utm_source=badge">
+        <img src="https://img.shields.io/endpoint?url=https://codspeed.io/badge.json" alt="CodSpeed"/>
+    </a>
 </h4>
 
 <img width="2688" height="1600" alt="Group 7154 (1)" src="https://github.com/user-attachments/assets/c5ee0412-6fb5-4fb6-ab5b-bafae4209ca6" />
@@ -263,6 +266,7 @@ Support for more providers. Missing a provider or LLM Platform, raise a [feature
 <table>
   <tr>
     <td><img height="60" alt="Stripe" src="https://github.com/user-attachments/assets/f7296d4f-9fbd-460d-9d05-e4df31697c4b" /></td>
+    <td><img height="60" alt="image" src="https://github.com/user-attachments/assets/436fca71-988b-40bb-b5fe-8450c80fdbd0" /></td>
     <td><img height="60" alt="Google ADK" src="https://github.com/user-attachments/assets/caf270a2-5aee-45c4-8222-41a2070c4f19" /></td>
     <td><img height="60" alt="Greptile" src="https://github.com/user-attachments/assets/0be4bd8a-7cfa-48d3-9090-f415fe948280" /></td>
     <td><img height="60" alt="OpenHands" src="https://github.com/user-attachments/assets/a6150c4c-149e-4cae-888b-8b92be6e003f" /></td>
@@ -399,7 +403,7 @@ Support for more providers. Missing a provider or LLM Platform, raise a [feature
 # Enterprise
 For companies that need better security, user management and professional support
 
-[Talk to founders](https://calendly.com/d/cx9p-5yf-2nm/litellm-introductions)
+[Talk to founders](https://enterprise.litellm.ai/demo)
 
 This covers:
 - ✅ **Features under the [LiteLLM Commercial License](https://docs.litellm.ai/docs/proxy/enterprise):**
@@ -449,7 +453,6 @@ All these checks must pass before your PR can be merged.
 - [Schedule Demo 👋](https://calendly.com/d/4mp-gd3-k5k/berriai-1-1-onboarding-litellm-hosted-version)
 - [Community Discord 💭](https://discord.gg/wuPM9dRgDw)
 - [Community Slack 💭](https://www.litellm.ai/support)
-- Our numbers 📞 +1 (770) 8783-106 / ‭+1 (412) 618-6238‬
 - Our emails ✉️ ishaan@berri.ai / krrish@berri.ai
 
 # Why did we build this

ci_cd/security_scans.sh

@@ -10,13 +10,13 @@ echo "Starting security scans for LiteLLM..."
 # Function to install Trivy and required tools
 install_trivy() {
     echo "Installing Trivy and required tools..."
+    TRIVY_VERSION="0.35.0"
     sudo apt-get update
-    sudo apt-get install -y wget apt-transport-https gnupg lsb-release jq curl
-    wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
-    echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
-    sudo apt-get update
-    sudo apt-get install trivy
-    echo "Trivy and required tools installed successfully"
+    sudo apt-get install -y wget jq curl bsdmainutils
+    wget -qO trivy.deb "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.deb"
+    sudo dpkg -i trivy.deb
+    rm trivy.deb
+    echo "Trivy ${TRIVY_VERSION} installed successfully"
 }
 
 # Function to install Grype
@@ -161,6 +161,11 @@ run_grype_scans() {
         "GHSA-3ppc-4f35-3m26" # minimatch ReDoS via repeated wildcards - from nodejs_wheel bundled npm, not used in application runtime code
         "GHSA-83g3-92jg-28cx" # tar arbitrary file read/write via hardlink - from nodejs_wheel bundled npm, not used in application runtime code
         "CVE-2026-25639" # axios - full fix requires 1.x major version bump; pinned to >=0.30.2 to clear other axios CVEs, upgrade to 1.x in follow-up
+        "CVE-2026-2297" # Python 3.13 SourcelessFileLoader audit hook bypass - no fix available in base image
+        "GHSA-qffp-2rhf-9h96" # tar hardlink path traversal - from nodejs_wheel bundled npm, not used in application runtime code
+        "CVE-2026-2673" # OpenSSL 3.6.1 TLS 1.3 key exchange group negotiation issue - no fix available yet
+        "CVE-2026-3644" # Python 3.13 vulnerability - no fix available in base image
+        "CVE-2026-4224" # Python 3.13 Expat parser stack overflow in ElementDeclHandler - no fix available in base image
     )
 
     # Build JSON array of allowlisted CVE IDs for jq

cookbook/benchmark/readme.md

@@ -178,4 +178,4 @@ Benchmark Results for 'When will BerriAI IPO?':
 ```
 
 ## Support 
-**🤝 Schedule a 1-on-1 Session:** Book a [1-on-1 session](https://calendly.com/d/cx9p-5yf-2nm/litellm-introductions) with Krrish and Ishaan, the founders, to discuss any issues, provide feedback, or explore how we can improve LiteLLM for you.
+**🤝 Schedule a 1-on-1 Session:** Book a [1-on-1 session](https://enterprise.litellm.ai/demo) with Krrish and Ishaan, the founders, to discuss any issues, provide feedback, or explore how we can improve LiteLLM for you.

cookbook/codellama-server/README.MD

@@ -143,7 +143,6 @@ All responses from the server are returned in the following format (for all LLM
 
 - [Our calendar 👋](https://calendly.com/d/4mp-gd3-k5k/berriai-1-1-onboarding-litellm-hosted-version)
 - [Community Discord 💭](https://discord.gg/wuPM9dRgDw)
-- Our numbers 📞 +1 (770) 8783-106 / +1 (412) 618-6238
 - Our emails ✉️ ishaan@berri.ai / krrish@berri.ai
 
 ## Roadmap

cookbook/litellm_proxy_server/readme.md

@@ -164,7 +164,6 @@ All responses from the server are returned in the following format (for all LLM
 
 - [Our calendar 👋](https://calendly.com/d/4mp-gd3-k5k/berriai-1-1-onboarding-litellm-hosted-version)
 - [Community Discord 💭](https://discord.gg/wuPM9dRgDw)
-- Our numbers 📞 +1 (770) 8783-106 / +1 (412) 618-6238
 - Our emails ✉️ ishaan@berri.ai / krrish@berri.ai
 
 ## Roadmap

deploy/charts/litellm-helm/templates/_helpers.tpl

@@ -61,6 +61,20 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
+{{/*
+Create the service account name used by migration jobs.
+When Helm hooks are enabled, pre-install/pre-upgrade hooks run before normal resources.
+If this chart is creating the ServiceAccount, it is not yet available for the hook job,
+so fall back to "default" (or an explicit override) to avoid a cyclic dependency.
+*/}}
+{{- define "litellm.migrationServiceAccountName" -}}
+{{- if and .Values.migrationJob.hooks.helm.enabled .Values.serviceAccount.create }}
+{{- default "default" .Values.migrationJob.serviceAccountName }}
+{{- else }}
+{{- include "litellm.serviceAccountName" . }}
+{{- end }}
+{{- end }}
+
 {{/*
 Get redis service name
 */}}

deploy/charts/litellm-helm/templates/deployment.yaml

@@ -13,9 +13,16 @@ spec:
   {{- if and (not .Values.keda.enabled) (not .Values.autoscaling.enabled) }}
   replicas: {{ .Values.replicaCount }}
   {{- end }}
+  {{- with .Values.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   selector:
     matchLabels:
       {{- include "litellm.selectorLabels" . | nindent 6 }}
+  {{- if .Values.deploymentMinReadySeconds }}
+  minReadySeconds: {{ .Values.deploymentMinReadySeconds }}
+  {{- end }}
   template:
     metadata:
       annotations:

deploy/charts/litellm-helm/templates/migrations-job.yaml

@@ -34,7 +34,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      serviceAccountName: {{ include "litellm.serviceAccountName" . }}
+      serviceAccountName: {{ include "litellm.migrationServiceAccountName" . }}
       {{- with .Values.migrationJob.extraInitContainers }}
       initContainers:
         {{- toYaml . | nindent 8 }}

deploy/charts/litellm-helm/tests/deployment_tests.yaml

@@ -306,3 +306,16 @@ tests:
       - equal:
           path: spec.template.spec.containers[0].resources
           value: {}
+  - it: should be able to set minReadySeconds
+    template: deployment.yaml
+    set:
+      deploymentMinReadySeconds: 5
+    asserts:
+      - equal:
+          path: spec.minReadySeconds
+          value: 5
+  - it: should have minReadySeconds absent when deploymentMinReadySeconds is not set
+    template: deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.minReadySeconds

deploy/charts/litellm-helm/tests/migrations-job_tests.yaml

@@ -124,4 +124,67 @@ tests:
       - notContains:
           path: spec.template.spec.containers[0].env
           content:
-            name: DATABASE_URL
+            name: DATABASE_URL
+
+  - it: should use default service account for helm hooks when serviceAccount.create is true
+    template: migrations-job.yaml
+    set:
+      migrationJob:
+        enabled: true
+        hooks:
+          helm:
+            enabled: true
+      serviceAccount:
+        create: true
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: default
+
+  - it: should use migrationJob.serviceAccountName override for helm hooks when serviceAccount.create is true
+    template: migrations-job.yaml
+    set:
+      migrationJob:
+        enabled: true
+        serviceAccountName: migration-sa
+        hooks:
+          helm:
+            enabled: true
+      serviceAccount:
+        create: true
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: migration-sa
+
+  - it: should use chart service account when helm hooks are disabled
+    template: migrations-job.yaml
+    set:
+      migrationJob:
+        enabled: true
+        hooks:
+          helm:
+            enabled: false
+      serviceAccount:
+        create: true
+        name: my-custom-sa
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: my-custom-sa
+
+  - it: should use pre-existing service account when helm hooks are enabled but serviceAccount.create is false
+    template: migrations-job.yaml
+    set:
+      migrationJob:
+        enabled: true
+        hooks:
+          helm:
+            enabled: true
+      serviceAccount:
+        create: false
+        name: pre-existing-sa
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: pre-existing-sa

deploy/charts/litellm-helm/values.yaml

@@ -31,10 +31,20 @@ serviceAccount:
 # annotations for litellm deployment
 deploymentAnnotations: {}
 deploymentLabels: {}
+deploymentMinReadySeconds: 0
+
 # annotations for litellm pods
 podAnnotations: {}
 podLabels: {}
 
+# -- Deployment strategy configuration
+# Example:
+#   type: RollingUpdate
+#   rollingUpdate:
+#     maxUnavailable: 0
+#     maxSurge: 1
+strategy: {}
+
 terminationGracePeriodSeconds: 90
 topologySpreadConstraints:
   []
@@ -299,6 +309,10 @@ migrationJob:
   retries: 3 # Number of retries for the Job in case of failure
   backoffLimit: 4 # Backoff limit for Job restarts
   disableSchemaUpdate: false # Skip schema migrations for specific environments. When True, the job will exit with code 0.
+  # Optional service account for the migration job.
+  # Only used when migrationJob.hooks.helm.enabled=true and serviceAccount.create=true.
+  # In that case, pre-install/pre-upgrade hooks run before normal resources, so this defaults to "default".
+  serviceAccountName: ""
   annotations: {}
   ttlSecondsAfterFinished: 120
   resources: {}

docker/Dockerfile.custom_ui

@@ -19,7 +19,7 @@ RUN apt-get update && apt-get upgrade -y \
         libgnutls30 \
         libc6 && \
     apt-get install -y nodejs npm && \
-    npm install -g npm@latest tar@7.5.8 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.1 diff@8.0.3 && \
+    npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     GLOBAL="$(npm root -g)" && \
     find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -36,7 +36,10 @@ RUN apt-get update && apt-get upgrade -y \
     find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
     done && \
-    npm cache clean --force
+    find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
+        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \
+    npm cache clean --force && \
+    apt-get purge -y npm
 
 # Copy the UI source into the container
 COPY ./ui/litellm-dashboard /app/ui/litellm-dashboard

docker/Dockerfile.database

@@ -50,7 +50,7 @@ USER root
 
 # Install runtime dependencies
 RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
-    npm install -g npm@latest tar@7.5.8 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.1 diff@8.0.3 && \
+    npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     GLOBAL="$(npm root -g)" && \
     find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -67,7 +67,10 @@ RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile
     find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
     done && \
-    npm cache clean --force
+    find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
+        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \
+    npm cache clean --force && \
+    { apk del --no-cache npm 2>/dev/null || true; }
 
 WORKDIR /app
 # Copy the current directory contents into the container at /app
@@ -85,6 +88,7 @@ RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ && rm -f *.whl
 # npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
 # Patch every copy of tar, glob, and brace-expansion inside that tree.
 RUN GLOBAL="$(npm root -g)" && \
+    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
     find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
     done && \
@@ -108,7 +112,7 @@ RUN sed -i 's/\r$//' docker/install_auto_router.sh && chmod +x docker/install_au
 # ensure pyjwt is used, not jwt
 RUN pip uninstall jwt -y
 RUN pip uninstall PyJWT -y
-RUN pip install PyJWT==2.9.0 --no-cache-dir
+RUN pip install PyJWT==2.12.0 --no-cache-dir
 
 # Build Admin UI (runtime stage)
 # Convert Windows line endings to Unix and make executable

docker/Dockerfile.dev

@@ -31,7 +31,7 @@ RUN --mount=type=cache,target=/root/.cache/pip \
 # Fix JWT dependency conflicts early
 RUN pip uninstall jwt -y || true && \
     pip uninstall PyJWT -y || true && \
-    pip install PyJWT==2.9.0 --no-cache-dir
+    pip install PyJWT==2.12.0 --no-cache-dir
 
 # Copy only necessary files for build
 COPY pyproject.toml README.md schema.prisma poetry.lock ./
@@ -75,7 +75,7 @@ RUN apt-get update && apt-get upgrade -y \
     nodejs \
     npm \
     && rm -rf /var/lib/apt/lists/* \
-    && npm install -g npm@latest tar@7.5.8 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.1 diff@8.0.3 \
+    && npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
     && GLOBAL="$(npm root -g)" \
     && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
           rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -92,7 +92,10 @@ RUN apt-get update && apt-get upgrade -y \
     && find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
           rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
        done \
-    && npm cache clean --force
+    && find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
+        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null \
+    && npm cache clean --force \
+    && apt-get purge -y npm
 
 WORKDIR /app
 
@@ -114,6 +117,7 @@ RUN pip install --no-cache-dir *.whl /wheels/* --no-index --find-links=/wheels/
 # npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
 # Patch every copy of tar, glob, and brace-expansion inside that tree.
 RUN GLOBAL="$(npm root -g)" && \
+    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
     find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
     done && \

docker/Dockerfile.non_root

@@ -32,7 +32,7 @@ RUN for i in 1 2 3; do \
 # Cache Python dependencies
 COPY requirements.txt .
 RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt \
-  && pip wheel --no-cache-dir --wheel-dir=/wheels/ "semantic_router==0.1.11" "aurelio-sdk==0.0.19" "PyJWT==2.9.0"
+  && pip wheel --no-cache-dir --wheel-dir=/wheels/ "semantic_router==0.1.11" "aurelio-sdk==0.0.19" "PyJWT==2.12.0"
 
 # Copy source after dependency layers
 COPY . .
@@ -106,7 +106,7 @@ RUN for i in 1 2 3; do \
     apk add --no-cache python3 py3-pip bash openssl tzdata nodejs npm supervisor && break || sleep 5; \
     done \
   && apk upgrade --no-cache nodejs \
-  && npm install -g npm@latest tar@7.5.8 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.1 diff@8.0.3 \
+  && npm install -g npm@latest tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
   && GLOBAL="$(npm root -g)" \
   && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -123,7 +123,10 @@ RUN for i in 1 2 3; do \
   && find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
      done \
-  && npm cache clean --force
+  && find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
+        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null \
+  && npm cache clean --force \
+  && { apk del --no-cache npm 2>/dev/null || true; }
 
 # Copy artifacts from builder
 COPY --from=builder /app/requirements.txt /app/requirements.txt
@@ -169,6 +172,7 @@ RUN pip install --no-index --find-links=/wheels/ -r requirements.txt && \
 # npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
 # Patch every copy of tar, glob, and brace-expansion inside that tree.
 RUN GLOBAL="$(npm root -g)" && \
+    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
     find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
     done && \
@@ -194,7 +198,7 @@ RUN sed -i 's/\r$//' docker/entrypoint.sh && \
     chown -R nobody:nogroup /app /var/lib/litellm/ui /var/lib/litellm/assets /nonexistent /.npm && \
     pip uninstall jwt -y || true && \
     pip uninstall PyJWT -y || true && \
-    pip install --no-index --find-links=/wheels/ PyJWT==2.10.1 --no-cache-dir && \
+    pip install --no-index --find-links=/wheels/ PyJWT==2.12.0 --no-cache-dir && \
     rm -rf /wheels && \
     PRISMA_PATH=$(python -c "import os, prisma; print(os.path.dirname(prisma.__file__))") && \
     chown -R nobody:nogroup $PRISMA_PATH && \

docs/my-website/blog/anthropic_opus_4_5_and_advanced_features/index.md

@@ -3,18 +3,9 @@ slug: anthropic_advanced_features
 title: "Day 0 Support: Claude 4.5 Opus (+Advanced Features)"
 date: 2025-11-25T10:00:00
 authors:
-  - name: Sameer Kankute
-    title: SWE @ LiteLLM (LLM Translation)
-    url: https://www.linkedin.com/in/sameer-kankute/
-    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - sameer
+  - krrish
+  - ishaan-alt
 description: "Guide to Claude Opus 4.5 and advanced features in LiteLLM: Tool Search, Programmatic Tool Calling, and Effort Parameter."
 tags: [anthropic, claude, tool search, programmatic tool calling, effort, advanced features]
 hide_table_of_contents: false
@@ -25,6 +16,8 @@ import TabItem from '@theme/TabItem';
 
 This guide covers Anthropic's latest model (Claude Opus 4.5) and its advanced features now available in LiteLLM: Tool Search, Programmatic Tool Calling, Tool Input Examples, and the Effort Parameter.
 
+{/* truncate */}
+
 ---
 
 | Feature | Supported Models |

docs/my-website/blog/anthropic_wildcard_model_access_incident/index.md

@@ -3,18 +3,9 @@ slug: anthropic-wildcard-model-access-incident
 title: "Incident Report: Wildcard Blocking New Models After Cost Map Reload"
 date: 2026-02-23T10:00:00
 authors:
-  - name: Sameer Kankute
-    title: SWE @ LiteLLM (LLM Translation)
-    url: https://www.linkedin.com/in/sameer-kankute/
-    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - sameer
+  - krrish
+  - ishaan-alt
 tags: [incident-report, proxy, auth, model-access]
 hide_table_of_contents: false
 ---

docs/my-website/blog/authors.yml

@@ -4,6 +4,12 @@ litellm:
   url: https://github.com/BerriAI/litellm
   image_url: https://github.com/BerriAI.png
 
+sameer:
+  name: Sameer Kankute
+  title: SWE @ LiteLLM (LLM Translation)
+  url: https://www.linkedin.com/in/sameer-kankute/
+  image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
+
 krrish:
   name: Krrish Dholakia
   title: CEO, LiteLLM
@@ -22,3 +28,21 @@ ishaan-alt:
   title: CTO, LiteLLM
   url: https://www.linkedin.com/in/reffajnaahsi/
   image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+
+ryan:
+  name: Ryan Crabbe
+  title: Performance Engineer, LiteLLM
+  url: https://www.linkedin.com/in/ryan-crabbe-0b9687214
+  image_url: https://media.licdn.com/dms/image/v2/D5603AQHt1t9Z4BJ6Gw/profile-displayphoto-shrink_400_400/profile-displayphoto-shrink_400_400/0/1724453682340?e=1772064000&v=beta&t=VXdmr13rsNB05wyA2F1TENOB5UuDHUZ0FCHTolNyR5M
+
+alexsander:
+  name: Alexsander Hamir
+  title: Performance Engineer, LiteLLM
+  url: https://www.linkedin.com/in/alexsander-baptista/
+  image_url: https://github.com/AlexsanderHamir.png
+
+yuneng:
+  name: Yuneng Jiang
+  title: SWE @ LiteLLM (Full Stack)
+  url: https://www.linkedin.com/in/yuneng-david-jiang-455676139/
+  image_url: https://avatars.githubusercontent.com/u/171294688?v=4

docs/my-website/blog/claude_code_beta_headers/index.md

@@ -3,18 +3,9 @@ slug: claude-code-beta-headers-incident
 title: "Incident Report: Invalid beta headers with Claude Code"
 date: 2026-02-16T10:00:00
 authors:
-  - name: Sameer Kankute
-    title: SWE @ LiteLLM (LLM Translation)
-    url: https://www.linkedin.com/in/sameer-kankute/
-    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
+  - sameer
+  - ishaan-alt
+  - krrish
 tags: [incident-report, anthropic, stability]
 hide_table_of_contents: false
 ---
@@ -173,5 +164,5 @@ curl -X POST "https://your-proxy-url/reload/anthropic_beta_headers" \
 
 ## Related documentation
 
-- [Managing Anthropic Beta Headers](../proxy/sync_anthropic_beta_headers.md) - Complete configuration guide
+- [Managing Anthropic Beta Headers](../../docs/proxy/sync_anthropic_beta_headers) - Complete configuration guide
 - [`anthropic_beta_headers_config.json`](https://github.com/BerriAI/litellm/blob/main/litellm/anthropic_beta_headers_config.json) - Current configuration file

docs/my-website/blog/claude_opus_4_6/index.md

@@ -3,18 +3,9 @@ slug: claude_opus_4_6
 title: "Day 0 Support: Claude Opus 4.6"
 date: 2026-02-05T10:00:00
 authors:
-  - name: Sameer Kankute
-    title: SWE @ LiteLLM (LLM Translation)
-    url: https://www.linkedin.com/in/sameer-kankute/
-    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
+  - sameer
+  - ishaan-alt
+  - krrish
 description: "Day 0 support for Claude Opus 4.6 on LiteLLM AI Gateway - use across Anthropic, Azure, Vertex AI, and Bedrock."
 tags: [anthropic, claude, opus 4.6]
 hide_table_of_contents: false
@@ -25,6 +16,8 @@ import TabItem from '@theme/TabItem';
 
 LiteLLM now supports Claude Opus 4.6 on Day 0. Use it across Anthropic, Azure, Vertex AI, and Bedrock through the LiteLLM AI Gateway.
 
+{/* truncate */}
+
 ## Docker Image
 
