Revert "Merge remote-tracking branch 'origin/litellm_oss_staging_04_21_2026' into fix/bedrock-invoke-output-config-effort-4-6"

This reverts commit 9eeb0bf3d2, reversing
changes made to 8e7a663ce5.

.circleci/requirements.txt

@@ -0,0 +1,21 @@
+# used by CI/CD testing
+openai==1.100.1
+python-dotenv
+tiktoken
+importlib_metadata
+cohere
+redis==5.2.1
+redisvl==0.4.1
+anthropic
+orjson==3.10.15 # fast /embedding responses
+pydantic==2.12.5
+google-cloud-aiplatform==1.133.0
+google-cloud-iam==2.19.1
+fastapi-sso==0.16.0 
+uvloop==0.21.0
+mcp==1.26.0    # for MCP server
+semantic_router==0.1.10 # for auto-routing with litellm
+fastuuid==0.14.0
+responses==0.25.7  # for proxy client tests
+pytest-retry==1.6.3  # for automatic test retries
+litellm-proxy-extras  # for prisma migrations

.devcontainer/post-create.sh

@@ -1,17 +1,17 @@
 #!/usr/bin/env bash
 set -e
 
-echo "[post-create] Installing uv"
-curl -LsSf https://astral.sh/uv/0.10.9/install.sh | env UV_NO_MODIFY_PATH=1 sh
-export PATH="$HOME/.local/bin:$PATH"
+echo "[post-create] Installing poetry via pip"
+python -m pip install --upgrade pip
+python -m pip install poetry
 
-echo "[post-create] Installing Python dependencies (uv)"
-uv sync --frozen --group proxy-dev --extra proxy
+echo "[post-create] Installing Python dependencies (poetry)"
+poetry install --with dev --extras proxy
 
 echo "[post-create] Generating Prisma client"
-uv run --no-sync prisma generate
+poetry run prisma generate
 
 echo "[post-create] Installing npm dependencies"
 cd ui/litellm-dashboard && npm ci
 
-echo "[post-create] Done"
+echo "[post-create] Done"

.gitguardian.yaml

@@ -37,7 +37,7 @@ secret:
     - "docs/**"
     - "**/*.md"
     - "**/*.lock"
-    - "uv.lock"
+    - "poetry.lock"
     - "package-lock.json"
 
   # Ignore security incidents with the SHA256 of the occurrence (false positives)

.github/pull_request_template.md

@@ -32,13 +32,6 @@ If you're seeing a delay in your PR being merged, ping the LiteLLM Team on [Slac
 - [ ] **Merge / cherry-pick CI run**  
        Links:
 
-## Screenshots / Proof of Fix
-
-<!-- Include screenshots, screen recordings, or log output demonstrating that your changes work as expected.
-     For bug fixes: show reproduction before the fix and passing behavior after.
-     For new features: show the feature working end-to-end.
-     For UI changes: include before/after screenshots. -->
-
 ## Type
 
 <!-- Select the type of Pull Request -->

.github/scripts/close_duplicate_issues.py

@@ -42,9 +42,7 @@ def gh(*args: str) -> str:
 def fetch_open_issues(repo: str | None) -> list[dict]:
     """Fetch all open issues (excluding PRs) via gh api --paginate."""
     if repo:
-        endpoint = (
-            f"repos/{repo}/issues?state=open&per_page=100&sort=created&direction=asc"
-        )
+        endpoint = f"repos/{repo}/issues?state=open&per_page=100&sort=created&direction=asc"
     else:
         endpoint = "repos/{owner}/{repo}/issues?state=open&per_page=100&sort=created&direction=asc"
     cmd = ["api", "--paginate", endpoint]
@@ -73,9 +71,7 @@ def close_as_duplicate(
     repo_args = ["--repo", repo] if repo else []
 
     if dry_run:
-        print(
-            f"  [DRY RUN] Would close #{issue_number} as duplicate of #{duplicate_of}"
-        )
+        print(f"  [DRY RUN] Would close #{issue_number} as duplicate of #{duplicate_of}")
         return
 
     # Add comment
@@ -119,9 +115,7 @@ def find_duplicate(
     return None
 
 
-def scan_all(
-    issues: list[dict], threshold: float, repo: str | None, dry_run: bool
-) -> int:
+def scan_all(issues: list[dict], threshold: float, repo: str | None, dry_run: bool) -> int:
     """Compare every issue against all older issues. Returns count of duplicates found."""
     # Sort oldest first
     issues.sort(key=lambda i: i["number"])
@@ -150,11 +144,7 @@ def scan_all(
 
 
 def check_single(
-    issue_number: int,
-    issues: list[dict],
-    threshold: float,
-    repo: str | None,
-    dry_run: bool,
+    issue_number: int, issues: list[dict], threshold: float, repo: str | None, dry_run: bool
 ) -> bool:
     """Check a single issue against all older open issues. Returns True if duplicate found."""
     target = None
@@ -188,23 +178,13 @@ def check_single(
 
 
 def main() -> None:
-    parser = argparse.ArgumentParser(
-        description="Detect and close duplicate GitHub issues"
-    )
+    parser = argparse.ArgumentParser(description="Detect and close duplicate GitHub issues")
     mode = parser.add_mutually_exclusive_group(required=True)
     mode.add_argument("--scan", action="store_true", help="Scan all open issues")
     mode.add_argument("--issue-number", type=int, help="Check a single issue number")
-    parser.add_argument(
-        "--threshold", type=float, default=0.85, help="Similarity threshold (0-1)"
-    )
-    parser.add_argument(
-        "--close",
-        action="store_true",
-        help="Actually close duplicates (default is dry-run)",
-    )
-    parser.add_argument(
-        "--repo", type=str, help="Repository (owner/repo). Auto-detected if omitted."
-    )
+    parser.add_argument("--threshold", type=float, default=0.85, help="Similarity threshold (0-1)")
+    parser.add_argument("--close", action="store_true", help="Actually close duplicates (default is dry-run)")
+    parser.add_argument("--repo", type=str, help="Repository (owner/repo). Auto-detected if omitted.")
     args = parser.parse_args()
 
     dry_run = not args.close
@@ -220,9 +200,7 @@ def main() -> None:
         count = scan_all(issues, args.threshold, args.repo, dry_run)
         print(f"\nTotal duplicates {'found' if dry_run else 'closed'}: {count}")
     else:
-        found = check_single(
-            args.issue_number, issues, args.threshold, args.repo, dry_run
-        )
+        found = check_single(args.issue_number, issues, args.threshold, args.repo, dry_run)
         sys.exit(0 if found else 0)  # Always exit 0; finding no dup is not an error
 
 

.github/scripts/scan_keywords.py

@@ -67,13 +67,14 @@ def send_webhook(webhook_url: str, payload: dict) -> None:
 def _excerpt(text: str, max_len: int = 400) -> str:
     if not text:
         return ""
-
+    
     # Keep original formatting
     if len(text) <= max_len:
         return text
     return text[: max_len - 1] + "…"
 
 
+
 def main() -> int:
     event = read_event_payload()
     if not event:
@@ -86,19 +87,8 @@ def main() -> int:
 
     # Keywords from env or defaults
     keywords_env = os.environ.get("KEYWORDS", "")
-    default_keywords = [
-        "azure",
-        "openai",
-        "bedrock",
-        "vertexai",
-        "vertex ai",
-        "anthropic",
-    ]
-    keywords = (
-        [k.strip() for k in keywords_env.split(",")]
-        if keywords_env
-        else default_keywords
-    )
+    default_keywords = ["azure", "openai", "bedrock", "vertexai", "vertex ai", "anthropic"]
+    keywords = [k.strip() for k in keywords_env.split(",")] if keywords_env else default_keywords
 
     matches = detect_keywords(combined_text, keywords)
     found = bool(matches)
@@ -139,3 +129,5 @@ def main() -> int:
 
 if __name__ == "__main__":
     raise SystemExit(main())
+
+

.github/workflows/_test-unit-base.yml

@@ -27,10 +27,6 @@ on:
         required: false
         type: number
         default: 10
-      artifact-name:
-        description: "Unique name for the coverage artifact (must be unique per run)"
-        required: true
-        type: string
 
 permissions:
   contents: read
@@ -51,30 +47,37 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
+      - name: Install Poetry
+        run: pip install 'poetry==2.3.2'
 
-      - name: Cache uv dependencies
+      - name: Cache Poetry dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
-            ~/.cache/uv
+            ~/.cache/pypoetry
+            ~/.cache/pip
             .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
           restore-keys: |
-            ${{ runner.os }}-uv-
+            ${{ runner.os }}-poetry-
 
       - name: Install dependencies
         run: |
-          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+          poetry config virtualenvs.in-project true
+          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
+          poetry run pip install google-genai==1.22.0 \
+            google-cloud-aiplatform==1.115.0 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core==0.23.0
+
+      - name: Setup litellm-enterprise
+        run: |
+          poetry run pip install --force-reinstall --no-deps -e enterprise/
 
       - name: Generate Prisma client
         env:
           PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
         run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+          poetry run pip install nodejs-wheel-binaries==24.13.1
+          poetry run prisma generate --schema litellm/proxy/schema.prisma
 
       - name: Run tests
         env:
@@ -83,53 +86,11 @@ jobs:
           WORKERS: ${{ inputs.workers }}
           RERUNS: ${{ inputs.reruns }}
         run: |
-          uv run --no-sync pytest ${TEST_PATH:?} \
+          poetry run pytest ${TEST_PATH:?} \
             --tb=short -vv \
             --maxfail="${MAX_FAILURES}" \
             -n "${WORKERS}" \
             --reruns "${RERUNS}" \
             --reruns-delay 1 \
             --dist=loadscope \
-            --durations=20 \
-            --cov=litellm \
-            --cov-report=xml:coverage.xml \
-            --cov-config=pyproject.toml
-
-      - name: Save coverage report
-        if: always()
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
-          path: coverage.xml
-          retention-days: 1
-
-  upload-coverage:
-    name: Upload coverage to Codecov
-    needs: run
-    if: always()
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-      pull-requests: write
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Download coverage report
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
-        with:
-          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
-          path: coverage-reports
-          merge-multiple: true
-
-      - name: Upload to Codecov
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
-        with:
-          use_oidc: true
-          directory: coverage-reports
-          root_dir: ${{ github.workspace }}
-          fail_ci_if_error: false
+            --durations=20

.github/workflows/_test-unit-services-base.yml

@@ -27,17 +27,23 @@ on:
         required: false
         type: number
         default: 10
+      enable-redis:
+        description: "Pass Redis Cloud credentials to tests via REDIS_HOST/PORT/PASSWORD env vars"
+        required: false
+        type: boolean
+        default: false
       enable-postgres:
         description: "Start a local Postgres service container and run Prisma migrations"
         required: false
         type: boolean
         default: false
-      artifact-name:
-        description: "Unique name for the coverage artifact (must be unique per run)"
-        required: false
-        type: string
-        default: "run"
     secrets:
+      REDIS_HOST:
+        required: false
+      REDIS_PORT:
+        required: false
+      REDIS_PASSWORD:
+        required: false
       DATABASE_URL:
         required: false
       POSTGRES_USER:
@@ -55,8 +61,11 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     # Environment is derived from the enable-* flags, not caller-controllable.
     # This prevents callers from passing arbitrary environment names to bypass secret scoping.
+    # Note: Postgres service container always starts (GHA limitation), so any Redis job
+    # also needs Postgres secrets → uses integration-redis-postgres, not integration-redis.
     environment: >-
       ${{
+        inputs.enable-redis && 'integration-redis-postgres' ||
         inputs.enable-postgres && 'integration-postgres' ||
         ''
       }}
@@ -86,37 +95,44 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
+      - name: Install Poetry
+        run: pip install 'poetry==2.3.2'
 
-      - name: Cache uv dependencies
+      - name: Cache Poetry dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
-            ~/.cache/uv
+            ~/.cache/pypoetry
+            ~/.cache/pip
             .venv
-          key: ${{ runner.os }}-uv-services-${{ hashFiles('uv.lock') }}
+          key: ${{ runner.os }}-poetry-services-${{ hashFiles('poetry.lock') }}
           restore-keys: |
-            ${{ runner.os }}-uv-services-
+            ${{ runner.os }}-poetry-services-
 
       - name: Install dependencies
         run: |
-          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+          poetry config virtualenvs.in-project true
+          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
+          poetry run pip install google-genai==1.22.0 \
+            google-cloud-aiplatform==1.115.0 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core==0.23.0
+
+      - name: Setup litellm-enterprise
+        run: |
+          poetry run pip install --force-reinstall --no-deps -e enterprise/
 
       - name: Generate Prisma client
         env:
           PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
         run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+          poetry run pip install nodejs-wheel-binaries==24.13.1
+          poetry run prisma generate --schema litellm/proxy/schema.prisma
 
       - name: Run Prisma migrations
         if: ${{ inputs.enable-postgres }}
         env:
           DATABASE_URL: ${{ secrets.DATABASE_URL }}
         run: |
-          uv run --no-sync prisma db push --schema litellm/proxy/schema.prisma --accept-data-loss
+          poetry run prisma db push --schema litellm/proxy/schema.prisma --accept-data-loss
 
       - name: Run tests
         env:
@@ -125,66 +141,24 @@ jobs:
           WORKERS: ${{ inputs.workers }}
           RERUNS: ${{ inputs.reruns }}
           DATABASE_URL: ${{ inputs.enable-postgres && secrets.DATABASE_URL || '' }}
+          REDIS_HOST: ${{ inputs.enable-redis && secrets.REDIS_HOST || '' }}
+          REDIS_PORT: ${{ inputs.enable-redis && secrets.REDIS_PORT || '' }}
+          REDIS_PASSWORD: ${{ inputs.enable-redis && secrets.REDIS_PASSWORD || '' }}
         run: |
           if [ "${WORKERS}" = "0" ]; then
-            uv run --no-sync pytest ${TEST_PATH:?} \
+            poetry run pytest ${TEST_PATH:?} \
               --tb=short -vv \
               --maxfail="${MAX_FAILURES}" \
               --reruns "${RERUNS}" \
               --reruns-delay 1 \
-              --durations=20 \
-              --cov=litellm \
-              --cov-report=xml:coverage.xml \
-              --cov-config=pyproject.toml
+              --durations=20
           else
-            uv run --no-sync pytest ${TEST_PATH:?} \
+            poetry run pytest ${TEST_PATH:?} \
               --tb=short -vv \
               --maxfail="${MAX_FAILURES}" \
               -n "${WORKERS}" \
               --reruns "${RERUNS}" \
               --reruns-delay 1 \
               --dist=loadscope \
-              --durations=20 \
-              --cov=litellm \
-              --cov-report=xml:coverage.xml \
-              --cov-config=pyproject.toml
+              --durations=20
           fi
-
-      - name: Save coverage report
-        if: always()
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
-          path: coverage.xml
-          retention-days: 1
-
-  upload-coverage:
-    name: Upload coverage to Codecov
-    needs: run
-    if: always()
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-      pull-requests: write
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Download coverage report
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
-        with:
-          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
-          path: coverage-reports
-          merge-multiple: true
-
-      - name: Upload to Codecov
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
-        with:
-          use_oidc: true
-          directory: coverage-reports
-          root_dir: ${{ github.workspace }}
-          fail_ci_if_error: false

.github/workflows/auto_update_price_and_context_window.yml

@@ -17,13 +17,12 @@ jobs:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           persist-credentials: false
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
+      - name: Install Dependencies
+        run: |
+          pip install 'aiohttp==3.13.3'
       - name: Update JSON Data
         run: |
-          uv run --frozen --with 'aiohttp==3.13.3' python ".github/workflows/auto_update_price_and_context_window_file.py"
+          python ".github/workflows/auto_update_price_and_context_window_file.py"
       - name: Create Pull Request
         run: |
           git add model_prices_and_context_window.json 

.github/workflows/codspeed.yml

@@ -34,21 +34,13 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
+      - name: Install dependencies
+        run: |
+          pip install -e "."
+          pip install pytest pytest-codspeed==4.3.0
 
       - name: Run benchmarks
         uses: CodSpeedHQ/action@1c8ae4843586d3ba879736b7f6b7b0c990757fab # v4.12.1
         with:
           mode: simulation
-          run: >
-            env PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-            uv run --frozen --no-default-groups
-            --with pytest==8.3.5
-            --with pytest-codspeed==4.3.0
-            pytest
-            -p pytest_codspeed.plugin
-            tests/benchmarks/
-            --codspeed
+          run: pytest tests/benchmarks/ --codspeed

.github/workflows/create-release.yml

@@ -48,21 +48,7 @@ jobs:
             const cosignSection = [
               `## Verify Docker Image Signature`,
               ``,
-              `All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit \`0112e53\`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).`,
-              ``,
-              `**Verify using the pinned commit hash (recommended):**`,
-              ``,
-              `A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:`,
-              ``,
-              '```bash',
-              `cosign verify \\`,
-              `  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \\`,
-              `  ghcr.io/berriai/litellm:${tag}`,
-              '```',
-              ``,
-              `**Verify using the release tag (convenience):**`,
-              ``,
-              `Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:`,
+              `All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). To verify the integrity of an image before deploying:`,
               ``,
               '```bash',
               `cosign verify \\`,

.github/workflows/guard-main-branch.yml

@@ -1,42 +0,0 @@
-name: Guard main branch
-
-on:
-  pull_request:
-    branches:
-      - main
-  merge_group:
-
-permissions: {}
-
-# DO NOT RENAME the job's `name:` — it is referenced by GitHub branch
-# protection as a required status check on `main`. Renaming silently
-# breaks the gate.
-jobs:
-  guard:
-    name: Verify PR source branch
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    steps:
-      - name: Reject merge_group events
-        if: github.event_name == 'merge_group'
-        run: |
-          echo "::error::Merge queue is not supported for main. Disable merge queue or update this guard."
-          exit 1
-      - name: Check head branch name
-        env:
-          HEAD_REF: ${{ github.head_ref }}
-          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
-          BASE_REPO: ${{ github.repository }}
-        run: |
-          echo "PR head repo: $HEAD_REPO"
-          echo "PR head branch: $HEAD_REF"
-          if [ "$HEAD_REPO" != "$BASE_REPO" ]; then
-            echo "::error::PRs to main must originate from the canonical repository ($BASE_REPO), not a fork ($HEAD_REPO). External contributors should open PRs against the 'litellm_oss_branch' branch instead."
-            exit 1
-          fi
-          if [ "$HEAD_REF" = "litellm_internal_staging" ] || [[ "$HEAD_REF" == litellm_hotfix_?* ]]; then
-            echo "Allowed source branch."
-            exit 0
-          fi
-          echo "::error::PRs to main must originate from 'litellm_internal_staging' or a 'litellm_hotfix_*' branch. Got: '$HEAD_REF'. If this is a contribution, retarget the PR against 'litellm_oss_branch' instead."
-          exit 1

.github/workflows/llm-translation-testing.yml

@@ -31,25 +31,26 @@ jobs:
         with:
           python-version: "3.11"
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
-          enable-cache: false
+      - name: Install Poetry
+        run: |
+          pip install 'poetry==2.3.2'
+          poetry config virtualenvs.create true
+          poetry config virtualenvs.in-project true
 
-      - name: Restore uv dependencies cache
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      - name: Restore Poetry dependencies cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.0.0
         with:
           path: |
-            ~/.cache/uv
+            ~/.cache/pypoetry
             .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }}
           restore-keys: |
-            ${{ runner.os }}-uv-
+            ${{ runner.os }}-poetry-
 
       - name: Install dependencies
         run: |
-          uv sync --frozen
+          poetry install --with dev
+          poetry run pip install 'pytest-xdist==3.8.0' 'pytest-timeout==2.4.0'
 
       - name: Create test results directory
         run: mkdir -p test-results

.github/workflows/publish_to_pypi.yml

@@ -24,22 +24,10 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
-          enable-cache: false
-
       - name: Check litellm version on PyPI
         id: check-litellm
         run: |
-          VERSION=$(python - <<'PY'
-          import tomllib
-
-          with open("pyproject.toml", "rb") as f:
-              print(tomllib.load(f)["project"]["version"])
-          PY
-          )
+          VERSION=$(grep -m1 '^version' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "Checking if litellm $VERSION exists on PyPI..."
 
@@ -54,46 +42,43 @@ jobs:
 
       - name: Sanity check proxy-extras version
         run: |
-          # Read pinned version from project optional dependencies
-          PYPROJECT_VERSION=$(python3 - <<'PY'
-          import sys
-          import tomllib
-
-          with open("pyproject.toml", "rb") as f:
-              proxy_requirements = tomllib.load(f)["project"]["optional-dependencies"]["proxy"]
-
-          version = None
-          for requirement in proxy_requirements:
-              normalized = requirement.split(";", 1)[0].strip()
-              if not normalized.startswith("litellm-proxy-extras"):
-                  continue
-              parts = normalized.split("==", 1)
-              if len(parts) == 2 and parts[0].strip() == "litellm-proxy-extras":
-                  candidate = parts[1].strip()
-                  if candidate:
-                      version = candidate
-                      break
-
-          if version is None:
-              print(
-                  "::error::Could not find an exact litellm-proxy-extras pin in project.optional-dependencies.proxy",
-                  file=sys.stderr,
-              )
-              sys.exit(1)
-
-          print(version)
-          PY
-          )
-          echo "pyproject.toml pins litellm-proxy-extras version: $PYPROJECT_VERSION"
-
-          # Check that the pinned version exists on PyPI
-          echo "Checking if litellm-proxy-extras $PYPROJECT_VERSION exists on PyPI..."
-          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm-proxy-extras/$PYPROJECT_VERSION/json")
-          if [ "$HTTP_STATUS" != "200" ]; then
-            echo "::error::litellm-proxy-extras $PYPROJECT_VERSION is not published on PyPI yet. Publish it before releasing litellm."
+          # Read pinned version from requirements.txt
+          REQ_VERSION=$(grep -oP 'litellm-proxy-extras==\K[0-9.]+' requirements.txt)
+          if [ -z "$REQ_VERSION" ]; then
+            echo "::error::Could not find litellm-proxy-extras version in requirements.txt"
             exit 1
           fi
-          echo "litellm-proxy-extras $PYPROJECT_VERSION exists on PyPI. Sanity check passed."
+          echo "requirements.txt pins litellm-proxy-extras==$REQ_VERSION"
+
+          # Read pinned version from pyproject.toml dependency
+          PYPROJECT_VERSION=$(python3 -c "
+          import re
+          with open('pyproject.toml') as f:
+              content = f.read()
+          match = re.search(r'litellm-proxy-extras\s*=\s*\{version\s*=\s*\"([^\"]+)\"', content)
+          if match:
+              print(match.group(1).lstrip('^~>='))
+          else:
+              import sys
+              print('::error::Could not find litellm-proxy-extras dependency in pyproject.toml', file=sys.stderr)
+              sys.exit(1)
+          ")
+          echo "pyproject.toml pins litellm-proxy-extras version: $PYPROJECT_VERSION"
+
+          # Check that both pinned versions match
+          if [ "$REQ_VERSION" != "$PYPROJECT_VERSION" ]; then
+            echo "::error::Version mismatch: requirements.txt has $REQ_VERSION but pyproject.toml has $PYPROJECT_VERSION"
+            exit 1
+          fi
+
+          # Check that the pinned version exists on PyPI
+          echo "Checking if litellm-proxy-extras $REQ_VERSION exists on PyPI..."
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm-proxy-extras/$REQ_VERSION/json")
+          if [ "$HTTP_STATUS" != "200" ]; then
+            echo "::error::litellm-proxy-extras $REQ_VERSION is not published on PyPI yet. Publish it before releasing litellm."
+            exit 1
+          fi
+          echo "litellm-proxy-extras $REQ_VERSION exists on PyPI. Sanity check passed."
 
   publish-litellm:
     name: Publish litellm to PyPI
@@ -115,19 +100,16 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
-          enable-cache: false
-
       - name: Copy model prices backup
         run: cp model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
 
+      - name: Install build tools
+        run: python -m pip install --upgrade pip build==1.4.2
+
       - name: Build package
         run: |
           rm -rf build dist
-          uv build
+          python -m build
 
       - name: Verify build artifacts
         env:
@@ -147,7 +129,8 @@ jobs:
 
       - name: Validate package metadata
         run: |
-          uv tool run --from 'twine==6.2.0' twine check dist/*
+          pip install twine==6.2.0
+          twine check dist/*
 
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

.github/workflows/run_llm_translation_tests.py

@@ -325,7 +325,7 @@ def run_tests(test_path: str = "tests/llm_translation/",
     
     # Run pytest
     cmd = [
-        "uv", "run", "--no-sync", "pytest", test_path,
+        "poetry", "run", "pytest", test_path,
         f"--junitxml={junit_xml}",
         "-v",
         "--tb=short",
@@ -335,7 +335,7 @@ def run_tests(test_path: str = "tests/llm_translation/",
     
     # Add timeout if pytest-timeout is installed
     try:
-        subprocess.run(["uv", "run", "--no-sync", "python", "-c", "import pytest_timeout"], 
+        subprocess.run(["poetry", "run", "python", "-c", "import pytest_timeout"], 
                       capture_output=True, check=True)
         cmd.extend(["--timeout=300"])
     except:
@@ -436,4 +436,4 @@ if __name__ == "__main__":
         commit=args.commit
     )
     
-    sys.exit(exit_code)
+    sys.exit(exit_code)

.github/workflows/test-linting.yml

@@ -2,11 +2,7 @@ name: LiteLLM Linting
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
@@ -28,28 +24,26 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
+      - name: Install Poetry
+        run: pip install 'poetry==2.3.2'
 
       - name: Clean Python cache
         run: |
           find . -type d -name "__pycache__" -exec rm -rf {} + || true
           find . -name "*.pyc" -delete || true
 
-      - name: Check uv.lock is up to date
+      - name: Check poetry.lock is up to date
         run: |
-          uv lock --check || (echo "❌ uv.lock is out of sync with pyproject.toml. Run 'uv lock' locally and commit the result." && exit 1)
+          poetry check --lock || (echo "❌ poetry.lock is out of sync with pyproject.toml. Run 'poetry lock' locally and commit the result." && exit 1)
 
       - name: Install dependencies
         run: |
-          uv sync --frozen
+          poetry install --with dev
 
       - name: Check Black formatting
         run: |
           cd litellm
-          uv run --no-sync black --check --exclude '/enterprise/' .
+          poetry run black --check --exclude '/enterprise/' .
           cd ..
 
       - name: Debug - Check file state
@@ -64,28 +58,28 @@ jobs:
       - name: Run Ruff linting
         run: |
           cd litellm
-          uv run --no-sync ruff check .
+          poetry run ruff check .
           cd ..
 
       - name: Print OpenAI version
         run: |
-          uv run --no-sync python -c "import openai; print(f'OpenAI version: {openai.__version__}')"
+          poetry run python -c "import openai; print(f'OpenAI version: {openai.__version__}')"
 
       - name: Run MyPy type checking
         run: |
           cd litellm
-          uv run --no-sync mypy .
+          poetry run mypy . 
           cd ..
 
       - name: Check for circular imports
         run: |
           cd litellm
-          uv run --no-sync python ../tests/documentation_tests/test_circular_imports.py
+          poetry run python ../tests/documentation_tests/test_circular_imports.py
           cd ..
 