 ```bash

docs/my-website/blog/claude_sonnet_4_6/index.md

@@ -3,14 +3,8 @@ slug: claude_sonnet_4_6
 title: "Day 0 Support: Claude Sonnet 4.6"
 date: 2026-02-17T10:00:00
 authors:
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
+  - ishaan-alt
+  - krrish
 description: "Day 0 support for Claude Sonnet 4.6 on LiteLLM AI Gateway - use across Anthropic, Azure, Vertex AI, and Bedrock."
 tags: [anthropic, claude, sonnet 4.6]
 hide_table_of_contents: false
@@ -21,6 +15,8 @@ import TabItem from '@theme/TabItem';
 
 LiteLLM now supports Claude Sonnet 4.6 on Day 0. Use it across Anthropic, Azure, Vertex AI, and Bedrock through the LiteLLM AI Gateway.
 
+{/* truncate */}
+
 ## Docker Image
 
 ```bash

docs/my-website/blog/fastapi_middleware_performance/index.mdx

@@ -3,18 +3,9 @@ slug: fastapi-middleware-performance
 title: "Your Middleware Could Be a Bottleneck"
 date: 2026-02-07T10:00:00
 authors:
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
-  - name: Ryan Crabbe
-    title: "Performance Engineer, LiteLLM"
-    url: https://www.linkedin.com/in/ryan-crabbe-0b9687214
-    image_url: https://media.licdn.com/dms/image/v2/D5603AQHt1t9Z4BJ6Gw/profile-displayphoto-shrink_400_400/profile-displayphoto-shrink_400_400/0/1724453682340?e=1772064000&v=beta&t=VXdmr13rsNB05wyA2F1TENOB5UuDHUZ0FCHTolNyR5M
+  - krrish
+  - ishaan-alt
+  - ryan
 description: "How we improved LiteLLM proxy latency and throughput by replacing a single middleware base class"
 tags: [performance, fastapi, middleware]
 hide_table_of_contents: false

docs/my-website/blog/gemin_3.1/index.md

@@ -3,18 +3,9 @@ slug: gemini_3_1_pro
 title: "DAY 0 Support: Gemini 3.1 Pro on LiteLLM"
 date: 2026-02-19T10:00:00
 authors:
-  - name: Sameer Kankute
-    title: SWE @ LiteLLM (LLM Translation)
-    url: https://www.linkedin.com/in/sameer-kankute/
-    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - sameer
+  - krrish
+  - ishaan-alt
 description: "Guide to using Gemini 3.1 Pro on LiteLLM Proxy and SDK with day 0 support."
 tags: [gemini, day 0 support, llms]
 hide_table_of_contents: false
@@ -28,6 +19,8 @@ import TabItem from '@theme/TabItem';
 
 LiteLLM now supports `gemini-3.1-pro-preview` and all the new API changes along with it.
 
+{/* truncate */}
+
 ## Deploy this version
 
 <Tabs>
@@ -67,7 +60,7 @@ LiteLLM provides **full end-to-end support** for Gemini 3.1 Pro on:
 - ✅ `/v1/chat/completions` - OpenAI-compatible chat completions endpoint
 - ✅ `/v1/responses` - OpenAI Responses API endpoint (streaming and non-streaming)
 - ✅ [`/v1/messages`](../../docs/anthropic_unified) - Anthropic-compatible messages endpoint
-- ✅ `/v1/generateContent` – [Google Gemini API](../../docs/generateContent.md) compatible endpoint 
+- ✅ `/v1/generateContent` – [Google Gemini API](../../docs/generateContent) compatible endpoint 
 
 All endpoints support:
 - Streaming and non-streaming responses
@@ -147,4 +140,3 @@ curl -X POST http://localhost:4000/v1/chat/completions \
 | `high` | `high` |
 | `disable` | `minimal` |
 | `none` | `minimal` |
-

docs/my-website/blog/gemini_3/index.md

@@ -3,18 +3,9 @@ slug: gemini_3
 title: "DAY 0 Support: Gemini 3 on LiteLLM"
 date: 2025-11-19T10:00:00
 authors:
-  - name: Sameer Kankute
-    title: SWE @ LiteLLM (LLM Translation)
-    url: https://www.linkedin.com/in/sameer-kankute/
-    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - sameer
+  - krrish
+  - ishaan-alt
 description: "Common questions and best practices for using gemini-3-pro-preview with LiteLLM Proxy and SDK."
 tags: [gemini, day 0 support, llms]
 hide_table_of_contents: false
@@ -29,6 +20,8 @@ This guide covers common questions and best practices for using `gemini-3-pro-pr
 
 :::
 
+{/* truncate */}
+
 ## Quick Start
 
 <Tabs>
@@ -976,8 +969,7 @@ messages.append(response.choices[0].message)  # ✅ Includes thought signatures
 
 ## Additional Resources
 
-- [Gemini Provider Documentation](../gemini.md)
-- [Thought Signatures Guide](../gemini.md#thought-signatures)
-- [Reasoning Content Documentation](../../reasoning_content.md)
-- [Function Calling Guide](../../function_calling.md)
-
+- [Gemini Provider Documentation](../../docs/providers/gemini)
+- [Thought Signatures Guide](../../docs/providers/gemini#thought-signatures)
+- [Reasoning Content Documentation](../../docs/reasoning_content)
+- [Function Calling Guide](../../docs/completion/function_call)

docs/my-website/blog/gemini_3_1_flash_lite/index.md

@@ -3,18 +3,9 @@ slug: gemini_3_1_flash_lite_preview
 title: "DAY 0 Support: Gemini 3.1 Flash Lite Preview on LiteLLM"
 date: 2026-03-03T08:00:00
 authors:
-  - name: Sameer Kankute
-    title: SWE @ LiteLLM (LLM Translation)
-    url: https://www.linkedin.com/in/sameer-kankute/
-    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - sameer
+  - krrish
+  - ishaan-alt
 description: "Guide to using Gemini 3.1 Flash Lite Preview on LiteLLM Proxy and SDK with day 0 support."
 tags: [gemini, day 0 support, llms, supernova]
 hide_table_of_contents: false
@@ -32,6 +23,8 @@ LiteLLM now supports `gemini-3.1-flash-lite-preview` with full day 0 support!
 If you only want cost tracking, you need no change in your current Litellm version. But if you want the support for new features introduced along with it like thinking levels, you will need to use v1.80.8-stable.1 or above.
 :::
 
+{/* truncate */}
+
 ## Deploy this version
 
 <Tabs>
@@ -150,7 +143,7 @@ LiteLLM provides **full end-to-end support** for Gemini 3.1 Flash Lite Preview o
 - ✅ `/v1/chat/completions` - OpenAI-compatible chat completions endpoint
 - ✅ `/v1/responses` - OpenAI Responses API endpoint (streaming and non-streaming)
 - ✅ [`/v1/messages`](../../docs/anthropic_unified) - Anthropic-compatible messages endpoint
-- ✅ `/v1/generateContent` – [Google Gemini API](../../docs/generateContent.md) compatible endpoint 
+- ✅ `/v1/generateContent` – [Google Gemini API](../../docs/generateContent) compatible endpoint 
 
 All endpoints support:
 - Streaming and non-streaming responses
@@ -172,4 +165,4 @@ LiteLLM automatically maps OpenAI's `reasoning_effort` parameter to Gemini's `th
 | `medium` | `medium` | Balanced reasoning for moderate complexity |
 | `high` | `high` | Maximum reasoning depth, complex problems |
 | `disable` | `minimal` | Disable extended reasoning |
-| `none` | `minimal` | No extended reasoning |
+| `none` | `minimal` | No extended reasoning |

docs/my-website/blog/gemini_3_flash/index.md

@@ -3,18 +3,9 @@ slug: gemini_3_flash
 title: "DAY 0 Support: Gemini 3 Flash on LiteLLM"
 date: 2025-12-17T10:00:00
 authors:
-  - name: Sameer Kankute
-    title: SWE @ LiteLLM (LLM Translation)
-    url: https://www.linkedin.com/in/sameer-kankute/
-    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - sameer
+  - krrish
+  - ishaan-alt
 description: "Guide to using Gemini 3 Flash on LiteLLM Proxy and SDK with day 0 support."
 tags: [gemini, day 0 support, llms]
 hide_table_of_contents: false
@@ -32,6 +23,8 @@ LiteLLM now supports `gemini-3-flash-preview` and all the new API changes along
 If you only want cost tracking, you need no change in your current Litellm version. But if you want the support for new features introduced along with it like thinking levels, you will need to use v1.80.8-stable.1 or above.
 :::
 
+{/* truncate */}
+
 ## Deploy this version
 
 <Tabs>
@@ -80,7 +73,7 @@ LiteLLM provides **full end-to-end support** for Gemini 3 Flash on:
 - ✅ `/v1/chat/completions` - OpenAI-compatible chat completions endpoint
 - ✅ `/v1/responses` - OpenAI Responses API endpoint (streaming and non-streaming)
 - ✅ [`/v1/messages`](../../docs/anthropic_unified) - Anthropic-compatible messages endpoint
-- ✅ `/v1/generateContent` – [Google Gemini API](../../docs/generateContent.md) compatible endpoint 
+- ✅ `/v1/generateContent` – [Google Gemini API](../../docs/generateContent) compatible endpoint 
 All endpoints support:
 - Streaming and non-streaming responses
 - Function calling with thought signatures
@@ -252,4 +245,3 @@ If using this model via vertex_ai, keep the location as global as this is the on
 | `high` | `high` |
 | `disable` | `minimal` |
 | `none` | `minimal` |
-

docs/my-website/blog/gemini_embedding_2_multimodal/index.md

@@ -0,0 +1,168 @@
+---
+slug: gemini_embedding_2_multimodal
+title: "Gemini Embedding 2 Preview: Multimodal Embeddings on LiteLLM"
+date: 2025-03-11T10:00:00
+authors:
+  - sameer
+description: "Generate embeddings from text, images, audio, video, and PDFs with gemini-embedding-2-preview on LiteLLM via Gemini API and Vertex AI."
+tags: [gemini, embeddings, multimodal, vertex ai]
+hide_table_of_contents: false
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# Gemini Embedding 2 Preview: Multimodal Embeddings
+
+LiteLLM now supports **multimodal embeddings** with `gemini-embedding-2-preview`—generating a single embedding from a mix of text, images, audio, video, and PDF content. Available via both the **Gemini API** (API key) and **Vertex AI** (GCP credentials).
+
+{/* truncate */}
+
+## Supported Input Types
+
+| Modality | Supported Formats | 
+|----------|-------------------|
+| **Text** | Plain text |
+| **Image** | PNG, JPEG | 
+| **Audio** | MP3, WAV | 
+| **Video** | MP4, MOV | 
+| **Documents** | PDF | 
+
+## Input Formats
+
+LiteLLM accepts three input formats for multimodal content:
+
+1. **Data URIs** – Base64-encoded inline: `data:image/png;base64,<encoded_data>`
+2. **GCS URLs** – Cloud Storage paths (Vertex AI): `gs://bucket/path/to/file.png`
+3. **Gemini File References** – Pre-uploaded files (Gemini API): `files/abc123`
+
+## Quick Start
+
+<Tabs>
+<TabItem value="gemini" label="Gemini API">
+
+```python
+from litellm import embedding
+import os
+
+os.environ["GEMINI_API_KEY"] = "your-api-key"
+
+# Text + Image (base64)
+response = embedding(
+    model="gemini/gemini-embedding-2-preview",
+    input=[
+        "The food was delicious and the waiter...",
+        "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAIAQMAAAD+wSzIAAAABlBMVEX///+/v7+jQ3Y5AAAADklEQVQI12P4AIX8EAgALgAD/aNpbtEAAAAASUVORK5CYII"
+    ],
+)
+print(response)
+```
+
+</TabItem>
+
+<TabItem value="vertex" label="Vertex AI">
+
+```python
+import litellm
+from litellm import embedding
+
+litellm.vertex_project = "your-project-id"
+litellm.vertex_location = "us-central1"
+
+# Text + Image (GCS URL)
+response = embedding(
+    model="vertex_ai/gemini-embedding-2-preview",
+    input=[
+        "Describe this image",
+        "gs://my-bucket/images/photo.png"
+    ],
+)
+print(response)
+```
+
+</TabItem>
+
+<TabItem value="proxy" label="LiteLLM Proxy">
+
+**1. Config (config.yaml)**
+
+```yaml
+model_list:
+  - model_name: gemini-embedding-2-preview
+    litellm_params:
+      model: gemini/gemini-embedding-2-preview
+      api_key: os.environ/GEMINI_API_KEY
+  - model_name: vertex-gemini-embedding-2-preview
+    litellm_params:
+      model: vertex_ai/gemini-embedding-2-preview
+      vertex_project: os.environ/VERTEXAI_PROJECT
+      vertex_location: os.environ/VERTEXAI_LOCATION
+
+general_settings:
+  master_key: sk-1234
+```
+
+**2. Start proxy**
+
+```bash
+litellm --config config.yaml
+```
+
+**3. Call embeddings**
+
+```bash
+curl -X POST http://localhost:4000/embeddings \
+  -H "Authorization: Bearer sk-1234" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "model": "gemini-embedding-2-preview",
+    "input": [
+      "The food was delicious and the waiter...",
+      "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAgAAAAIAQMAAAD+wSzIAAAABlBMVEX///+/v7+jQ3Y5AAAADklEQVQI12P4AIX8EAgALgAD/aNpbtEAAAAASUVORK5CYII"
+    ]
+  }'
+```
+
+</TabItem>
+</Tabs>
+
+## Input Format Examples
+
+| Format | Example | Provider |
+|--------|---------|----------|
+| **Data URI** | `data:image/png;base64,...` | Gemini, Vertex AI |
+| **GCS URL** | `gs://bucket/path/image.png` | Vertex AI |
+| **File reference** | `files/abc123` | Gemini API only |
+
+### Supported MIME Types for Data URIs
+
+- **Images:** `image/png`, `image/jpeg`
+- **Audio:** `audio/mpeg`, `audio/wav`
+- **Video:** `video/mp4`, `video/quicktime`
+- **Documents:** `application/pdf`
+
+### GCS URL MIME Inference
+
+For Vertex AI, MIME types are inferred from file extensions:
+
+- `.png` → `image/png`
+- `.jpg` / `.jpeg` → `image/jpeg`
+- `.mp3` → `audio/mpeg`
+- `.wav` → `audio/wav`
+- `.mp4` → `video/mp4`
+- `.mov` → `video/quicktime`
+- `.pdf` → `application/pdf`
+
+## Optional Parameters
+
+| Parameter | Description | Maps to |
+|-----------|-------------|---------|
+| `dimensions` | Output embedding size | `outputDimensionality` |
+
+```python
+response = embedding(
+    model="gemini/gemini-embedding-2-preview",
+    input=["text to embed"],
+    dimensions=768,  # Optional: control output vector size
+)
+```

docs/my-website/blog/gpt_5_3_codex/index.md

@@ -3,18 +3,9 @@ slug: gpt_5_3_codex
 title: "Day 0 Support: GPT-5.3-Codex"
 date: 2026-02-24T10:00:00
 authors:
-  - name: Sameer Kankute
-    title: SWE @ LiteLLM (LLM Translation)
-    url: https://www.linkedin.com/in/sameer-kankute/
-    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - sameer
+  - krrish
+  - ishaan-alt
 description: "Day 0 support for GPT-5.3-Codex on LiteLLM, including phase parameter handling for Responses API."
 tags: [openai, gpt-5.3-codex, codex, day 0 support]
 hide_table_of_contents: false
@@ -25,6 +16,8 @@ import TabItem from '@theme/TabItem';
 
 LiteLLM now supports GPT-5.3-Codex on Day 0, including support for the new assistant `phase` metadata on Responses API output items.
 
+{/* truncate */}
+
 ## Why `phase` matters for GPT-5.3-Codex
 
 `phase` appears on assistant output items and helps distinguish preamble/commentary turns from final closeout responses.

docs/my-website/blog/gpt_5_4/index.md

@@ -0,0 +1,90 @@
+---
+slug: gpt_5_4
+title: "Day 0 Support: GPT-5.4"
+date: 2026-03-05T10:00:00
+authors:
+  - sameer
+  - krrish
+  - ishaan-alt
+description: "GPT-5.4 model support in LiteLLM"
+tags: [openai, gpt-5.4, completion]
+hide_table_of_contents: false
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+LiteLLM now supports fully GPT-5.4!
+
+{/* truncate */}
+
+## Docker Image
+
+```bash
+docker pull ghcr.io/berriai/litellm:v1.81.14-stable.gpt-5.4_patch
+```
+
+## Usage
+
+<Tabs>
+<TabItem value="proxy" label="LiteLLM Proxy">
+
+**1. Setup config.yaml**
+
+```yaml
+model_list:
+  - model_name: gpt-5.4
+    litellm_params:
+      model: openai/gpt-5.4
+      api_key: os.environ/OPENAI_API_KEY
+```
+
+**2. Start the proxy**
+
+```bash
+docker run -d \
+  -p 4000:4000 \
+  -e OPENAI_API_KEY=$OPENAI_API_KEY \
+  -v $(pwd)/config.yaml:/app/config.yaml \
+  ghcr.io/berriai/litellm:v1.81.14-stable.gpt-5.4_patch \
+  --config /app/config.yaml
+```
+
+**3. Test it**
+
+```bash
+curl -X POST "http://0.0.0.0:4000/chat/completions" \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer $LITELLM_KEY" \
+  -d '{
+    "model": "gpt-5.4",
+    "messages": [
+      {"role": "user", "content": "Write a Python function to check if a number is prime."}
+    ]
+  }'
+```
+
+</TabItem>
+<TabItem value="sdk" label="LiteLLM SDK">
+
+```python
+from litellm import completion
+
+response = completion(
+    model="openai/gpt-5.4",
+    messages=[
+        {"role": "user", "content": "Write a Python function to check if a number is prime."}
+    ],
+)
+
+print(response.choices[0].message.content)
+```
+
+</TabItem>
+</Tabs>
+
+## Notes
+
+- Restart your container to get the cost tracking for this model.
+- Use `/responses` for better model performance.
+- GPT-5.4 supports reasoning, function calling, vision, and tool-use — see the [OpenAI provider docs](../../docs/providers/openai) for advanced usage.

docs/my-website/blog/gpt_5_4_mini_nano/index.md

@@ -0,0 +1,106 @@
+---
+slug: gpt_5_4_mini_nano
+title: "Day 0 Support: GPT-5.4-mini and GPT-5.4-nano"
+date: 2026-03-17T10:00:00
+authors:
+  - name: Sameer Kankute
+    title: SWE @ LiteLLM (LLM Translation)
+    url: https://www.linkedin.com/in/sameer-kankute/
+    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
+  - name: Krrish Dholakia
+    title: "CEO, LiteLLM"
+    url: https://www.linkedin.com/in/krish-d/
+    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
+  - name: Ishaan Jaff
+    title: "CTO, LiteLLM"
+    url: https://www.linkedin.com/in/reffajnaahsi/
+    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+description: "GPT-5.4-mini and GPT-5.4-nano model support in LiteLLM"
+tags: [openai, gpt-5.4-mini, gpt-5.4-nano, completion]
+hide_table_of_contents: false
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+LiteLLM now supports GPT-5.4-mini and GPT-5.4-nano — cost-effective models for simple completions and high-throughput workloads.
+
+:::note
+If you're on **v1.82.3-stable** or above, you don't need any update to use these models.
+:::
+
+## Usage
+
+<Tabs>
+<TabItem value="proxy" label="LiteLLM Proxy">
+
+**1. Setup config.yaml**
+
+```yaml
+model_list:
+  - model_name: gpt-5.4-mini
+    litellm_params:
+      model: openai/gpt-5.4-mini
+      api_key: os.environ/OPENAI_API_KEY
+  - model_name: gpt-5.4-nano
+    litellm_params:
+      model: openai/gpt-5.4-nano
+      api_key: os.environ/OPENAI_API_KEY
+```
+
+**2. Start the proxy**
+
+```bash
+litellm --config /path/to/config.yaml
+```
+
+**3. Test it**
+
+```bash
+# GPT-5.4-mini
+curl -X POST "http://localhost:4000/v1/chat/completions" \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer $LITELLM_KEY" \
+  -d '{
+    "model": "gpt-5.4-mini",
+    "messages": [{"role": "user", "content": "What is the capital of France?"}]
+  }'
+
+# GPT-5.4-nano
+curl -X POST "http://localhost:4000/v1/chat/completions" \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer $LITELLM_KEY" \
+  -d '{
+    "model": "gpt-5.4-nano",
+    "messages": [{"role": "user", "content": "What is 2 + 2?"}]
+  }'
+```
+
+</TabItem>
+<TabItem value="sdk" label="LiteLLM SDK">
+
+```python
+from litellm import completion
+
+# GPT-5.4-mini
+response = completion(
+    model="openai/gpt-5.4-mini",
+    messages=[{"role": "user", "content": "What is the capital of France?"}],
+)
+print(response.choices[0].message.content)
+
+# GPT-5.4-nano
+response = completion(
+    model="openai/gpt-5.4-nano",
+    messages=[{"role": "user", "content": "What is 2 + 2?"}],
+)
+print(response.choices[0].message.content)
+```
+
+</TabItem>
+</Tabs>
+
+## Notes
+
+- Both models support function calling, vision, and tool-use — see the [OpenAI provider docs](../../docs/providers/openai) for advanced usage.
+- GPT-5.4-nano is the most cost-effective option for simple tasks; GPT-5.4-mini offers a balance of speed and capability.

docs/my-website/blog/guardrail_logging_secret_exposure_incident/index.md

@@ -0,0 +1,78 @@
+---
+slug: guardrail-logging-secret-exposure-incident
+title: "Incident Report: Guardrail logging exposed secret headers in spend logs and traces"
+date: 2026-03-18T10:00:00
+authors:
+  - litellm
+tags: [incident-report, security, guardrails]
+hide_table_of_contents: false
+---
+
+**Date:** March 18, 2026
+**Duration:** Unknown
+**Severity:** High
+**Status:** Resolved
+
+## Summary
+
+When a custom guardrail returned the full LiteLLM request/data dictionary, the guardrail response logged by LiteLLM could include `secret_fields.raw_headers`, including plaintext `Authorization` headers containing API keys or other credentials.
+
+This information could then propagate to logging and observability surfaces that consume guardrail metadata, including:
+
+- **Spend logs in the LiteLLM UI:** visible to admins with access to spend-log data
+- **OpenTelemetry traces:** visible to anyone with access to the relevant telemetry backend
+
+LLM calls, proxy routing, and provider execution were not blocked by this bug. The impact was exposure of sensitive request headers in observability and logging paths.
+
+{/* truncate */}
+
+---
+
+## Background
+
+LiteLLM keeps internal request data (including request headers) for use during the call. That data is not meant to be written to logs or telemetry.
+
+When custom guardrails run, their outcomes are logged so they can appear in spend logs, OpenTelemetry traces, and other observability backends. If a guardrail returned the full request payload instead of a minimal result, that internal request data could be included in what was logged. Before the fix, the guardrail logging path did not strip that data before sending it to those systems.
+
+```mermaid
+flowchart TD
+    inboundRequest["1. Incoming proxy request"] --> storeSecrets["2. Store internal request data"]
+    storeSecrets --> guardrailRuns["3. Custom guardrail runs"]
+    guardrailRuns --> fullDataReturn["4. Guardrail returns full request payload"]
+    fullDataReturn --> loggingBuild["5. Build guardrail log payload"]
+    loggingBuild --> spendLogs["6a. Persist to spend logs / UI"]
+    loggingBuild --> otelTraces["6b. Attach to OTEL guardrail spans"]
+```
+
+---
+
+## Root Cause
+
+The root cause was incomplete sanitization in the guardrail logging path. When building the payload that gets sent to spend logs and traces, LiteLLM prepared guardrail responses for logging but did not strip internal request data (such as headers) from them. If a guardrail returned a response that included that data, it was passed through to the logging and observability systems unchanged.
+
+---
+
+## Impact
+
+This issue required all of the following:
+
+1. A custom guardrail returned the full LiteLLM request/data dictionary, or another response object containing `secret_fields`.
+2. LiteLLM logged that guardrail response through the standard guardrail logging path.
+3. An operator, admin, or telemetry consumer had access to the resulting logs or traces.
+
+When those conditions were met, sensitive values could become visible through:
+
+- **Spend logs / UI responses:** guardrail metadata could be included in spend-log payloads rendered in the admin UI.
+- **OpenTelemetry traces:** `guardrail_response` could be written as a span attribute on guardrail spans.
+- **Other downstream observability backends:** any integration consuming the same guardrail metadata could receive the leaked values.
+
+This was a logging and telemetry exposure bug. It did not let callers bypass auth, access other tenants directly, or change model behavior, but it could expose plaintext credentials to people with access to those observability systems.
+
+---
+
+## Guidance For Users
+
+- Upgrade to LiteLLM 1.82.3+.
+- If you operated custom guardrails that return the full request/data dict, review whether spend logs or telemetry traces were retained during the affected period.
+- Rotate any credentials that may have appeared in `Authorization` or other forwarded request headers in those systems.
+- Apply least-privilege access controls to spend-log views and telemetry backends that may contain request-derived metadata.

docs/my-website/blog/httpx_cache_eviction_incident/index.md

@@ -3,17 +3,9 @@ slug: httpx-cache-eviction-incident
 title: "Incident Report: Cache Eviction Closes In-Use httpx Clients"
 date: 2026-02-27T10:00:00
 authors:
-  - name: Ryan Crabbe
-    title: Performance Engineer, LiteLLM
-    url: https://www.linkedin.com/in/ryan-crabbe-0b9687214
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
+  - ryan
+  - ishaan-alt
+  - krrish
 tags: [incident-report, caching, stability]
 hide_table_of_contents: false
 ---
@@ -31,6 +23,8 @@ A change to improve Redis connection pool cleanup introduced a regression that c
 
 **Impact:** Any proxy instance that hit the cache TTL (default 10 minutes) or capacity limit (200 entries) would have its httpx clients closed out from under it, causing requests to LLM providers to fail with connection errors.
 
+{/* truncate */}
+
 ---
 
 ## Background

docs/my-website/blog/litellm_observatory/index.md

@@ -3,18 +3,9 @@ slug: litellm-observatory
 title: "Improve release stability with 24 hour load tests"
 date: 2026-02-06T10:00:00
 authors:
-  - name: Alexsander Hamir
-    title: "Performance Engineer, LiteLLM"
-    url: https://www.linkedin.com/in/alexsander-baptista/
-    image_url: https://github.com/AlexsanderHamir.png
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - alexsander
+  - krrish
+  - ishaan-alt
 description: "How we built a long-running, release-validation system to catch regressions before they reach users."
 tags: [testing, observability, reliability, releases]
 hide_table_of_contents: false
@@ -28,6 +19,8 @@ As LiteLLM adoption has grown, so have expectations around reliability, performa
 
 This post introduces **LiteLLM Observatory**, a long-running release-validation system we built to catch regressions before they reach users.
 
+{/* truncate */}
+
 ---
 
 ## Why We Built the Observatory
@@ -133,4 +126,3 @@ Reliability is an ongoing investment.
 LiteLLM Observatory is one of several systems we’re building to continuously raise the bar on release quality and operational safety. As LiteLLM evolves, so will our validation tooling, informed by real-world usage and lessons learned.
 
 We’ll continue to share those improvements openly as we go.
-

docs/my-website/blog/minimax_m2_5/index.md

@@ -3,18 +3,9 @@ slug: minimax_m2_5
 title: "Day 0 Support: MiniMax-M2.5"
 date: 2026-02-12T10:00:00
 authors:
-  - name: Sameer Kankute
-    title: SWE @ LiteLLM (LLM Translation)
-    url: https://www.linkedin.com/in/sameer-kankute/
-    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - sameer
+  - krrish
+  - ishaan-alt
 description: "Day 0 support for MiniMax-M2.5 on LiteLLM"
 tags: [minimax, M2.5, llm]
 hide_table_of_contents: false
@@ -25,6 +16,8 @@ import TabItem from '@theme/TabItem';
 
 LiteLLM now supports MiniMax-M2.5 on Day 0. Use it across OpenAI-compatible and Anthropic-compatible APIs through the LiteLLM AI Gateway.
 
+{/* truncate */}
+
 ## Supported Models
 
 LiteLLM supports the following MiniMax models:

docs/my-website/blog/model_cost_map_incident/index.md

@@ -3,10 +3,7 @@ slug: model-cost-map-incident
 title: "Incident Report: Invalid model cost map on main"
 date: 2026-02-10T10:00:00
 authors:
-  - name: Ishaan Jaffer
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/ishaanjaffer/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - ishaan