       - name: Check import safety
         run: |
-          uv run --no-sync python -c "from litellm import *" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
+          poetry run python -c "from litellm import *" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
 
   secret-scan:
     runs-on: ubuntu-latest
@@ -104,21 +98,18 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
-
       - name: Run secret scan test
         run: |
-          uv run --frozen --with 'pytest==9.0.2' pytest tests/litellm/test_no_hardcoded_secrets.py -v
+          pip install 'pytest==9.0.2'
+          pytest tests/litellm/test_no_hardcoded_secrets.py -v
 
       - name: Run ggshield secret scan
         env:
           GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
         run: |
           if [ -n "$GITGUARDIAN_API_KEY" ]; then
-            uv tool run --from 'ggshield==1.48.0' ggshield secret scan repo .
+            pip install 'ggshield==1.48.0'
+            ggshield secret scan repo .
           else
             echo "GITGUARDIAN_API_KEY not set, skipping ggshield scan"
           fi

.github/workflows/test-litellm-matrix.yml

@@ -0,0 +1,214 @@
+name: LiteLLM Unit Tests (Matrix)
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+# Cancel in-progress runs for the same PR
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20 # Increased from 15 to 20
+    strategy:
+      fail-fast: false
+      matrix:
+        test-group:
+          # tests/test_litellm split by subdirectory (~560 files total)
+          # Vertex AI tests separated for better isolation (prevent auth/env pollution)
+          - name: "llms-vertex"
+            path: "tests/test_litellm/llms/vertex_ai"
+            workers: 1
+            reruns: 2
+          - name: "llms-other"
+            path: "tests/test_litellm/llms --ignore=tests/test_litellm/llms/vertex_ai"
+            workers: 2
+            reruns: 2
+          # tests/test_litellm/proxy split by subdirectory (~180 files total)
+          - name: "proxy-guardrails"
+            path: "tests/test_litellm/proxy/guardrails tests/test_litellm/proxy/management_endpoints tests/test_litellm/proxy/management_helpers"
+            workers: 2
+            reruns: 2
+          - name: "proxy-core"
+            path: "tests/test_litellm/proxy/auth tests/test_litellm/proxy/client tests/test_litellm/proxy/db tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine"
+            workers: 2
+            reruns: 2
+          - name: "proxy-misc"
+            path: "tests/test_litellm/proxy/_experimental tests/test_litellm/proxy/agent_endpoints tests/test_litellm/proxy/anthropic_endpoints tests/test_litellm/proxy/common_utils tests/test_litellm/proxy/discovery_endpoints tests/test_litellm/proxy/experimental tests/test_litellm/proxy/google_endpoints tests/test_litellm/proxy/health_endpoints tests/test_litellm/proxy/image_endpoints tests/test_litellm/proxy/middleware tests/test_litellm/proxy/openai_files_endpoint tests/test_litellm/proxy/pass_through_endpoints tests/test_litellm/proxy/prompts tests/test_litellm/proxy/public_endpoints tests/test_litellm/proxy/response_api_endpoints tests/test_litellm/proxy/spend_tracking tests/test_litellm/proxy/ui_crud_endpoints tests/test_litellm/proxy/vector_store_endpoints tests/test_litellm/proxy/test_*.py"
+            workers: 2
+            reruns: 2
+          - name: "integrations"
+            path: "tests/test_litellm/integrations"
+            workers: 2
+            reruns: 3 # Integration tests tend to be flakier
+          - name: "core-utils"
+            path: "tests/test_litellm/litellm_core_utils"
+            workers: 2
+            reruns: 1
+          - name: "other-1"
+            # responses (5942) + caching (1723) + types (819) ≈ 8.5k lines
+            path: "tests/test_litellm/responses tests/test_litellm/caching tests/test_litellm/types"
+            workers: 2
+            reruns: 2
+          - name: "other-2"
+            # enterprise (3062) + google_genai (2511) + router_utils (1982) ≈ 7.6k lines
+            path: "tests/test_litellm/enterprise tests/test_litellm/google_genai tests/test_litellm/router_utils"
+            workers: 2
+            reruns: 2
+          - name: "other-3"
+            # remaining dirs ≈ 8.0k lines
+            path: "tests/test_litellm/router_strategy tests/test_litellm/secret_managers tests/test_litellm/a2a_protocol tests/test_litellm/anthropic_interface tests/test_litellm/completion_extras tests/test_litellm/containers tests/test_litellm/experimental_mcp_client tests/test_litellm/images tests/test_litellm/interactions tests/test_litellm/passthrough tests/test_litellm/vector_stores"
+            workers: 2
+            reruns: 2
+          - name: "root"
+            path: "tests/test_litellm/test_*.py"
+            workers: 2
+            reruns: 2
+          # tests/proxy_unit_tests split alphabetically (~48 files total)
+          - name: "proxy-unit-a1"
+            # test_[a-j]*.py: jwt (1564) + auth_checks (978) + google_gemini (478) + e2e_pod_lock (437) + rest
+            path: "tests/proxy_unit_tests/test_[a-j]*.py"
+            workers: 2
+            reruns: 1
+          - name: "proxy-unit-a2"
+            # test_[k-o]*.py: key_generate_prisma (4346) + key_generate_dynamodb + models_fallback
+            path: "tests/proxy_unit_tests/test_[k-o]*.py"
+            workers: 2
+            reruns: 1
+          - name: "proxy-unit-b1"
+            # lighter config/utility proxy tests (prisma, project, prompt, proxy_[c-r]*)
+            path: "tests/proxy_unit_tests/test_prisma*.py tests/proxy_unit_tests/test_project*.py tests/proxy_unit_tests/test_prompt*.py tests/proxy_unit_tests/test_proxy_[c-r]*.py"
+            workers: 2
+            reruns: 1
+          - name: "proxy-unit-b2"
+            # proxy_server.py alone (2750 lines) - isolated to avoid blocking smaller tests
+            path: "tests/proxy_unit_tests/test_proxy_server.py"
+            workers: 2
+            reruns: 1
+          - name: "proxy-unit-b3"
+            # proxy_server_* (618) + proxy_setting_guardrails (71) - smaller server-related tests
+            path: "tests/proxy_unit_tests/test_proxy_server_*.py tests/proxy_unit_tests/test_proxy_setting_guardrails.py"
+            workers: 2
+            reruns: 1
+          - name: "proxy-unit-b4"
+            # proxy_utils.py alone (2339 lines) - isolated to avoid blocking token counter
+            path: "tests/proxy_unit_tests/test_proxy_utils.py"
+            workers: 2
+            reruns: 1
+          - name: "proxy-unit-b5"
+            # proxy_token_counter (1279) - runs independently from utils
+            path: "tests/proxy_unit_tests/test_proxy_token_counter.py"
+            workers: 2
+            reruns: 1
+          - name: "proxy-unit-b6"
+            # test_[r-t]*.py: response_polling (1399) + search_api_logging (202) + server_root (64) + skills_db (261) + realtime_cache (62)
+            path: "tests/proxy_unit_tests/test_[r-t]*.py"
+            workers: 2
+            reruns: 1
+          - name: "proxy-unit-b7"
+            # test_[u-z]*.py: user_api_key_auth (1136) + zero_cost (590) + update_spend (305) + unit_test_* (206) + ui_path (157)
+            path: "tests/proxy_unit_tests/test_[u-z]*.py"
+            workers: 2
+            reruns: 1
+
+    name: test (${{ matrix.test-group.name }})
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Install Poetry
+        run: pip install 'poetry==2.3.2'
+
+      - name: Cache Poetry dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.0.0
+        with:
+          path: |
+            ~/.cache/pypoetry
+            ~/.cache/pip
+            .venv
+          key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-poetry-
+
+      - name: Install dependencies
+        run: |
+          poetry config virtualenvs.in-project true
+          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
+          # pytest-rerunfailures and pytest-xdist are in pyproject.toml dev dependencies
+          poetry run pip install google-genai==1.22.0 \
+            google-cloud-aiplatform==1.115.0 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core==0.23.0
+
+      - name: Setup litellm-enterprise
+        run: |
+          poetry run pip install --force-reinstall --no-deps -e enterprise/
+
+      - name: Generate Prisma client
+        env:
+          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
+        run: |
+          poetry run pip install nodejs-wheel-binaries==24.13.1
+          poetry run prisma generate --schema litellm/proxy/schema.prisma
+
+      - name: Run tests - ${{ matrix.test-group.name }}
+        run: |
+          poetry run pytest ${{ matrix.test-group.path }} \
+            --tb=short -vv \
+            --maxfail=10 \
+            -n ${{ matrix.test-group.workers }} \
+            --reruns ${{ matrix.test-group.reruns }} \
+            --reruns-delay 1 \
+            --dist=loadscope \
+            --durations=20 \
+            --cov=litellm \
+            --cov-report=xml:coverage-${{ matrix.test-group.name }}.xml \
+            --cov-config=pyproject.toml
+
+      - name: Save coverage report
+        if: always()
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: coverage-${{ matrix.test-group.name }}
+          path: coverage-${{ matrix.test-group.name }}.xml
+          retention-days: 1
+
+  upload-coverage:
+    name: Upload coverage to Codecov
+    needs: test
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write        # Required for OIDC tokenless upload
+      pull-requests: write   # Required for Codecov PR comments
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Download all coverage reports
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern: coverage-*
+          path: coverage-reports
+          merge-multiple: true
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@aa56896cf108bd10b5eb883cd1d24196da57f695 # v5.5.4
+        with:
+          use_oidc: true
+          directory: coverage-reports
+          root_dir: ${{ github.workspace }}
+          fail_ci_if_error: false

.github/workflows/test-litellm-ui-build.yml

@@ -4,11 +4,7 @@ permissions:
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 jobs:
   build-ui:

.github/workflows/test-litellm.yml

@@ -31,15 +31,23 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
+      - name: Install Poetry
+        run: pip install 'poetry==2.3.2'
 
       - name: Install dependencies
         run: |
-          uv lock --check
-          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+          poetry lock
+          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
+          poetry run pip install "pytest-retry==1.6.3"
+          poetry run pip install 'pytest-xdist==3.8.0'
+          poetry run pip install "google-genai==1.22.0"
+          poetry run pip install "google-cloud-aiplatform==1.115.0"
+          poetry run pip install "fastapi-offline==1.7.3"
+          poetry run pip install "python-multipart==0.0.22"
+          poetry run pip install "openapi-core==0.23.0"
+      - name: Setup litellm-enterprise as local package
+        run: |
+          poetry run pip install --force-reinstall --no-deps -e enterprise/
       - name: Run tests
         run: |
-          uv run --no-sync pytest tests/test_litellm --tb=short -vv --maxfail=10 -n 4 --durations=50
+          poetry run pytest tests/test_litellm --tb=short -vv --maxfail=10 -n 4 --durations=50

.github/workflows/test-mcp.yml

@@ -2,11 +2,7 @@ name: LiteLLM MCP Tests (folder - tests/mcp_tests)
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
@@ -31,16 +27,26 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
+      - name: Install Poetry
+        run: pip install 'poetry==2.3.2'
 
       - name: Install dependencies
         run: |
-          uv lock --check
-          uv sync --frozen --group proxy-dev --extra proxy --extra semantic-router
+          poetry lock
+          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
+          poetry run pip install "pytest==7.3.1"
+          poetry run pip install "pytest-retry==1.6.3"
+          poetry run pip install "pytest-cov==5.0.0"
+          poetry run pip install "pytest-asyncio==0.21.1"
+          poetry run pip install "respx==0.22.0"
+          poetry run pip install "pydantic==2.11.0"
+          poetry run pip install "mcp==1.25.0"
+          poetry run pip install 'pytest-xdist==3.8.0'
+
+      - name: Setup litellm-enterprise as local package
+        run: |
+          poetry run pip install --force-reinstall --no-deps -e enterprise/
 
       - name: Run MCP tests
         run: |
-          uv run --no-sync pytest tests/mcp_tests -x -vv -n 4 --cov=litellm --cov-report=xml --durations=5
+          poetry run pytest tests/mcp_tests -x -vv -n 4 --cov=litellm --cov-report=xml --durations=5

.github/workflows/test-model-map.yaml

@@ -2,11 +2,7 @@ name: Validate model_prices_and_context_window.json
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read

.github/workflows/test-proxy-e2e-azure-batches.yml

@@ -0,0 +1,97 @@
+name: Proxy E2E Azure Batches Tests
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  proxy_e2e_azure_batches_tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    services:
+      postgres:
+        image: postgres:15
+        env:
+          POSTGRES_USER: llmproxy
+          POSTGRES_PASSWORD: dbpassword9090
+          POSTGRES_DB: litellm
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Install Poetry
+        run: pip install 'poetry==2.3.2'
+
+      - name: Cache Poetry dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.0.0
+        with:
+          path: |
+            ~/.cache/pypoetry
+            ~/.cache/pip
+            .venv
+          key: ${{ runner.os }}-poetry-e2e-batches-${{ hashFiles('poetry.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-poetry-e2e-batches-
+            ${{ runner.os }}-poetry-
+
+      - name: Install dependencies
+        run: |
+          poetry config virtualenvs.in-project true
+          poetry install --with dev,proxy-dev --extras "proxy"
+          poetry run pip install psycopg2-binary==2.9.11 uvicorn==0.42.0 fastapi==0.135.2 httpx==0.28.1 tenacity==9.1.4
+
+      - name: Setup litellm-enterprise
+        run: |
+          poetry run pip install --force-reinstall --no-deps -e enterprise/
+
+      - name: Generate Prisma client
+        env:
+          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
+        run: |
+          poetry run pip install nodejs-wheel-binaries==24.13.1
+          poetry run prisma generate --schema litellm/proxy/schema.prisma
+
+      - name: Run Prisma migrations
+        env:
+          DATABASE_URL: postgresql://llmproxy:dbpassword9090@localhost:5432/litellm
+        run: |
+          cd litellm/proxy
+          poetry run prisma migrate deploy --schema schema.prisma
+          cd ../..
+
+      - name: Run Azure Batch E2E Tests
+        env:
+          DATABASE_URL: postgresql://llmproxy:dbpassword9090@localhost:5432/litellm
+          USE_LOCAL_LITELLM: "true"
+          USE_MOCK_MODELS: "true"
+          USE_STATE_TRACKER: "true"
+          LITELLM_LOG: DEBUG
+        run: |
+          poetry run pytest tests/proxy_e2e_azure_batches_tests/test_proxy_e2e_azure_batches.py \
+            -vv -s -k "test_e2e_managed_batch" \
+            --tb=short \
+            --maxfail=3 \
+            --durations=10

.github/workflows/test-unit-caching-redis.yml

@@ -0,0 +1,38 @@
+name: "Unit Tests: Caching (Redis)"
+
+# Uses cloud Redis credentials — only runs on trusted branches, not PRs.
+# This prevents external PRs from accessing Redis credentials.
+on:
+  push:
+    branches: [main, "litellm_*"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  caching-redis:
+    uses: ./.github/workflows/_test-unit-services-base.yml
+    with:
+      # Redis-only tests that do NOT require provider API keys.
+      # Tests needing API keys (test_caching.py, test_caching_ssl.py, test_prometheus_service.py,
+      # test_router_caching.py) are in Phase 3 integration workflows.
+      test-path: >-
+        tests/local_testing/test_dual_cache.py
+        tests/local_testing/test_redis_batch_optimizations.py
+        tests/local_testing/test_router_utils.py
+      workers: 2
+      reruns: 2
+      timeout-minutes: 20
+      enable-redis: true
+      enable-postgres: false
+    secrets:
+      REDIS_HOST: ${{ secrets.REDIS_HOST }}
+      REDIS_PORT: ${{ secrets.REDIS_PORT }}
+      REDIS_PASSWORD: ${{ secrets.REDIS_PASSWORD }}
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}
+      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}

.github/workflows/test-unit-core-utils.yml

@@ -2,16 +2,10 @@ name: "Unit Tests: Core Utilities"
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
-  id-token: write
-  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -24,4 +18,3 @@ jobs:
       test-path: "tests/test_litellm/litellm_core_utils"
       workers: 2
       reruns: 1
-      artifact-name: core-utils

.github/workflows/test-unit-documentation.yml

@@ -2,11 +2,7 @@ name: "Unit Tests: Documentation Validation"
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
@@ -30,35 +26,42 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
+      - name: Install Poetry
+        run: pip install 'poetry==2.3.2'
 
-      - name: Cache uv dependencies
+      - name: Cache Poetry dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
-            ~/.cache/uv
+            ~/.cache/pypoetry
+            ~/.cache/pip
             .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
           restore-keys: |
-            ${{ runner.os }}-uv-
+            ${{ runner.os }}-poetry-
 
       - name: Install dependencies
         run: |
-          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+          poetry config virtualenvs.in-project true
+          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
+          poetry run pip install google-genai==1.22.0 \
+            google-cloud-aiplatform==1.115.0 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core==0.23.0
+
+      - name: Setup litellm-enterprise
+        run: |
+          poetry run pip install --force-reinstall --no-deps -e enterprise/
 
       - name: Generate Prisma client
         env:
           PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
         run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+          poetry run pip install nodejs-wheel-binaries==24.13.1
+          poetry run prisma generate --schema litellm/proxy/schema.prisma
 
       # Run the same documentation tests that CircleCI ran (as direct Python scripts)
       - name: Run documentation validation tests
         run: |
-          uv run --no-sync python ./tests/documentation_tests/test_env_keys.py
-          uv run --no-sync python ./tests/documentation_tests/test_router_settings.py
-          uv run --no-sync python ./tests/documentation_tests/test_api_docs.py
-          uv run --no-sync python ./tests/documentation_tests/test_circular_imports.py
+          poetry run python ./tests/documentation_tests/test_env_keys.py
+          poetry run python ./tests/documentation_tests/test_router_settings.py
+          poetry run python ./tests/documentation_tests/test_api_docs.py
+          poetry run python ./tests/documentation_tests/test_circular_imports.py

.github/workflows/test-unit-enterprise-routing.yml

@@ -2,16 +2,10 @@ name: "Unit Tests: Enterprise, Google GenAI & Routing"
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
-  id-token: write
-  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -28,4 +22,3 @@ jobs:
         tests/test_litellm/router_strategy
       workers: 2
       reruns: 2
-      artifact-name: enterprise-routing

.github/workflows/test-unit-integrations.yml

@@ -2,16 +2,10 @@ name: "Unit Tests: Integrations (Callbacks & Logging)"
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
-  id-token: write
-  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -24,4 +18,3 @@ jobs:
       test-path: "tests/test_litellm/integrations"
       workers: 2
       reruns: 3
-      artifact-name: integrations

.github/workflows/test-unit-llm-providers.yml

@@ -2,11 +2,7 @@ name: "Unit Tests: LLM Provider Transformations"
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
@@ -18,26 +14,16 @@ concurrency:
 jobs:
   vertex-ai:
     name: Vertex AI
-    permissions:
-      contents: read
-      id-token: write
-      pull-requests: write
     uses: ./.github/workflows/_test-unit-base.yml
     with:
       test-path: "tests/test_litellm/llms/vertex_ai"
       workers: 1
       reruns: 2
-      artifact-name: llm-vertex-ai
 
   other-providers:
     name: All Other Providers
-    permissions:
-      contents: read
-      id-token: write
-      pull-requests: write
     uses: ./.github/workflows/_test-unit-base.yml
     with:
       test-path: "tests/test_litellm/llms --ignore=tests/test_litellm/llms/vertex_ai"
       workers: 2
       reruns: 2
-      artifact-name: llm-other-providers

.github/workflows/test-unit-misc.yml

@@ -2,16 +2,10 @@ name: "Unit Tests: MCP, Secrets, Containers & Misc"
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
-  id-token: write
-  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -35,4 +29,3 @@ jobs:
         tests/test_litellm/test_*.py
       workers: 2
       reruns: 2
-      artifact-name: misc

.github/workflows/test-unit-proxy-auth.yml

@@ -2,16 +2,10 @@ name: "Unit Tests: Proxy Auth & Key Management"
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
-  id-token: write
-  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -24,4 +18,3 @@ jobs:
       test-path: "tests/test_litellm/proxy/auth tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine tests/test_litellm/proxy/client"
       workers: 2
       reruns: 2
-      artifact-name: proxy-auth

.github/workflows/test-unit-proxy-db.yml

@@ -3,7 +3,7 @@ name: "Unit Tests: Proxy DB Operations"
 # Uses DATABASE_URL secret — only runs on trusted branches, not PRs.
 on:
   push:
-    branches: [main, "litellm_**"]
+    branches: [main, "litellm_*"]
 
 permissions:
   contents: read
@@ -14,10 +14,6 @@ concurrency:
 
 jobs:
   proxy-db:
-    permissions:
-      contents: read
-      id-token: write
-      pull-requests: write
     strategy:
       fail-fast: false
       matrix:
@@ -34,15 +30,15 @@ jobs:
           - test-group: remaining
             test-path: "tests/proxy_unit_tests --ignore=tests/proxy_unit_tests/test_key_generate_prisma.py --ignore=tests/proxy_unit_tests/test_auth_checks.py --ignore=tests/proxy_unit_tests/test_user_api_key_auth.py"
             workers: 8
-            timeout: 30
+            timeout: 20
     uses: ./.github/workflows/_test-unit-services-base.yml
     with:
       test-path: ${{ matrix.test-path }}
       workers: ${{ matrix.workers }}
       reruns: 2
       timeout-minutes: ${{ matrix.timeout }}
+      enable-redis: false
       enable-postgres: true
-      artifact-name: proxy-db-${{ matrix.test-group }}
     secrets:
       DATABASE_URL: ${{ secrets.DATABASE_URL }}
       POSTGRES_USER: ${{ secrets.POSTGRES_USER }}

.github/workflows/test-unit-proxy-endpoints.yml

@@ -2,16 +2,10 @@ name: "Unit Tests: Proxy API Endpoints"
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
-  id-token: write
-  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -39,4 +33,3 @@ jobs:
         tests/test_litellm/proxy/ui_crud_endpoints
       workers: 2
       reruns: 2
-      artifact-name: proxy-endpoints

.github/workflows/test-unit-proxy-infra.yml

@@ -2,16 +2,10 @@ name: "Unit Tests: Proxy Infrastructure"
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
-  id-token: write
-  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -32,4 +26,3 @@ jobs:
         tests/test_litellm/proxy/test_*.py
       workers: 2
       reruns: 2
-      artifact-name: proxy-infra

.github/workflows/test-unit-proxy-legacy.yml

@@ -2,11 +2,7 @@ name: "Unit Tests: Proxy Legacy Tests"
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
@@ -54,36 +50,43 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
-        with:
-          version: "0.10.9"
+      - name: Install Poetry
+        run: pip install 'poetry==2.3.2'
 
-      - name: Cache uv dependencies
+      - name: Cache Poetry dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
-            ~/.cache/uv
+            ~/.cache/pypoetry
+            ~/.cache/pip
             .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
           restore-keys: |
-            ${{ runner.os }}-uv-
+            ${{ runner.os }}-poetry-
 
       - name: Install dependencies
         run: |
-          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+          poetry config virtualenvs.in-project true
+          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
+          poetry run pip install google-genai==1.22.0 \
+            google-cloud-aiplatform==1.115.0 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core==0.23.0
+
+      - name: Setup litellm-enterprise
+        run: |
+          poetry run pip install --force-reinstall --no-deps -e enterprise/
 
       - name: Generate Prisma client
         env:
           PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
         run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+          poetry run pip install nodejs-wheel-binaries==24.13.1
+          poetry run prisma generate --schema litellm/proxy/schema.prisma
 
       - name: Run tests - ${{ matrix.test-group.name }}
         env:
           TEST_PATH: ${{ matrix.test-group.path }}
         run: |
-          uv run --no-sync pytest ${TEST_PATH} \
+          poetry run pytest ${TEST_PATH} \
             --tb=short -vv \
             --maxfail=10 \
             -n 2 \

.github/workflows/test-unit-responses-caching-types.yml

@@ -2,16 +2,10 @@ name: "Unit Tests: Responses, Caching & Types"
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 permissions:
   contents: read
-  id-token: write
-  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -24,4 +18,3 @@ jobs:
       test-path: "tests/test_litellm/responses tests/test_litellm/caching tests/test_litellm/types"
       workers: 2
       reruns: 2
-      artifact-name: responses-caching-types

.github/workflows/test-unit-security.yml

@@ -3,12 +3,10 @@ name: "Unit Tests: Security"
 # Uses DATABASE_URL secret — only runs on trusted branches, not PRs.
 on:
   push:
-    branches: [main, "litellm_**"]
+    branches: [main, "litellm_*"]
 
 permissions:
   contents: read
-  id-token: write
-  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -22,8 +20,8 @@ jobs:
       workers: 1
       reruns: 2
       timeout-minutes: 20
+      enable-redis: false
       enable-postgres: true
-      artifact-name: security
     secrets:
       DATABASE_URL: ${{ secrets.DATABASE_URL }}
       POSTGRES_USER: ${{ secrets.POSTGRES_USER }}

.github/workflows/test_server_root_path.yml

@@ -4,16 +4,12 @@ permissions:
 
 on:
   pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
+    branches: [main]
 
 jobs:
   test-server-root-path:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 15
 
     strategy:
       matrix:
@@ -25,12 +21,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Free up disk space
-        run: |
-          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/boost
-          sudo apt-get clean
-          df -h /
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12
 

.trivyignore

@@ -0,0 +1,12 @@
+# LiteLLM Trivy Ignore File
+# CVEs listed here are temporarily allowlisted pending fixes
+
+# Next.js vulnerabilities in UI dashboard (next@14.2.35)
+# Allowlisted: 2026-01-31, 7-day fix timeline
+# Fix: Upgrade to Next.js 15.5.10+ or 16.1.5+
+
+# HIGH: DoS via request deserialization
+GHSA-h25m-26qc-wcjf
+
+# MEDIUM: Image Optimizer DoS
+CVE-2025-59471

AGENTS.md

@@ -51,9 +51,7 @@ LiteLLM is a unified interface for 100+ LLMs that:
 
 ### MAKING CODE CHANGES FOR THE UI (IGNORE FOR BACKEND)
 
-1. **Always use `antd` for new UI components — Tremor is DEPRECATED**
-   - We are migrating off of `@tremor/react`. Do not introduce new `Badge`, `Text`, `Card`, `Grid`, `Title`, or other imports from `@tremor/react` in any new or modified file.
-   - Use `antd` equivalents: `Tag` for labels, plain `<span>`/`<div>` with Tailwind classes (or `Typography.Text`) for text, `Card` from `antd`, etc. Note that `antd` has no `"yellow"` Tag color — use `"gold"` for amber/yellow.
+1. **Tremor is DEPRECATED, do not use Tremor components in new features/changes**
    - The only exception is the Tremor Table component and its required Tremor Table sub components.
 
 2. **Use Common Components as much as possible**:
@@ -123,7 +121,7 @@ LiteLLM supports MCP for agent workflows:
 
 ## RUNNING SCRIPTS
 
-Use `uv run python script.py` to run Python scripts in the project environment (for non-test files).
+Use `poetry run python script.py` to run Python scripts in the project environment (for non-test files).
 
 ## GITHUB TEMPLATES
 
@@ -234,16 +232,16 @@ When opening issues or pull requests, follow these templates:
 
 ### Environment
 
-- uv is installed in `~/.local/bin`; the update script ensures it is on `PATH`.
+- Poetry is installed in `~/.local/bin`; the update script ensures it is on `PATH`.
 - Python 3.12, Node 22 are pre-installed.
-- The project virtual environment lives under `.venv/`.
+- The virtual environment lives under `~/.cache/pypoetry/virtualenvs/`.
 
 ### Running the proxy server
 
 Start the proxy with a config file:
 
 ```bash
-uv run litellm --config dev_config.yaml --port 4000
+poetry run litellm --config dev_config.yaml --port 4000
 ```
 
 The proxy takes ~15-20 seconds to fully start (it runs Prisma migrations on boot). Wait for `/health` to return before sending requests. Without a PostgreSQL `DATABASE_URL`, the proxy connects to a default Neon dev database embedded in the `litellm-proxy-extras` package.
@@ -252,16 +250,17 @@ The proxy takes ~15-20 seconds to fully start (it runs Prisma migrations on boot
 
 See `CLAUDE.md` and the `Makefile` for standard commands. Key notes:
 
-- `uv sync --group proxy-dev --extra proxy` installs the Prisma and proxy-side test dependencies used by the standard local workflow.
+- `psycopg-binary` must be installed (`poetry run pip install psycopg-binary`) because the pytest-postgresql plugin requires it and the lock file only includes `psycopg` (no binary).
+- `openapi-core` must be installed (`poetry run pip install openapi-core`) for the OpenAPI compliance tests in `tests/test_litellm/interactions/`.
 - The `--timeout` pytest flag is NOT available; don't pass it.
-- Unit tests: `uv run pytest tests/test_litellm/ -x -vv -n 4`
-- **Before committing, always run `uv run black .` to format your code.** Black formatting is enforced in CI.
-- If `uv sync` fails because the lockfile is outdated, run `uv lock` and retry.
+- Unit tests: `poetry run pytest tests/test_litellm/ -x -vv -n 4`
+- Black `--check` may report pre-existing formatting issues; this does not block test runs.
+- If `poetry install` fails with "pyproject.toml changed significantly since poetry.lock was last generated", run `poetry lock` first to regenerate the lock file.
 
 ### Lint
 
 ```bash
-cd litellm && uv run ruff check .
+cd litellm && poetry run ruff check .
 ```
 
 Ruff is the primary fast linter. For the full lint suite (including mypy, black, circular imports), run `make lint` per `CLAUDE.md`.
@@ -272,4 +271,4 @@ Ruff is the primary fast linter. For the full lint suite (including mypy, black,
 - The proxy at port 4000 serves a **pre-built** static UI from `litellm/proxy/_experimental/out/`. After making UI code changes, you must run `npm run build` in the dashboard directory and copy the output: `cp -r ui/litellm-dashboard/out/* litellm/proxy/_experimental/out/` for the proxy to serve the updated UI.
 - SVGs used as provider logos (loaded via `<img>` tags) must NOT use `fill="currentColor"` — replace with an explicit color like `#000000` or use the `-color` variant from lobehub icons, since CSS color inheritance does not work inside `<img>` elements.
 - Provider logos live in `ui/litellm-dashboard/public/assets/logos/` (source) and `litellm/proxy/_experimental/out/assets/logos/` (pre-built). Both locations must have the file for it to work in dev and proxy-served modes.
-- UI Vitest tests: `cd ui/litellm-dashboard && npx vitest run`
+- UI Vitest tests: `cd ui/litellm-dashboard && npx vitest run`

CLAUDE.md

@@ -7,7 +7,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 ### Installation
 - `make install-dev` - Install core development dependencies
 - `make install-proxy-dev` - Install proxy development dependencies with full feature set
-- `make install-test-deps` - Install the full local test environment and generate the Prisma client
+- `make install-test-deps` - Install all test dependencies
 
 ### Testing
 - `make test` - Run all tests
@@ -20,14 +20,13 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - `make format` - Apply Black code formatting
 - `make lint-ruff` - Run Ruff linting only
 - `make lint-mypy` - Run MyPy type checking only
-- **Before committing, always run `uv run black .` to format your code.** Black formatting is enforced in CI.
 
 ### Single Test Files
-- `uv run pytest tests/path/to/test_file.py -v` - Run specific test file
-- `uv run pytest tests/path/to/test_file.py::test_function -v` - Run specific test
+- `poetry run pytest tests/path/to/test_file.py -v` - Run specific test file
+- `poetry run pytest tests/path/to/test_file.py::test_function -v` - Run specific test
 
 ### Running Scripts
-- `uv run python script.py` - Run Python scripts (use for non-test files)
+- `poetry run python script.py` - Run Python scripts (use for non-test files)
 
 ### GitHub Issue & PR Templates
 When contributing to the project, use the appropriate templates:
@@ -109,9 +108,6 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components:
 ### UI / Backend Consistency
 - When wiring a new UI entity type to an existing backend endpoint, verify the backend API contract (single value vs. array, required vs. optional params) and ensure the UI controls match — e.g., use a single-select dropdown when the backend accepts a single value, not a multi-select
 
-### UI Component Library
-- **Always use `antd` for new UI components** — we are migrating off of `@tremor/react`. Do not introduce new `Badge`, `Text`, `Card`, `Grid`, `Title`, or other imports from `@tremor/react` in any new or modified file. Use `antd` equivalents: `Tag` for labels, `Typography.Text` / `Typography.Title` / `Typography.Paragraph` for textual content (avoid plain text-only `<span>`, `<p>`, `<h*>` when Typography fits), and `Card` from `antd`. Note that `antd` has no `"yellow"` Tag color — use `"gold"` for amber/yellow.
-
 ### MCP OAuth / OpenAPI Transport Mapping
 - `TRANSPORT.OPENAPI` is a UI-only concept. The backend only accepts `"http"`, `"sse"`, or `"stdio"`. Always map it to `"http"` before any API call (including pre-OAuth temp-session calls).
 - FastAPI validation errors return `detail` as an array of `{loc, msg, type}` objects. Error extractors must handle: array (map `.msg`), string, nested `{error: string}`, and fallback.
@@ -154,14 +150,6 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components:
 - Optional features enabled via environment variables
 - Separate licensing and authentication for enterprise features
 
-### CI Supply-Chain Safety
-- **Never pipe a remote script into a shell** (`curl ... | bash`, `wget ... | sh`). Download the artifact to a file, verify its SHA-256 checksum, then install.
-- **Pin every external tool to a specific version** with a full URL (not `latest` or `stable`). Unversioned downloads silently change under you.
-- **Verify checksums for all downloaded binaries.** Use the provider's official `.sha256` / `.sha256sum` sidecar file when available; otherwise compute and hardcode the digest.
-- **Prefer reusable CircleCI commands** (`commands:` section) so a tool is installed and verified in exactly one place, then referenced everywhere with `- install_<tool>` or `- wait_for_service`.
-- **Don't add tools just because they were there before.** Audit whether an external dependency is still needed. If it can be replaced with a shell one-liner or a tool already in the image, remove it.
-- These rules apply to every download in CI: binaries, install scripts, language version managers, package repos. No exceptions.
-
 ### HTTP Client Cache Safety
 - **Never close HTTP/SDK clients on cache eviction.** `LLMClientCache._remove_key()` must not call `close()`/`aclose()` on evicted clients — they may still be used by in-flight requests. Doing so causes `RuntimeError: Cannot send a request, as the client has been closed.` after the 1-hour TTL expires. Cleanup happens at shutdown via `close_litellm_async_clients()`.
 

CONTRIBUTING.md

@@ -122,17 +122,9 @@ Run all unit tests (uses parallel execution for speed):
 make test-unit
 ```
 
-If you're running broader test suites, proxy tests, or anything that touches PostgreSQL-backed fixtures/plugins, install the full local test environment first:
-
-```bash
-make install-test-deps
-```
-
-This syncs the locked test environment used across the repo, including `psycopg` v3 plus `psycopg-binary` (used by `pytest-postgresql`), `psycopg2-binary` (used by some proxy E2E tests), and a generated Prisma client for DB-backed proxy tests, so pytest startup matches CI without manual package installs.
-
 Run specific test files:
 ```bash
-uv run pytest tests/test_litellm/test_your_file.py -v
+poetry run pytest tests/test_litellm/test_your_file.py -v
 ```
 
 ### Running Linting and Formatting Checks
@@ -157,19 +149,6 @@ Apply formatting (auto-fixes issues):
 make format
 ```
 
-> **Black formatting is enforced in CI.** All PRs must pass the Black formatting check.
->
-> - **AI coding agents** (Claude Code, Copilot, Cursor, etc.): `AGENTS.md` and `CLAUDE.md` instruct agents to run `poetry run black .` before committing.
-> - **VS Code users**: Install the [Black Formatter extension](https://marketplace.visualstudio.com/items?itemName=ms-python.black-formatter) and enable format-on-save:
->   ```json
->   {
->     "[python]": {
->       "editor.defaultFormatter": "ms-python.black-formatter",
->       "editor.formatOnSave": true
->     }
->   }
->   ```
-
 ### CI Compatibility
 
 To ensure your changes will pass CI, run the exact same checks locally:
@@ -193,7 +172,7 @@ Run `make help` to see all available commands:
 make help                       # Show all available commands
 make install-dev               # Install development dependencies
 make install-proxy-dev         # Install proxy development dependencies
-make install-test-deps         # Install the full local test environment
+make install-test-deps         # Install test dependencies (for running tests)
 make format                    # Apply Black code formatting
 make format-check              # Check Black formatting (matches CI)
 make lint                      # Run all linting checks
@@ -255,7 +234,7 @@ To run the proxy server locally:
 make install-proxy-dev
 
 # Start the proxy server
-uv run litellm --config your_config.yaml
+poetry run litellm --config your_config.yaml
 ```
 
 ### Docker Development
@@ -340,4 +319,4 @@ Looking for ideas? Check out:
 - 🧪 Test coverage improvements
 - 🔌 New LLM provider integrations
 
-Thank you for contributing to LiteLLM! 🚀 
+Thank you for contributing to LiteLLM! 🚀 

Dockerfile

@@ -3,75 +3,57 @@ ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92
 
 # Runtime image
 ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
-ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
-
-FROM $UV_IMAGE AS uvbin
 
 # Builder stage
 FROM $LITELLM_BUILD_IMAGE AS builder
 
+# Set the working directory to /app
 WORKDIR /app
+
 USER root
 
-COPY --from=uvbin /uv /usr/local/bin/uv
-COPY --from=uvbin /uvx /usr/local/bin/uvx
+# Install build dependencies
+RUN apk add --no-cache bash gcc py3-pip python3 python3-dev openssl openssl-dev
 
-RUN apk add --no-cache \
-    bash \
-    gcc \
-    python3 \
-    python3-dev \
-    openssl \
-    openssl-dev \
-    nodejs \
-    npm \
-    libsndfile
+RUN python -m pip install build==1.4.2
 
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    UV_PROJECT_ENVIRONMENT=/app/.venv \
-    UV_LINK_MODE=copy \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/app/.venv/bin:${PATH}"
-
-# Copy dependency metadata first for layer caching
-COPY pyproject.toml uv.lock ./
-COPY enterprise/pyproject.toml enterprise/
-COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
-
-# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
-RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python3
-
-# Copy full source tree
+# Copy the current directory contents into the container at /app
 COPY . .
 
-# Build Admin UI before final sync
+# Build Admin UI
+# Convert Windows line endings to Unix and make executable
 RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
 
-# Install project and workspace packages (fast - deps already cached)
-RUN uv sync --frozen --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python3
+# Build the package
+RUN rm -rf dist/* && python -m build
 
-RUN prisma generate --schema=./schema.prisma
+# There should be only one wheel file now, assume the build only creates one
+RUN ls -1 dist/*.whl | head -1
 
-RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
-    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
+# Install the package
+RUN pip install dist/*.whl
+
+# install dependencies as wheels
+RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
+
+# ensure pyjwt is used, not jwt
+RUN pip uninstall jwt -y
+RUN pip uninstall PyJWT -y
+RUN pip install PyJWT==2.12.0 --no-cache-dir
 
 # Runtime stage
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
 
+# Ensure runtime stage runs as root
 USER root
 
-RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile supervisor && \
+# Install runtime dependencies (libsndfile needed for audio processing on ARM64)
+RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
     npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
+    # SECURITY FIX: npm bundles tar, glob, and brace-expansion at multiple nested
+    # levels inside its dependency tree. `npm install -g <pkg>` only creates a
+    # SEPARATE global package, it does NOT replace npm's internal copies.
+    # We must find and replace EVERY copy inside npm's directory.
     GLOBAL="$(npm root -g)" && \
     find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
@@ -88,24 +70,73 @@ RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile supervi
     find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
         rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
     done && \
+    # SECURITY FIX: patch npm's own package.json metadata so scanners see the
+    # actual installed versions instead of the stale declared dependencies.
     find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
         sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \
     npm cache clean --force && \
+    # Remove the apk-tracked npm so its stale SBOM metadata (tar 7.5.9) is
+    # no longer visible to image scanners.  The globally installed npm@latest
+    # at /usr/local/lib/node_modules/npm/ remains fully functional.
     { apk del --no-cache npm 2>/dev/null || true; }
 
 WORKDIR /app
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/app/.venv/bin:${PATH}"
+# Copy the current directory contents into the container at /app
+COPY . .
+RUN ls -la /app
 
-COPY --from=builder /app /app
+# Copy the built wheel from the builder stage to the runtime stage; assumes only one wheel file is present
+COPY --from=builder /app/dist/*.whl .
+COPY --from=builder /wheels/ /wheels/
 
-RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \
-    find /app/.venv -type d -path "*/tornado/test" -delete
+# Install the built wheel using pip; again using a wildcard if it's the only file
+RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ --no-deps && rm -f *.whl && rm -rf /wheels
+
+# Replace the nodejs-wheel-binaries bundled node with the system node (fixes CVE-2025-55130)
+RUN NODEJS_WHEEL_NODE=$(find /usr/lib -path "*/nodejs_wheel/bin/node" 2>/dev/null) && \
+    if [ -n "$NODEJS_WHEEL_NODE" ]; then cp /usr/bin/node "$NODEJS_WHEEL_NODE"; fi
+
+# Remove test files and keys from dependencies
+RUN find /usr/lib -type f -path "*/tornado/test/*" -delete && \
+    find /usr/lib -type d -path "*/tornado/test" -delete
+
+# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
+# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
+# Patch every copy of tar, glob, and brace-expansion inside that tree.
+RUN GLOBAL="$(npm root -g)" && \
+    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
+    find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+    done && \
+    find /usr/lib -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+    done && \
+    find /usr/lib -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+    done && \
+    find /usr/lib -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
+    done && \
+    find /usr/lib -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
+    done
+
+# Install semantic_router and aurelio-sdk using script
+# Convert Windows line endings to Unix and make executable
+RUN sed -i 's/\r$//' docker/install_auto_router.sh && chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh
+
+# Generate prisma client using the correct schema
+RUN prisma generate --schema=./litellm/proxy/schema.prisma
+# Convert Windows line endings to Unix for entrypoint scripts
+RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
+RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
 
 EXPOSE 4000/tcp
 
+RUN apk add --no-cache supervisor
 COPY docker/supervisord.conf /etc/supervisord.conf
 
 ENTRYPOINT ["docker/prod_entrypoint.sh"]
+
+# Append "--detailed_debug" to the end of CMD to view detailed debug logs
 CMD ["--port", "4000"]

GEMINI.md

@@ -22,11 +22,11 @@ This file provides guidance to Gemini when working with code in this repository.
 - `make lint-mypy` - Run MyPy type checking only
 
 ### Single Test Files
-- `uv run pytest tests/path/to/test_file.py -v` - Run specific test file
-- `uv run pytest tests/path/to/test_file.py::test_function -v` - Run specific test
+- `poetry run pytest tests/path/to/test_file.py -v` - Run specific test file
+- `poetry run pytest tests/path/to/test_file.py::test_function -v` - Run specific test
 
 ### Running Scripts
-- `uv run python script.py` - Run Python scripts (use for non-test files)
+- `poetry run python script.py` - Run Python scripts (use for non-test files)
 
 ### GitHub Issue & PR Templates
 When contributing to the project, use the appropriate templates:
@@ -105,4 +105,4 @@ LiteLLM is a unified interface for 100+ LLM providers with two main components:
 ### Enterprise Features
 - Enterprise-specific code in `enterprise/` directory
 - Optional features enabled via environment variables
-- Separate licensing and authentication for enterprise features
+- Separate licensing and authentication for enterprise features

Makefile

@@ -15,7 +15,7 @@ help:
 	@echo "  make install-proxy-dev  - Install proxy development dependencies"
 	@echo "  make install-dev-ci     - Install dev dependencies (CI-compatible, pins OpenAI)"
 	@echo "  make install-proxy-dev-ci - Install proxy dev dependencies (CI-compatible)"
-	@echo "  make install-test-deps  - Install the full local test environment"
+	@echo "  make install-test-deps  - Install test dependencies"
 	@echo "  make install-helm-unittest - Install helm unittest plugin"
 	@echo "  make format             - Apply Black code formatting"
 	@echo "  make format-check       - Check Black code formatting (matches CI)"
@@ -40,44 +40,49 @@ help:
 	@echo "  make test-integration   - Run integration tests"
 	@echo "  make test-unit-helm     - Run helm unit tests"
 
-UV := uv
-UV_RUN := $(UV) run --no-sync
+# Keep PIP simple for edge cases:
+PIP := $(shell command -v pip > /dev/null 2>&1 && echo "pip" || echo "python3 -m pip")
 
 # Show info
 info:
-	@echo "UV: $(UV)"
+	@echo "PIP: $(PIP)"
 
 # Installation targets
 install-dev:
-	$(UV) sync --frozen
+	poetry install --with dev
 
 install-proxy-dev:
-	$(UV) sync --frozen --group proxy-dev --extra proxy
+	poetry install --with dev,proxy-dev --extras proxy
 
 # CI-compatible installations (matches GitHub workflows exactly)
 install-dev-ci:
-	$(UV) sync --frozen
+	$(PIP) install openai==2.8.0
+	poetry install --with dev
+	$(PIP) install openai==2.8.0
 
 install-proxy-dev-ci:
-	$(UV) sync --frozen --group proxy-dev --extra proxy
+	poetry install --with dev,proxy-dev --extras proxy
+	$(PIP) install openai==2.8.0
 
 install-test-deps: install-proxy-dev
-	$(UV) sync --frozen --all-groups --all-extras
-	$(UV_RUN) prisma generate --schema litellm/proxy/schema.prisma
+	poetry run $(PIP) install "pytest-retry==1.6.3"
+	poetry run $(PIP) install pytest-xdist
+	poetry run $(PIP) install openapi-core
+	cd enterprise && poetry run $(PIP) install -e . && cd ..
 
 install-helm-unittest:
 	helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.4.4 || echo "ignore error if plugin exists"
 
 # Formatting
 format: install-dev
-	cd litellm && $(UV_RUN) black . && cd ..
+	cd litellm && poetry run black . && cd ..
 
 format-check: install-dev
-	cd litellm && $(UV_RUN) black --check . && cd ..
+	cd litellm && poetry run black --check . && cd ..
 
 # Linting targets
 lint-ruff: install-dev
-	cd litellm && $(UV_RUN) ruff check . && cd ..
+	cd litellm && poetry run ruff check . && cd ..
 
 # faster linter for developing ...
 # inspiration from:
@@ -91,36 +96,37 @@ lint-format-changed: install-dev
 			$$start = $$1; $$count = $$2 || 1; $$end = $$start + $$count - 1; \
 			print "$$file:$$start:1-$$end:999\n"; \
 		}' | \
-		while read range; do \
-			file="$${range%%:*}"; \
-			lines="$${range#*:}"; \
-			echo "Formatting $$file (lines $$lines)"; \
-			$(UV_RUN) ruff format --range "$$lines" "$$file"; \
-		done
+	while read range; do \
+		file="$${range%%:*}"; \
+		lines="$${range#*:}"; \
+		echo "Formatting $$file (lines $$lines)"; \
+		poetry run ruff format --range "$$lines" "$$file"; \
+	done
 
 lint-ruff-dev: install-dev
 	@tmpfile=$$(mktemp /tmp/ruff-dev.XXXXXX) && \
 	cd litellm && \
-	($(UV_RUN) ruff check . --output-format=pylint || true) > "$$tmpfile" && \
-	$(UV_RUN) diff-quality --violations=pylint "$$tmpfile" --compare-branch=origin/main && \
+	(poetry run ruff check . --output-format=pylint || true) > "$$tmpfile" && \
+	poetry run diff-quality --violations=pylint "$$tmpfile" --compare-branch=origin/main && \
 	cd .. ; \
 	rm -f "$$tmpfile"
 
 lint-ruff-FULL-dev: install-dev
 	@files=$$(git diff --name-only origin/main -- '*.py'); \
-	if [ -n "$$files" ]; then echo "$$files" | xargs $(UV_RUN) ruff check; \
+	if [ -n "$$files" ]; then echo "$$files" | xargs poetry run ruff check; \
 	else echo "No changed .py files to check."; fi
 
 lint-mypy: install-dev
-	cd litellm && $(UV_RUN) mypy . --ignore-missing-imports && cd ..
+	poetry run $(PIP) install types-requests types-setuptools types-redis types-PyYAML
+	cd litellm && poetry run mypy . --ignore-missing-imports && cd ..
 
 lint-black: format-check
 
 check-circular-imports: install-dev
-	cd litellm && $(UV_RUN) python ../tests/documentation_tests/test_circular_imports.py && cd ..
+	cd litellm && poetry run python ../tests/documentation_tests/test_circular_imports.py && cd ..
 
 check-import-safety: install-dev
-	@$(UV_RUN) python -c "from litellm import *; print('[from litellm import *] OK! no issues!');" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
+	@poetry run python -c "from litellm import *; print('[from litellm import *] OK! no issues!');" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
 
 # Combined linting (matches test-linting.yml workflow)
 lint: format-check lint-ruff lint-mypy check-circular-imports check-import-safety
@@ -129,46 +135,46 @@ lint: format-check lint-ruff lint-mypy check-circular-imports check-import-safet
 lint-dev: lint-format-changed lint-mypy check-circular-imports check-import-safety
 
 # Testing targets
-test: install-test-deps
-	$(UV_RUN) pytest tests/
+test:
+	poetry run pytest tests/
 
 test-unit: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm -x -vv -n 4
+	poetry run pytest tests/test_litellm -x -vv -n 4
 
 # Matrix test targets (matching CI workflow groups)
 test-unit-llms: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/llms --tb=short -vv -n 4 --durations=20
+	poetry run pytest tests/test_litellm/llms --tb=short -vv -n 4 --durations=20
 
 test-unit-proxy-guardrails: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/proxy/guardrails tests/test_litellm/proxy/management_endpoints tests/test_litellm/proxy/management_helpers --tb=short -vv -n 4 --durations=20
+	poetry run pytest tests/test_litellm/proxy/guardrails tests/test_litellm/proxy/management_endpoints tests/test_litellm/proxy/management_helpers --tb=short -vv -n 4 --durations=20
 
 test-unit-proxy-core: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/proxy/auth tests/test_litellm/proxy/client tests/test_litellm/proxy/db tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine --tb=short -vv -n 4 --durations=20
+	poetry run pytest tests/test_litellm/proxy/auth tests/test_litellm/proxy/client tests/test_litellm/proxy/db tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine --tb=short -vv -n 4 --durations=20
 
 test-unit-proxy-misc: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/proxy/_experimental tests/test_litellm/proxy/agent_endpoints tests/test_litellm/proxy/anthropic_endpoints tests/test_litellm/proxy/common_utils tests/test_litellm/proxy/discovery_endpoints tests/test_litellm/proxy/experimental tests/test_litellm/proxy/google_endpoints tests/test_litellm/proxy/health_endpoints tests/test_litellm/proxy/image_endpoints tests/test_litellm/proxy/middleware tests/test_litellm/proxy/openai_files_endpoint tests/test_litellm/proxy/pass_through_endpoints tests/test_litellm/proxy/prompts tests/test_litellm/proxy/public_endpoints tests/test_litellm/proxy/response_api_endpoints tests/test_litellm/proxy/spend_tracking tests/test_litellm/proxy/ui_crud_endpoints tests/test_litellm/proxy/vector_store_endpoints tests/test_litellm/proxy/test_*.py --tb=short -vv -n 4 --durations=20
+	poetry run pytest tests/test_litellm/proxy/_experimental tests/test_litellm/proxy/agent_endpoints tests/test_litellm/proxy/anthropic_endpoints tests/test_litellm/proxy/common_utils tests/test_litellm/proxy/discovery_endpoints tests/test_litellm/proxy/experimental tests/test_litellm/proxy/google_endpoints tests/test_litellm/proxy/health_endpoints tests/test_litellm/proxy/image_endpoints tests/test_litellm/proxy/middleware tests/test_litellm/proxy/openai_files_endpoint tests/test_litellm/proxy/pass_through_endpoints tests/test_litellm/proxy/prompts tests/test_litellm/proxy/public_endpoints tests/test_litellm/proxy/response_api_endpoints tests/test_litellm/proxy/spend_tracking tests/test_litellm/proxy/ui_crud_endpoints tests/test_litellm/proxy/vector_store_endpoints tests/test_litellm/proxy/test_*.py --tb=short -vv -n 4 --durations=20
 
 test-unit-integrations: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/integrations --tb=short -vv -n 4 --durations=20
+	poetry run pytest tests/test_litellm/integrations --tb=short -vv -n 4 --durations=20
 
 test-unit-core-utils: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/litellm_core_utils --tb=short -vv -n 2 --durations=20
+	poetry run pytest tests/test_litellm/litellm_core_utils --tb=short -vv -n 2 --durations=20
 
 test-unit-other: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/caching tests/test_litellm/responses tests/test_litellm/secret_managers tests/test_litellm/vector_stores tests/test_litellm/a2a_protocol tests/test_litellm/anthropic_interface tests/test_litellm/completion_extras tests/test_litellm/containers tests/test_litellm/enterprise tests/test_litellm/experimental_mcp_client tests/test_litellm/google_genai tests/test_litellm/images tests/test_litellm/interactions tests/test_litellm/passthrough tests/test_litellm/router_strategy tests/test_litellm/router_utils tests/test_litellm/types --tb=short -vv -n 4 --durations=20
+	poetry run pytest tests/test_litellm/caching tests/test_litellm/responses tests/test_litellm/secret_managers tests/test_litellm/vector_stores tests/test_litellm/a2a_protocol tests/test_litellm/anthropic_interface tests/test_litellm/completion_extras tests/test_litellm/containers tests/test_litellm/enterprise tests/test_litellm/experimental_mcp_client tests/test_litellm/google_genai tests/test_litellm/images tests/test_litellm/interactions tests/test_litellm/passthrough tests/test_litellm/router_strategy tests/test_litellm/router_utils tests/test_litellm/types --tb=short -vv -n 4 --durations=20
 
 test-unit-root: install-test-deps
-	$(UV_RUN) pytest tests/test_litellm/test_*.py --tb=short -vv -n 4 --durations=20
+	poetry run pytest tests/test_litellm/test_*.py --tb=short -vv -n 4 --durations=20
 
 # Proxy unit tests (tests/proxy_unit_tests split alphabetically)
 test-proxy-unit-a: install-test-deps
-	$(UV_RUN) pytest tests/proxy_unit_tests/test_[a-o]*.py --tb=short -vv -n 2 --durations=20
+	poetry run pytest tests/proxy_unit_tests/test_[a-o]*.py --tb=short -vv -n 2 --durations=20
 
 test-proxy-unit-b: install-test-deps
-	$(UV_RUN) pytest tests/proxy_unit_tests/test_[p-z]*.py --tb=short -vv -n 2 --durations=20
+	poetry run pytest tests/proxy_unit_tests/test_[p-z]*.py --tb=short -vv -n 2 --durations=20
 
-test-integration: install-test-deps
-	$(UV_RUN) pytest tests/ -k "not test_litellm"
+test-integration:
+	poetry run pytest tests/ -k "not test_litellm"
 
 test-unit-helm: install-helm-unittest
 	helm unittest -f 'tests/*.yaml' deploy/charts/litellm-helm
@@ -182,6 +188,6 @@ test-llm-translation-single: install-test-deps
 	@echo "Running single LLM translation test file..."
 	@if [ -z "$(FILE)" ]; then echo "Usage: make test-llm-translation-single FILE=test_filename.py"; exit 1; fi
 	@mkdir -p test-results
-	$(UV_RUN) pytest tests/llm_translation/$(FILE) \
+	poetry run pytest tests/llm_translation/$(FILE) \
 		--junitxml=test-results/junit.xml \
 		-v --tb=short --maxfail=100 --timeout=300

README.md

@@ -12,7 +12,7 @@
         </a>
         </p>
     </p>
-<h4 align="center"><a href="https://docs.litellm.ai/docs/simple_proxy" target="_blank">LiteLLM Proxy Server (AI Gateway)</a> | <a href="https://docs.litellm.ai/docs/enterprise#hosted-litellm-proxy" target="_blank"> Hosted Proxy</a> | <a href="https://litellm.ai/enterprise"target="_blank">Enterprise Tier</a> | <a href="https://www.litellm.ai/ai-gateway" target="_blank">Website</a></h4>
+<h4 align="center"><a href="https://docs.litellm.ai/docs/simple_proxy" target="_blank">LiteLLM Proxy Server (AI Gateway)</a> | <a href="https://docs.litellm.ai/docs/enterprise#hosted-litellm-proxy" target="_blank"> Hosted Proxy</a> | <a href="https://litellm.ai/enterprise"target="_blank">Enterprise Tier</a> | <a href="https://litellm.ai/" target="_blank">Website</a></h4>
 <h4 align="center">
     <a href="https://pypi.org/project/litellm/" target="_blank">
         <img src="https://img.shields.io/pypi/v/litellm.svg" alt="PyPI Version">
@@ -39,45 +39,8 @@
 
 <img width="2688" height="1600" alt="Group 7154 (1)" src="https://github.com/user-attachments/assets/c5ee0412-6fb5-4fb6-ab5b-bafae4209ca6" />
 
----
 
-## What is LiteLLM
-
-LiteLLM is an open source AI Gateway that gives you a single, unified interface to call 100+ LLM providers — OpenAI, Anthropic, Gemini, Bedrock, Azure, and more — using the OpenAI format.
-
-Use it as a **Python SDK** for direct library integration, or deploy the **AI Gateway (Proxy Server)** as a centralized service for your team or organization.
-
-[**Jump to LiteLLM Proxy (LLM Gateway) Docs**](https://docs.litellm.ai/docs/simple_proxy) <br>
-[**Jump to Supported LLM Providers**](https://docs.litellm.ai/docs/providers)
-
----
-
-## Why LiteLLM
-
-Managing LLM calls across providers gets complicated fast — different SDKs, auth patterns, request formats, and error types for every model. LiteLLM removes that friction:
-
-- **Unified API** — one interface for 100+ LLMs, no provider-specific SDK juggling
-- **Drop-in OpenAI compatibility** — swap providers without rewriting your code
-- **Production-ready gateway** — virtual keys, spend tracking, guardrails, load balancing, and an admin dashboard out of the box
-- **8ms P95 latency** at 1k RPS ([benchmarks](https://docs.litellm.ai/docs/benchmarks))
-
-### OSS Adopters
-
-<table>
-  <tr>
-    <td><img height="60" alt="Stripe" src="https://github.com/user-attachments/assets/f7296d4f-9fbd-460d-9d05-e4df31697c4b" /></td>
-    <td><img height="60" alt="image" src="https://github.com/user-attachments/assets/436fca71-988b-40bb-b5fe-8450c80fdbd0" /></td>
-    <td><img height="60" alt="Google ADK" src="https://github.com/user-attachments/assets/caf270a2-5aee-45c4-8222-41a2070c4f19" /></td>
-    <td><img height="60" alt="Greptile" src="https://github.com/user-attachments/assets/0be4bd8a-7cfa-48d3-9090-f415fe948280" /></td>
-    <td><img height="60" alt="OpenHands" src="https://github.com/user-attachments/assets/a6150c4c-149e-4cae-888b-8b92be6e003f" /></td>
-    <td><h2>Netflix</h2></td>
-    <td><img height="60" alt="OpenAI Agents SDK" src="https://github.com/user-attachments/assets/c02f7be0-8c2e-4d27-aea7-7c024bfaebc0" /></td>
-  </tr>
-</table>
-
----
-
-## Features
+## Use LiteLLM for
 
 <details open>
 <summary><b>LLMs</b> - Call 100+ LLMs (Python SDK + AI Gateway)</summary>
@@ -87,7 +50,7 @@ Managing LLM calls across providers gets complicated fast — different SDKs, au
 ### Python SDK
 