 tags: [incident-report, stability]
 hide_table_of_contents: false
 ---

docs/my-website/blog/realtime_webrtc_http_endpoints/index.md

@@ -0,0 +1,111 @@
+---
+slug: realtime_webrtc_http_endpoints
+title: "Realtime WebRTC HTTP Endpoints"
+date: 2026-03-12T10:00:00
+authors:
+  - sameer
+  - krrish
+  - ishaan-alt
+description: "Use the LiteLLM proxy to route OpenAI-style WebRTC realtime via HTTP: client_secrets and SDP exchange."
+tags: [realtime, webrtc, proxy, openai]
+hide_table_of_contents: false
+---
+
+import WebRTCTester from '@site/src/components/WebRTCTester';
+
+Connect to the Realtime API via WebRTC from browser/mobile clients. LiteLLM handles auth and key management.
+
+{/* truncate */}
+
+## How it works
+
+![WebRTC flow: Browser, LiteLLM Proxy, and OpenAI/Azure](../../img/webrtc_flow.png)
+
+**Flow of generating ephemeral token**
+
+![Ephemeral token flow: Browser requests token, LiteLLM gets real token from OpenAI, returns encrypted token](../../img/ephemeral_token.png)
+
+
+## Proxy Setup
+
+```yaml
+model_list:
+  - model_name: gpt-4o-realtime
+    litellm_params:
+      model: openai/gpt-4o-realtime-preview-2024-12-17
+      api_key: os.environ/OPENAI_API_KEY
+    model_info:
+      mode: realtime
+```
+
+**Azure:** use `model: azure/gpt-4o-realtime-preview`, `api_key`, `api_base`.
+
+```bash
+litellm --config /path/to/config.yaml
+```
+
+## Try it live
+
+<WebRTCTester />
+
+## Client Usage
+
+**1. Get token** - `POST /v1/realtime/client_secrets` with LiteLLM API key and `{ model }`.
+
+**2. WebRTC handshake** - Create `RTCPeerConnection`, add mic track, create data channel `oai-events`, send SDP offer to `POST /v1/realtime/calls` with `Authorization: Bearer <encrypted_token>` and `Content-Type: application/sdp`.
+
+**3. Events** - Use the data channel for `session.update` and other events.
+
+<details>
+<summary>Full code example</summary>
+
+```javascript
+// 1. Token
+const r = await fetch("http://proxy:4000/v1/realtime/client_secrets", {
+  method: "POST",
+  headers: { "Authorization": "Bearer sk-litellm-key", "Content-Type": "application/json" },
+  body: JSON.stringify({ model: "gpt-4o-realtime" }),
+});
+const { client_secret } = await r.json();
+const token = client_secret.value;
+
+// 2. WebRTC
+const pc = new RTCPeerConnection();
+const audio = document.createElement("audio");
+audio.autoplay = true;
+pc.ontrack = (e) => (audio.srcObject = e.streams[0]);
+const ms = await navigator.mediaDevices.getUserMedia({ audio: true });
+pc.addTrack(ms.getTracks()[0]);
+const dc = pc.createDataChannel("oai-events");
+const offer = await pc.createOffer();
+await pc.setLocalDescription(offer);
+
+const sdpRes = await fetch("http://proxy:4000/v1/realtime/calls", {
+  method: "POST",
+  headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/sdp" },
+  body: offer.sdp,
+});
+await pc.setRemoteDescription({ type: "answer", sdp: await sdpRes.text() });
+
+// 3. Events
+dc.send(JSON.stringify({ type: "session.update", session: { instructions: "..." } }));
+```
+
+</details>
+
+## FAQ
+
+**Q: What do I do if I get a 401 Token expired error?**  
+A: Tokens are short-lived. Get a fresh token right before creating the WebRTC offer.
+
+**Q: Which key should I use for `/v1/realtime/calls`?**  
+A: Use the **encrypted token** from `client_secrets`, not your raw API key.
+
+**Q: Should I pass the `model` parameter when making the call?**  
+A: No, the encrypted token already encodes all routing information including model.
+
+**Q: How do I resolve Azure `api-version` errors?**  
+A: Set the correct `api_version` in `litellm_params` (or via the `AZURE_API_VERSION` environment variable), along with the right `api_base` and deployment values.
+
+**Q: What if I get no audio?**  
+A: Make sure you grant microphone permission, ensure `pc.ontrack` assigns the audio element with `autoplay` enabled, check your network/firewall for WebRTC traffic, and inspect the browser console for ICE or SDP errors.

docs/my-website/blog/responses_api_encrypted_content_incident/index.md

@@ -3,18 +3,9 @@ slug: responses-api-encrypted-content-incident
 title: "Incident Report: Encrypted Content Failures in Multi-Region Responses API Load Balancing"
 date: 2026-02-24T10:00:00
 authors:
-  - name: Sameer Kankute
-    title: SWE @ LiteLLM (LLM Translation)
-    url: https://www.linkedin.com/in/sameer-kankute/
-    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - sameer
+  - krrish
+  - ishaan-alt
 tags: [incident-report, proxy, responses-api, load-balancing]
 hide_table_of_contents: false
 ---

docs/my-website/blog/security_update_march_2026/index.md

@@ -0,0 +1,782 @@
+---
+slug: security-update-march-2026
+title: "Security Update: Suspected Supply Chain Incident"
+date: 2026-03-24T14:00:00
+authors:
+  - krrish
+  - ishaan-alt
+description: "As of 2:00 PM ET on March 24, 2026"
+tags: [security, incident-report]
+hide_table_of_contents: false
+---
+
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+import VersionVerificationTable from '@site/src/components/VersionVerificationTable';
+
+> **Status:** Active investigation
+> **Last updated:** March 27, 2026
+
+> **Update (March 27):** Added [Verified safe versions](#verified-safe-versions) section with SHA-256 checksums for all audited PyPI and Docker releases.
+
+> **Update (March 26):** Added `checkmarx[.]zone` to [Indicators of compromise](#indicators-of-compromise-iocs)
+
+> **Update (March 25):** Added community-contributed scripts for scanning GitHub Actions and GitLab CI pipelines for the compromised versions. See [How to check if you are affected](#how-to-check-if-you-are-affected). s/o [@Zach Fury](https://www.linkedin.com/in/fryware/) for these scripts.
+
+
+## TLDR; 
+- The compromised PyPI packages were **litellm==1.82.7** and **litellm==1.82.8**. Those packages have now been removed from PyPI.
+- We believe that the compromise originated from the Trivy dependency used in our CI/CD security scanning workflow.
+- Customers running the official LiteLLM Proxy Docker image were not impacted. That deployment path pins dependencies in requirements.txt and does not rely on the compromised PyPI packages.
+- We are pausing new LiteLLM releases until we complete a broader supply-chain review and confirm the release path is safe.
+
+
+## Overview
+
+LiteLLM AI Gateway is investigating a suspected supply chain attack involving unauthorized PyPI package publishes. Current evidence suggests a maintainer's PyPI account may have been compromised and used to distribute malicious code.
+
+At this time, we believe this incident may be linked to the broader [Trivy security compromise](https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/), in which stolen credentials were reportedly used to gain unauthorized access to the LiteLLM publishing pipeline.
+
+This investigation is ongoing. Details below may change as we confirm additional findings.
+
+## Confirmed affected versions
+
+The following LiteLLM versions published to PyPI were impacted:
+
+- **v1.82.7**: contained a malicious payload in the LiteLLM AI Gateway `proxy_server.py`
+- **v1.82.8**: contained `litellm_init.pth` and a malicious payload in the LiteLLM AI Gateway `proxy_server.py`
+
+If you installed or ran either of these versions, review the recommendations below immediately.
+
+Note: These versions have already been removed from PyPI.
+
+## What happened
+
+Initial evidence suggests the attacker bypassed official CI/CD workflows and uploaded malicious packages directly to PyPI.
+
+These compromised versions appear to have included a credential stealer designed to:
+
+- Harvest secrets by scanning for:
+  - environment variables
+  - SSH keys
+  - cloud provider credentials (AWS, GCP, Azure)
+  - Kubernetes tokens
+  - database passwords
+- Encrypt and exfiltrate data via a `POST` request to `models.litellm.cloud`, which is **not** an official BerriAI / LiteLLM domain
+
+## Who is affected
+
+You may be affected if **any** of the following are true:
+
+- You installed or upgraded LiteLLM via `pip` on **March 24, 2026**, between **10:39 UTC and 16:00 UTC**
+- You ran `pip install litellm` without pinning a version and received **v1.82.7** or **v1.82.8**
+- You built a Docker image during this window that included `pip install litellm` without a pinned version
+- A dependency in your project pulled in LiteLLM as a transitive, unpinned dependency
+  (for example through AI agent frameworks, MCP servers, or LLM orchestration tools)
+
+You are **not** affected if any of the following are true:
+
+**LiteLLM AI Gateway/Proxy users:** Customers running the official LiteLLM Proxy Docker image were not impacted. That deployment path pins dependencies in requirements.txt and does not rely on the compromised PyPI packages.
+
+- You are using **LiteLLM Cloud**
+- You are using the official LiteLLM AI Gateway Docker image: `ghcr.io/berriai/litellm`
+- You are on **v1.82.6 or earlier** and did not upgrade during the affected window
+- You installed LiteLLM from source via the GitHub repository, which was **not** compromised
+
+
+### How to check if you are affected
+
+<Tabs>
+<TabItem value="sdk" label="SDK">
+
+```bash
+pip show litellm
+```
+</TabItem>
+<TabItem value="proxy" label="PROXY">
+
+Go to the proxy base url, and check the version of the installed LiteLLM.
+
+![Proxy version check](../../img/security_update_march_2026/proxy_version.png)
+</TabItem>
+<TabItem value="github" label="GitHub Actions">
+
+Scans all repositories in a GitHub organization for workflow jobs that installed the compromised versions.
+
+**Requirements:** Python 3 and `requests` (`pip install requests`).
+
+**Setup:**
+
+```bash
+export GITHUB_TOKEN="your-github-pat"
+```
+
+**Run:**
+
+```bash
+python find_litellm_github.py
+```
+
+Set the `ORG` variable in the script to your GitHub organization name.
+
+Both scripts default to scanning jobs from **today**. Adjust the `WINDOW_START` and `WINDOW_END` constants to cover **March 24, 2026** (the incident date) if running on a different day.
+
+<details>
+<summary>View full script (find_litellm_github.py)</summary>
+
+```python
+#!/usr/bin/env python3
+"""
+Scan all GitHub Actions jobs in a GitHub org that ran between
+0800-1244 UTC today and identify any that installed litellm 1.82.7 or 1.82.8.
+
+Adjust WINDOW_START / WINDOW_END to cover March 24, 2026 if running later.
+"""
+
+import io
+import os
+import re
+import sys
+import zipfile
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from datetime import datetime, timezone
+
+import requests
+
+GITHUB_URL   = "https://api.github.com"
+ORG          = "your-org"  # <-- set to your GitHub organization
+TOKEN        = os.environ.get("GITHUB_TOKEN", "")
+
+TODAY        = datetime.now(timezone.utc).date()
+WINDOW_START = datetime(TODAY.year, TODAY.month, TODAY.day,  8,  0, 0, tzinfo=timezone.utc)
+WINDOW_END   = datetime(TODAY.year, TODAY.month, TODAY.day, 12, 44, 0, tzinfo=timezone.utc)
+
+TARGET_VERSIONS = {"1.82.7", "1.82.8"}
+VERSION_PATTERN = re.compile(r"litellm[=\-](\d+\.\d+\.\d+)", re.IGNORECASE)
+
+SESSION = requests.Session()
+SESSION.headers.update({
+    "Authorization": f"Bearer {TOKEN}",
+    "Accept": "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+})
+
+
+def get_paginated(url, params=None):
+    params = dict(params or {})
+    params.setdefault("per_page", 100)
+    page = 1
+    while True:
+        params["page"] = page
+        resp = SESSION.get(url, params=params, timeout=30)
+        if resp.status_code == 404:
+            return
+        resp.raise_for_status()
+        data = resp.json()
+        if isinstance(data, dict):
+            items = next((v for v in data.values() if isinstance(v, list)), [])
+        else:
+            items = data
+        if not items:
+            break
+        yield from items
+        if len(items) < params["per_page"]:
+            break
+        page += 1
+
+
+def parse_ts(ts_str):
+    if not ts_str:
+        return None
+    return datetime.fromisoformat(ts_str.replace("Z", "+00:00"))
+
+
+def get_repos():
+    repos = []
+    for r in get_paginated(f"{GITHUB_URL}/orgs/{ORG}/repos", {"type": "all"}):
+        repos.append({"id": r["id"], "name": r["name"], "full_name": r["full_name"]})
+    return repos
+
+
+def get_runs_in_window(repo_full_name):
+    created_filter = (
+        f"{WINDOW_START.strftime('%Y-%m-%dT%H:%M:%SZ')}"
+        f"..{WINDOW_END.strftime('%Y-%m-%dT%H:%M:%SZ')}"
+    )
+    url = f"{GITHUB_URL}/repos/{repo_full_name}/actions/runs"
+    runs = []
+    for run in get_paginated(url, {"created": created_filter, "per_page": 100}):
+        ts = parse_ts(run.get("run_started_at") or run.get("created_at"))
+        if ts and WINDOW_START <= ts <= WINDOW_END:
+            runs.append(run)
+    return runs
+
+
+def get_jobs_for_run(repo_full_name, run_id):
+    url = f"{GITHUB_URL}/repos/{repo_full_name}/actions/runs/{run_id}/jobs"
+    jobs = []
+    for job in get_paginated(url, {"filter": "all"}):
+        ts = parse_ts(job.get("started_at"))
+        if ts and WINDOW_START <= ts <= WINDOW_END:
+            jobs.append(job)
+    return jobs
+
+
+def fetch_job_log(repo_full_name, job_id):
+    url = f"{GITHUB_URL}/repos/{repo_full_name}/actions/jobs/{job_id}/logs"
+    resp = SESSION.get(url, timeout=60, allow_redirects=True)
+    if resp.status_code in (403, 404, 410):
+        return ""
+    resp.raise_for_status()
+
+    content_type = resp.headers.get("Content-Type", "")
+    if "zip" in content_type or resp.content[:2] == b"PK":
+        try:
+            with zipfile.ZipFile(io.BytesIO(resp.content)) as zf:
+                parts = []
+                for name in sorted(zf.namelist()):
+                    with zf.open(name) as f:
+                        parts.append(f.read().decode("utf-8", errors="replace"))
+                return "\n".join(parts)
+        except zipfile.BadZipFile:
+            pass
+    return resp.text
+
+
+def check_job(repo_full_name, job):
+    job_id   = job["id"]
+    job_name = job["name"]
+    run_id   = job["run_id"]
+    started  = job.get("started_at", "")
+
+    log_text = fetch_job_log(repo_full_name, job_id)
+    if not log_text:
+        return None
+
+    found_versions = set()
+    context_lines  = []
+    for line in log_text.splitlines():
+        m = VERSION_PATTERN.search(line)
+        if m:
+            ver = m.group(1)
+            if ver in TARGET_VERSIONS:
+                found_versions.add(ver)
+                context_lines.append(line.strip())
+
+    if not found_versions:
+        return None
+
+    return {
+        "repo":       repo_full_name,
+        "run_id":     run_id,
+        "job_id":     job_id,
+        "job_name":   job_name,
+        "started_at": started,
+        "versions":   sorted(found_versions),
+        "context":    context_lines[:10],
+        "job_url":    job.get("html_url", f"https://github.com/{repo_full_name}/actions/runs/{run_id}"),
+    }
+
+
+def main():
+    if not TOKEN:
+        print("ERROR: Set GITHUB_TOKEN environment variable.", file=sys.stderr)
+        sys.exit(1)
+
+    print(f"Time window : {WINDOW_START.isoformat()} -> {WINDOW_END.isoformat()}")
+    print(f"Hunting for : litellm {', '.join(sorted(TARGET_VERSIONS))}")
+    print()
+
+    print(f"Fetching repositories for org '{ORG}'...")
+    repos = get_repos()
+    print(f"  Found {len(repos)} repositories")
+    print()
+
+    jobs_to_check = []
+
+    print("Scanning workflow runs for time window...")
+    for repo in repos:
+        full_name = repo["full_name"]
+        try:
+            runs = get_runs_in_window(full_name)
+        except requests.HTTPError as e:
+            print(f"  WARN: {full_name} - {e}", file=sys.stderr)
+            continue
+        if not runs:
+            continue
+        print(f"  {full_name}: {len(runs)} run(s) in window")
+        for run in runs:
+            try:
+                jobs = get_jobs_for_run(full_name, run["id"])
+            except requests.HTTPError as e:
+                print(f"    WARN: run {run['id']} - {e}", file=sys.stderr)
+                continue
+            for job in jobs:
+                jobs_to_check.append((full_name, job))
+
+    total = len(jobs_to_check)
+    print(f"\nFetching logs for {total} job(s)...")
+    print()
+
+    hits = []
+    with ThreadPoolExecutor(max_workers=8) as pool:
+        futures = {
+            pool.submit(check_job, full_name, job): (full_name, job["id"])
+            for full_name, job in jobs_to_check
+        }
+        done = 0
+        for future in as_completed(futures):
+            done += 1
+            full_name, jid = futures[future]
+            try:
+                result = future.result()
+            except Exception as e:
+                print(f"  ERROR {full_name} job {jid}: {e}", file=sys.stderr)
+                continue
+            if result:
+                hits.append(result)
+            print(
+                f"  [{done}/{total}] {full_name} job {jid}" +
+                (f"  *** HIT: litellm {result['versions']} ***" if result else ""),
+                flush=True,
+            )
+
+    print()
+    print("=" * 72)
+    print(f"RESULTS: {len(hits)} job(s) installed litellm {' or '.join(sorted(TARGET_VERSIONS))}")
+    print("=" * 72)
+
+    if not hits:
+        print("No matches found.")
+        return
+
+    for h in sorted(hits, key=lambda x: x["started_at"]):
+        print()
+        print(f"  Repo      : {h['repo']}")
+        print(f"  Job       : {h['job_name']} (#{h['job_id']})")
+        print(f"  Run ID    : {h['run_id']}")
+        print(f"  Started   : {h['started_at']}")
+        print(f"  Versions  : litellm {', '.join(h['versions'])}")
+        print(f"  URL       : {h['job_url']}")
+        print(f"  Log lines :")
+        for line in h["context"]:
+            print(f"    {line}")
+
+
+if __name__ == "__main__":
+    main()
+```
+
+</details>
+
+</TabItem>
+<TabItem value="gitlab" label="GitLab CI">
+
+Scans all projects in a GitLab group (including subgroups) for CI/CD jobs that installed the compromised versions.
+
+**Requirements:** Python 3 and `requests` (`pip install requests`).
+
+**Setup:**
+
+```bash
+export GITLAB_TOKEN="your-gitlab-pat"
+```
+
+**Run:**
+
+```bash
+python find_litellm_jobs.py
+```
+
+Set the `GROUP_NAME` variable in the script to your GitLab group name.
+
+Both scripts default to scanning jobs from **today**. Adjust the `WINDOW_START` and `WINDOW_END` constants to cover **March 24, 2026** (the incident date) if running on a different day.
+
+<details>
+<summary>View full script (find_litellm_jobs.py)</summary>
+
+```python
+#!/usr/bin/env python3
+"""
+Scan all GitLab CI/CD jobs in a GitLab group that ran between
+0800-1244 UTC today and identify any that installed litellm 1.82.7 or 1.82.8.
+
+Adjust WINDOW_START / WINDOW_END to cover March 24, 2026 if running later.
+"""
+
+import os
+import re
+import sys
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from datetime import datetime, timezone
+
+import requests
+
+GITLAB_URL = "https://gitlab.com"
+GROUP_NAME = "YourGroup"  # <-- set to your GitLab group name
+TOKEN = os.environ.get("GITLAB_TOKEN", "")
+
+TODAY = datetime.now(timezone.utc).date()
+WINDOW_START = datetime(TODAY.year, TODAY.month, TODAY.day, 8, 0, 0, tzinfo=timezone.utc)
+WINDOW_END   = datetime(TODAY.year, TODAY.month, TODAY.day, 12, 44, 0, tzinfo=timezone.utc)
+
+TARGET_VERSIONS = {"1.82.7", "1.82.8"}
+VERSION_PATTERN = re.compile(r"litellm[=\-](\d+\.\d+\.\d+)", re.IGNORECASE)
+
+HEADERS = {"PRIVATE-TOKEN": TOKEN}
+SESSION = requests.Session()
+SESSION.headers.update(HEADERS)
+
+
+def get_paginated(url, params=None):
+    params = dict(params or {})
+    params.setdefault("per_page", 100)
+    page = 1
+    while True:
+        params["page"] = page
+        resp = SESSION.get(url, params=params, timeout=30)
+        resp.raise_for_status()
+        data = resp.json()
+        if not data:
+            break
+        yield from data
+        if len(data) < params["per_page"]:
+            break
+        page += 1
+
+
+def get_group_id(group_name):
+    resp = SESSION.get(f"{GITLAB_URL}/api/v4/groups/{group_name}", timeout=30)
+    resp.raise_for_status()
+    return resp.json()["id"]
+
+
+def get_all_projects(group_id):
+    projects = []
+    for p in get_paginated(
+        f"{GITLAB_URL}/api/v4/groups/{group_id}/projects",
+        {"include_subgroups": "true", "archived": "false"},
+    ):
+        projects.append({"id": p["id"], "name": p["path_with_namespace"]})
+    return projects
+
+
+def parse_ts(ts_str):
+    if not ts_str:
+        return None
+    ts_str = ts_str.replace("Z", "+00:00")
+    return datetime.fromisoformat(ts_str)
+
+
+def jobs_in_window(project_id):
+    matching = []
+    url = f"{GITLAB_URL}/api/v4/projects/{project_id}/jobs"
+    params = {"per_page": 100, "scope[]": ["success", "failed", "canceled", "running"]}
+
+    page = 1
+    while True:
+        params["page"] = page
+        resp = SESSION.get(url, params=params, timeout=30)
+        if resp.status_code == 403:
+            return matching
+        resp.raise_for_status()
+        jobs = resp.json()
+        if not jobs:
+            break
+
+        stop_early = False
+        for job in jobs:
+            ts = parse_ts(job.get("started_at") or job.get("created_at"))
+            if ts is None:
+                continue
+            if ts > WINDOW_END:
+                continue
+            if ts < WINDOW_START:
+                stop_early = True
+                continue
+            matching.append(job)
+
+        if stop_early or len(jobs) < 100:
+            break
+        page += 1
+
+    return matching
+
+
+def fetch_trace(project_id, job_id):
+    url = f"{GITLAB_URL}/api/v4/projects/{project_id}/jobs/{job_id}/trace"
+    resp = SESSION.get(url, timeout=60)
+    if resp.status_code in (403, 404):
+        return ""
+    resp.raise_for_status()
+    return resp.text
+
+
+def check_job(project_name, project_id, job):
+    job_id   = job["id"]
+    job_name = job["name"]
+    ref      = job.get("ref", "")
+    started  = job.get("started_at", job.get("created_at", ""))
+
+    trace = fetch_trace(project_id, job_id)
+    if not trace:
+        return None
+
+    found_versions = set()
+    for match in VERSION_PATTERN.finditer(trace):
+        ver = match.group(1)
+        if ver in TARGET_VERSIONS:
+            found_versions.add(ver)
+
+    if not found_versions:
+        return None
+
+    context_lines = []
+    for line in trace.splitlines():
+        if VERSION_PATTERN.search(line):
+            ver_match = VERSION_PATTERN.search(line)
+            if ver_match and ver_match.group(1) in TARGET_VERSIONS:
+                context_lines.append(line.strip())
+
+    return {
+        "project":    project_name,
+        "project_id": project_id,
+        "job_id":     job_id,
+        "job_name":   job_name,
+        "ref":        ref,
+        "started_at": started,
+        "versions":   sorted(found_versions),
+        "context":    context_lines[:10],
+        "job_url":    f"{GITLAB_URL}/{project_name}/-/jobs/{job_id}",
+    }
+
+
+def main():
+    if not TOKEN:
+        print("ERROR: Set GITLAB_TOKEN environment variable.", file=sys.stderr)
+        sys.exit(1)
+
+    print(f"Time window : {WINDOW_START.isoformat()} -> {WINDOW_END.isoformat()}")
+    print(f"Hunting for : litellm {', '.join(sorted(TARGET_VERSIONS))}")
+    print()
+
+    print(f"Resolving group '{GROUP_NAME}'...")
+    group_id = get_group_id(GROUP_NAME)
+
+    print("Fetching projects...")
+    projects = get_all_projects(group_id)
+    print(f"  Found {len(projects)} projects")
+    print()
+
+    all_jobs_to_check = []
+
+    print("Scanning job listings for time window...")
+    for proj in projects:
+        try:
+            jobs = jobs_in_window(proj["id"])
+        except requests.HTTPError as e:
+            print(f"  WARN: {proj['name']} - {e}", file=sys.stderr)
+            continue
+        if jobs:
+            print(f"  {proj['name']}: {len(jobs)} job(s) in window")
+        for j in jobs:
+            all_jobs_to_check.append((proj["name"], proj["id"], j))
+
+    total = len(all_jobs_to_check)
+    print(f"\nFetching traces for {total} job(s)...")
+    print()
+
+    hits = []
+    with ThreadPoolExecutor(max_workers=10) as pool:
+        futures = {
+            pool.submit(check_job, pname, pid, job): (pname, job["id"])
+            for pname, pid, job in all_jobs_to_check
+        }
+        done = 0
+        for future in as_completed(futures):
+            done += 1
+            pname, jid = futures[future]
+            try:
+                result = future.result()
+            except Exception as e:
+                print(f"  ERROR checking {pname} job {jid}: {e}", file=sys.stderr)
+                continue
+            if result:
+                hits.append(result)
+            print(f"  [{done}/{total}] checked {pname} job {jid}" +
+                  (f"  *** HIT: litellm {result['versions']} ***" if result else ""),
+                  flush=True)
+
+    print()
+    print("=" * 72)
+    print(f"RESULTS: {len(hits)} job(s) installed litellm {' or '.join(sorted(TARGET_VERSIONS))}")
+    print("=" * 72)
+
+    if not hits:
+        print("No matches found.")
+        return
+
+    for h in sorted(hits, key=lambda x: x["started_at"]):
+        print()
+        print(f"  Project   : {h['project']}")
+        print(f"  Job       : {h['job_name']} (#{h['job_id']})")
+        print(f"  Branch/tag: {h['ref']}")
+        print(f"  Started   : {h['started_at']}")
+        print(f"  Versions  : litellm {', '.join(h['versions'])}")
+        print(f"  URL       : {h['job_url']}")
+        print(f"  Log lines :")
+        for line in h["context"]:
+            print(f"    {line}")
+
+
+if __name__ == "__main__":
+    main()
+```
+
+</details>
+
+</TabItem>
+</Tabs>
+
+*CI/CD scripts contributed by the community ([original gist](https://gist.github.com/fryz/93ec8d4898ffe5b5ac5706a208823ef3)). Review before running.*
+
+
+## Indicators of compromise (IoCs)
+
+Review affected systems for the following indicators:
+
+- `litellm_init.pth` present in your `site-packages`
+- Outbound traffic or requests to `models.litellm[.]cloud`
+  This domain is **not** affiliated with LiteLLM
+- Outbound traffic or requests to `checkmarx[.]zone`
+  This domain is **not** affiliated with LiteLLM
+
+
+## Immediate actions for affected users
+
+If you installed or ran **v1.82.7** or **v1.82.8**, take the following actions immediately.
+
+### 1. Rotate all secrets
+
+Treat any credentials present on the affected systems as compromised, including:
+
+- API keys
+- Cloud access keys
+- Database passwords
+- SSH keys
+- Kubernetes tokens
+- Any secrets stored in environment variables or configuration files
+
+### 2. Inspect your filesystem
+
+Check your `site-packages` directory for a file named `litellm_init.pth`:
+
+```bash
+find /usr/lib/python3.13/site-packages/ -name "litellm_init.pth"
+```
+
+If present:
+
+- remove it immediately
+- investigate the host for further compromise
+- preserve relevant artifacts if your security team is performing forensics
+
+### 3. Audit version history
+
+Review your:
+
+- Local environments
+- CI/CD pipelines
+- Docker builds
+- Deployment logs
+
+Confirm whether **v1.82.7** or **v1.82.8** was installed anywhere.
+
+Pin LiteLLM to a known safe version such as **v1.82.6 or earlier**, or to a later verified release once announced.
+
+
+## Response and remediation
+
+The LiteLLM AI Gateway team has already taken the following steps:
+
+- Removed compromised packages from PyPI
+- Rotated maintainer credentials and established new authorized maintainers
+- Engaged Google's Mandiant security team to assist with forensic analysis of the build and publishing chain
+
+
+## Verified safe versions
+
+We have audited every LiteLLM release published between v1.78.0 and v1.82.6 across both PyPI and Docker. Each artifact was verified by:
+
+1. Downloading the published artifact and computing its SHA-256 digest
+2. Scanning for the known [indicators of compromise](#indicators-of-compromise-iocs) (IOCs)
+3. Comparing the artifact contents against the corresponding Git commit in the BerriAI/litellm repository
+
+**All versions listed below are confirmed clean.**
+
+<Tabs>
+<TabItem value="pypi" label="PyPI Releases">
+
+<VersionVerificationTable entries={[
+  { version: "1.82.6", sha256: "164a3ef3e19f309e3cabc199bef3d2045212712fefdfa25fc7f75884a5b5b205", gitCommit: "38d477507dad" },
+  { version: "1.82.5", sha256: "e1012ab816352215c4e00776dd48b0c68058b537888a8ff82cca62af19e6fb11", gitCommit: "1998c4f3703f" },
+  { version: "1.82.4", sha256: "d37c34a847e7952a146ed0e2888a24d3edec7787955c6826337395e755ad5c4b", gitCommit: "cfeafbe38811" },
+  { version: "1.82.3", sha256: "609901f6c5a5cf8c24386e4e3f50738bb8a9db719709fd76b208c8ee6d00f7a7", gitCommit: "61409275c8d8" },
+  { version: "1.82.2", sha256: "641ed024774fa3d5b4dd9347f0efb1e31fa422fba2a6500aabedee085d1194cb", gitCommit: "f351bbdb3683" },
+  { version: "1.82.1", sha256: "a9ec3fe42eccb1611883caaf8b1bf33c9f4e12163f94c7d1004095b14c379eb2", gitCommit: "94b002066e3a" },
+  { version: "1.82.0", sha256: "5496b5d4532cccdc7a095c21cbac4042f7662021c57bc1d17be4e39838929e80", gitCommit: "6c6585af568e" },
+  { version: "1.81.16", sha256: "d6bcc13acbd26719e07bfa6b9923740e88409cbf1f9d626d85fc9ae0e0eec88c", gitCommit: "678200ee4887" },
+  { version: "1.81.15", sha256: "2fa253658702509ce09fe0e172e5a47baaadf697fb0f784c7fd4ff665ae76ae1", gitCommit: "2e819656cee9" },
+  { version: "1.81.14", sha256: "6394e61bbdef7121e5e3800349f6b01e9369e7cf611e034f1832750c481abfed", gitCommit: "96bcee0b0af7" },
+  { version: "1.81.13", sha256: "ae4aea2a55e85993f5f6dd36d036519422d24812a1a3e8540d9e987f2d7a4304", gitCommit: "cc957a19a560" },
+  { version: "1.81.12", sha256: "219cf9729e5ea30c6d3f75aa43fef3c56a717369939a6d717cbad0fd78e3c146", gitCommit: "ba0d541b1982" },
+  { version: "1.81.11", sha256: "06a66c24742e082ddd2813c87f40f5c12fe7baa73ce1f9457eaf453dc44a0f65", gitCommit: "231aedeeff7e" },
+  { version: "1.81.10", sha256: "9efa1cbe61ac051f6500c267b173d988ff2d511c2eecf1c8f2ee546c0870747c", gitCommit: "7488abece8e7" },
+  { version: "1.81.9", sha256: "24ee273bc8a62299fbb754035f83fb7d8d44329c383701a2bd034f4fd1c19084", gitCommit: "a09d3e9162eb" },
+  { version: "1.81.8", sha256: "78cca92f36bc6c267c191d1fe1e2630c812bff6daec32c58cade75748c2692f6", gitCommit: "4fea649f519b" },
+  { version: "1.81.7", sha256: "58466c88c3289c6a3830d88768cf8f307581d9e6c87861de874d1128bb2de90d", gitCommit: "3f6a281d0f7a" },
+  { version: "1.81.6", sha256: "573206ba194d49a1691370ba33f781671609ac77c35347f8a0411d852cf6341a", gitCommit: "8da3a93e6e63" },
+  { version: "1.81.5", sha256: "206505c5a0c6503e465154b9c979772be3ede3f5bf746d15b37dca5ae54d239f", gitCommit: "2cc3778761d4" },
+  { version: "1.81.3", sha256: "3f60fd8b727587952ad3dd18b68f5fed538d6f43d15bb0356f4c3a11bccb2b92", gitCommit: "f30742fe6e8e" },
+]} />
+
+</TabItem>
+<TabItem value="docker" label="Docker Images">
+
+<VersionVerificationTable entries={[
+  { version: "1.82.3", sha256: "0a571da849db5f9c3cf3fead2ffbf1df982eebff7e7b38b46dbec3f640dafdbb", gitCommit: "61409275c8d8" },
+  { version: "1.82.3-stable", sha256: "0c2b2a0ad3e50af1702fc493ecd07f22a5180b6d1cfb169440b429b40e340e29", gitCommit: "61409275c8d8" },
+  { version: "1.82.0-stable", sha256: "71bf7283767ca436edcfa9f1f26c1743487b5fa29736c61c3eb6977776007c42", gitCommit: "97947c254252" },
+  { version: "1.81.15", sha256: "303c31af87e7915e7b34d6c4d55a6ac753ef947a5deaa899e9ccfd3d1d58f7c2", gitCommit: "20bf3aa8070a" },
+  { version: "1.81.14-stable", sha256: "a34f9758048231817d799b703fb998e40e2a5cbabb89ab95039fc30798f01b3c", gitCommit: "0435375b1271" },
+  { version: "1.81.13", sha256: "a876f3f22f9b6fd481c9091c44a8a893d81c172d66dc2749298dcd3dc4a3d6f0", gitCommit: "cc957a19a560" },
+  { version: "1.81.12-stable", sha256: "e24022878ccc87f57d808ac9304f18b87b8359e6556746d81cc20a5dc85f423a", gitCommit: "ba0d541b1982" },
+  { version: "1.81.9-stable", sha256: "262e53d7702ed82579717faff0b08f7c0b7e9973a6406cfcc0e4af7826327627", gitCommit: "a09d3e9162eb" },
+  { version: "1.81.3-stable", sha256: "dff82ccc32fb648927c090607887401c7e8ec814fe7c951beb95fe51073ca02b", gitCommit: "61ed8f9e0355" },
+  { version: "1.81.0-stable", sha256: "f4913297d1bb3dc373eb8911a5ac816b597be9b5e08a91636b6c2786dd572aa8", gitCommit: "790a5ce0b323" },
+  { version: "1.80.15-stable", sha256: "0b4ec3861e978b4aa254f4070f292cd345496a5fb59c72e1ee21cd6db94b670b", gitCommit: "17c8d8d109b5" },
+  { version: "1.80.11-stable", sha256: "4068108d9101cd2affba3924310fd7f34f23d14e36dd4853733898b9e04d81ca", gitCommit: "57e07bddd341" },
+  { version: "1.80.8-stable", sha256: "0304c2eb1f3cf54262d1b4e0629487232bab459e95b99a21e5810231d2b27021", gitCommit: "3381d63152f8" },
+  { version: "1.80.5-stable", sha256: "a89e173135fff96af4b5b91ea31845164eadcf6497c82adeb64c36a23c8a3d11", gitCommit: "6c49b95a4ab7" },
+  { version: "1.80.0-stable", sha256: "a3416f4cd0c896c94a1f526d872ff6c19bee22ff4afcdcc6f9ff690707900176", gitCommit: "98365205acd0" },
+  { version: "1.79.3-stable", sha256: "27aae83d6ab6cb0b63bf8179e375ce0e11f5cfef51f2675b0c1e60c6f546dbc1", gitCommit: "c0548542d4a9" },
+  { version: "1.79.1-stable", sha256: "7780d29a9543c4ce762430db7dfb0640105f7357fc38e35bf3fb7bbb1e6ba63f", gitCommit: "c217bddb59ba" },
+  { version: "1.79.0-stable", sha256: "32bf6ac059a56641e11e4712f63b8467c295f988b6c160dc7229660417ee44bd", gitCommit: "8d495f56a9cc" },
+  { version: "1.78.5-stable", sha256: "d5e607648eafa15edc63b0b1a5ed01f8b31a1fa0c80f7d25b252ae18a593ee29", gitCommit: "c471bf1f16c2" },
+  { version: "1.78.0-stable", sha256: "7a56b32dc7153763d31c0a056123dc878a598959935d8c7daacb1fca5272c205", gitCommit: "5fde83d9f154" },
+]} />
+
+</TabItem>
+</Tabs>
+
+
+## Questions and support
+
+If you believe your systems may be affected, contact us immediately:
+
+- **Security:** `security@berri.ai`
+- **Support:** `support@berri.ai`
+- **Slack:** Reach out to the LiteLLM team directly
+
+For real-time updates, follow [LiteLLM (YC W23) on X](https://x.com/LiteLLM).
+

docs/my-website/blog/server_root_path/index.md

@@ -3,17 +3,9 @@ slug: server-root-path-incident
 title: "Incident Report: SERVER_ROOT_PATH regression broke UI routing"
 date: 2026-02-21T10:00:00
 authors:
-  - name: Yuneng Jiang
-    title: SWE @ LiteLLM (Full Stack)
-    url: https://www.linkedin.com/in/yunengjiang/
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
+  - yuneng
+  - ishaan-alt
+  - krrish
 tags: [incident-report, ui, stability]
 hide_table_of_contents: false
 ---

docs/my-website/blog/sub_millisecond_proxy_overhead/index.md

@@ -3,18 +3,9 @@ slug: sub-millisecond-proxy-overhead
 title: "Achieving Sub-Millisecond Proxy Overhead"
 date: 2026-02-02T10:00:00
 authors:
-  - name: Alexsander Hamir
-    title: "Performance Engineer, LiteLLM"
-    url: https://www.linkedin.com/in/alexsander-baptista/
-    image_url: https://github.com/AlexsanderHamir.png
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - alexsander
+  - krrish
+  - ishaan-alt
 description: "Our Q1 performance target and architectural direction for achieving sub-millisecond proxy overhead on modest hardware."
 tags: [performance, architecture]
 hide_table_of_contents: false
@@ -32,6 +23,8 @@ Proxy overhead refers to the latency introduced by LiteLLM itself, independent o
 
 To measure it, we run the same workload directly against the provider and through LiteLLM at identical QPS (for example, 1,000 QPS) and compare the latency delta. To reduce noise, the load generator, LiteLLM, and a mock LLM endpoint all run on the same machine, ensuring the difference reflects proxy overhead rather than network latency.
 
+{/* truncate */}
+
 ---
 
 ## Where We're Coming From

docs/my-website/blog/video_characters_litellm/index.md

@@ -0,0 +1,121 @@
+---
+slug: video_characters_api
+title: "New Video Characters, Edit and Extension API support"
+date: 2026-03-16T10:00:00
+authors:
+  - sameer
+  - krrish
+  - ishaan-alt
+description: "LiteLLM now supports creating, retrieving, and managing reusable video characters across multiple video generations."
+tags: [videos, characters, proxy, routing]
+hide_table_of_contents: false
+---
+
+LiteLLM now supoports videos character, edit and extension apis.
+
+{/* truncate */}
+
+## What's New
+
+Four new endpoints for video character operations:
+- **Create character** - Upload a video to create a reusable asset
+- **Get character** - Retrieve character metadata
+- **Edit video** - Modify generated videos
+- **Extend video** - Continue clips with character consistency
+
+**Available from:** LiteLLM v1.83.0+
+
+## Quick Example
+
+```python
+import litellm
+
+# Create character from video
+character = litellm.avideo_create_character(
+    name="Luna",
+    video=open("luna.mp4", "rb"),
+    custom_llm_provider="openai",
+    model="sora-2"
+)
+print(f"Character: {character.id}")
+
+# Use in generation
+video = litellm.avideo(
+    model="sora-2",
+    prompt="Luna dances through a magical forest.",
+    characters=[{"id": character.id}],
+    seconds="8"
+)
+
+# Get character info
+fetched = litellm.avideo_get_character(
+    character_id=character.id,
+    custom_llm_provider="openai"
+)
+
+# Edit with character preserved
+edited = litellm.avideo_edit(
+    video_id=video.id,
+    prompt="Add warm golden lighting"
+)
+
+# Extend sequence
+extended = litellm.avideo_extension(
+    video_id=video.id,
+    prompt="Luna waves goodbye",
+    seconds="5"
+)
+```
+
+## Via Proxy
+
+```bash
+# Create character
+curl -X POST "http://localhost:4000/v1/videos/characters" \
+  -H "Authorization: Bearer sk-litellm-key" \
+  -F "video=@luna.mp4" \
+  -F "name=Luna"
+
+# Get character
+curl -X GET "http://localhost:4000/v1/videos/characters/char_abc123def456" \
+  -H "Authorization: Bearer sk-litellm-key"
+
+# Edit video
+curl -X POST "http://localhost:4000/v1/videos/edits" \
+  -H "Authorization: Bearer sk-litellm-key" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "video": {"id": "video_xyz789"},
+    "prompt": "Add warm golden lighting and enhance colors"
+  }'
+
+# Extend video
+curl -X POST "http://localhost:4000/v1/videos/extensions" \
+  -H "Authorization: Bearer sk-litellm-key" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "video": {"id": "video_xyz789"},
+    "prompt": "Luna waves goodbye and walks into the sunset",
+    "seconds": "5"
+  }'
+```
+
+## Managed Character IDs
+
+LiteLLM automatically encodes provider and model metadata into character IDs:
+
+**What happens:**
+```
+Upload character "Luna" with model "sora-2" on OpenAI
+  ↓
+LiteLLM creates: char_abc123def456 (contains provider + model_id)
+  ↓
+When you reference it later, LiteLLM decodes automatically
+  ↓
+Router knows exactly which deployment to use
+```
+
+**Behind the scenes:**
+- Character ID format: `character_<base64_encoded_metadata>`
+- Metadata includes: provider, model_id, original_character_id
+- Transparent to you - just use the ID, LiteLLM handles routing

docs/my-website/blog/vllm_embeddings_incident/index.md

@@ -3,18 +3,9 @@ slug: vllm-embeddings-incident