 ```shell
-uv add litellm
+pip install litellm
 ```
 
 ```python
@@ -109,7 +72,7 @@ response = completion(model="anthropic/claude-sonnet-4-20250514", messages=[{"ro
 [**Getting Started - E2E Tutorial**](https://docs.litellm.ai/docs/proxy/docker_quick_start) - Setup virtual keys, make your first request
 
 ```shell
-uv tool install 'litellm[proxy]'
+pip install 'litellm[proxy]'
 litellm --model gpt-4o
 ```
 
@@ -260,7 +223,63 @@ curl -X POST 'http://0.0.0.0:4000/v1/chat/completions' \
 
 </details>
 
-### Supported Providers ([Website Supported Models](https://models.litellm.ai/) | [Docs](https://docs.litellm.ai/docs/providers))
+---
+
+## How to use LiteLLM
+
+You can use LiteLLM through either the Proxy Server or Python SDK. Both gives you a unified interface to access multiple LLMs (100+ LLMs). Choose the option that best fits your needs:
+
+<table style={{width: '100%', tableLayout: 'fixed'}}>
+<thead>
+<tr>
+<th style={{width: '14%'}}></th>
+<th style={{width: '43%'}}><strong><a href="https://docs.litellm.ai/docs/simple_proxy">LiteLLM AI Gateway</a></strong></th>
+<th style={{width: '43%'}}><strong><a href="https://docs.litellm.ai/docs/">LiteLLM Python SDK</a></strong></th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td style={{width: '14%'}}><strong>Use Case</strong></td>
+<td style={{width: '43%'}}>Central service (LLM Gateway) to access multiple LLMs</td>
+<td style={{width: '43%'}}>Use LiteLLM directly in your Python code</td>
+</tr>
+<tr>
+<td style={{width: '14%'}}><strong>Who Uses It?</strong></td>
+<td style={{width: '43%'}}>Gen AI Enablement / ML Platform Teams</td>
+<td style={{width: '43%'}}>Developers building LLM projects</td>
+</tr>
+<tr>
+<td style={{width: '14%'}}><strong>Key Features</strong></td>
+<td style={{width: '43%'}}>Centralized API gateway with authentication and authorization, multi-tenant cost tracking and spend management per project/user, per-project customization (logging, guardrails, caching), virtual keys for secure access control, admin dashboard UI for monitoring and management</td>
+<td style={{width: '43%'}}>Direct Python library integration in your codebase, Router with retry/fallback logic across multiple deployments (e.g. Azure/OpenAI) - <a href="https://docs.litellm.ai/docs/routing">Router</a>, application-level load balancing and cost tracking, exception handling with OpenAI-compatible errors, observability callbacks (Lunary, MLflow, Langfuse, etc.)</td>
+</tr>
+</tbody>
+</table>
+
+LiteLLM Performance: **8ms P95 latency** at 1k RPS (See benchmarks [here](https://docs.litellm.ai/docs/benchmarks))
+
+[**Jump to LiteLLM Proxy (LLM Gateway) Docs**](https://docs.litellm.ai/docs/simple_proxy) <br>
+[**Jump to Supported LLM Providers**](https://docs.litellm.ai/docs/providers)
+
+**Stable Release:** Use docker images with the `-stable` tag. These have undergone 12 hour load tests, before being published. [More information about the release cycle here](https://docs.litellm.ai/docs/proxy/release_cycle)
+
+Support for more providers. Missing a provider or LLM Platform, raise a [feature request](https://github.com/BerriAI/litellm/issues/new?assignees=&labels=enhancement&projects=&template=feature_request.yml&title=%5BFeature%5D%3A+).
+
+## OSS Adopters 
+
+<table>
+  <tr>
+    <td><img height="60" alt="Stripe" src="https://github.com/user-attachments/assets/f7296d4f-9fbd-460d-9d05-e4df31697c4b" /></td>
+    <td><img height="60" alt="image" src="https://github.com/user-attachments/assets/436fca71-988b-40bb-b5fe-8450c80fdbd0" /></td>
+    <td><img height="60" alt="Google ADK" src="https://github.com/user-attachments/assets/caf270a2-5aee-45c4-8222-41a2070c4f19" /></td>
+    <td><img height="60" alt="Greptile" src="https://github.com/user-attachments/assets/0be4bd8a-7cfa-48d3-9090-f415fe948280" /></td>
+    <td><img height="60" alt="OpenHands" src="https://github.com/user-attachments/assets/a6150c4c-149e-4cae-888b-8b92be6e003f" /></td>
+    <td><h2>Netflix</h2></td>
+    <td><img height="60" alt="OpenAI Agents SDK" src="https://github.com/user-attachments/assets/c02f7be0-8c2e-4d27-aea7-7c024bfaebc0" /></td>
+  </tr>
+</table>
+
+## Supported Providers ([Website Supported Models](https://models.litellm.ai/) | [Docs](https://docs.litellm.ai/docs/providers))
 
 | Provider                                                                            | `/chat/completions` | `/messages` | `/responses` | `/embeddings` | `/image/generations` | `/audio/transcriptions` | `/audio/speech` | `/moderations` | `/batches` | `/rerank` |
 |-------------------------------------------------------------------------------------|---------------------|-------------|--------------|---------------|----------------------|-------------------------|-----------------|----------------|-----------|-----------|
@@ -367,89 +386,24 @@ curl -X POST 'http://0.0.0.0:4000/v1/chat/completions' \
 
 [**Read the Docs**](https://docs.litellm.ai/docs/)
 
----
-
-## Get Started
-
-You can use LiteLLM through either the Proxy Server or Python SDK. Both give you a unified interface to access multiple LLMs (100+ LLMs). Choose the option that best fits your needs:
-
-<table style={{width: '100%', tableLayout: 'fixed'}}>
-<thead>
-<tr>
-<th style={{width: '14%'}}></th>
-<th style={{width: '43%'}}><strong><a href="https://docs.litellm.ai/docs/simple_proxy">LiteLLM AI Gateway</a></strong></th>
-<th style={{width: '43%'}}><strong><a href="https://docs.litellm.ai/docs/">LiteLLM Python SDK</a></strong></th>
-</tr>
-</thead>
-<tbody>
-<tr>
-<td style={{width: '14%'}}><strong>Use Case</strong></td>
-<td style={{width: '43%'}}>Central service (LLM Gateway) to access multiple LLMs</td>
-<td style={{width: '43%'}}>Use LiteLLM directly in your Python code</td>
-</tr>
-<tr>
-<td style={{width: '14%'}}><strong>Who Uses It?</strong></td>
-<td style={{width: '43%'}}>Gen AI Enablement / ML Platform Teams</td>
-<td style={{width: '43%'}}>Developers building LLM projects</td>
-</tr>
-<tr>
-<td style={{width: '14%'}}><strong>Key Features</strong></td>
-<td style={{width: '43%'}}>Centralized API gateway with authentication and authorization, multi-tenant cost tracking and spend management per project/user, per-project customization (logging, guardrails, caching), virtual keys for secure access control, admin dashboard UI for monitoring and management</td>
-<td style={{width: '43%'}}>Direct Python library integration in your codebase, Router with retry/fallback logic across multiple deployments (e.g. Azure/OpenAI) - <a href="https://docs.litellm.ai/docs/routing">Router</a>, application-level load balancing and cost tracking, exception handling with OpenAI-compatible errors, observability callbacks (Lunary, MLflow, Langfuse, etc.)</td>
-</tr>
-</tbody>
-</table>
-
-**Stable Release:** Use docker images with the `-stable` tag. These have undergone 12 hour load tests, before being published. [More information about the release cycle here](https://docs.litellm.ai/docs/proxy/release_cycle)
-
-Support for more providers. Missing a provider or LLM Platform, raise a [feature request](https://github.com/BerriAI/litellm/issues/new?assignees=&labels=enhancement&projects=&template=feature_request.yml&title=%5BFeature%5D%3A+).
-
-### Run in Developer Mode
-#### Services
+## Run in Developer mode
+### Services
 1. Setup .env file in root
 2. Run dependant services `docker-compose up db prometheus`
 
-#### Backend
+### Backend
 1. (In root) create virtual environment `python -m venv .venv`
 2. Activate virtual environment `source .venv/bin/activate`
-3. Install dependencies `uv sync --all-extras --group proxy-dev`
-4. `uv run prisma generate`
+3. Install dependencies `pip install -e ".[all]"`
+4. `pip install prisma`
 5. `prisma generate`
 6. Start proxy backend `python litellm/proxy/proxy_cli.py`
 
-#### Frontend
+### Frontend
 1. Navigate to `ui/litellm-dashboard`
 2. Install dependencies `npm install`
 3. Run `npm run dev` to start the dashboard
 
-### Verify Docker Image Signatures
-
-All LiteLLM Docker images published to GHCR are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).
-
-**Verify using the pinned commit hash (recommended):**
-
-A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:
-
-```bash
-cosign verify \
-  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
-  ghcr.io/berriai/litellm:<release-tag>
-```
-
-**Verify using a release tag (convenience):**
-
-Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
-
-```bash
-cosign verify \
-  --key https://raw.githubusercontent.com/BerriAI/litellm/<release-tag>/cosign.pub \
-  ghcr.io/berriai/litellm:<release-tag>
-```
-
-Replace `<release-tag>` with the version you are deploying (e.g. `v1.83.0-stable`).
-
----
-
 # Enterprise
 For companies that need better security, user management and professional support
 
@@ -470,7 +424,7 @@ We welcome contributions to LiteLLM! Whether you're fixing bugs, adding features
 
 ## Quick Start for Contributors
 
-This requires uv to be installed.
+This requires poetry to be installed.
 
 ```bash
 git clone https://github.com/BerriAI/litellm.git
@@ -506,6 +460,10 @@ All these checks must pass before your PR can be merged.
 - [Community Slack 💭](https://www.litellm.ai/support)
 - Our emails ✉️ ishaan@berri.ai / krrish@berri.ai
 
+# Why did we build this
+
+- **Need for simplicity**: Our code started to get extremely complicated managing & translating calls between Azure, OpenAI and Cohere.
+
 # Contributors
 
 <!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
@@ -520,3 +478,4 @@ All these checks must pass before your PR can be merged.
 <a href="https://github.com/BerriAI/litellm/graphs/contributors">
   <img src="https://contrib.rocks/image?repo=BerriAI/litellm" />
 </a>
+

ci_cd/.grype.yaml

@@ -0,0 +1,36 @@
+ignore:
+  - vulnerability: CVE-2026-22184
+    reason: no fixed zlib package is available yet in the Wolfi repositories, so this is ignored temporarily until an upstream release exists
+  # Wolfi base image: Python 3.13 and Node from apk have no fixed builds in Wolfi yet / not applicable
+  - vulnerability: CVE-2025-55130
+    reason: Node in Wolfi apk; only used for Admin UI build/prisma
+  - vulnerability: CVE-2025-59465
+    reason: Node in Wolfi apk; only used for Admin UI build/prisma
+  - vulnerability: CVE-2025-55131
+    reason: Node in Wolfi apk; only used for Admin UI build/prisma
+  - vulnerability: CVE-2025-59466
+    reason: Node in Wolfi apk; only used for Admin UI build/prisma
+  - vulnerability: CVE-2026-21637
+    reason: Node in Wolfi apk; only used for Admin UI build/prisma
+  - vulnerability: CVE-2025-55132
+    reason: Node in Wolfi apk; only used for Admin UI build/prisma
+  - vulnerability: GHSA-hx9q-6w63-j58v
+    reason: orjson dumps recursion; allowlisted
+  - vulnerability: GHSA-73rr-hh4g-fpgx
+    reason: diff npm transitive dep; override in package.json, allowlisted
+  - vulnerability: CVE-2026-0865
+    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+  - vulnerability: CVE-2025-15282
+    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+  - vulnerability: CVE-2026-0672
+    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+  - vulnerability: CVE-2025-15366
+    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+  - vulnerability: CVE-2025-15367
+    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+  - vulnerability: CVE-2025-11468
+    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+  - vulnerability: CVE-2025-12781
+    reason: Python 3.13 in Wolfi base; no fixed apk build yet
+  - vulnerability: CVE-2026-1299
+    reason: Python 3.13 in Wolfi base; no fixed apk build yet

ci_cd/run_migration.py

@@ -17,9 +17,7 @@ def create_migration(migration_name: str = None):
     try:
         # Get paths
         root_dir = Path(__file__).parent.parent
-        migrations_dir = (
-            root_dir / "litellm-proxy-extras" / "litellm_proxy_extras" / "migrations"
-        )
+        migrations_dir = root_dir / "litellm-proxy-extras" / "litellm_proxy_extras" / "migrations"
         schema_path = root_dir / "schema.prisma"
 
         # Create temporary PostgreSQL database

ci_cd/security_scans.sh

@@ -0,0 +1,261 @@
+#!/bin/bash
+
+# Security Scans Script for LiteLLM
+# This script runs comprehensive security scans including Trivy and Grype
+
+set -e
+
+echo "Starting security scans for LiteLLM..."
+
+# Function to install Trivy and required tools
+install_trivy() {
+    echo "Installing Trivy and required tools..."
+    TRIVY_VERSION="0.35.0"
+    sudo apt-get update
+    sudo apt-get install -y wget jq curl bsdmainutils
+    wget -qO trivy.deb "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.deb"
+    sudo dpkg -i trivy.deb
+    rm trivy.deb
+    echo "Trivy ${TRIVY_VERSION} installed successfully"
+}
+
+# Function to install Grype
+install_grype() {
+    echo "Installing Grype..."
+    curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sudo sh -s -- -b /usr/local/bin
+    echo "Grype installed successfully"
+}
+
+# Function to install ggshield
+install_ggshield() {
+    echo "Installing ggshield..."
+    pip3 install --upgrade pip
+    pip3 install ggshield
+    echo "ggshield installed successfully"
+}
+
+# # Function to run secret detection scans
+# run_secret_detection() {
+#     echo "Running secret detection scans..."
+    
+#     if ! command -v ggshield &> /dev/null; then
+#         install_ggshield
+#     fi
+    
+#     # Check if GITGUARDIAN_API_KEY is set (required for CI/CD)
+#     if [ -z "$GITGUARDIAN_API_KEY" ]; then
+#         echo "Warning: GITGUARDIAN_API_KEY environment variable is not set."
+#         echo "ggshield requires a GitGuardian API key to scan for secrets."
+#         echo "Please set GITGUARDIAN_API_KEY in your CI/CD environment variables."
+#         exit 1
+#     fi
+    
+#     echo "Scanning codebase for secrets..."
+#     echo "Note: Large codebases may take several minutes due to API rate limits (50 requests/minute on free plan)"
+#     echo "ggshield will automatically handle rate limits and retry as needed."
+#     echo "Binary files, cache files, and build artifacts are excluded via .gitguardian.yaml"
+    
+#     # Use --recursive for directory scanning and auto-confirm if prompted
+#     # .gitguardian.yaml will automatically exclude binary files, wheel files, etc.
+#     # GITGUARDIAN_API_KEY environment variable will be used for authentication
+#     echo y | ggshield secret scan path . --recursive || {
+#         echo ""
+#         echo "=========================================="
+#         echo "ERROR: Secret Detection Failed"
+#         echo "=========================================="
+#         echo "ggshield has detected secrets in the codebase."
+#         echo "Please review discovered secrets above, revoke any actively used secrets"
+#         echo "from underlying systems and make changes to inject secrets dynamically at runtime."
+#         echo ""
+#         echo "For more information, see: https://docs.gitguardian.com/secrets-detection/"
+#         echo "=========================================="
+#         echo ""
+#         exit 1
+#     }
+    
+#     echo "Secret detection scans completed successfully"
+# }
+
+# Function to run Trivy scans
+run_trivy_scans() {
+    echo "Running Trivy scans..."
+    
+    echo "Scanning LiteLLM Docs..."
+    trivy fs --ignorefile .trivyignore --scanners vuln --dependency-tree --exit-code 1 --severity HIGH,CRITICAL,MEDIUM ./docs/
+    
+    echo "Scanning LiteLLM UI..."
+    trivy fs --ignorefile .trivyignore --scanners vuln --dependency-tree --exit-code 1 --severity HIGH,CRITICAL,MEDIUM ./ui/
+    
+    echo "Trivy scans completed successfully"
+}
+
+# Function to build and scan Docker images with Grype
+run_grype_scans() {
+    echo "Running Grype scans..."
+    
+    # Temporarily add wheel files to .dockerignore for security scans
+    echo "Temporarily modifying .dockerignore to exclude problematic wheel files..."
+    cp .dockerignore .dockerignore.backup 2>/dev/null || touch .dockerignore.backup
+    echo "/*.whl" >> .dockerignore
+    
+    # Build and scan Dockerfile.database
+    echo "Building and scanning Dockerfile.database..."
+    docker build --no-cache -t litellm-database:latest -f ./docker/Dockerfile.database .
+    grype litellm-database:latest --config ci_cd/.grype.yaml --fail-on critical
+    
+    # Build and scan main Dockerfile
+    echo "Building and scanning main Dockerfile..."
+    docker build --no-cache -t litellm:latest .
+    grype litellm:latest --config ci_cd/.grype.yaml --fail-on critical
+    
+    # Restore original .dockerignore
+    echo "Restoring original .dockerignore..."
+    mv .dockerignore.backup .dockerignore
+    
+    # Scan the locally built LiteLLM image for vulnerabilities with CVSS >= 4.0
+    echo "Scanning locally built LiteLLM image for high-severity vulnerabilities..."
+    echo "Using locally built image: litellm:latest"
+    
+    # Allowlist of CVEs to be ignored in failure threshold/reporting
+    # - CVE-2025-8869: Not applicable on Python >=3.13 (PEP 706 implemented); pip fallback unused; no OS-level fix
+    # - GHSA-4xh5-x5gv-qwph: GitHub Security Advisory alias for CVE-2025-8869
+    # - GHSA-5j98-mcp5-4vw2: glob CLI command injection via -c/--cmd; glob CLI is not used in the litellm runtime image,
+    #   and the vulnerable versions are pulled in only via OS-level/node tooling outside of our application code
+    ALLOWED_CVES=(
+        "CVE-2025-8869"
+        "GHSA-4xh5-x5gv-qwph"
+        "CVE-2025-8291" # no fix available as of Oct 11, 2025
+        "GHSA-5j98-mcp5-4vw2"
+        "CVE-2025-13836" # Python 3.13 HTTP response reading OOM/DoS - no fix available in base image
+        "CVE-2025-12084" # Python 3.13 xml.dom.minidom quadratic algorithm - no fix available in base image
+        "CVE-2025-60876" # BusyBox wget HTTP request splitting - no fix available in Chainguard Wolfi base image
+        "CVE-2026-0861" # Wolfi glibc still flagged even on 2.42-r5; upstream patched build unavailable yet
+        "CVE-2010-4756" # glibc glob DoS - awaiting patched Wolfi glibc build
+        "CVE-2019-1010022" # glibc stack guard bypass - awaiting patched Wolfi glibc build
+        "CVE-2019-1010023" # glibc ldd remap issue - awaiting patched Wolfi glibc build
+        "CVE-2019-1010024" # glibc ASLR mitigation bypass - awaiting patched Wolfi glibc build
+        "CVE-2019-1010025" # glibc pthread heap address leak - awaiting patched Wolfi glibc build
+        "CVE-2026-22184" # zlib untgz buffer overflow - untgz unused + no fixed Wolfi build yet
+        "GHSA-58pv-8j8x-9vj2" # jaraco.context path traversal - setuptools vendored only (v5.3.0), not used in application code (using v6.1.0+)
+        "GHSA-34x7-hfp2-rc4v" # node-tar hardlink path traversal - not applicable, tar CLI not exposed in application code
+        "GHSA-r6q2-hw4h-h46w" # node-tar not used by application runtime, Linux-only container, not affect by macOS APFS-specific exploit
+        "GHSA-8rrh-rw8j-w5fx" # wheel is from chainguard and will be handled by then TODO: Remove this after Chainguard updates the wheel
+        "CVE-2025-59465" # Node only used for Admin UI build/prisma
+        "CVE-2025-55131" # Node only used for Admin UI build/prisma
+        "CVE-2025-59466" # Node only used for Admin UI build/prisma
+        "CVE-2025-55130" # Node only used for Admin UI build/prisma
+        "CVE-2025-59467" # Node only used for Admin UI build/prisma
+        "CVE-2026-21637" # Node only used for Admin UI build/prisma
+        "CVE-2025-55132" # Node only used for Admin UI build/prisma
+        "GHSA-hx9q-6w63-j58v" # orjson dumps recursion; allowlisted
+        "CVE-2025-15281" # No fix available yet
+        "CVE-2026-0865" # No fix available yet
+        "CVE-2025-15282" # No fix available yet
+        "CVE-2026-0672" # No fix available yet
+        "CVE-2025-15366" # No fix available yet
+        "CVE-2025-15367" # No fix available yet
+        "CVE-2025-12781" # No fix available yet
+        "CVE-2025-11468" # No fix available yet
+        "CVE-2026-1299" # Python 3.13 email module header injection - not applicable, LiteLLM doesn't use BytesGenerator for email serialization
+        "CVE-2026-0775" # npm cli incorrect permission assignment - no fix available yet, npm is only used at build/prisma-generate time
+        "GHSA-3ppc-4f35-3m26" # minimatch ReDoS via repeated wildcards - from nodejs_wheel bundled npm, not used in application runtime code
+        "GHSA-83g3-92jg-28cx" # tar arbitrary file read/write via hardlink - from nodejs_wheel bundled npm, not used in application runtime code
+        "CVE-2026-2297" # Python 3.13 SourcelessFileLoader audit hook bypass - no fix available in base image
+        "GHSA-qffp-2rhf-9h96" # tar hardlink path traversal - from nodejs_wheel bundled npm, not used in application runtime code
+        "CVE-2026-2673" # OpenSSL 3.6.1 TLS 1.3 key exchange group negotiation issue - no fix available yet
+        "CVE-2026-3644" # Python 3.13 vulnerability - no fix available in base image
+        "CVE-2026-4224" # Python 3.13 Expat parser stack overflow in ElementDeclHandler - no fix available in base image
+    )
+
+    # Build JSON array of allowlisted CVE IDs for jq
+    ALLOWED_IDS_JSON=$(printf '%s\n' "${ALLOWED_CVES[@]}" | jq -R . | jq -s .)
+
+    echo "Checking for vulnerabilities with CVSS score >= 4.0..."
+    echo "Allowlisted CVEs (ignored in threshold): ${ALLOWED_CVES[*]}"
+    echo ""
+    
+    # Show all high-severity vulnerabilities for transparency
+    TOTAL_HIGH_SEVERITY=$(grype litellm:latest -o json | jq -r '
+        .matches[]
+        | select(.vulnerability.cvss[]?.metrics.baseScore >= 4.0)
+        | .vulnerability.id' | wc -l)
+    
+    if [ "$TOTAL_HIGH_SEVERITY" -gt 0 ]; then
+        echo "Total vulnerabilities found with CVSS >= 4.0: $TOTAL_HIGH_SEVERITY"
+        echo ""
+        echo "All high-severity vulnerabilities (including allowlisted):"
+        grype litellm:latest -o json | jq --argjson allow "$ALLOWED_IDS_JSON" -r '
+        ["Package", "Version", "Vulnerability ID", "CVSS Score", "Allowlisted"],
+        (.matches[]
+          | select(.vulnerability.cvss[]?.metrics.baseScore >= 4.0)
+          | [.artifact.name, .artifact.version, .vulnerability.id, .vulnerability.cvss[0].metrics.baseScore, (if (.vulnerability.id as $id | $allow | index($id)) then "YES" else "NO" end)])
+        | @tsv' | column -t -s $'\t'
+        echo ""
+    fi
+
+    HIGH_SEVERITY_COUNT=$(grype litellm:latest -o json | jq --argjson allow "$ALLOWED_IDS_JSON" -r '
+        .matches[]
+        | select(.vulnerability.cvss[]?.metrics.baseScore >= 4.0)
+        | select((.vulnerability.id as $id | $allow | index($id) | not))
+        | .vulnerability.id' | wc -l)
+    
+    if [ "$HIGH_SEVERITY_COUNT" -gt 0 ]; then
+        echo ""
+        echo "=========================================="
+        echo "ERROR: Security Scan Failed"
+        echo "=========================================="
+        echo "Found $HIGH_SEVERITY_COUNT non-allowlisted vulnerabilities with CVSS score >= 4.0 in litellm:latest"
+        echo ""
+        echo "These vulnerabilities are NOT in the allowlist and must be addressed."
+        echo "Current allowlisted CVEs: ${ALLOWED_CVES[*]}"
+        echo ""
+        echo "Detailed vulnerability report:"
+        echo ""
+        grype litellm:latest -o json | jq --argjson allow "$ALLOWED_IDS_JSON" -r '
+        ["Package", "Version", "Vulnerability ID", "CVSS Score", "Severity", "Fix Version", "Description"],
+        (.matches[]
+          | select(.vulnerability.cvss[]?.metrics.baseScore >= 4.0)
+          | select((.vulnerability.id as $id | $allow | index($id) | not))
+          | [.artifact.name, .artifact.version, .vulnerability.id, .vulnerability.cvss[0].metrics.baseScore, .vulnerability.severity, (.vulnerability.fix.versions[0] // "No fix available"), .vulnerability.description])
+        | @tsv' | column -t -s $'\t'
+        echo ""
+        echo "=========================================="
+        echo "Action Required:"
+        echo "=========================================="
+        echo "1. If a fix is available, update the package to the fixed version"
+        echo "2. If the vulnerability is not applicable or has no fix:"
+        echo "   - Add the CVE/GHSA ID to ALLOWED_CVES array in ci_cd/security_scans.sh"
+        echo "   - Add a comment explaining why it's safe to ignore"
+        echo ""
+        echo "Note: Some vulnerabilities may have multiple IDs (CVE-XXXX and GHSA-XXXX)."
+        echo "Add all relevant IDs to the allowlist if they refer to the same issue."
+        echo "=========================================="
+        echo ""
+        exit 1
+    else
+        echo "No high-severity vulnerabilities (CVSS >= 4.0) found in litellm:latest"
+    fi
+    
+    echo "Grype scans completed successfully"
+}
+
+# Main execution
+main() {
+    echo "Installing security scanning tools..."
+    install_trivy
+    install_grype
+    
+    # echo "Running secret detection scans..."
+    # run_secret_detection
+    
+    echo "Running filesystem vulnerability scans..."
+    run_trivy_scans
+    
+    echo "Running Docker image vulnerability scans..."
+    run_grype_scans
+    
+    echo "All security scans completed successfully!"
+}
+
+# Execute main function
+main "$@"

cookbook/anthropic_agent_sdk/agent_with_mcp.py

@@ -24,26 +24,24 @@ async def interactive_chat_with_mcp():
     Interactive CLI chat with the agent and MCP server
     """
     config = Config()
-
+    
     # Configure Anthropic SDK to point to LiteLLM gateway
     litellm_base_url = setup_litellm_env(config)
-
+    
     # Fetch available models from proxy
-    available_models = await fetch_available_models(
-        litellm_base_url, config.LITELLM_API_KEY
-    )
-
+    available_models = await fetch_available_models(litellm_base_url, config.LITELLM_API_KEY)
+    
     current_model = config.LITELLM_MODEL
-
+    
     # MCP server configuration
     mcp_server_url = f"{litellm_base_url}/mcp/deepwiki2"
     use_mcp = os.getenv("USE_MCP", "true").lower() == "true"
-
+    
     if not use_mcp:
         print("⚠️  MCP disabled via USE_MCP=false")
-
+    
     print_header(litellm_base_url, current_model, has_mcp=use_mcp)
-
+    
     while True:
         # Configure agent options
         if use_mcp:
@@ -60,7 +58,7 @@ async def interactive_chat_with_mcp():
                             "url": mcp_server_url,
                             "headers": {
                                 "Authorization": f"Bearer {config.LITELLM_API_KEY}"
-                            },
+                            }
                         }
                     },
                 )
@@ -80,12 +78,12 @@ async def interactive_chat_with_mcp():
                 model=current_model,
                 max_turns=50,
             )
-
+        
         # Create agent client
         try:
             async with ClaudeSDKClient(options=options) as client:
                 conversation_active = True
-
+                
                 while conversation_active:
                     # Get user input
                     try:
@@ -93,36 +91,34 @@ async def interactive_chat_with_mcp():
                     except (EOFError, KeyboardInterrupt):
                         print("\n\n👋 Goodbye!")
                         return
-
+                    
                     # Handle commands
-                    if user_input.lower() in ["quit", "exit"]:
+                    if user_input.lower() in ['quit', 'exit']:
                         print("\n👋 Goodbye!")
                         return
-
-                    if user_input.lower() == "clear":
+                    
+                    if user_input.lower() == 'clear':
                         print("\n🔄 Starting new conversation...\n")
                         conversation_active = False
                         continue
-
-                    if user_input.lower() == "models":
+                    
+                    if user_input.lower() == 'models':
                         handle_model_list(available_models, current_model)
                         continue
-
-                    if user_input.lower() == "model":
-                        new_model, should_restart = handle_model_switch(
-                            available_models, current_model
-                        )
+                    
+                    if user_input.lower() == 'model':
+                        new_model, should_restart = handle_model_switch(available_models, current_model)
                         if should_restart:
                             current_model = new_model
                             conversation_active = False
                         continue
-
+                    
                     if not user_input:
                         continue
-
+                    
                     # Stream response from agent
                     await stream_response(client, user_input)
-
+        
         except Exception as e:
             print(f"\n❌ Error creating agent client: {e}")
             print("This might be an MCP configuration issue. Try running without MCP:")

cookbook/anthropic_agent_sdk/common.py

@@ -8,13 +8,13 @@ import httpx
 
 class Config:
     """Configuration for LiteLLM Gateway connection"""
-
+    
     # LiteLLM proxy URL (default to local instance)
     LITELLM_PROXY_URL = os.getenv("LITELLM_PROXY_URL", "http://localhost:4000")
-
+    
     # LiteLLM API key (master key or virtual key)
     LITELLM_API_KEY = os.getenv("LITELLM_API_KEY", "sk-1234")
-
+    
     # Model name as configured in LiteLLM (e.g., "bedrock-claude-sonnet-4", "gpt-4", etc.)
     LITELLM_MODEL = os.getenv("LITELLM_MODEL", "bedrock-claude-sonnet-4.5")
 
@@ -28,7 +28,7 @@ async def fetch_available_models(base_url: str, api_key: str) -> list[str]:
             response = await client.get(
                 f"{base_url}/models",
                 headers={"Authorization": f"Bearer {api_key}"},
-                timeout=10.0,
+                timeout=10.0
             )
             response.raise_for_status()
             data = response.json()
@@ -50,7 +50,7 @@ def setup_litellm_env(config: Config):
     """
     Configure environment variables to point Agent SDK to LiteLLM
     """
-    litellm_base_url = config.LITELLM_PROXY_URL.rstrip("/")
+    litellm_base_url = config.LITELLM_PROXY_URL.rstrip('/')
     os.environ["ANTHROPIC_BASE_URL"] = litellm_base_url
     os.environ["ANTHROPIC_API_KEY"] = config.LITELLM_API_KEY
     return litellm_base_url
@@ -87,12 +87,10 @@ def handle_model_list(available_models: list[str], current_model: str):
         print(f"  {marker} {i}. {model}")
 
 
-def handle_model_switch(
-    available_models: list[str], current_model: str
-) -> tuple[str, bool]:
+def handle_model_switch(available_models: list[str], current_model: str) -> tuple[str, bool]:
     """
     Handle model switching
-
+    
     Returns:
         tuple: (new_model, should_restart_conversation)
     """
@@ -100,7 +98,7 @@ def handle_model_switch(
     for i, model in enumerate(available_models, 1):
         marker = "✓" if model == current_model else " "
         print(f"  {marker} {i}. {model}")
-
+    
     try:
         choice = input("\nEnter number (or press Enter to cancel): ").strip()
         if choice:
@@ -114,7 +112,7 @@ def handle_model_switch(
                 print("❌ Invalid choice")
     except (ValueError, IndexError):
         print("❌ Invalid input")
-
+    
     return current_model, False
 
 
@@ -122,43 +120,41 @@ async def stream_response(client, user_input: str):
     """
     Stream response from the agent
     """
-    print("\n🤖 Assistant: ", end="", flush=True)
-
+    print("\n🤖 Assistant: ", end='', flush=True)
+    
     try:
         await client.query(user_input)
-
+        
         # Show loading indicator
-        print("⏳ thinking...", end="", flush=True)
-
+        print("⏳ thinking...", end='', flush=True)
+        
         # Stream the response
         first_chunk = True
         async for msg in client.receive_response():
             # Clear loading indicator on first message
             if first_chunk:
-                print("\r🤖 Assistant: ", end="", flush=True)
+                print("\r🤖 Assistant: ", end='', flush=True)
                 first_chunk = False
-
+            
             # Handle different message types
-            if hasattr(msg, "type"):
-                if msg.type == "content_block_delta":
+            if hasattr(msg, 'type'):
+                if msg.type == 'content_block_delta':
                     # Streaming text delta
-                    if hasattr(msg, "delta") and hasattr(msg.delta, "text"):
-                        print(msg.delta.text, end="", flush=True)
-                elif msg.type == "content_block_start":
+                    if hasattr(msg, 'delta') and hasattr(msg.delta, 'text'):
+                        print(msg.delta.text, end='', flush=True)
+                elif msg.type == 'content_block_start':
                     # Start of content block
-                    if hasattr(msg, "content_block") and hasattr(
-                        msg.content_block, "text"
-                    ):
-                        print(msg.content_block.text, end="", flush=True)
-
+                    if hasattr(msg, 'content_block') and hasattr(msg.content_block, 'text'):
+                        print(msg.content_block.text, end='', flush=True)
+            
             # Fallback to original content handling
-            if hasattr(msg, "content"):
+            if hasattr(msg, 'content'):
                 for content_block in msg.content:
-                    if hasattr(content_block, "text"):
-                        print(content_block.text, end="", flush=True)
-
+                    if hasattr(content_block, 'text'):
+                        print(content_block.text, end='', flush=True)
+        
         print()  # New line after response
-
+        
     except Exception as e:
         print(f"\r\n❌ Error: {e}")
         print("Please check your LiteLLM gateway is running and configured correctly.")

cookbook/anthropic_agent_sdk/main.py

@@ -24,19 +24,17 @@ async def interactive_chat():
     Interactive CLI chat with the agent
     """
     config = Config()
-
+    
     # Configure Anthropic SDK to point to LiteLLM gateway
     litellm_base_url = setup_litellm_env(config)
-
+    
     # Fetch available models from proxy
-    available_models = await fetch_available_models(
-        litellm_base_url, config.LITELLM_API_KEY
-    )
-
+    available_models = await fetch_available_models(litellm_base_url, config.LITELLM_API_KEY)
+    
     current_model = config.LITELLM_MODEL
-
+    
     print_header(litellm_base_url, current_model)
-
+    
     while True:
         # Configure agent options for each conversation
         options = ClaudeAgentOptions(
@@ -44,11 +42,11 @@ async def interactive_chat():
             model=current_model,
             max_turns=50,
         )
-
+        
         # Create agent client
         async with ClaudeSDKClient(options=options) as client:
             conversation_active = True
-
+            
             while conversation_active:
                 # Get user input
                 try:
@@ -56,33 +54,31 @@ async def interactive_chat():
                 except (EOFError, KeyboardInterrupt):
                     print("\n\n👋 Goodbye!")
                     return
-
+                
                 # Handle commands
-                if user_input.lower() in ["quit", "exit"]:
+                if user_input.lower() in ['quit', 'exit']:
                     print("\n👋 Goodbye!")
                     return
-
-                if user_input.lower() == "clear":
+                
+                if user_input.lower() == 'clear':
                     print("\n🔄 Starting new conversation...\n")
                     conversation_active = False
                     continue
-
-                if user_input.lower() == "models":
+                
+                if user_input.lower() == 'models':
                     handle_model_list(available_models, current_model)
                     continue
-
-                if user_input.lower() == "model":
-                    new_model, should_restart = handle_model_switch(
-                        available_models, current_model
-                    )
+                
+                if user_input.lower() == 'model':
+                    new_model, should_restart = handle_model_switch(available_models, current_model)
                     if should_restart:
                         current_model = new_model
                         conversation_active = False
                     continue
-
+                
                 if not user_input:
                     continue
-
+                
                 # Stream response from agent
                 await stream_response(client, user_input)
 

cookbook/litellm-ollama-docker-image/requirements.txt

@@ -1 +1 @@
-litellm==1.83.5
+litellm==1.61.15

cookbook/litellm_proxy_server/batch_api/bedrock/bedrock.py

@@ -11,15 +11,15 @@ BEDROCK_BATCH_MODEL = "bedrock/batch-anthropic.claude-3-5-sonnet-20240620-v1:0"
 batch_input_file = client.files.create(
     file=open("./bedrock_batch_completions.jsonl", "rb"),
     purpose="batch",
-    extra_body={"target_model_names": BEDROCK_BATCH_MODEL},
+    extra_body={"target_model_names": BEDROCK_BATCH_MODEL}
 )
 print(batch_input_file)
 
 # Create batch
-batch = client.batches.create(
+batch = client.batches.create( 
     input_file_id=batch_input_file.id,
     endpoint="/v1/chat/completions",
     completion_window="24h",
     metadata={"description": "Test batch job"},
 )
-print(batch)
+print(batch)

cookbook/litellm_proxy_server/cli_token_usage.py

@@ -8,7 +8,6 @@ in your Python scripts after running `litellm-proxy login`.
 
 from textwrap import indent
 import litellm
-
 LITELLM_BASE_URL = "http://localhost:4000/"
 
 
@@ -16,38 +15,38 @@ def main():
     """Using CLI token with LiteLLM SDK"""
     print("🚀 Using CLI Token with LiteLLM SDK")
     print("=" * 40)
-    # litellm._turn_on_debug()
-
+    #litellm._turn_on_debug()
+    
     # Get the CLI token
     api_key = litellm.get_litellm_gateway_api_key()
-
+    
     if not api_key:
         print("❌ No CLI token found. Please run 'litellm-proxy login' first.")
         return
-
+    
     print("✅ Found CLI token.")
 
     available_models = litellm.get_valid_models(
         check_provider_endpoint=True,
         custom_llm_provider="litellm_proxy",
         api_key=api_key,
-        api_base=LITELLM_BASE_URL,
+        api_base=LITELLM_BASE_URL
     )
-
+    
     print("✅ Available models:")
     if available_models:
         for i, model in enumerate(available_models, 1):
             print(f"   {i:2d}. {model}")
     else:
         print("   No models available")
-
+    
     # Use with LiteLLM
     try:
         response = litellm.completion(
             model="litellm_proxy/gemini/gemini-2.5-flash",
             messages=[{"role": "user", "content": "Hello from CLI token!"}],
             api_key=api_key,
-            base_url=LITELLM_BASE_URL,
+            base_url=LITELLM_BASE_URL
         )
         print(f"✅ LLM Response: {response.model_dump_json(indent=4)}")
     except Exception as e:
@@ -56,7 +55,7 @@ def main():
 
 if __name__ == "__main__":
     main()
-
+    
     print("\n💡 Tips:")
     print("1. Run 'litellm-proxy login' to authenticate first")
     print("2. Replace 'https://your-proxy.com' with your actual proxy URL")

cookbook/litellm_proxy_server/mcp/mcp_with_litellm_proxy.py

@@ -3,12 +3,11 @@ Use LiteLLM Proxy MCP Gateway to call MCP tools.
 
 When using LiteLLM Proxy, you can use the same MCP tools across all your LLM providers.
 """
-
 import openai
 
 client = openai.OpenAI(
-    api_key="sk-1234",  # paste your litellm proxy api key here
-    base_url="http://localhost:4000",  # paste your litellm proxy base url here
+    api_key="sk-1234", # paste your litellm proxy api key here
+    base_url="http://localhost:4000" # paste your litellm proxy base url here
 )
 print("Making API request to Responses API with MCP tools")
 
@@ -18,7 +17,7 @@ response = client.responses.create(
         {
             "role": "user",
             "content": "give me TLDR of what BerriAI/litellm repo is about",
-            "type": "message",
+            "type": "message"
         }
     ],
     tools=[
@@ -26,11 +25,11 @@ response = client.responses.create(
             "type": "mcp",
             "server_label": "litellm",
             "server_url": "litellm_proxy",
-            "require_approval": "never",
+            "require_approval": "never"
         }
     ],
     stream=True,
-    tool_choice="required",
+    tool_choice="required"
 )
 
 for chunk in response:

cookbook/litellm_proxy_server/secret_manager/my_secret_manager.py

@@ -40,10 +40,8 @@ class InMemorySecretManager(CustomSecretManager):
     ) -> Optional[str]:
         """Read secret synchronously"""
         from litellm._logging import verbose_proxy_logger
-
-        verbose_proxy_logger.info(
-            f"CUSTOM SECRET MANAGER: LOOKING FOR SECRET: {secret_name}"
-        )
+        
+        verbose_proxy_logger.info(f"CUSTOM SECRET MANAGER: LOOKING FOR SECRET: {secret_name}")
         value = self.secrets.get(secret_name)
         verbose_proxy_logger.info(f"CUSTOM SECRET MANAGER: READ SECRET: {value}")
         return value
@@ -78,3 +76,4 @@ class InMemorySecretManager(CustomSecretManager):
             del self.secrets[secret_name]
             return {"status": "deleted", "secret_name": secret_name}
         return {"status": "not_found", "secret_name": secret_name}
+

cookbook/livekit_agent_sdk/main.py

@@ -5,7 +5,6 @@ This example shows how to use LiveKit's xAI realtime plugin through LiteLLM prox
 LiteLLM acts as a unified interface, allowing you to switch between xAI, OpenAI, 
 and Azure realtime APIs without changing your agent code.
 """
-
 import asyncio
 import json
 import os
@@ -24,79 +23,71 @@ async def run_voice_agent():
     2. Sends a user message
     3. Streams back the response
     """
-
+    
     url = f"ws://{PROXY_URL.replace('http://', '').replace('https://', '')}/v1/realtime?model={MODEL}"
     headers = {"Authorization": f"Bearer {API_KEY}"}
-
+    
     print(f"🎙️  Connecting to voice agent...")
     print(f"   Model: {MODEL}")
     print(f"   Proxy: {PROXY_URL}")
     print()
-
+    
     async with websockets.connect(url, additional_headers=headers) as ws:
         # Receive initial connection event
         initial = json.loads(await ws.recv())
         print(f"✅ Connected! Event: {initial['type']}\n")
-
+        
         # Get user input
         user_message = input("💬 Your message: ").strip()
         if not user_message:
             user_message = "Tell me a fun fact about AI!"
-
+        
         print(f"\n🤖 Sending to {MODEL}...\n")
-
+        
         # Send user message
-        await ws.send(
-            json.dumps(
-                {
-                    "type": "conversation.item.create",
-                    "item": {
-                        "type": "message",
-                        "role": "user",
-                        "content": [{"type": "input_text", "text": user_message}],
-                    },
-                }
-            )
-        )
-
+        await ws.send(json.dumps({
+            "type": "conversation.item.create",
+            "item": {
+                "type": "message",
+                "role": "user",
+                "content": [{"type": "input_text", "text": user_message}]
+            }
+        }))
+        
         # Request response
-        await ws.send(
-            json.dumps(
-                {
-                    "type": "response.create",
-                    "response": {"modalities": ["text", "audio"]},
-                }
-            )
-        )
-
+        await ws.send(json.dumps({
+            "type": "response.create",
+            "response": {"modalities": ["text", "audio"]}
+        }))
+        
         # Stream response
-        print("🎤 Response: ", end="", flush=True)
+        print("🎤 Response: ", end='', flush=True)
         transcript = []
-
+        
         try:
             while True:
                 msg = await asyncio.wait_for(ws.recv(), timeout=15.0)
                 event = json.loads(msg)
-
+                
                 # Capture transcript deltas
-                if event["type"] == "response.output_audio_transcript.delta":
-                    delta = event.get("delta", "")
+                if event['type'] == 'response.output_audio_transcript.delta':
+                    delta = event.get('delta', '')
                     if delta:
-                        print(delta, end="", flush=True)
+                        print(delta, end='', flush=True)
                         transcript.append(delta)
-
+                
                 # Done when response completes
-                elif event["type"] == "response.done":
+                elif event['type'] == 'response.done':
                     break
-
+        
         except asyncio.TimeoutError:
             pass
-
+        
         print("\n")
-
+        
         if transcript:
             print(f"✅ Complete response: {''.join(transcript)}")
-
+        
         await ws.close()
 
 
@@ -106,7 +97,7 @@ def main():
     print("LiveKit xAI Voice Agent via LiteLLM Proxy")
     print("=" * 70)
     print()
-
+    
     try:
         asyncio.run(run_voice_agent())
     except KeyboardInterrupt:

cookbook/misc/RELEASE_NOTES_GENERATION_INSTRUCTIONS.md

@@ -9,32 +9,6 @@ This document provides comprehensive instructions for AI agents to generate rele
 3. **Previous Version Commit Hash** - To compare model pricing changes
 4. **Reference Release Notes** - Use recent stable releases (v1.76.3-stable, v1.77.2-stable) as templates for consistent formatting
 
-### Resolving Staging PRs
-
-The GitHub release page (e.g. `https://github.com/BerriAI/litellm/releases/tag/v1.83.3-stable`) does **not** list the real changelog directly. The "What's Changed" section contains **staging PRs** that each bundle many individual commits/PRs. For example:
-
-- `Litellm oss staging 03 14 2026 by @RheagalFire in #23686`
-- `Litellm ryan march 16 by @ryan-crabbe in #23822`
-
-To get the real changelog, you MUST click into each staging PR (e.g. `#23686`, `#23822`), open its **Commits** tab, and extract every underlying commit/PR (look for the `(#NNNNN)` suffix on commit titles). Those underlying PRs — not the staging PRs — are what get categorized in the release notes. Never treat a staging PR title as a single changelog entry.
-
-**IMPORTANT — staging PRs are not the complete source.** Some PRs land on the release branch *before* the staging PRs and are therefore not reachable via `gh api /pulls/<staging>/commits`. GitHub's auto-generated "What's Changed" on the release page also misses these. To catch every PR in the release, you MUST additionally walk the full git log range between the previous release's commit and this release's commit:
-
-```bash
-git fetch origin --tags
-git log <prev_release_commit>..<this_release_commit> --oneline | grep -oE '#[0-9]+' | sort -u
-```
-
-Union the PR set from the staging-PR walk with the PR set from `git log`. Any PR in `git log` but missing from your staging-expanded set is almost certainly a content PR that merged directly to the release branch — fetch its title/body with `gh pr view <N>` and categorize it. Do not trust the GH release body or the staging PRs alone as the authoritative list.
-
-**Sanity check for new contributors.** The GH release body's "New Contributors" list is a *floor*, not authoritative. For every PR author who appears in the release (including underlying PRs from staging and PRs found only via `git log`), verify whether they are a first-time contributor by running:
-
-```bash
-gh api "search/issues?q=is:pr+author:<login>+repo:BerriAI/litellm+is:merged&sort=created&order=asc" --jq '.items[0] | {n:.number, merged:.closed_at}'
-```
-
-If the author's earliest merged PR number matches a PR in this release window, they are a new contributor. If their earliest merged PR predates the previous release tag, they are not. Do not copy the GH release body's list blindly — it can both miss contributors (PRs that merged via an older dev branch) and falsely include contributors whose "first" PR in this window was not actually their first ever.
-
 ## Step-by-Step Process
 
 ### 1. Initial Setup and Analysis

cookbook/misc/test_responses_api.py

@@ -1,9 +1,10 @@
 import base64
 from openai import OpenAI
 import time
-
-client = OpenAI(base_url="http://0.0.0.0:4001", api_key="sk-1234")
-
+client = OpenAI(
+    base_url="http://0.0.0.0:4001",
+    api_key="sk-1234"
+)
 
 # Function to encode the image
 def encode_image(image_path):
@@ -24,7 +25,7 @@ response = client.responses.create(
         {
             "role": "user",
             "content": [
-                {"type": "input_text", "text": "what color is the image"},
+                { "type": "input_text", "text": "what color is the image"},
                 {
                     "type": "input_image",
                     "image_url": f"data:image/jpeg;base64,{base64_image}",
@@ -35,6 +36,7 @@ response = client.responses.create(
 )
 
 
+
 print(response.output_text)
 print("response1 id===", response.id)
 print("sleeping for 20 seconds...")
@@ -43,7 +45,9 @@ print("making follow up request for existing id")
 response2 = client.responses.create(
     model="bedrock/us.anthropic.claude-haiku-4-5-20251001-v1:0",
     previous_response_id=response.id,
-    input="ok, and what objects are in the image?",
+    input="ok, and what objects are in the image?"
 )
 
 print(response2.output_text)
+
+

cookbook/nova_sonic_realtime.py

@@ -52,11 +52,11 @@ class RealtimeClient:
     async def connect(self):
         """Connect to LiteLLM proxy realtime endpoint."""
         print(f"Connecting to {self.url}...")
-
+        
         headers = {}
         if self.api_key:
             headers["Authorization"] = f"Bearer {self.api_key}"
-
+        
         self.ws = await websockets.connect(
             self.url,
             additional_headers=headers,
@@ -175,9 +175,7 @@ class RealtimeClient:
 
         try:
             while self.is_active:
-                audio_data = self.input_stream.read(
-                    CHUNK_SIZE, exception_on_overflow=False
-                )
+                audio_data = self.input_stream.read(CHUNK_SIZE, exception_on_overflow=False)
                 await self.send_audio_chunk(audio_data)
                 await asyncio.sleep(0.01)  # Small delay to prevent overwhelming
         except Exception as e:
@@ -272,7 +270,6 @@ async def main():
     except Exception as e:
         print(f"\n❌ Error: {e}")
         import traceback
-
         traceback.print_exc()
     finally:
         await client.close()
@@ -284,7 +281,7 @@ if __name__ == "__main__":
     print("2. Bedrock is configured in proxy_server_config.yaml")
     print("3. AWS credentials are set")
     print()
-
+    
     try:
         asyncio.run(main())
     except KeyboardInterrupt:

cookbook/veo_video_generation.py

@@ -21,45 +21,49 @@ from typing import Optional
 
 class VeoVideoGenerator:
     """Complete Veo video generation client using LiteLLM proxy."""
-
-    def __init__(
-        self,
-        base_url: str = "http://localhost:4000/gemini/v1beta",
-        api_key: str = "sk-1234",
-    ):
+    
+    def __init__(self, base_url: str = "http://localhost:4000/gemini/v1beta", 
+                 api_key: str = "sk-1234"):
         """
         Initialize the Veo video generator.
-
+        
         Args:
             base_url: Base URL for the LiteLLM proxy with Gemini pass-through
             api_key: API key for LiteLLM proxy authentication
         """
         self.base_url = base_url
         self.api_key = api_key
-        self.headers = {"x-goog-api-key": api_key, "Content-Type": "application/json"}
-
+        self.headers = {
+            "x-goog-api-key": api_key,
+            "Content-Type": "application/json"
+        }
+    
     def generate_video(self, prompt: str) -> Optional[str]:
         """
         Initiate video generation with Veo.
-
+        
         Args:
             prompt: Text description of the video to generate
-
+            
         Returns:
             Operation name if successful, None otherwise
         """
         print(f"🎬 Generating video with prompt: '{prompt}'")
-
+        
         url = f"{self.base_url}/models/veo-3.0-generate-preview:predictLongRunning"
-        payload = {"instances": [{"prompt": prompt}]}
-
+        payload = {
+            "instances": [{
+                "prompt": prompt
+            }]
+        }
+        
         try:
             response = requests.post(url, headers=self.headers, json=payload)
             response.raise_for_status()
-
+            
             data = response.json()
             operation_name = data.get("name")
-
+            
             if operation_name:
                 print(f"✅ Video generation started: {operation_name}")
                 return operation_name
@@ -67,64 +71,58 @@ class VeoVideoGenerator:
                 print("❌ No operation name returned")
                 print(f"Response: {json.dumps(data, indent=2)}")
                 return None
-
+                
         except requests.RequestException as e:
             print(f"❌ Failed to start video generation: {e}")
-            if hasattr(e, "response") and e.response is not None:
+            if hasattr(e, 'response') and e.response is not None:
                 try:
                     error_data = e.response.json()
                     print(f"Error details: {json.dumps(error_data, indent=2)}")
                 except:
                     print(f"Error response: {e.response.text}")
             return None
-
-    def wait_for_completion(
-        self, operation_name: str, max_wait_time: int = 600
-    ) -> Optional[str]:
+    
+    def wait_for_completion(self, operation_name: str, max_wait_time: int = 600) -> Optional[str]:
         """
         Poll operation status until video generation is complete.
-
+        
         Args:
             operation_name: Name of the operation to monitor
             max_wait_time: Maximum time to wait in seconds (default: 10 minutes)
-
+            
         Returns:
             Video URI if successful, None otherwise
         """
         print("⏳ Waiting for video generation to complete...")
-
+        
         operation_url = f"{self.base_url}/{operation_name}"
         start_time = time.time()
         poll_interval = 10  # Start with 10 seconds
-
+        
         while time.time() - start_time < max_wait_time:
             try:
-                print(
-                    f"🔍 Polling status... ({int(time.time() - start_time)}s elapsed)"
-                )
-
+                print(f"🔍 Polling status... ({int(time.time() - start_time)}s elapsed)")
+                
                 response = requests.get(operation_url, headers=self.headers)
                 response.raise_for_status()
-
+                
                 data = response.json()
-
+                
                 # Check for errors
                 if "error" in data:
                     print("❌ Error in video generation:")
                     print(json.dumps(data["error"], indent=2))
                     return None
-
+                
                 # Check if operation is complete
                 is_done = data.get("done", False)
-
+                
                 if is_done:
                     print("🎉 Video generation complete!")
-
+                    
                     try:
                         # Extract video URI from nested response
-                        video_uri = data["response"]["generateVideoResponse"][
-                            "generatedSamples"