 title: "Incident Report: vLLM Embeddings Broken by encoding_format Parameter"
 date: 2026-02-18T10:00:00
 authors:
-  - name: Sameer Kankute
-    title: SWE @ LiteLLM (LLM Translation)
-    url: https://www.linkedin.com/in/sameer-kankute/
-    image_url: https://pbs.twimg.com/profile_images/2001352686994907136/ONgNuSk5_400x400.jpg
-  - name: Krrish Dholakia
-    title: "CEO, LiteLLM"
-    url: https://www.linkedin.com/in/krish-d/
-    image_url: https://pbs.twimg.com/profile_images/1298587542745358340/DZv3Oj-h_400x400.jpg
-  - name: Ishaan Jaff
-    title: "CTO, LiteLLM"
-    url: https://www.linkedin.com/in/reffajnaahsi/
-    image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg
+  - sameer
+  - krrish
+  - ishaan-alt
 tags: [incident-report, embeddings, vllm]
 hide_table_of_contents: false
 ---

docs/my-website/docs/a2a.md

@@ -20,6 +20,7 @@ Add A2A Agents on LiteLLM AI Gateway, Invoke agents in A2A Protocol, track reque
 | Logging | ✅ |
 | Load Balancing | ✅ |
 | Streaming | ✅ |
+| [Iteration Budgets](a2a_iteration_budgets) | ✅ |
 
 
 :::tip

docs/my-website/docs/a2a_agent_headers.md

@@ -0,0 +1,252 @@
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# A2A Agent Authentication Headers
+
+Forward authentication credentials (Bearer tokens, API keys, etc.) from clients to backend A2A agents.
+
+## Overview
+
+When LiteLLM proxies a request to a backend A2A agent, the agent may require its own authentication headers. There are three ways to supply them:
+
+| Method | Who configures | How it works |
+|---|---|---|
+| **Static headers** | Admin (UI / API) | Always sent, regardless of client request |
+| **Forward client headers** | Admin (UI / API) | Header names to extract from client request and forward |
+| **Convention-based** | Client (no admin config) | Client sends `x-a2a-{agent_name}-{header}` — automatically routed |
+
+All three methods can be combined. **Static headers always win** on key conflicts.
+
+---
+
+## Method 1 — Static Headers
+
+Admin-configured headers that are always sent to the backend agent. Use this for server-to-server tokens or internal credentials that clients should never see or override.
+
+<Tabs>
+<TabItem value="ui" label="UI">
+
+1. Go to **Agents** in the LiteLLM dashboard.
+2. Create or edit an agent.
+3. Open the **Authentication Headers** panel.
+4. Under **Static Headers**, click **Add Static Header** and fill in the header name and value.
+
+</TabItem>
+<TabItem value="api" label="REST API">
+
+```bash
+curl -X POST http://localhost:4000/v1/agents \
+  -H "Authorization: Bearer sk-admin" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "agent_name": "my-agent",
+    "agent_card_params": { ... },
+    "static_headers": {
+      "Authorization": "Bearer internal-server-token",
+      "X-Internal-Service": "litellm-proxy"
+    }
+  }'
+```
+
+To update an existing agent:
+
+```bash
+curl -X PATCH http://localhost:4000/v1/agents/{agent_id} \
+  -H "Authorization: Bearer sk-admin" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "static_headers": {
+      "Authorization": "Bearer new-token"
+    }
+  }'
+```
+
+</TabItem>
+</Tabs>
+
+**Client call — no special headers needed:**
+
+```bash
+curl -X POST http://localhost:4000/a2a/my-agent \
+  -H "Authorization: Bearer sk-client-key" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "jsonrpc": "2.0", "id": "1", "method": "message/send",
+    "params": { "message": { "role": "user", "parts": [{"kind": "text", "text": "Hello"}], "messageId": "msg-1" } }
+  }'
+```
+
+The backend agent receives `Authorization: Bearer internal-server-token` without the client ever knowing the value.
+
+---
+
+## Method 2 — Forward Client Headers
+
+Admin specifies a list of header **names**. When the client sends a request that includes those headers, LiteLLM extracts their values and forwards them to the backend agent. The client controls the values; the admin controls which headers are eligible to be forwarded.
+
+<Tabs>
+<TabItem value="ui" label="UI">
+
+1. Go to **Agents** in the LiteLLM dashboard.
+2. Create or edit an agent.
+3. Open the **Authentication Headers** panel.
+4. Under **Forward Client Headers**, type header names and press **Enter** (e.g. `x-api-key`, `Authorization`).
+
+</TabItem>
+<TabItem value="api" label="REST API">
+
+```bash
+curl -X POST http://localhost:4000/v1/agents \
+  -H "Authorization: Bearer sk-admin" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "agent_name": "my-agent",
+    "agent_card_params": { ... },
+    "extra_headers": ["x-api-key", "x-user-token"]
+  }'
+```
+
+</TabItem>
+</Tabs>
+
+**Client call — include the forwarded headers:**
+
+```bash
+curl -X POST http://localhost:4000/a2a/my-agent \
+  -H "Authorization: Bearer sk-client-key" \
+  -H "x-api-key: user-secret-value" \
+  -H "Content-Type: application/json" \
+  -d '{ ... }'
+```
+
+The backend agent receives `x-api-key: user-secret-value`.
+
+:::note
+Header name matching is **case-insensitive**. If the client sends `X-API-Key` and `extra_headers` lists `x-api-key`, they match.
+:::
+
+---
+
+## Method 3 — Convention-Based Forwarding
+
+Clients can forward headers to a specific agent without any admin pre-configuration by using the naming convention:
+
+```
+x-a2a-{agent_name_or_id}-{header_name}: value
+```
+
+LiteLLM parses these headers automatically and routes them to the matching agent only.
+
+**Examples:**
+
+| Client header sent | Agent name/ID | Forwarded as |
+|---|---|---|
+| `x-a2a-my-agent-authorization: Bearer tok` | `my-agent` | `authorization: Bearer tok` |
+| `x-a2a-my-agent-x-api-key: secret` | `my-agent` | `x-api-key: secret` |
+| `x-a2a-abc123-authorization: Bearer tok` | agent ID `abc123` | `authorization: Bearer tok` |
+
+```bash
+curl -X POST http://localhost:4000/a2a/my-agent \
+  -H "Authorization: Bearer sk-client-key" \
+  -H "x-a2a-my-agent-authorization: Bearer agent-specific-token" \
+  -H "Content-Type: application/json" \
+  -d '{ ... }'
+```
+
+The `x-a2a-other-agent-authorization` header sent in the same request is **not** forwarded to `my-agent` — it is silently ignored.
+
+:::tip Matches both agent name and agent ID
+Both the human-readable name (e.g. `my-agent`) and the UUID (e.g. `abc123-...`) are valid. Use whichever is convenient for the client.
+:::
+
+---
+
+## Merge Precedence
+
+When multiple methods supply the same header name, **static headers win**:
+
+```
+dynamic (forwarded/convention)  →  merged  ←  static (overlays, wins)
+```
+
+Example:
+
+| Source | `Authorization` value |
+|---|---|
+| Client sends (via `extra_headers` or convention) | `Bearer client-token` |
+| Admin-configured `static_headers` | `Bearer server-token` |
+| **What the backend agent receives** | **`Bearer server-token`** |
+
+This ensures admin-controlled credentials cannot be overridden by client requests.
+
+---
+
+## Combining All Three Methods
+
+```bash
+# Register agent with static + forwarded headers
+curl -X POST http://localhost:4000/v1/agents \
+  -H "Authorization: Bearer sk-admin" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "agent_name": "my-agent",
+    "agent_card_params": { ... },
+    "static_headers": {
+      "X-Internal-Token": "secret123"
+    },
+    "extra_headers": ["x-user-id"]
+  }'
+
+# Client call using all three mechanisms
+curl -X POST http://localhost:4000/a2a/my-agent \
+  -H "Authorization: Bearer sk-client-key" \
+  -H "x-user-id: user-42" \
+  -H "x-a2a-my-agent-x-request-id: req-abc" \
+  -H "Content-Type: application/json" \
+  -d '{ ... }'
+```
+
+The backend agent receives:
+
+```
+X-Internal-Token: secret123          ← static header (always)
+x-user-id: user-42                   ← forwarded (in extra_headers)
+x-request-id: req-abc                ← convention-based (x-a2a-my-agent-*)
+X-LiteLLM-Trace-Id: <uuid>           ← LiteLLM internal
+X-LiteLLM-Agent-Id: <agent-id>       ← LiteLLM internal
+```
+
+---
+
+## Header Isolation
+
+Each agent invocation uses an isolated HTTP connection. Headers configured for agent A are **never** sent to agent B, even if both agents are running and receiving requests simultaneously.
+
+---
+
+## API Reference
+
+### `POST /v1/agents` / `PATCH /v1/agents/{agent_id}`
+
+| Field | Type | Description |
+|---|---|---|
+| `static_headers` | `object` | `{"Header-Name": "value"}` — always forwarded |
+| `extra_headers` | `string[]` | Header names to extract from client request and forward |
+
+### Agent Response
+
+Both fields are returned in `GET /v1/agents` and `GET /v1/agents/{agent_id}`:
+
+```json
+{
+  "agent_id": "...",
+  "agent_name": "my-agent",
+  "static_headers": { "X-Internal-Token": "secret123" },
+  "extra_headers": ["x-user-id"],
+  ...
+}
+```
+
+:::caution
+`static_headers` values are stored in the database and returned by the API. Treat them as you would any credential — do not store sensitive long-lived tokens here if your API is publicly accessible. Consider using short-lived tokens or environment-injected secrets instead.
+:::

docs/my-website/docs/a2a_iteration_budgets.md

@@ -0,0 +1,188 @@
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+# Agent Iteration Budgets
+
+Control runaway costs from agentic loops with per-session iteration and budget caps.
+
+## Overview
+
+When agents run agentic loops, they can make unbounded LLM calls, causing unexpected costs. LiteLLM provides two controls:
+
+| Control | Description |
+|---------|-------------|
+| **Max Iterations** | Hard cap on the number of LLM calls per session |
+| **Max Budget Per Session** | Dollar cap per session (identified by `x-litellm-trace-id`) |
+
+Both controls require a `session_id` (sent via `x-litellm-trace-id` header or `metadata.session_id`) to track calls within a session.
+
+## Trace-ID Enforcement
+
+LiteLLM supports two independent trace-id flags, configured in `litellm_params` on the agent:
+
+| Flag | Description |
+|------|-------------|
+| `require_trace_id_on_calls_to_agent` | Requires callers invoking this agent to include `x-litellm-trace-id`. Use when the agent should only be called as a sub-agent with a trace context. Returns **400** if missing. |
+| `require_trace_id_on_calls_by_agent` | Requires all LLM/MCP calls made **by** this agent (via its virtual key) to include `x-litellm-trace-id`. This is what enables `max_iterations` and `max_budget_per_session` tracking. Returns **400** if missing. |
+
+## Configuring via UI
+
+When creating an agent in the LiteLLM Admin UI:
+
+1. Navigate to the **Agents** tab and click **Add Agent**
+2. In the **Agent Settings** step, expand the **Tracing** section
+3. Toggle **Require x-litellm-trace-id on calls BY this agent** to enable session tracking
+4. Set **Max Iterations** to cap the number of LLM calls per session
+5. Set **Max Budget Per Session ($)** to cap spend per session
+
+The trace-id flags are stored on the agent's `litellm_params`. Budget controls (`max_iterations`, `max_budget_per_session`) are stored in the virtual key's metadata.
+
+## Configuring via API
+
+Set trace-id enforcement on the agent itself:
+
+```bash
+curl -X POST 'http://localhost:4000/v1/agents' \
+  -H 'Authorization: Bearer sk-1234' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "agent_name": "my-research-agent",
+    "agent_card_params": {
+      "name": "my-research-agent",
+      "description": "A research agent with budget controls",
+      "url": "http://my-agent:8080",
+      "version": "1.0.0"
+    },
+    "litellm_params": {
+      "require_trace_id_on_calls_to_agent": true,
+      "require_trace_id_on_calls_by_agent": true
+    }
+  }'
+```
+
+Budget controls are set on the agent's `litellm_params` (not on individual keys), so they apply across all keys for the agent:
+
+```bash
+curl -X POST 'http://localhost:4000/v1/agents' \
+  -H 'Authorization: Bearer sk-1234' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "agent_name": "my-research-agent",
+    "agent_card_params": {
+      "name": "my-research-agent",
+      "description": "A research agent with budget controls",
+      "url": "http://my-agent:8080",
+      "version": "1.0.0"
+    },
+    "litellm_params": {
+      "require_trace_id_on_calls_by_agent": true,
+      "max_iterations": 25,
+      "max_budget_per_session": 5.00
+    }
+  }'
+```
+
+## How It Works
+
+### Session Tracking
+
+Callers identify their session by including a `session_id` in one of these ways:
+- **Header**: `x-litellm-trace-id: my-session-123`
+- **Metadata**: `{"metadata": {"session_id": "my-session-123"}}`
+
+### Max Iterations
+
+When `max_iterations` is set in agent `litellm_params`:
+- Each LLM call for a session increments a counter
+- When the counter exceeds `max_iterations`, the request receives a **429 Too Many Requests**
+- Counters expire after 1 hour by default (configurable via `LITELLM_MAX_ITERATIONS_TTL` env var)
+
+### Max Budget Per Session
+
+When `max_budget_per_session` is set in agent `litellm_params`:
+- After each successful LLM call, the response cost is accumulated for the session
+- Before each call, the accumulated spend is checked against the budget