-                        ][0]["video"]["uri"]
+                        video_uri = data["response"]["generateVideoResponse"]["generatedSamples"][0]["video"]["uri"]
                         print(f"📹 Video URI: {video_uri}")
                         return video_uri
                     except KeyError as e:
@@ -132,68 +130,64 @@ class VeoVideoGenerator:
                         print("Full response:")
                         print(json.dumps(data, indent=2))
                         return None
-
+                
                 # Wait before next poll, with exponential backoff
                 time.sleep(poll_interval)
                 poll_interval = min(poll_interval * 1.2, 30)  # Cap at 30 seconds
-
+                
             except requests.RequestException as e:
                 print(f"❌ Error polling operation status: {e}")
                 time.sleep(poll_interval)
-
+        
         print(f"⏰ Timeout after {max_wait_time} seconds")
         return None
-
-    def download_video(
-        self, video_uri: str, output_filename: str = "generated_video.mp4"
-    ) -> bool:
+    
+    def download_video(self, video_uri: str, output_filename: str = "generated_video.mp4") -> bool:
         """
         Download the generated video file.
-
+        
         Args:
             video_uri: URI of the video to download (from Google's response)
             output_filename: Local filename to save the video
-
+            
         Returns:
             True if download successful, False otherwise
         """
         print(f"⬇️  Downloading video...")
         print(f"Original URI: {video_uri}")
-
+        
         # Convert Google URI to LiteLLM proxy URI
         # Example: files/abc123 -> /gemini/v1beta/files/abc123:download?alt=media
         if video_uri.startswith("files/"):
             download_path = f"{video_uri}:download?alt=media"
         else:
             download_path = video_uri
-
+            
         litellm_download_url = f"{self.base_url}/{download_path}"
         print(f"Download URL: {litellm_download_url}")
-
+        
         try:
             # Download with streaming and redirect handling
             response = requests.get(
-                litellm_download_url,
-                headers=self.headers,
+                litellm_download_url, 
+                headers=self.headers, 
                 stream=True,
-                allow_redirects=True,  # Handle redirects automatically
+                allow_redirects=True  # Handle redirects automatically
             )
             response.raise_for_status()
-
+            
             # Save video file
-            with open(output_filename, "wb") as f:
+            with open(output_filename, 'wb') as f:
                 downloaded_size = 0
                 for chunk in response.iter_content(chunk_size=8192):
                     if chunk:
                         f.write(chunk)
                         downloaded_size += len(chunk)
-
+                        
                         # Progress indicator for large files
                         if downloaded_size % (1024 * 1024) == 0:  # Every MB
-                            print(
-                                f"📦 Downloaded {downloaded_size / (1024*1024):.1f} MB..."
-                            )
-
+                            print(f"📦 Downloaded {downloaded_size / (1024*1024):.1f} MB...")
+            
             # Verify file was created and has content
             if os.path.exists(output_filename):
                 file_size = os.path.getsize(output_filename)
@@ -209,52 +203,48 @@ class VeoVideoGenerator:
             else:
                 print("❌ File was not created")
                 return False
-
+                
         except requests.RequestException as e:
             print(f"❌ Download failed: {e}")
-            if hasattr(e, "response") and e.response is not None:
+            if hasattr(e, 'response') and e.response is not None:
                 print(f"Status code: {e.response.status_code}")
                 print(f"Response headers: {dict(e.response.headers)}")
             return False
-
+    
     def generate_and_download(self, prompt: str, output_filename: str = None) -> bool:
         """
         Complete workflow: generate video and download it.
-
+        
         Args:
             prompt: Text description for video generation
             output_filename: Output filename (auto-generated if None)
-
+            
         Returns:
             True if successful, False otherwise
         """
         # Auto-generate filename if not provided
         if output_filename is None:
             timestamp = int(time.time())
-            safe_prompt = "".join(
-                c for c in prompt[:30] if c.isalnum() or c in (" ", "-", "_")
-            ).rstrip()
-            output_filename = (
-                f"veo_video_{safe_prompt.replace(' ', '_')}_{timestamp}.mp4"
-            )
-
+            safe_prompt = "".join(c for c in prompt[:30] if c.isalnum() or c in (' ', '-', '_')).rstrip()
+            output_filename = f"veo_video_{safe_prompt.replace(' ', '_')}_{timestamp}.mp4"
+        
         print("=" * 60)
         print("🎬 VEO VIDEO GENERATION WORKFLOW")
         print("=" * 60)
-
+        
         # Step 1: Generate video
         operation_name = self.generate_video(prompt)
         if not operation_name:
             return False
-
+        
         # Step 2: Wait for completion
         video_uri = self.wait_for_completion(operation_name)
         if not video_uri:
             return False
-
+        
         # Step 3: Download video
         success = self.download_video(video_uri, output_filename)
-
+        
         if success:
             print("=" * 60)
             print("🎉 SUCCESS! Video generation complete!")
@@ -264,51 +254,51 @@ class VeoVideoGenerator:
             print("=" * 60)
             print("❌ FAILED! Video generation or download failed")
             print("=" * 60)
-
+        
         return success
 
 
 def main():
     """
     Example usage of the VeoVideoGenerator.
-
+    
     Configure these environment variables:
     - LITELLM_BASE_URL: Your LiteLLM proxy URL (default: http://localhost:4000/gemini/v1beta)
     - LITELLM_API_KEY: Your LiteLLM API key (default: sk-1234)
     """
-
+    
     # Configuration from environment or defaults
     base_url = os.getenv("LITELLM_BASE_URL", "http://localhost:4000/gemini/v1beta")
     api_key = os.getenv("LITELLM_API_KEY", "sk-1234")
-
+    
     print("🚀 Starting Veo Video Generation Example")
     print(f"📡 Using LiteLLM proxy at: {base_url}")
-
+    
     # Initialize generator
     generator = VeoVideoGenerator(base_url=base_url, api_key=api_key)
-
+    
     # Example prompts - try different ones!
     example_prompts = [
         "A cat playing with a ball of yarn in a sunny garden",
         "Ocean waves crashing against rocky cliffs at sunset",
         "A bustling city street with people walking and cars passing by",
-        "A peaceful forest with sunlight filtering through the trees",
+        "A peaceful forest with sunlight filtering through the trees"
     ]
-
+    
     # Use first example or get from user
     prompt = example_prompts[0]
     print(f"🎬 Using prompt: '{prompt}'")
-
+    
     # Generate and download video
     success = generator.generate_and_download(prompt)
-
+    
     if success:
         print("\n✅ Example completed successfully!")
         print("💡 Try modifying the prompt in the script for different videos!")
     else:
         print("\n❌ Example failed!")
         print("🔧 Check your LiteLLM proxy configuration and Google AI Studio API key")
-
+        
         # Troubleshooting tips
         print("\n🔍 Troubleshooting:")
         print("1. Ensure LiteLLM proxy is running with Google AI Studio pass-through")

deploy/charts/litellm-helm/templates/deployment.yaml

@@ -47,7 +47,7 @@ spec:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       {{- with .Values.extraInitContainers }}
       initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
+        {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
         - name: {{ include "litellm.name" . }}
@@ -212,7 +212,7 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
       {{- with .Values.extraContainers }}
-        {{- tpl (toYaml .) $ | nindent 8 }}
+        {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
         {{ if .Values.securityContext.readOnlyRootFilesystem }}

deploy/charts/litellm-helm/templates/migrations-job.yaml

@@ -37,7 +37,7 @@ spec:
       serviceAccountName: {{ include "litellm.migrationServiceAccountName" . }}
       {{- with .Values.migrationJob.extraInitContainers }}
       initContainers:
-        {{- tpl (toYaml .) $ | nindent 8 }}
+        {{- toYaml . | nindent 8 }}
       {{- end }} 
       containers:
         - name: prisma-migrations
@@ -96,7 +96,7 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
       {{- with .Values.migrationJob.extraContainers }}
-        {{- tpl (toYaml .) $ | nindent 8 }}
+        {{- toYaml . | nindent 8 }}
       {{- end }}
       {{- with .Values.volumes }}
       volumes:

deploy/charts/litellm-helm/tests/deployment_tests.yaml

@@ -319,61 +319,3 @@ tests:
     asserts:
       - notExists:
           path: spec.minReadySeconds
-  - it: should work with extraInitContainers
-    template: deployment.yaml
-    set:
-      extraInitContainers:
-        - name: init-test
-          image: busybox:latest
-          command: ["echo", "hello"]
-    asserts:
-      - contains:
-          path: spec.template.spec.initContainers
-          content:
-            name: init-test
-            image: busybox:latest
-            command: ["echo", "hello"]
-  - it: should support tpl in extraInitContainers
-    template: deployment.yaml
-    set:
-      image:
-        repository: ghcr.io/berriai/litellm-database
-        tag: test
-      extraInitContainers:
-        - name: init-tpl
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-          command: ["echo", "hello"]
-    asserts:
-      - contains:
-          path: spec.template.spec.initContainers
-          content:
-            name: init-tpl
-            image: "ghcr.io/berriai/litellm-database:test"
-            command: ["echo", "hello"]
-  - it: should work with extraContainers
-    template: deployment.yaml
-    set:
-      extraContainers:
-        - name: sidecar
-          image: busybox:latest
-    asserts:
-      - contains:
-          path: spec.template.spec.containers
-          content:
-            name: sidecar
-            image: busybox:latest
-  - it: should support tpl in extraContainers
-    template: deployment.yaml
-    set:
-      image:
-        repository: ghcr.io/berriai/litellm-database
-        tag: test
-      extraContainers:
-        - name: sidecar-tpl
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-    asserts:
-      - contains:
-          path: spec.template.spec.containers
-          content:
-            name: sidecar-tpl
-            image: "ghcr.io/berriai/litellm-database:test"

deploy/charts/litellm-helm/tests/migrations-job_tests.yaml

@@ -188,69 +188,3 @@ tests:
       - equal:
           path: spec.template.spec.serviceAccountName
           value: pre-existing-sa
-  - it: should work with extraInitContainers
-    template: migrations-job.yaml
-    set:
-      migrationJob:
-        enabled: true
-        extraInitContainers:
-          - name: init-test
-            image: busybox:latest
-            command: ["echo", "hello"]
-    asserts:
-      - contains:
-          path: spec.template.spec.initContainers
-          content:
-            name: init-test
-            image: busybox:latest
-            command: ["echo", "hello"]
-  - it: should support tpl in extraInitContainers
-    template: migrations-job.yaml
-    set:
-      image:
-        repository: ghcr.io/berriai/litellm-database
-        tag: test
-      migrationJob:
-        enabled: true
-        extraInitContainers:
-          - name: init-tpl
-            image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-            command: ["echo", "hello"]
-    asserts:
-      - contains:
-          path: spec.template.spec.initContainers
-          content:
-            name: init-tpl
-            image: "ghcr.io/berriai/litellm-database:test"
-            command: ["echo", "hello"]
-  - it: should work with extraContainers
-    template: migrations-job.yaml
-    set:
-      migrationJob:
-        enabled: true
-        extraContainers:
-          - name: sidecar
-            image: busybox:latest
-    asserts:
-      - contains:
-          path: spec.template.spec.containers
-          content:
-            name: sidecar
-            image: busybox:latest
-  - it: should support tpl in extraContainers
-    template: migrations-job.yaml
-    set:
-      image:
-        repository: ghcr.io/berriai/litellm-database
-        tag: test
-      migrationJob:
-        enabled: true
-        extraContainers:
-          - name: sidecar-tpl
-            image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-    asserts:
-      - contains:
-          path: spec.template.spec.containers
-          content:
-            name: sidecar-tpl
-            image: "ghcr.io/berriai/litellm-database:test"

docker/Dockerfile.alpine

@@ -3,66 +3,55 @@ ARG LITELLM_BUILD_IMAGE=python:3.11-alpine@sha256:f07e2ace46f560f09a6eeec7b4913b
 
 # Runtime image
 ARG LITELLM_RUNTIME_IMAGE=python:3.11-alpine@sha256:f07e2ace46f560f09a6eeec7b4913b80ee99546e749ef82342a419a326620856
-ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
-
-FROM $UV_IMAGE AS uvbin
 
+# Builder stage
 FROM $LITELLM_BUILD_IMAGE AS builder
 
+# Set the working directory to /app
 WORKDIR /app
 
-COPY --from=uvbin /uv /usr/local/bin/uv
-COPY --from=uvbin /uvx /usr/local/bin/uvx
+# Install build dependencies
+RUN apk add --no-cache gcc python3-dev musl-dev
 
-RUN apk add --no-cache gcc python3-dev musl-dev nodejs npm libsndfile
+RUN pip install --upgrade pip==26.0.1 && \
+    pip install build==1.4.2
 
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    UV_PROJECT_ENVIRONMENT=/app/.venv \
-    UV_LINK_MODE=copy \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/app/.venv/bin:${PATH}"
-
-# Copy dependency metadata first for layer caching
-COPY pyproject.toml uv.lock ./
-COPY enterprise/pyproject.toml enterprise/
-COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
-
-# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
-RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python3
-
-# Copy full source tree
+# Copy the current directory contents into the container at /app
 COPY . .
 
-# Install project and workspace packages (fast - deps already cached)
-RUN uv sync --frozen --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python3
+# Build the package
+RUN rm -rf dist/* && python -m build
 
-RUN prisma generate --schema=./schema.prisma
+# There should be only one wheel file now, assume the build only creates one
+RUN ls -1 dist/*.whl | head -1
 
-RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
-    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
+# Install the package
+RUN pip install dist/*.whl
 
+# install dependencies as wheels
+RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
+
+# Runtime stage
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
 
-RUN apk upgrade --no-cache && apk add --no-cache libsndfile nodejs npm
+# Update dependencies and clean up, install libsndfile for audio processing
+RUN apk upgrade --no-cache && apk add --no-cache libsndfile
 
 WORKDIR /app
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/app/.venv/bin:${PATH}"
 
-COPY --from=builder /app /app
+# Copy the built wheel from the builder stage to the runtime stage; assumes only one wheel file is present
+COPY --from=builder /app/dist/*.whl .
+COPY --from=builder /wheels/ /wheels/
+
+# Install the built wheel using pip; again using a wildcard if it's the only file
+RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ --no-deps && rm -f *.whl && rm -rf /wheels
+
+# Convert Windows line endings to Unix for entrypoint scripts
+RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
+RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
 
 EXPOSE 4000/tcp
 
+# Set your entrypoint and command
 ENTRYPOINT ["docker/prod_entrypoint.sh"]
 CMD ["--port", "4000"]

docker/Dockerfile.custom_ui

@@ -71,16 +71,8 @@ WORKDIR /app
 RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
 RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
 
-# Run as non-root user
-RUN groupadd --gid 1000 appuser && useradd --uid 1000 --gid 1000 --no-create-home appuser \
-    && chown -R appuser:appuser /app
-USER appuser
-
 # Expose the necessary port
 EXPOSE 4000/tcp
 
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-  CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:4000/health')"]
-
 # Override the CMD instruction with your desired command and arguments
 CMD ["--port", "4000", "--config", "config.yaml", "--detailed_debug"]

docker/Dockerfile.database

@@ -3,72 +3,53 @@ ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92
 
 # Runtime image
 ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
-ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
-
-FROM $UV_IMAGE AS uvbin
-
+# Builder stage
 FROM $LITELLM_BUILD_IMAGE AS builder
 
+# Set the working directory to /app
 WORKDIR /app
+
 USER root
 
-COPY --from=uvbin /uv /usr/local/bin/uv
-COPY --from=uvbin /uvx /usr/local/bin/uvx
-
+# Install build dependencies
 RUN apk add --no-cache \
     bash \
     gcc \
+    py3-pip \
     python3 \
     python3-dev \
     openssl \
-    openssl-dev \
-    nodejs \
-    npm \
-    libsndfile
+    openssl-dev
 
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    UV_PROJECT_ENVIRONMENT=/app/.venv \
-    UV_LINK_MODE=copy \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/app/.venv/bin:${PATH}"
+RUN python -m pip install build==1.4.2
 
-# Copy dependency metadata first for layer caching
-COPY pyproject.toml uv.lock ./
-COPY enterprise/pyproject.toml enterprise/
-COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
-
-# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
-RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python3
-
-# Copy full source tree
+# Copy the current directory contents into the container at /app
 COPY . .
 
-# Build Admin UI before final sync
+# Build Admin UI
+# Convert Windows line endings to Unix and make executable
 RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
 
-# Install project and workspace packages (fast - deps already cached)
-RUN uv sync --frozen --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python3
+# Build the package
+RUN rm -rf dist/* && python -m build
 
-RUN prisma generate --schema=./schema.prisma
+# There should be only one wheel file now, assume the build only creates one
+RUN ls -1 dist/*.whl | head -1
 
-RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
-    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
+# Install the package
+RUN pip install dist/*.whl
 
+# install dependencies as wheels
+RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
+
+# Runtime stage
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
 
+# Ensure runtime stage runs as root
 USER root
 
-RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile supervisor && \
+# Install runtime dependencies
+RUN apk add --no-cache bash openssl tzdata nodejs npm python3 py3-pip libsndfile && \
     npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
     GLOBAL="$(npm root -g)" && \
     find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
@@ -92,18 +73,66 @@ RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile supervi
     { apk del --no-cache npm 2>/dev/null || true; }
 
 WORKDIR /app
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/app/.venv/bin:${PATH}"
+# Copy the current directory contents into the container at /app
+COPY . .
+RUN ls -la /app
 
-COPY --from=builder /app /app
+# Copy the built wheel from the builder stage to the runtime stage; assumes only one wheel file is present
+COPY --from=builder /app/dist/*.whl .
+COPY --from=builder /wheels/ /wheels/
 
-RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \
-    find /app/.venv -type d -path "*/tornado/test" -delete
+# Install the built wheel using pip; again using a wildcard if it's the only file
+RUN pip install *.whl /wheels/* --no-index --find-links=/wheels/ --no-deps && rm -f *.whl && rm -rf /wheels
 
+# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
+# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
+# Patch every copy of tar, glob, and brace-expansion inside that tree.
+RUN GLOBAL="$(npm root -g)" && \
+    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
+    find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+    done && \
+    find /usr/lib -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+    done && \
+    find /usr/lib -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+    done && \
+    find /usr/lib -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
+    done && \
+    find /usr/lib -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
+    done
+
+# Install semantic_router and aurelio-sdk using script
+# Convert Windows line endings to Unix and make executable
+RUN sed -i 's/\r$//' docker/install_auto_router.sh && chmod +x docker/install_auto_router.sh && ./docker/install_auto_router.sh
+
+# ensure pyjwt is used, not jwt
+RUN pip uninstall jwt -y
+RUN pip uninstall PyJWT -y
+RUN pip install PyJWT==2.12.0 --no-cache-dir
+
+# Build Admin UI (runtime stage)
+# Convert Windows line endings to Unix and make executable
+RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
+
+# Generate prisma client
+RUN prisma generate
+# Convert Windows line endings to Unix for entrypoint scripts
+RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh
+RUN sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
 EXPOSE 4000/tcp
 
+RUN apk add --no-cache supervisor
 COPY docker/supervisord.conf /etc/supervisord.conf
 
+# # Set your entrypoint and command
+
+
 ENTRYPOINT ["docker/prod_entrypoint.sh"]
+
+# Append "--detailed_debug" to the end of CMD to view detailed debug logs 
+# CMD ["--port", "4000", "--detailed_debug"]
 CMD ["--port", "4000"]

docker/Dockerfile.dev

@@ -3,70 +3,60 @@ ARG LITELLM_BUILD_IMAGE=python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973a
 
 # Runtime image
 ARG LITELLM_RUNTIME_IMAGE=python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
-ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
-
-FROM $UV_IMAGE AS uvbin
 
+# Builder stage
 FROM $LITELLM_BUILD_IMAGE AS builder
 
+# Set the working directory to /app
 WORKDIR /app
+
 USER root
 
-COPY --from=uvbin /uv /usr/local/bin/uv
-COPY --from=uvbin /uvx /usr/local/bin/uvx
-
+# Install build dependencies in one layer
 RUN apt-get update && apt-get install -y --no-install-recommends \
     gcc \
     g++ \
     python3-dev \
     libssl-dev \
     pkg-config \
-    nodejs \
-    npm \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* \
+    && pip install --upgrade pip==26.0.1 build==1.4.2
 
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    UV_PROJECT_ENVIRONMENT=/app/.venv \
-    UV_LINK_MODE=copy \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/app/.venv/bin:${PATH}"
+# Copy requirements first for better layer caching
+COPY requirements.txt .
 
-# Copy dependency metadata first for layer caching
-COPY pyproject.toml uv.lock ./
-COPY enterprise/pyproject.toml enterprise/
-COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
+# Install Python dependencies with cache mount for faster rebuilds
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt
 
-# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
-RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python
+# Fix JWT dependency conflicts early
+RUN pip uninstall jwt -y || true && \
+    pip uninstall PyJWT -y || true && \
+    pip install PyJWT==2.12.0 --no-cache-dir
 
-# Copy full source tree
-COPY . .
+# Copy only necessary files for build
+COPY pyproject.toml README.md schema.prisma poetry.lock ./
+COPY litellm/ ./litellm/
+COPY enterprise/ ./enterprise/
+COPY docker/ ./docker/
 
-# Build Admin UI before final sync
+# Build Admin UI once
+# Convert Windows line endings to Unix and make executable
 RUN sed -i 's/\r$//' docker/build_admin_ui.sh && chmod +x docker/build_admin_ui.sh && ./docker/build_admin_ui.sh
 
-# Install project and workspace packages (fast - deps already cached)
-RUN uv sync --frozen --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python
+# Build the package
+RUN rm -rf dist/* && python -m build
 
-RUN prisma generate --schema=./schema.prisma
-
-RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
-    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
+# Install the built package
+RUN pip install dist/*.whl
 
+# Runtime stage
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
 
+# Ensure runtime stage runs as root
 USER root
 
+# Install only runtime dependencies
 RUN apt-get update && apt-get upgrade -y \
         libxml2 \
         libexpat1 \
@@ -82,9 +72,9 @@ RUN apt-get update && apt-get upgrade -y \
         libc6 \
     && apt-get install -y --no-install-recommends \
         libssl3 \
-        libatomic1 \
-        nodejs \
-        npm \
+    libatomic1 \
+    nodejs \
+    npm \
     && rm -rf /var/lib/apt/lists/* \
     && npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
     && GLOBAL="$(npm root -g)" \
@@ -109,13 +99,53 @@ RUN apt-get update && apt-get upgrade -y \
     && apt-get purge -y npm
 
 WORKDIR /app
-ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    XDG_CACHE_HOME=/app/.cache \
-    PATH="/app/.venv/bin:${PATH}"
 
-COPY --from=builder /app /app
+# Copy only necessary runtime files
+COPY docker/entrypoint.sh docker/prod_entrypoint.sh ./docker/
+COPY litellm/ ./litellm/
+COPY pyproject.toml README.md schema.prisma poetry.lock ./
+
+# Copy pre-built wheels and install everything at once
+COPY --from=builder /wheels/ /wheels/
+COPY --from=builder /app/dist/*.whl .
+
+# Install all dependencies in one step with no-cache for smaller image
+RUN pip install --no-cache-dir *.whl /wheels/* --no-index --find-links=/wheels/ --no-deps && \
+    rm -f *.whl && \
+    rm -rf /wheels
+
+# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
+# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
+# Patch every copy of tar, glob, and brace-expansion inside that tree.
+RUN GLOBAL="$(npm root -g)" && \
+    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
+    find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+    done && \
+    find /usr/lib -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+    done && \
+    find /usr/lib -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+    done && \
+    find /usr/lib -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
+    done && \
+    find /usr/lib -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
+    done
+
+# Generate prisma client and set permissions
+# Convert Windows line endings to Unix for entrypoint scripts
+RUN prisma generate && \
+    sed -i 's/\r$//' docker/entrypoint.sh && \
+    sed -i 's/\r$//' docker/prod_entrypoint.sh && \
+    chmod +x docker/entrypoint.sh && \
+    chmod +x docker/prod_entrypoint.sh
 
 EXPOSE 4000/tcp
 
 ENTRYPOINT ["docker/prod_entrypoint.sh"]
-CMD ["--port", "4000"]
+
+# Append "--detailed_debug" to the end of CMD to view detailed debug logs 
+CMD ["--port", "4000"]

docker/Dockerfile.health_check

@@ -1,30 +1,24 @@
-ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
-FROM $UV_IMAGE AS uvbin
-
 FROM python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
 
 WORKDIR /app
 
-# Copy the uv binary and the health check script.
-COPY --from=uvbin /uv /usr/local/bin/uv
-COPY pyproject.toml uv.lock /app/
+# Copy health check script and requirements
 COPY scripts/health_check/health_check_client.py /app/health_check_client.py
+COPY scripts/health_check/health_check_requirements.txt /app/requirements.txt
 
-# Resolve and install the health-check dependencies from the project lockfile
-# so the runtime image stays self-contained and reproducible.
-RUN uv export --frozen --no-default-groups --only-group healthcheck --no-emit-project --no-hashes --output-file /tmp/health-check-requirements.txt \
-  && uv pip install --system -r /tmp/health-check-requirements.txt \
-  && rm /tmp/health-check-requirements.txt \
-  && rm /app/pyproject.toml /app/uv.lock \
-  && chmod +x /app/health_check_client.py
+# Install dependencies
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Make script executable
+RUN chmod +x /app/health_check_client.py
 
 # Run as non-root user
-RUN groupadd --gid 1000 appuser && useradd --uid 1000 --gid 1000 --no-create-home appuser
-USER appuser
+RUN adduser --disabled-password --gecos "" --uid 1001 healthcheck
+USER healthcheck
 
 # Health check
-HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
-  CMD ["python", "/app/health_check_client.py", "--help"]
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
+  CMD python /app/health_check_client.py --help || exit 1
 
 # Set entrypoint
 ENTRYPOINT ["python", "/app/health_check_client.py"]

docker/Dockerfile.non_root

@@ -2,98 +2,64 @@
 ARG LITELLM_BUILD_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
 ARG LITELLM_RUNTIME_IMAGE=cgr.dev/chainguard/wolfi-base@sha256:a5a619c1793039dcf92f02178f37c94bb3d6001403716da59d6092dfe8d9b502
 ARG PROXY_EXTRAS_SOURCE=published
-ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
-
-FROM $UV_IMAGE AS uvbin
 
+# -----------------
+# Builder Stage
+# -----------------
 FROM $LITELLM_BUILD_IMAGE AS builder
 ARG PROXY_EXTRAS_SOURCE
 WORKDIR /app
 USER root
 
-COPY --from=uvbin /uv /usr/local/bin/uv
-COPY --from=uvbin /uvx /usr/local/bin/uvx
-
+# Install build dependencies with retry logic (includes node for UI build)
 RUN for i in 1 2 3; do \
     apk add --no-cache \
-      python3 \
-      python3-dev \
-      clang \
-      llvm \
-      lld \
-      gcc \
-      linux-headers \
-      build-base \
-      bash \
-      coreutils \
-      curl \
-      openssl \
-      openssl-dev \
-      nodejs \
-      npm \
-      libsndfile && break || sleep 5; \
-    done
+    python3 \
+    python3-dev \
+    py3-pip \
+    clang \
+    llvm \
+    lld \
+    gcc \
+    linux-headers \
+    build-base \
+    bash \
+    nodejs \
+    npm && break || sleep 5; \
+    done \
+  && pip install --no-cache-dir --upgrade pip==26.0.1 build==1.4.2
 
-ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
-    UV_LINK_MODE=copy \
-    NVM_DIR=/root/.nvm \
-    PATH="/root/.nvm/versions/node/v20.20.2/bin:/app/.venv/bin:${PATH}" \
-    LITELLM_NON_ROOT=true \
-    PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
-    PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" \
-    XDG_CACHE_HOME=/app/.cache
+# Cache Python dependencies
+COPY requirements.txt .
+RUN pip wheel --no-cache-dir --wheel-dir=/wheels/ -r requirements.txt \
+  && pip wheel --no-cache-dir --wheel-dir=/wheels/ "semantic_router==0.1.11" "aurelio-sdk==0.0.19" "PyJWT==2.12.0"
 
-# Copy dependency metadata first for layer caching
-COPY pyproject.toml uv.lock ./
-COPY enterprise/pyproject.toml enterprise/
-COPY litellm-proxy-extras/pyproject.toml litellm-proxy-extras/
-
-# Install third-party dependencies (cached unless pyproject.toml/uv.lock change)
-RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python3
-
-# Copy full source tree
+# Copy source after dependency layers
 COPY . .
 
 # Set non-root flag for build time consistency
 ENV LITELLM_NON_ROOT=true
 
-# Build Admin UI once and stage the static output for the runtime image.
-# NOTE: .npmrc files (which may set ignore-scripts=true and min-release-age=3d)
-# are temporarily renamed during npm install/ci so they don't block lifecycle
-# scripts needed by the build. This is safe because npm ci installs from
+# Build Admin UI using the upstream command order while keeping a single RUN layer
+# NOTE: .npmrc (which has ignore-scripts=true and min-release-age=3d) is temporarily
+# renamed during npm install/ci. This is safe because npm ci installs from
 # package-lock.json with pinned versions + integrity hashes.
-RUN mkdir -p /var/lib/litellm/ui /var/lib/litellm/assets && \
-    ([ -f /app/.npmrc ] && mv /app/.npmrc /app/.npmrc.bak || true) && \
-    NVM_VERSION="v0.40.4" && \
-    NVM_CHECKSUM="4b7412c49960c7d31e8df72da90c1fb5b8cccb419ac99537b737028d497aba4f" && \
-    NODE_VERSION="v20.20.2" && \
-    NVM_SCRIPT="/tmp/install-nvm.sh" && \
-    curl -fsSL "https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_VERSION}/install.sh" -o "$NVM_SCRIPT" && \
-    echo "${NVM_CHECKSUM}  ${NVM_SCRIPT}" | sha256sum -c - && \
-    bash "$NVM_SCRIPT" && \
-    export NVM_DIR="$HOME/.nvm" && \
-    . "$NVM_DIR/nvm.sh" && \
-    nvm install "${NODE_VERSION}" && \
-    nvm use "${NODE_VERSION}" && \
+RUN mkdir -p /var/lib/litellm/ui && \
+    mv /app/.npmrc /app/.npmrc.bak && \
     npm install -g npm@11.12.1 && \
     npm install -g node-gyp@12.2.0 && \
-    ln -sf "$(npm root -g)/node-gyp" "$(npm root -g)/npm/node_modules/node-gyp" && \
+    ln -sf /usr/local/lib/node_modules/node-gyp /usr/lib/node_modules/npm/node_modules/node-gyp && \
     npm cache clean --force && \
     cd /app/ui/litellm-dashboard && \
     if [ -f "/app/enterprise/enterprise_ui/enterprise_colors.json" ]; then \
       cp /app/enterprise/enterprise_ui/enterprise_colors.json ./ui_colors.json; \
     fi && \
-    ([ -f .npmrc ] && mv .npmrc .npmrc.bak || true) && \
-    npm ci --no-audit --no-fund && \
-    ([ -f .npmrc.bak ] && mv .npmrc.bak .npmrc || true) && \
-    ([ -f /app/.npmrc.bak ] && mv /app/.npmrc.bak /app/.npmrc || true) && \
+    mv .npmrc .npmrc.bak && \
+    npm ci && \
+    mv .npmrc.bak .npmrc && mv /app/.npmrc.bak /app/.npmrc && \
     npm run build && \
     cp -r /app/ui/litellm-dashboard/out/* /var/lib/litellm/ui/ && \
+    mkdir -p /var/lib/litellm/assets && \
     cp /app/litellm/proxy/logo.jpg /var/lib/litellm/assets/logo.jpg && \
     ( cd /var/lib/litellm/ui && \
       for html_file in *.html; do \
@@ -106,106 +72,175 @@ RUN mkdir -p /var/lib/litellm/ui /var/lib/litellm/assets && \
       touch .litellm_ui_ready ) && \
     cd /app/ui/litellm-dashboard && rm -rf ./out
 
-RUN if [ "$PROXY_EXTRAS_SOURCE" = "published" ]; then \
-      uv sync --frozen --no-default-groups --no-editable \
-        --extra proxy \
-        --extra proxy-runtime \
-        --extra extra_proxy \
-        --extra semantic-router \
-        --python python3 \
-        --no-sources-package litellm-proxy-extras; \
-    else \
-      uv sync --frozen --no-default-groups --no-editable \
-        --extra proxy \
-        --extra proxy-runtime \
-        --extra extra_proxy \
-        --extra semantic-router \
-        --python python3; \
+# Build litellm wheel and place it in wheels dir (replace any PyPI wheels)
+RUN rm -rf dist/* && python -m build && \
+  rm -f /wheels/litellm-*.whl && \
+  cp dist/*.whl /wheels/
+
+# Optionally build local litellm-proxy-extras wheel
+RUN if [ "$PROXY_EXTRAS_SOURCE" = "local" ]; then \
+      cd /app/litellm-proxy-extras && rm -rf dist && python -m build && \
+      cp dist/*.whl /wheels/; \
     fi
 
-RUN mkdir -p /app/.cache/npm && \
-    prisma generate --schema=./schema.prisma && \
+# Pre-cache Prisma binaries in the builder stage
+ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+    PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" \
+    XDG_CACHE_HOME=/app/.cache \
+    PATH="/usr/lib/python3.13/site-packages/nodejs/bin:${PATH}"
+
+RUN pip install --no-cache-dir prisma==0.11.0 nodejs-wheel-binaries==24.13.1 \
+    && mkdir -p /app/.cache/npm
+
+RUN NPM_CONFIG_CACHE=/app/.cache/npm \
+    python -c "import prisma.cli.prisma as p; p.ensure_cached()"
+
+RUN prisma generate && \
     prisma --version && \
     prisma migrate diff --from-empty --to-schema-datamodel ./schema.prisma --script > /dev/null 2>&1 || true
 
-RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
-    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
-
+# -----------------
+# Runtime Stage
+# -----------------
 FROM $LITELLM_RUNTIME_IMAGE AS runtime
 ARG PROXY_EXTRAS_SOURCE
 WORKDIR /app
 USER root
 
+# Install runtime dependencies with retry
 RUN for i in 1 2 3; do \
     apk upgrade --no-cache && break || sleep 5; \
-    done && \
-    for i in 1 2 3; do \
-      apk add --no-cache python3 bash openssl tzdata nodejs npm supervisor libsndfile && break || sleep 5; \
-    done && \
-    apk upgrade --no-cache nodejs && \
-    npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 && \
-    GLOBAL="$(npm root -g)" && \
-    find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
-      rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
-    done && \
-    find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
-      rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
-    done && \
-    find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
-      rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
-    done && \
-    find "$GLOBAL/npm" -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
-      rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
-    done && \
-    find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
-      rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
-    done && \
-    find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
-      sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null && \
-    npm cache clean --force && \
-    { apk del --no-cache npm 2>/dev/null || true; }
+    done \
+  && for i in 1 2 3; do \
+    apk add --no-cache python3 py3-pip bash openssl tzdata nodejs npm supervisor && break || sleep 5; \
+    done \
+  && apk upgrade --no-cache nodejs \
+  && npm install -g npm@11.12.1 tar@7.5.11 glob@11.1.0 @isaacs/brace-expansion@5.0.1 minimatch@10.2.4 diff@8.0.3 \
+  && GLOBAL="$(npm root -g)" \
+  && find "$GLOBAL/npm" -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+     done \
+  && find "$GLOBAL/npm" -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+     done \
+  && find "$GLOBAL/npm" -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+     done \
+  && find "$GLOBAL/npm" -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
+     done \
+  && find "$GLOBAL/npm" -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
+     done \
+  && find /usr/local/lib /usr/lib -path "*/node_modules/npm/package.json" -exec \
+        sed -i 's/"tar": "\^7\.5\.[0-9]*"/"tar": "^7.5.10"/g; s/"minimatch": "\^10\.[0-9.]*"/"minimatch": "^10.2.4"/g' {} + 2>/dev/null \
+  && npm cache clean --force \
+  && { apk del --no-cache npm 2>/dev/null || true; }
 
-COPY --from=builder /app /app
+# Copy artifacts from builder
+COPY --from=builder /app/requirements.txt /app/requirements.txt
+COPY --from=builder /app/docker/entrypoint.sh /app/docker/prod_entrypoint.sh /app/docker/
+COPY --from=builder /app/docker/supervisord.conf /etc/supervisord.conf
+COPY --from=builder /app/schema.prisma /app/
+# Keep enterprise bridge module in runtime so `enterprise.enterprise_hooks`
+# can load and register managed enterprise hooks (e.g. managed_files).
+COPY --from=builder /app/enterprise /app/enterprise
+# Copy prisma_migration.py for Helm migrations job compatibility
+COPY --from=builder /app/litellm/proxy/prisma_migration.py /app/litellm/proxy/prisma_migration.py
+COPY --from=builder /wheels/ /wheels/
 COPY --from=builder /var/lib/litellm/ui /var/lib/litellm/ui
 COPY --from=builder /var/lib/litellm/assets /var/lib/litellm/assets
-COPY --from=builder /app/docker/supervisord.conf /etc/supervisord.conf
+COPY --from=builder /app/.cache /app/.cache
+COPY --from=builder /app/litellm-proxy-extras /app/litellm-proxy-extras
+COPY --from=builder \
+  /usr/lib/python3.13/site-packages/nodejs* \
+  /usr/lib/python3.13/site-packages/prisma* \
+  /usr/lib/python3.13/site-packages/tomlkit* \
+  /usr/lib/python3.13/site-packages/nodeenv* \
+  /usr/lib/python3.13/site-packages/
+COPY --from=builder /usr/bin/prisma /usr/bin/prisma
 
-ENV PATH="/app/.venv/bin:${PATH}" \
-    PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+# Final runtime environment configuration
+ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
     PRISMA_CLI_BINARY_TARGETS="debian-openssl-3.0.x" \
     HOME=/app \
     LITELLM_NON_ROOT=true \
-    XDG_CACHE_HOME=/app/.cache \
-    PRISMA_SKIP_POSTINSTALL_GENERATE=1 \
+    XDG_CACHE_HOME=/app/.cache
+
+# Install packages from wheels and optional extras without network
+RUN pip install --no-index --find-links=/wheels/ -r requirements.txt && \
+    pip install --no-index --find-links=/wheels/ /wheels/litellm-*-py3-none-any.whl && \
+    pip install --no-index --find-links=/wheels/ --no-deps semantic_router==0.1.11 && \
+    pip install --no-index --find-links=/wheels/ aurelio-sdk==0.0.19 && \
+    if [ "$PROXY_EXTRAS_SOURCE" = "local" ]; then \
+      if ls /wheels/litellm_proxy_extras-*.whl >/dev/null 2>&1; then \
+        pip install --no-index --find-links=/wheels/ /wheels/litellm_proxy_extras-*.whl; \
+      else \
+        echo "litellm_proxy_extras wheel not found; skipping local install"; \
+      fi; \
+    fi
+
+# SECURITY FIX: nodejs-wheel-binaries (pip package used by Prisma) bundles a complete
+# npm with old vulnerable deps at /usr/lib/python3.*/site-packages/nodejs_wheel/.
+# Patch every copy of tar, glob, and brace-expansion inside that tree.
+RUN GLOBAL="$(npm root -g)" && \
+    [ -n "$GLOBAL" ] || { echo "ERROR: npm root -g returned empty; aborting"; exit 1; } && \
+    find /usr/lib -type d -name "tar" -path "*/node_modules/tar" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/tar" "$d"; \
+    done && \
+    find /usr/lib -type d -name "glob" -path "*/node_modules/glob" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/glob" "$d"; \
+    done && \
+    find /usr/lib -type d -name "brace-expansion" -path "*/node_modules/@isaacs/brace-expansion" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/@isaacs/brace-expansion" "$d"; \
+    done && \
+    find /usr/lib -type d -name "minimatch" -path "*/node_modules/minimatch" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/minimatch" "$d"; \
+    done && \
+    find /usr/lib -type d -name "diff" -path "*/node_modules/diff" | while read d; do \
+        rm -rf "$d" && cp -rL "$GLOBAL/diff" "$d"; \
+    done
+
+# Permissions, cleanup, and Prisma prep
+# Convert Windows line endings to Unix for entrypoint scripts
+RUN sed -i 's/\r$//' docker/entrypoint.sh && \
+    sed -i 's/\r$//' docker/prod_entrypoint.sh && \
+    chmod +x docker/entrypoint.sh docker/prod_entrypoint.sh && \
+    mkdir -p /nonexistent /.npm /var/lib/litellm/assets /var/lib/litellm/ui && \
+    chown -R nobody:nogroup /app /var/lib/litellm/ui /var/lib/litellm/assets /nonexistent /.npm && \
+    pip uninstall jwt -y || true && \
+    pip uninstall PyJWT -y || true && \
+    pip install --no-index --find-links=/wheels/ PyJWT==2.12.0 --no-cache-dir && \
+    rm -rf /wheels && \
+    PRISMA_PATH=$(python -c "import os, prisma; print(os.path.dirname(prisma.__file__))") && \
+    chown -R nobody:nogroup $PRISMA_PATH && \
+    LITELLM_PKG_MIGRATIONS_PATH="$(python -c 'import os, litellm_proxy_extras; print(os.path.dirname(litellm_proxy_extras.__file__))' 2>/dev/null || echo '')/migrations" && \
+    [ -n "$LITELLM_PKG_MIGRATIONS_PATH" ] && chown -R nobody:nogroup $LITELLM_PKG_MIGRATIONS_PATH && \
+    LITELLM_PROXY_EXTRAS_PATH=$(python -c "import os, litellm_proxy_extras; print(os.path.dirname(litellm_proxy_extras.__file__))" 2>/dev/null || echo "") && \
+    chgrp -R 0 $PRISMA_PATH /var/lib/litellm/ui /var/lib/litellm/assets && \
+    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chgrp -R 0 $LITELLM_PROXY_EXTRAS_PATH || true && \
+    chmod -R g=u $PRISMA_PATH /var/lib/litellm/ui /var/lib/litellm/assets && \
+    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g=u $LITELLM_PROXY_EXTRAS_PATH || true && \
+    chmod -R g+w $PRISMA_PATH /var/lib/litellm/ui /var/lib/litellm/assets && \
+    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g+w $LITELLM_PROXY_EXTRAS_PATH || true && \
+    chmod -R g+rX $PRISMA_PATH && \
+    chmod -R g+rX /app/.cache && \
+    mkdir -p /tmp/.npm /nonexistent /.npm
+
+# Switch to non-root user for runtime
+USER nobody
+
+# Generate Prisma client as nobody user to ensure correct file ownership
+RUN prisma generate
+
+# Prisma runtime knobs for offline containers
+ENV PRISMA_SKIP_POSTINSTALL_GENERATE=1 \
     PRISMA_HIDE_UPDATE_MESSAGE=1 \
     PRISMA_ENGINES_CHECKSUM_IGNORE_MISSING=1 \
     NPM_CONFIG_CACHE=/app/.cache/npm \
     NPM_CONFIG_PREFER_OFFLINE=true \
     PRISMA_OFFLINE_MODE=true
 
-RUN sed -i 's/\r$//' docker/entrypoint.sh && \
-    sed -i 's/\r$//' docker/prod_entrypoint.sh && \
-    chmod +x docker/entrypoint.sh docker/prod_entrypoint.sh && \
-    mkdir -p /nonexistent /.npm /var/lib/litellm/assets /var/lib/litellm/ui /tmp/.npm && \
-    chown -R nobody:nogroup /app /var/lib/litellm/ui /var/lib/litellm/assets /nonexistent /.npm /tmp/.npm && \
-    PRISMA_PATH=$(python -c "import os, prisma; print(os.path.dirname(prisma.__file__))") && \
-    chown -R nobody:nogroup "$PRISMA_PATH" && \
-    LITELLM_PKG_MIGRATIONS_PATH="$(python -c 'import os, litellm_proxy_extras; print(os.path.dirname(litellm_proxy_extras.__file__))' 2>/dev/null || echo '')/migrations" && \
-    [ -n "$LITELLM_PKG_MIGRATIONS_PATH" ] && chown -R nobody:nogroup "$LITELLM_PKG_MIGRATIONS_PATH" || true && \
-    LITELLM_PROXY_EXTRAS_PATH=$(python -c "import os, litellm_proxy_extras; print(os.path.dirname(litellm_proxy_extras.__file__))" 2>/dev/null || echo "") && \
-    chgrp -R 0 "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \
-    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chgrp -R 0 "$LITELLM_PROXY_EXTRAS_PATH" || true && \
-    chmod -R g=u "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \
-    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g=u "$LITELLM_PROXY_EXTRAS_PATH" || true && \
-    chmod -R g+w "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \
-    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g+w "$LITELLM_PROXY_EXTRAS_PATH" || true && \
-    chmod -R g+rX "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets /app/.cache
-
-USER nobody
-
-RUN prisma generate --schema=./schema.prisma
-
 EXPOSE 4000/tcp
-
 ENTRYPOINT ["/app/docker/prod_entrypoint.sh"]
 CMD ["--port", "4000"]

docker/README.md

@@ -13,19 +13,19 @@ To build and run the application, you will use the `docker-compose.yml` file loc
 
 ### 1. Set the Master Key
 
-The application requires a `LITELLM_MASTER_KEY` for signing and validating tokens. You must set this key as an environment variable before running the application.
+The application requires a `MASTER_KEY` for signing and validating tokens. You must set this key as an environment variable before running the application.
 
 Create a `.env` file in the root of the project and add the following line:
 
 ```
-LITELLM_MASTER_KEY=your-secret-key
+MASTER_KEY=your-secret-key
 ```
 
 Replace `your-secret-key` with a strong, randomly generated secret.
 
 ### 2. Build and Run the Containers
 
-Once you have set the `LITELLM_MASTER_KEY`, you can build and run the containers using the following command:
+Once you have set the `MASTER_KEY`, you can build and run the containers using the following command:
 
 ```bash
 docker compose up -d --build
@@ -89,4 +89,4 @@ This command should succeed (showing engine versions) even with `--network none`
 ## Troubleshooting
 
 -   **`build_admin_ui.sh: not found`**: This error can occur if the Docker build context is not set correctly. Ensure that you are running the `docker-compose` command from the root of the project.
--   **`Master key is not initialized`**: This error means the `LITELLM_MASTER_KEY` environment variable is not set. Make sure you have created a `.env` file in the project root with the `LITELLM_MASTER_KEY` defined.
+-   **`Master key is not initialized`**: This error means the `MASTER_key` environment variable is not set. Make sure you have created a `.env` file in the project root with the `MASTER_KEY` defined.

docker/build_from_pip/Dockerfile.build_from_pip

@@ -1,53 +1,27 @@
-ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9@sha256:10902f58a1606787602f303954cea099626a4adb02acbac4c69920fe9d278f82
-FROM $UV_IMAGE AS uvbin
-
 FROM python:3.13-slim@sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d
 
-ARG LITELLM_VERSION=1.83.0
-
 WORKDIR /app
 
-COPY --from=uvbin /uv /usr/local/bin/uv
-COPY --from=uvbin /uvx /usr/local/bin/uvx
+ENV HOME=/home/litellm
+ENV PATH="${HOME}/venv/bin:$PATH"
 
+# Install runtime dependencies needed for building native extensions
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends gcc libffi-dev nodejs npm && \
+    apt-get install -y --no-install-recommends gcc libffi-dev && \
     rm -rf /var/lib/apt/lists/*
 
-ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
-    UV_LINK_MODE=copy \
-    PATH="/app/.venv/bin:${PATH}"
+RUN python -m venv ${HOME}/venv
+RUN ${HOME}/venv/bin/pip install --no-cache-dir --upgrade pip==26.0.1
 
+COPY docker/build_from_pip/requirements.txt .
+RUN --mount=type=cache,target=${HOME}/.cache/pip \
+    ${HOME}/venv/bin/pip install -r requirements.txt
+
+# Copy Prisma schema file
 COPY schema.prisma .
 
-# This image is specifically for validating/installing the published PyPI
-# artifact, not the checked-out source tree.
-# Keep the moved proxy-runtime packages explicit until the published PyPI
-# artifact includes that extra; newer releases will simply dedupe these.
-RUN uv venv --python python && \
-    uv pip install --python /app/.venv/bin/python \
-      "litellm[proxy,proxy-runtime]==${LITELLM_VERSION}" \
-      "google-cloud-aiplatform==1.133.0" \
-      "google-genai==1.37.0" \
-      "anthropic[vertex]==0.84.0" \
-      "grpcio==1.78.0" \
-      "prometheus-client==0.20.0" \
-      "langfuse==2.59.7" \
-      "opentelemetry-api==1.28.0" \
-      "opentelemetry-sdk==1.28.0" \
-      "opentelemetry-exporter-otlp==1.28.0" \
-      "ddtrace==2.19.0" \
-      "sentry-sdk==2.21.0" \
-      "mangum==0.17.0" \
-      "azure-ai-contentsafety==1.0.0" \
-      "azure-storage-file-datalake==12.20.0" \
-      "pypdf==6.7.5" \
-      "llm-sandbox==0.3.31" \
-      "detect-secrets==1.5.0" \
-      "prisma==0.11.0" \
-      "openai==2.24.0"
-
-RUN prisma generate --schema=./schema.prisma
+# Generate prisma client
+RUN prisma generate
 
 EXPOSE 4000/tcp
 

docker/build_from_pip/requirements.txt

@@ -0,0 +1,6 @@
+litellm[proxy]==1.83.0
+prometheus_client==0.20.0
+langfuse==2.59.7
+prisma==0.11.0
+openai==2.24.0
+ddtrace==2.19.0 # for advanced DD tracing / profiling

docker/entrypoint.sh

@@ -1,16 +1,13 @@
 #!/bin/bash
-set -euo pipefail
+echo $(pwd)
 
-REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
-VENV_PYTHON="$REPO_ROOT/.venv/bin/python"
-MIGRATION_SCRIPT="$REPO_ROOT/litellm/proxy/prisma_migration.py"
+# Run the Python migration script
+python3 litellm/proxy/prisma_migration.py
 
-if [ -x "$VENV_PYTHON" ]; then
-    "$VENV_PYTHON" "$MIGRATION_SCRIPT"
-elif command -v uv >/dev/null 2>&1; then
-    (cd "$REPO_ROOT" && uv run --no-sync python "$MIGRATION_SCRIPT")
+# Check if the Python script executed successfully
+if [ $? -eq 0 ]; then
+    echo "Migration script ran successfully!"
 else
-    python3 "$MIGRATION_SCRIPT"
+    echo "Migration script failed!"
+    exit 1
 fi
-
-echo "Migration script ran successfully!"

docker/install_auto_router.sh

@@ -1,4 +1,3 @@
 #!/bin/bash
-set -euo pipefail
-
-# semantic-router dependencies are installed via `uv sync`.
+pip install semantic_router==0.1.11 --no-deps
+pip install aurelio-sdk==0.0.19 --no-deps

docs/my-website/.trivyignore

@@ -0,0 +1,7 @@
+# js-yaml CVE-2025-64718
+# This vulnerability is not applicable because we've forced js-yaml to version 4.1.1
+# via npm overrides in package.json. Trivy incorrectly reports this based on
+# dependency requirements in the lockfile, but the actual installed version is 4.1.1.
+# Verified with: npm list js-yaml
+CVE-2025-64718
+

docs/my-website/Dockerfile

@@ -1,32 +1,9 @@
-ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.10.9
-
-FROM $UV_IMAGE AS uvbin
-
 FROM python:3.14.0a3-slim
 
-COPY --from=uvbin /uv /usr/local/bin/uv
-COPY --from=uvbin /uvx /usr/local/bin/uvx
 COPY . /app
 WORKDIR /app
-
-ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
-    UV_LINK_MODE=copy \
-    PATH="/app/.venv/bin:${PATH}"
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    gcc \
-    python3-dev \
-    libssl-dev \
-    pkg-config \
-    && rm -rf /var/lib/apt/lists/*
-
-RUN uv sync --frozen --no-default-groups --no-editable \
-    --extra proxy \
-    --extra proxy-runtime \
-    --extra extra_proxy \
-    --extra semantic-router \
-    --python python
+RUN pip install -r requirements.txt
 
 EXPOSE $PORT 
 
-CMD ["sh", "-c", "litellm --host 0.0.0.0 --port $PORT --workers 10 --config config.yaml"]
+CMD litellm --host 0.0.0.0 --port $PORT --workers 10 --config config.yaml

docs/my-website/blog/april_townhall_announcement/index.md

@@ -4,7 +4,6 @@ title: "April Townhall: Security + Product Roadmap"
 date: 2026-04-02T07:30:00
 authors:
   - krrish
-  - ishaan-alt
 description: "Join the LiteLLM April townhall on Friday, 10 April at 7:30 AM to learn about LiteLLM's security and product roadmap."
 tags: [announcement, townhall]
 hide_table_of_contents: true

docs/my-website/blog/april_townhall_updates/index.md

@@ -1,162 +0,0 @@
----
-slug: april-townhall-updates
-title: "April Townhall Updates: CI/CD v2, Stability, and Product Roadmap"
-date: 2026-04-10T12:00:00
-authors:
-  - krrish
-  - ishaan-alt
-description: "A recap of the April LiteLLM town hall covering CI/CD v2, product stability work, and the near-term roadmap."
-tags: [townhall, security, reliability, product]
-hide_table_of_contents: false
----
-
-import Image from '@theme/IdealImage';
-
-Thank you to everyone who joined our April town hall.
-
-We used the session to share our CI/CD v2 improvements, product stability work, and what we are prioritizing next across reliability and product roadmap.
-
-{/* truncate */}
-
-## CI/CD v2 improvements
-
-Our CI/CD v2 work is centered around four goals:
-
-1. **Limit** what each package can access
-2. **Reduce** the number of sensitive environment variables
-3. **Avoid** compromised packages
-4. **Reduce the risk of** release tampering
-
-#### New architecture: isolated environments
-
-We have begun moving to isolated environments for distinct CI/CD stages to reduce the chance that a single compromised step can inherit broad access across the entire pipeline.
-
-<Image
-  img={require('../../img/april_townhall_isolated_environments.png')}
-  style={{width: '900px', height: 'auto', display: 'block'}}
-/>
-
-#### Current rollout status
-
-These changes are deployed in our current release workflow. [See here](https://github.com/BerriAI/litellm/tags)
-
-#### Independently verify releases
-
-A key part of CI/CD v2 is supporting independent verification of release artifacts using our published verification process, while reducing reliance on any single credential or release path.
-
-[**Learn more about how to verify releases**](https://docs.litellm.ai/docs/proxy/docker_image_security)
-
-<Image
-  img={require('../../img/verify_releases.png')}
-  style={{width: '900px', height: 'auto', display: 'block'}}
-/>
-
-## Stability improvements
-
-### SDLC improvements
-
-This month, we're focusing on process stability improvements around:
-- Improving main-branch stability
-- Mapping UI QA to built Docker images for 1:1 environment parity
-- Consistent release tags across PyPI and Docker
-- Fixing release notes publication
-
-#### Improving main-branch stability
-
-We're introducing a staging-gated flow:
-
-<Image
-  img={require('../../img/stable_main.png')}
-  style={{width: '900px', height: 'auto', display: 'block'}}
-/>
-
-- Only an internal staging branch can push to `main`.
-- PRs to that staging branch must pass CircleCI LLM API testing.
-- Collision handling happens on staging, which is designed to reduce unstable changes reaching `main`.
-
-#### UI QA in Docker environment
-
-Moving forward, all UI QA will be performed in the built Docker image that users run.
-
-Previously, some UI QA paths were run in local environments that did not fully replicate Docker runtime conditions.
-
-That contributed to release-specific issues, including MCP registration problems in `v1.82.3`.
-
-#### Consistent release tags
-
-Today we publish releases for multiple scenarios:
-- Dev (Built of a PR for a customer-specific scenario)
-- Nightly (Passes all CI/CD checks)
-- Release Candidate (Passes all CI/CD checks + manual UI QA)
-- Stable (intended to pass all CI/CD checks + manual UI QA + 7 days of production testing)
-
-We are targeting a consistent naming convention across PyPI and Docker by the end of April.
-
-#### Release notes
-
-CI/CD v2 changes moved release notes to a manual path. This is a temporary solution while we investigate a better automated workflow. We are targeting a more consistent process by the end of April.
-
-### Product stability improvements
-
-#### Stable Prisma migrations
-
-Today, we have observed several migration failure classes:
-- Migration not applied
-- Migration marked applied but incomplete
-- Migration not applied due to non-root image issues
-
-We're prioritizing this work this month and have assigned an engineering owner to the effort. Our target is to resolve these error classes by the end of April.
-
-#### UI type safety
-
-Another area of focus is improving the stability of the UI. Today, one cause of errors is that the UI maintains its own assumptions about backend API types. This can lead to issues when backend responses differ from UI assumptions.
-
-We aim to move to having the UI and Backend be in sync with each other, and are exploring OpenAPI-driven mapping to achieve this.
-
-## Product roadmap
-
-### Our Assumptions
-
-Over the next few years, we expect:
-- Companies will give employees more AI tools.
-- More AI agents will move into production workflows across HR, finance, support, and operations.
-
-### Our Inferences
-#### Near-term
-
-- AI spend will increase.
-- Uptime and latency will become even more important.
-- More AI resources (skills, CLIs, and related assets) will require governance.
-- Agent and MCP usage patterns will require deeper controls.
-- Broader developer adoption will increase the need for simpler, more discoverable tooling.
-
-#### Long-term 
-
-- We expect many organizations to treat agent auditability (how decisions were made across LLM + MCP + sub-agent inputs/outputs) as a compliance expectation.
-- Permission management will get more complex as user-agent interaction chains deepen.
-
-Roadmap timelines in this post are targets and may evolve based on validation and user feedback.
-
-## April investments
-
-### Reliability
-
-- Increase uptime for 10k+ RPS scenarios.
-- Investigate latency overhead for long-running Claude Code requests.
-
-### Feature reliability
-
-- Polish MCP authentication.
-- Better understand how teams are using agents through LiteLLM.
-
-### Governance
-
-- Launch Skills as a first-class citizen in LiteLLM.
-
-## Q&A
-
-Thank you again for all the questions and direct feedback. We will keep sharing concrete progress updates as these efforts ship.
-
-## Hiring
-
-We are actively hiring across several roles, please apply [here](https://jobs.ashbyhq.com/litellm) if you're interested!