+- When spend exceeds the budget, the request receives a **429 Too Many Requests**
+- Session spend counters expire after 1 hour by default (configurable via `LITELLM_MAX_BUDGET_PER_SESSION_TTL` env var)
+
+## Example
+
+Create an agent with max 25 iterations and a $5 budget cap:
+
+<Tabs>
+<TabItem value="ui" label="Via UI">
+
+1. Go to **Agents** → **Add Agent**
+2. Configure your agent (name, model, etc.)
+3. In **Agent Settings**, expand the **Tracing** section
+4. Toggle on **Require x-litellm-trace-id on calls BY this agent**
+5. Set **Max Iterations** to `25`
+6. Set **Max Budget Per Session** to `5.00`
+7. Proceed to create a new key for the agent
+8. Click **Create Agent**
+
+</TabItem>
+<TabItem value="api" label="Via API">
+
+```bash
+# 1. Create the agent with trace-id enforcement
+curl -X POST 'http://localhost:4000/v1/agents' \
+  -H 'Authorization: Bearer sk-1234' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "agent_name": "my-research-agent",
+    "agent_card_params": {
+      "name": "my-research-agent",
+      "description": "A research agent with budget controls",
+      "url": "http://my-agent:8080",
+      "version": "1.0.0"
+    },
+    "litellm_params": {
+      "require_trace_id_on_calls_by_agent": true
+    }
+  }'
+
+# 2. Create a key for the agent
+curl -X POST 'http://localhost:4000/key/generate' \
+  -H 'Authorization: Bearer sk-1234' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "agent_id": "<agent_id_from_step_1>",
+    "key_alias": "my-research-agent-key"
+  }'
+```
+
+</TabItem>
+</Tabs>
+
+### Making Calls with Session Tracking
+
+```bash
+curl -X POST 'http://localhost:4000/chat/completions' \
+  -H 'Authorization: Bearer sk-agent-key-xxx' \
+  -H 'x-litellm-trace-id: session-abc-123' \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "model": "gpt-4o",
+    "messages": [{"role": "user", "content": "Hello"}]
+  }'
+```
+
+After 25 calls or $5 spent within this session, subsequent requests will receive:
+
+```json
+{
+  "error": {
+    "message": "Session budget exceeded for session session-abc-123. Current spend: $5.0032, max_budget_per_session: $5.00.",
+    "type": "budget_exceeded",
+    "code": 429
+  }
+}
+```
+
+## Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `LITELLM_MAX_ITERATIONS_TTL` | `3600` (1 hour) | TTL in seconds for session iteration counters |
+| `LITELLM_MAX_BUDGET_PER_SESSION_TTL` | `3600` (1 hour) | TTL in seconds for session budget counters |

docs/my-website/docs/anthropic_count_tokens.md

@@ -138,6 +138,7 @@ The `/v1/messages/count_tokens` endpoint automatically routes to the appropriate
 | Provider | Token Counting Method |
 |----------|----------------------|
 | Anthropic | [Anthropic Token Counting API](https://docs.anthropic.com/en/docs/build-with-claude/token-counting) |
+| OpenAI | [OpenAI Responses API `/input_tokens`](https://platform.openai.com/docs/api-reference/responses/input-tokens) — see [Token Counting](./count_tokens.md) |
 | Vertex AI (Claude) | Vertex AI Partner Models Token Counter |
 | Bedrock (Claude) | AWS Bedrock CountTokens API |
 | Gemini | Google AI Studio countTokens API |

docs/my-website/docs/anthropic_unified/index.md

@@ -506,12 +506,15 @@ Request body will be in the Anthropic messages API format. **litellm follows the
   A system prompt providing context or specific instructions to the model.
 - **temperature** (number):  
   Controls randomness in the model's responses. Valid range: `0 < temperature < 1`.
-- **thinking** (object):  
+- **thinking** (object):
   Configuration for enabling extended thinking. If enabled, it includes:
-  - **budget_tokens** (integer):  
+  - **budget_tokens** (integer):
     Minimum of 1024 tokens (and less than `max_tokens`).
-  - **type** (enum):  
+  - **type** (enum):
     E.g., `"enabled"`.
+  - **summary** (string, optional):
+    Enables the summary style for thinking blocks. Possible values: `"auto"`, `"concise"`, `"detailed"`, `"disabled"`.
+    When routing to non-Anthropic providers (e.g., `openai/gpt-5.1`), the `summary` value is preserved and forwarded to the downstream API.
 - **tool_choice** (object):  
   Instructs how the model should utilize any provided tools.
 - **tools** (array of objects):  

docs/my-website/docs/anthropic_unified/messages_to_responses_mapping.md

@@ -0,0 +1,120 @@
+# v1/messages → /responses Parameter Mapping
+
+When you send a request to `/v1/messages` targeting an OpenAI or Azure model, LiteLLM internally routes it through the OpenAI Responses API. This page documents exactly how every parameter gets translated in both directions.
+
+The transformation lives in `litellm/llms/anthropic/experimental_pass_through/responses_adapters/transformation.py`.
+
+
+## Request: Anthropic → Responses API
+
+### Top-level parameters
+
+| Anthropic (`/v1/messages`) | Responses API | Notes |
+|---|---|---|
+| `model` | `model` | Passed through as-is |
+| `messages` | `input` | Structurally transformed — see the messages section below |
+| `system` (string) | `instructions` | Passed as a plain string |
+| `system` (list of content blocks) | `instructions` | Text blocks are joined with `\n`; non-text blocks are ignored |
+| `max_tokens` | `max_output_tokens` | Renamed |
+| `temperature` | `temperature` | Passed through as-is |
+| `top_p` | `top_p` | Passed through as-is |
+| `tools` | `tools` | Format-translated — see the tools section below |
+| `tool_choice` | `tool_choice` | Type-remapped — see the tool_choice section below |
+| `thinking` | `reasoning` | Budget tokens mapped to effort level — see the thinking section below |
+| `output_format` or `output_config.format` | `text` | Wrapped as `{"format": {"type": "json_schema", "name": "structured_output", "schema": ..., "strict": true}}` |
+| `context_management` | `context_management` | Converted from Anthropic dict to OpenAI array format — see the context_management section below |
+| `metadata.user_id` | `user` | Extracted from the metadata object and truncated to 64 characters |
+| `stop_sequences` | ❌ Not mapped | Dropped silently |
+| `top_k` | ❌ Not mapped | Dropped silently |
+| `speed` | ❌ Not mapped | Only used to set Anthropic beta headers on the native path |
+
+
+### How messages get converted
+
+Each Anthropic message is expanded into one or more Responses API input items. The key difference is that `tool_result` and `tool_use` blocks become **top-level items** in the input array rather than being nested inside a message.
+
+| Anthropic message | Responses API input item |
+|---|---|
+| `user` role, string content | `{"type": "message", "role": "user", "content": [{"type": "input_text", "text": "..."}]}` |
+| `user` role, `{"type": "text"}` block | `{"type": "input_text", "text": "..."}` inside a user message |
+| `user` role, `{"type": "image", "source": {"type": "base64"}}` | `{"type": "input_image", "image_url": "data:<media_type>;base64,<data>"}` inside a user message |
+| `user` role, `{"type": "image", "source": {"type": "url"}}` | `{"type": "input_image", "image_url": "<url>"}` inside a user message |
+| `user` role, `{"type": "tool_result"}` block | Top-level `{"type": "function_call_output", "call_id": "...", "output": "..."}` — pulled out of the message entirely |
+| `assistant` role, string content | `{"type": "message", "role": "assistant", "content": [{"type": "output_text", "text": "..."}]}` |
+| `assistant` role, `{"type": "text"}` block | `{"type": "output_text", "text": "..."}` inside an assistant message |
+| `assistant` role, `{"type": "tool_use"}` block | Top-level `{"type": "function_call", "call_id": "<id>", "name": "...", "arguments": "<JSON string>"}` — pulled out of the message entirely |
+| `assistant` role, `{"type": "thinking"}` block | `{"type": "output_text", "text": "<thinking text>"}` inside an assistant message |
+
+
+### tools
+
+| Anthropic tool | Responses API tool |
+|---|---|
+| Any tool where `type` starts with `"web_search"` or `name == "web_search"` | `{"type": "web_search_preview"}` |
+| All other tools | `{"type": "function", "name": "...", "description": "...", "parameters": <input_schema>}` |
+
+
+### tool_choice
+
+| Anthropic `tool_choice.type` | Responses API `tool_choice` |
+|---|---|
+| `"auto"` | `{"type": "auto"}` |
+| `"any"` | `{"type": "required"}` |
+| `"tool"` | `{"type": "function", "name": "<tool name>"}` |
+
+
+### thinking → reasoning
+
+The `budget_tokens` value is mapped to a string effort level. `summary` is always set to `"detailed"`.
+
+| `thinking.budget_tokens` | `reasoning.effort` |
+|---|---|
+| >= 10000 | `"high"` |
+| >= 5000 | `"medium"` |
+| >= 2000 | `"low"` |
+| < 2000 | `"minimal"` |
+
+If `thinking.type` is anything other than `"enabled"`, the `reasoning` field is not sent at all.
+
+
+### context_management
+
+Anthropic uses a nested dict with an `edits` array. OpenAI uses a flat array of compaction objects.
+
+```
+Anthropic input:
+{
+  "edits": [
+    {
+      "type": "compact_20260112",
+      "trigger": {"type": "input_tokens", "value": 150000}
+    }
+  ]
+}
+
+Responses API output:
+[
+  {"type": "compaction", "compact_threshold": 150000}
+]
+```
+
+
+## Response: Responses API → Anthropic
+
+When the Responses API reply comes back, LiteLLM converts it into an Anthropic `AnthropicMessagesResponse`.
+
+| Responses API field | Anthropic response field | Notes |
+|---|---|---|
+| `response.id` | `id` | |
+| `response.model` | `model` | Falls back to `"unknown-model"` if missing |
+| `ResponseReasoningItem` — `summary[*].text` | `content` block `{"type": "thinking", "thinking": "..."}` | Each non-empty summary text becomes a thinking block |
+| `ResponseOutputMessage` — `content[*]` where `type == "output_text"` | `content` block `{"type": "text", "text": "..."}` | |
+| `ResponseFunctionToolCall` — `{call_id, name, arguments}` | `content` block `{"type": "tool_use", "id": "...", "name": "...", "input": {...}}` | `arguments` is JSON-parsed back into a dict |
+| Any `function_call` present in output | `stop_reason: "tool_use"` | |
+| `response.status == "incomplete"` | `stop_reason: "max_tokens"` | Takes precedence over the default |
+| Everything else | `stop_reason: "end_turn"` | Default |
+| `response.usage.input_tokens` | `usage.input_tokens` | |
+| `response.usage.output_tokens` | `usage.output_tokens` | |
+| *(hardcoded)* | `type: "message"` | Always set |
+| *(hardcoded)* | `role: "assistant"` | Always set |
+| *(hardcoded)* | `stop_sequence: null` | Always null on this path |

docs/my-website/docs/apply_guardrail.md

@@ -11,6 +11,7 @@ This endpoint supports various guardrail types including:
 - **Presidio** - PII detection and masking
 - **Bedrock** - AWS Bedrock guardrails for content moderation
 - **Lakera** - AI safety guardrails
+- **PANW Prisma AIRS** - Threat detection, DLP, and policy enforcement
 - **Custom guardrails** - User-defined guardrails
 
 ## Configuration

docs/my-website/docs/audio_transcription.md

@@ -13,7 +13,7 @@ import TabItem from '@theme/TabItem';
 | Fallbacks | ✅ | Works between supported models |
 | Loadbalancing | ✅ | Works between supported models |
 | Guardrails | ✅ | Applies to output transcribed text (non-streaming only) |
-| Supported Providers | `openai`, `azure`, `vertex_ai`, `gemini`, `deepgram`, `groq`, `fireworks_ai`, `ovhcloud` | |
+| Supported Providers | `openai`, `azure`, `vertex_ai`, `gemini`, `deepgram`, `groq`, `fireworks_ai`, `ovhcloud`, `mistral` | |
 
 ## Quick Start
 
@@ -126,6 +126,7 @@ transcript = client.audio.transcriptions.create(
 - [Fireworks AI](./providers/fireworks_ai.md#audio-transcription)
 - [Groq](./providers/groq.md#speech-to-text---whisper)
 - [Deepgram](./providers/deepgram.md)
+- [Mistral (Voxtral)](./providers/mistral.md#audio-transcription)
 - [OVHcloud AI Endpoints](./providers/ovhcloud.md)
 
 ---

docs/my-website/docs/completion/output.md

@@ -51,6 +51,28 @@ Here's what an example response looks like
 }
 ```
 
+## Native Finish Reason
+
+LiteLLM maps all provider-specific `finish_reason` values to OpenAI-compatible values (`stop`, `length`, `tool_calls`, `function_call`, `content_filter`). When the original provider value differs from the mapped value, it is preserved in `provider_specific_fields["native_finish_reason"]`.
+
+This is useful for agent loops that need to distinguish between different stop conditions (e.g., Gemini's `MALFORMED_FUNCTION_CALL` vs a normal `stop`).
+
+```python
+response = completion(model="gemini/gemini-2.0-flash", messages=messages)
+
+choice = response.choices[0]
+print(choice.finish_reason)  # "stop" (OpenAI-compatible)
+
+# Access the original provider value when it differs:
+if hasattr(choice, "provider_specific_fields") and choice.provider_specific_fields:
+    native = choice.provider_specific_fields.get("native_finish_reason")
+    if native == "MALFORMED_FUNCTION_CALL":
+        # Handle malformed function call differently from a normal stop
+        pass
+```
+
+When the provider already returns an OpenAI-compatible value (e.g., `stop`), `native_finish_reason` is not set.
+
 ## Additional Attributes
 
 You can also access information like latency.