docs/my-website/blog/authors.yml

@@ -24,7 +24,7 @@ ishaan:
 
 # Alias for typo in name
 ishaan-alt:
-  name: Ishaan Jaffer
+  name: Ishaan Jaff
   title: CTO, LiteLLM
   url: https://www.linkedin.com/in/reffajnaahsi/
   image_url: https://pbs.twimg.com/profile_images/1613813310264340481/lz54oEiB_400x400.jpg

docs/my-website/blog/ci_cd_v2_improvements/index.md

@@ -27,41 +27,6 @@ Building on the roadmap from our [security incident](https://docs.litellm.ai/blo
 - Validation and release are separated into different repositories, making it harder for an attacker to reach release credentials.
 - Trusted Publishing for PyPI releases - this means no long-lived credentials are used to publish releases.
 - Immutable Docker release tags - this means no tampering of Docker release tags after they are published [Learn more](https://docs.docker.com/docker-hub/repos/manage/hub-images/immutable-tags/). Note: work for GHCR docker releases is planned as well.
-- Docker image signing with [Cosign](https://github.com/sigstore/cosign) - all release images are signed so users can independently verify they came from us.
-
-## Verify Docker image signatures
-
-Starting from `v1.83.0-nightly`, all LiteLLM Docker images published to GHCR are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).
-
-**Verify using the pinned commit hash (recommended):**
-
-A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:
-
-```bash
-cosign verify \
-  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
-  ghcr.io/berriai/litellm:<release-tag>
-```
-
-**Verify using a release tag (convenience):**
-
-Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
-
-```bash
-cosign verify \
-  --key https://raw.githubusercontent.com/BerriAI/litellm/<release-tag>/cosign.pub \
-  ghcr.io/berriai/litellm:<release-tag>
-```
-
-Replace `<release-tag>` with the version you are deploying (e.g. `v1.83.0-stable`).
-
-Expected output:
-
-```
-The following checks were performed on each of these signatures:
-  - The cosign claims were validated
-  - The signatures were verified against the specified public key
-```
 
 ## What's next
 

docs/my-website/blog/claude_opus_4_7/index.md

@@ -1,366 +0,0 @@
----
-slug: claude_opus_4_7
-title: "Day 0 Support: Claude Opus 4.7"
-date: 2026-04-16T10:00:00
-authors:
-  - sameer
-  - ishaan-alt
-  - krrish
-description: "Day 0 support for Claude Opus 4.7 on LiteLLM AI Gateway - use across Anthropic, Azure, Vertex AI, and Bedrock."
-tags: [anthropic, claude, opus 4.7]
-hide_table_of_contents: false
----
-
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-
-LiteLLM now supports [Claude Opus 4.7](https://www.anthropic.com/news/claude-opus-4-7) on Day 0. Use it across Anthropic, Azure, Vertex AI, and Bedrock through the LiteLLM AI Gateway.
-
-{/* truncate */}
-
-## Docker Image
-
-```bash
-docker pull ghcr.io/berriai/litellm:litellm_stable_release_branch-v1.83.3-stable.opus-4.7
-```
-
-## Usage - Anthropic
-
-<Tabs>
-<TabItem value="proxy" label="LiteLLM Proxy">
-
-**1. Setup config.yaml**
-
-```yaml
-model_list:
-  - model_name: claude-opus-4-7
-    litellm_params:
-      model: anthropic/claude-opus-4-7
-      api_key: os.environ/ANTHROPIC_API_KEY
-```
-
-**2. Start the proxy**
-
-```bash
-docker run -d \
-  -p 4000:4000 \
-  -e ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY \
-  -v $(pwd)/config.yaml:/app/config.yaml \
-  ghcr.io/berriai/litellm:litellm_stable_release_branch-v1.83.3-stable.opus-4.7 \
-  --config /app/config.yaml
-```
-
-**3. Test it!**
-
-```bash
-curl --location 'http://0.0.0.0:4000/chat/completions' \
---header 'Content-Type: application/json' \
---header 'Authorization: Bearer $LITELLM_KEY' \
---data '{
-  "model": "claude-opus-4-7",
-  "messages": [
-    {
-      "role": "user",
-      "content": "what llm are you"
-    }
-  ]
-}'
-```
-
-</TabItem>
-</Tabs>
-
-## Usage - Azure
-
-<Tabs>
-<TabItem value="proxy" label="LiteLLM Proxy">
-
-**1. Setup config.yaml**
-
-```yaml
-model_list:
-  - model_name: claude-opus-4-7
-    litellm_params:
-      model: azure_ai/claude-opus-4-7
-      api_key: os.environ/AZURE_AI_API_KEY
-      api_base: os.environ/AZURE_AI_API_BASE  # https://<resource>.services.ai.azure.com
-```
-
-**2. Start the proxy**
-
-```bash
-docker run -d \
-  -p 4000:4000 \
-  -e AZURE_AI_API_KEY=$AZURE_AI_API_KEY \
-  -e AZURE_AI_API_BASE=$AZURE_AI_API_BASE \
-  -v $(pwd)/config.yaml:/app/config.yaml \
-  ghcr.io/berriai/litellm:litellm_stable_release_branch-v1.83.3-stable.opus-4.7 \
-  --config /app/config.yaml
-```
-
-**3. Test it!**
-
-```bash
-curl --location 'http://0.0.0.0:4000/chat/completions' \
---header 'Content-Type: application/json' \
---header 'Authorization: Bearer $LITELLM_KEY' \
---data '{
-  "model": "claude-opus-4-7",
-  "messages": [
-    {
-      "role": "user",
-      "content": "what llm are you"
-    }
-  ]
-}'
-```
-
-</TabItem>
-</Tabs>
-
-## Usage - Vertex AI
-
-<Tabs>
-<TabItem value="proxy" label="LiteLLM Proxy">
-
-**1. Setup config.yaml**
-
-```yaml
-model_list:
-  - model_name: claude-opus-4-7
-    litellm_params:
-      model: vertex_ai/claude-opus-4-7
-      vertex_project: os.environ/VERTEX_PROJECT
-      vertex_location: us-east5
-```
-
-**2. Start the proxy**
-
-```bash
-docker run -d \
-  -p 4000:4000 \
-  -e VERTEX_PROJECT=$VERTEX_PROJECT \
-  -e GOOGLE_APPLICATION_CREDENTIALS=/app/credentials.json \
-  -v $(pwd)/config.yaml:/app/config.yaml \
-  -v $(pwd)/credentials.json:/app/credentials.json \
-  ghcr.io/berriai/litellm:litellm_stable_release_branch-v1.83.3-stable.opus-4.7 \
-  --config /app/config.yaml
-```
-
-**3. Test it!**
-
-```bash
-curl --location 'http://0.0.0.0:4000/chat/completions' \
---header 'Content-Type: application/json' \
---header 'Authorization: Bearer $LITELLM_KEY' \
---data '{
-  "model": "claude-opus-4-7",
-  "messages": [
-    {
-      "role": "user",
-      "content": "what llm are you"
-    }
-  ]
-}'
-```
-
-</TabItem>
-</Tabs>
-
-## Usage - Bedrock
-
-<Tabs>
-<TabItem value="proxy" label="LiteLLM Proxy">
-
-**1. Setup config.yaml**
-
-```yaml
-model_list:
-  - model_name: claude-opus-4-7
-    litellm_params:
-      model: bedrock/anthropic.claude-opus-4-7
-      aws_access_key_id: os.environ/AWS_ACCESS_KEY_ID
-      aws_secret_access_key: os.environ/AWS_SECRET_ACCESS_KEY
-      aws_region_name: us-east-1
-```
-
-**2. Start the proxy**
-
-```bash
-docker run -d \
-  -p 4000:4000 \
-  -e AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID \
-  -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY \
-  -v $(pwd)/config.yaml:/app/config.yaml \
-  ghcr.io/berriai/litellm:litellm_stable_release_branch-v1.83.3-stable.opus-4.7 \
-  --config /app/config.yaml
-```
-
-**3. Test it!**
-
-```bash
-curl --location 'http://0.0.0.0:4000/chat/completions' \
---header 'Content-Type: application/json' \
---header 'Authorization: Bearer $LITELLM_KEY' \
---data '{
-  "model": "claude-opus-4-7",
-  "messages": [
-    {
-      "role": "user",
-      "content": "what llm are you"
-    }
-  ]
-}'
-```
-
-</TabItem>
-</Tabs>
-
-## Advanced Features
-
-### Adaptive Thinking
-
-:::note
-When using `reasoning_effort` with Claude Opus 4.7, all values (`low`, `medium`, `high`, `xhigh`) are mapped to `thinking: {type: "adaptive"}`. To use explicit thinking budgets with `type: "enabled"`, pass the native `thinking` parameter directly.
-:::
-
-<Tabs>
-<TabItem value="completions" label="/chat/completions">
-
-LiteLLM supports adaptive thinking through the `reasoning_effort` parameter:
-
-```bash
-curl --location 'http://0.0.0.0:4000/chat/completions' \
---header 'Content-Type: application/json' \
---header 'Authorization: Bearer $LITELLM_KEY' \
---data '{
-  "model": "claude-opus-4-7",
-  "messages": [
-    {
-      "role": "user",
-      "content": "Solve this complex problem: What is the optimal strategy for..."
-    }
-  ],
-  "reasoning_effort": "high"
-}'
-```
-
-</TabItem>
-<TabItem value="messages" label="/v1/messages">
-
-Use the `thinking` parameter with `type: "adaptive"` to enable adaptive thinking mode:
-
-```bash
-curl --location 'http://0.0.0.0:4000/v1/messages' \
---header 'x-api-key: sk-12345' \
---header 'content-type: application/json' \
---data '{
-    "model": "claude-opus-4-7",
-    "max_tokens": 16000,
-    "thinking": {
-        "type": "adaptive"
-    },
-    "messages": [
-        {
-            "role": "user",
-            "content": "Explain why the sum of two even numbers is always even."
-        }
-    ]
-}'
-```
-
-</TabItem>
-</Tabs>
-
-### Effort Levels
-
-Claude Opus 4.7 supports four effort levels: `low`, `medium`, `high` (default), and `xhigh`. These give you finer-grained control over how much reasoning the model applies to a task. Pass the effort level via the `output_config` parameter.
-
-`xhigh` is a new effort level introduced with Opus 4.7 that sits above `high`. The `max` effort level is Claude Opus 4.6 only and is not available on 4.7.
-
-<Tabs>
-<TabItem value="completions" label="/chat/completions">
-
-```bash
-curl --location 'http://0.0.0.0:4000/chat/completions' \
---header 'Content-Type: application/json' \
---header 'Authorization: Bearer $LITELLM_KEY' \
---data '{
-  "model": "claude-opus-4-7",
-  "messages": [
-    {
-      "role": "user",
-      "content": "Explain quantum computing"
-    }
-  ],
-  "output_config": {
-    "effort": "xhigh"
-  }
-}'
-```
-
-**Using OpenAI SDK:**
-
-```python
-import openai
-
-client = openai.OpenAI(
-    api_key="your-litellm-key",
-    base_url="http://0.0.0.0:4000"
-)
-
-response = client.chat.completions.create(
-    model="claude-opus-4-7",
-    messages=[{"role": "user", "content": "Explain quantum computing"}],
-    extra_body={"output_config": {"effort": "xhigh"}}
-)
-```
-
-**Using LiteLLM SDK:**
-
-```python
-from litellm import completion
-
-response = completion(
-    model="anthropic/claude-opus-4-7",
-    messages=[{"role": "user", "content": "Explain quantum computing"}],
-    output_config={"effort": "xhigh"},
-)
-```
-
-You can combine `reasoning_effort` with `output_config` for even more fine-grained control over the model's behavior.
-
-</TabItem>
-<TabItem value="messages" label="/v1/messages">
-
-```bash
-curl --location 'http://0.0.0.0:4000/v1/messages' \
---header 'x-api-key: sk-12345' \
---header 'content-type: application/json' \
---data '{
-    "model": "claude-opus-4-7",
-    "max_tokens": 4096,
-    "messages": [
-        {
-            "role": "user",
-            "content": "Explain quantum computing"
-        }
-    ],
-    "output_config": {
-        "effort": "xhigh"
-    }
-}'
-```
-
-</TabItem>
-</Tabs>
-
-**Effort level guide:**
-
-| Effort | When to use |
-|--------|-------------|
-| `low` | Short, fast responses — simple lookups, formatting, classification |
-| `medium` | Balanced tradeoff for everyday Q&A and light reasoning |
-| `high` (default) | Complex reasoning, code generation, analysis |
-| `xhigh` | Hardest problems — multi-step math, deep research, agentic planning |
-

docs/my-website/blog/redis_circuit_breaker/diagrams.js

@@ -1,159 +0,0 @@
-import React from 'react';
-
-const s = {
-  fig: {margin: '2.5rem 0', fontFamily: 'inherit'},
-  box: {borderRadius: 12, border: '1px solid #e5e7eb', background: '#fff', padding: '2rem 2.5rem'},
-  label: {fontSize: 11, fontWeight: 700, textTransform: 'uppercase', letterSpacing: '0.12em', color: '#9ca3af', textAlign: 'center', marginBottom: '1.5rem'},
-  caption: {textAlign: 'center', fontSize: 12, color: '#9ca3af', marginTop: 12},
-  node: (border='#d1d5db', bg='#f9fafb') => ({
-    border: `1px solid ${border}`, borderRadius: 6, padding: '8px 20px',
-    fontSize: 13, background: bg, display: 'inline-block',
-  }),
-  arrow: {display: 'flex', flexDirection: 'column', alignItems: 'center'},
-};
-
-const SmallArrow = ({color='#9ca3af'}) => (
-  <svg width="2" height="28" style={{display:'block'}}>
-    <line x1="1" y1="0" x2="1" y2="22" stroke={color} strokeWidth="1.5"/>
-    <polygon points="1,28 -2,21 4,21" fill={color}/>
-  </svg>
-);
-
-export function CascadeFailure() {
-  return (
-    <figure style={s.fig}>
-      <div style={s.box}>
-        <p style={s.label}>Without circuit breaker — cascade failure</p>
-        <div style={{display:'flex', flexDirection:'column', alignItems:'center', gap:0}}>
-          <div style={s.node()}>LiteLLM Pod (×100)</div>
-          <SmallArrow />
-          <div style={s.node()}>Rate limit / cache check</div>
-          <div style={{position:'relative', display:'flex', flexDirection:'column', alignItems:'center'}}>
-            <SmallArrow color="#f87171"/>
-            <span style={{position:'absolute', left:8, top:4, fontSize:11, color:'#f87171', whiteSpace:'nowrap'}}>hangs 30s per request</span>
-          </div>
-          <div style={s.node('#fca5a5','#fef2f2')}><span style={{color:'#b91c1c', fontWeight:600}}>Redis — degraded, timing out</span></div>
-          <SmallArrow color="#fb923c"/>
-          <div style={s.node('#fdba74','#fff7ed')}><span style={{color:'#c2410c', fontWeight:600}}>Postgres — 100× normal read load</span></div>
-          <SmallArrow />
-          <div style={{...s.node('#111827','#111827'), color:'#fff', fontWeight:600}}>Total outage — gateway down</div>
-        </div>
-      </div>
-      <figcaption style={s.caption}>Slow Redis → every auth check times out → database overwhelmed → full cascade</figcaption>
-    </figure>
-  );
-}
-
-export function CircuitBreakerStates() {
-  const circle = (border, color, label, sub) => (
-    <div style={{display:'flex', flexDirection:'column', alignItems:'center', width: 140}}>
-      <div style={{width:88, height:88, borderRadius:'50%', border:`2px solid ${border}`, background:'#fff', display:'flex', flexDirection:'column', alignItems:'center', justifyContent:'center'}}>
-        <span style={{fontSize:11, fontWeight:700, color, letterSpacing:'0.06em'}}>{label}</span>
-        <span style={{fontSize:10, color:'#9ca3af', marginTop:2}}>{sub}</span>
-      </div>
-      <p style={{fontSize:11, color:'#6b7280', textAlign:'center', marginTop:10, lineHeight:1.5}}>{'\u00a0'}</p>
-    </div>
-  );
-  const arrow = (label) => (
-    <div style={{display:'flex', flexDirection:'column', alignItems:'center', marginTop:36, marginLeft:4, marginRight:4}}>
-      <span style={{fontSize:10, color:'#6b7280', marginBottom:4}}>{label}</span>
-      <div style={{display:'flex', alignItems:'center'}}>
-        <div style={{height:1, width:48, background:'#9ca3af'}}/>
-        <svg width="8" height="8" style={{marginLeft:-1}}><polygon points="0,0 8,4 0,8" fill="#6b7280"/></svg>
-      </div>
-    </div>
-  );
-  return (
-    <figure style={s.fig}>
-      <div style={s.box}>
-        <p style={s.label}>Circuit breaker state machine</p>
-        <div style={{display:'flex', justifyContent:'center', alignItems:'flex-start'}}>
-          {circle('#1f2937','#111827','CLOSED','normal')}
-          {arrow('5 failures')}
-          {circle('#f87171','#dc2626','OPEN','fast-fail')}
-          {arrow('60s timeout')}
-          {circle('#fbbf24','#b45309','HALF-OPEN','probing')}
-        </div>
-        <div style={{display:'flex', justifyContent:'center', gap:32, marginTop:24}}>
-          <div style={{display:'flex', flexDirection:'column', alignItems:'center', gap:4}}>
-            <div style={{display:'flex', alignItems:'center', gap:4}}>
-              <svg width="8" height="8"><polygon points="8,0 0,4 8,8" fill="#16a34a"/></svg>
-              <div style={{height:1, width:100, background:'#16a34a'}}/>
-            </div>
-            <span style={{fontSize:10, color:'#16a34a'}}>probe success → CLOSED</span>
-          </div>
-          <div style={{display:'flex', flexDirection:'column', alignItems:'center', gap:4}}>
-            <div style={{display:'flex', alignItems:'center', gap:4}}>
-              <svg width="8" height="8"><polygon points="8,0 0,4 8,8" fill="#ef4444"/></svg>
-              <div style={{height:1, width:100, borderTop:'2px dashed #f87171'}}/>
-            </div>
-            <span style={{fontSize:10, color:'#ef4444'}}>probe failure → OPEN again</span>
-          </div>
-        </div>
-      </div>
-    </figure>
-  );
-}
-
-export function CircuitBreakerFlow() {
-  return (
-    <figure style={s.fig}>
-      <div style={s.box}>
-        <p style={s.label}>With circuit breaker — graceful degradation</p>
-        <div style={{display:'flex', flexDirection:'column', alignItems:'center'}}>
-          <div style={s.node()}>Incoming request</div>
-          <SmallArrow />
-          <div style={{...s.node('#111827'), border:'2px solid #111827', fontWeight:600}}>Circuit Breaker</div>
-          <div style={{display:'flex', gap:80, marginTop:20, alignItems:'flex-start'}}>
-            <div style={{display:'flex', flexDirection:'column', alignItems:'center', gap:8}}>
-              <SmallArrow />
-              <span style={{fontSize:10, fontWeight:700, textTransform:'uppercase', letterSpacing:'0.06em', color:'#6b7280', border:'1px solid #e5e7eb', borderRadius:4, padding:'2px 8px'}}>Closed</span>
-              <div style={{...s.node(), textAlign:'center', fontSize:13}}>Redis call<br/><span style={{fontSize:11, color:'#9ca3af'}}>normal latency</span></div>
-            </div>
-            <div style={{display:'flex', flexDirection:'column', alignItems:'center', gap:8}}>
-              <SmallArrow />
-              <span style={{fontSize:10, fontWeight:700, textTransform:'uppercase', letterSpacing:'0.06em', color:'#ef4444', border:'1px solid #fca5a5', borderRadius:4, padding:'2px 8px'}}>Open</span>
-              <div style={{...s.node('#fca5a5'), textAlign:'center', fontSize:13}}>Fast-fail — 0ms<br/><span style={{fontSize:11, color:'#9ca3af'}}>no network call</span></div>
-              <SmallArrow />
-              <div style={{...s.node(), textAlign:'center', fontSize:13}}>DB fallback<br/><span style={{fontSize:11, color:'#9ca3af'}}>bounded load</span></div>
-            </div>
-          </div>
-          <div style={{...s.node('#111827','#111827'), color:'#fff', fontWeight:600, marginTop:24}}>Request completes — gateway stays up</div>
-        </div>
-      </div>
-      <figcaption style={s.caption}>Redis down → circuit opens → 0ms rejection → DB absorbs bounded fallback traffic</figcaption>
-    </figure>
-  );
-}
-
-export function IncidentTimeline() {
-  const row = (color, text) => (
-    <div style={{display:'flex', alignItems:'flex-start', gap:10, marginBottom:12}}>
-      <div style={{marginTop:5, width:6, height:6, borderRadius:'50%', background:color, flexShrink:0}}/>
-      <p style={{fontSize:13, color:'#4b5563', margin:0, lineHeight:1.5}}>{text}</p>
-    </div>
-  );
-  return (
-    <figure style={s.fig}>
-      <div style={s.box}>
-        <p style={s.label}>Redis degrades — before vs. after</p>
-        <div style={{display:'grid', gridTemplateColumns:'1fr 1fr', gap:20}}>
-          <div style={{border:'1px solid #e5e7eb', borderRadius:8, padding:20}}>
-            <p style={{fontSize:10, fontWeight:700, textTransform:'uppercase', letterSpacing:'0.1em', color:'#9ca3af', marginBottom:16}}>Without circuit breaker</p>
-            {row('#f87171','All 100 pods hang for 30s on each auth check')}
-            {row('#f87171','Threadpools fill up, requests queue')}
-            {row('#f87171','100× simultaneous DB fallbacks overwhelm Postgres')}
-            {row('#f87171','Requires manual intervention to recover')}
-          </div>
-          <div style={{border:'1px solid #111827', borderRadius:8, padding:20}}>
-            <p style={{fontSize:10, fontWeight:700, textTransform:'uppercase', letterSpacing:'0.1em', color:'#9ca3af', marginBottom:16}}>With circuit breaker</p>
-            {row('#111827','Circuit opens after 5 failures — 0ms fast-fail')}
-            {row('#111827','Auth falls back to DB — bounded, not 100× load')}
-            {row('#111827','Cache miss rate temporarily elevated — gateway stays up')}
-            {row('#111827','Auto-recovers when Redis comes back — no intervention needed')}
-          </div>
-        </div>
-      </div>
-    </figure>
-  );
-}

docs/my-website/blog/redis_circuit_breaker/index.md

@@ -1,141 +0,0 @@
----
-slug: redis-circuit-breaker
-title: "Making the AI Gateway Resilient to Redis Failures"
-date: 2026-04-11T09:00:00
-authors:
-  - ishaan
-description: "How LiteLLM's production AI Gateway handles Redis degradation at scale without cascading failures — circuit breaker pattern, 0ms fast-fail, automatic recovery."
-tags: [reliability, redis, infrastructure, engineering, ai-gateway]
-hide_table_of_contents: true
----
-
-import { CascadeFailure, CircuitBreakerStates, CircuitBreakerFlow, IncidentTimeline } from './diagrams';
-
-*Last Updated: April 2026*
-
-Enterprise AI Gateway deployments put Redis in the hot path for nearly every request: rate limiting, cache lookups, spend tracking. When Redis is healthy, the latency contribution is single-digit milliseconds — invisible to end users. When it degrades, a production AI Gateway needs to stay up regardless.
-
-Running LiteLLM at scale across 100+ pods means designing for failure modes before they appear. The easy case is Redis going fully down: fail fast, fall through to the database, continue serving requests. The hard case — the one that takes down gateways — is a *slow* Redis: still accepting connections, still responding, but timing out after 20-30 seconds per operation.
-
-{/* truncate */}
-
-## Why slow Redis is harder than a full outage
-
-<CascadeFailure />
-
-With 100 pods each hanging 30 seconds on every auth check, threadpools fill up and requests queue. By the time Redis times out and falls through to Postgres, the database receives 100× its normal load from simultaneous fallbacks. A slow Redis becomes a database outage becomes a full gateway outage. A production-grade AI Gateway cannot allow one degraded dependency to cascade into total failure.
-
-## The fix: circuit breaker pattern
-
-The circuit breaker pattern tracks consecutive failures and cuts off the unhealthy dependency before it cascades. Instead of hanging 30 seconds on each Redis call, the circuit opens after 5 consecutive failures and fast-fails at 0ms — no network call, no wait.
-
-<CircuitBreakerStates />
-
-Three states:
-
-- **CLOSED** — normal. All Redis calls pass through.
-- **OPEN** — Redis is unhealthy. Every call fast-fails instantly. Requests continue with degraded-but-functional behavior: auth and rate limiting fall back to the database.
-- **HALF-OPEN** — after 60 seconds, one probe request tests recovery. Success closes the circuit; failure resets the timer.
-
-This is how a reliable AI Gateway handles infrastructure degradation: stay up, degrade gracefully, recover automatically.
-
-## How requests flow through the AI Gateway
-
-<CircuitBreakerFlow />
-
-When the circuit is open, the gateway does not stall. Auth checks fall back to Postgres — slower, but bounded. The database absorbs the load because it receives *some* requests via DB fallback, not *all* 100 pods simultaneously dumping their queued requests after a 30-second timeout.
-
-The difference between a resilient AI Gateway and a fragile one: controlled degradation vs. uncontrolled cascade.
-
-## The implementation
-
-```python
-class RedisCircuitBreaker:
-    def __init__(self, failure_threshold: int, recovery_timeout: int):
-        self.failure_threshold = failure_threshold  # default: 5
-        self.recovery_timeout = recovery_timeout    # default: 60s
-        self._failure_count = 0
-        self._state = self.CLOSED
-
-    def is_open(self) -> bool:
-        if self._state == self.OPEN:
-            if time.time() - self._opened_at > self.recovery_timeout:
-                self._state = self.HALF_OPEN
-                return False  # this caller is the recovery probe
-            return True       # fast-fail
-        return False
-
-    def record_failure(self):
-        self._failure_count += 1
-        self._opened_at = time.time()
-        if self._failure_count >= self.failure_threshold:
-            self._state = self.OPEN  # open the circuit
-
-    def record_success(self):
-        self._failure_count = 0
-        self._state = self.CLOSED   # Redis recovered
-```
-
-Every async Redis operation goes through a decorator that checks the breaker before touching the network. When open, it raises immediately:
-
-```python
-@_redis_circuit_breaker_guard
-async def async_get_cache(self, key: str):
-    ...
-```
-
-The decorator handles all bookkeeping — success resets nothing, failures increment the counter, exceptions trigger `record_failure()`. The caller sees a clean exception and falls through to its normal non-Redis path. No changes required in calling code.
-
-## AI Gateway resilience in production
-
-<IncidentTimeline />
-
-Redis degradation events no longer cascade in production. The observable symptom during a Redis slowdown is a temporary bump in cache miss rate — the right failure mode for a resilient AI Gateway. Auth still works. Rate limiting still works. Spend tracking still works, at slightly higher DB cost. Recovery is fully automatic when Redis comes back.
-
-```bash
-# configure via environment variables
-REDIS_CIRCUIT_BREAKER_FAILURE_THRESHOLD=5   # failures before opening
-REDIS_CIRCUIT_BREAKER_RECOVERY_TIMEOUT=60  # seconds before probe
-```
-
-The circuit breaker ships on by default in all LiteLLM versions since `v1.82.0`. No configuration needed for most deployments.
-
-## Key Takeaways
-
-- A slow Redis is more dangerous than a downed one: 30-second timeouts across 100+ pods overwhelm Postgres at 100× normal load
-- LiteLLM's AI Gateway uses a circuit breaker that fast-fails Redis calls at 0ms after 5 consecutive failures
-- Three states: CLOSED (normal), OPEN (fast-fail + DB fallback), HALF-OPEN (probe recovery)
-- Auth, rate limiting, and spend tracking continue working during Redis outages
-- Resilient, production-grade behavior — enabled by default since `v1.82.0`, no configuration required
-
----
-
-### Frequently Asked Questions
-
-### Does the circuit breaker affect normal Redis performance?
-
-No. When Redis is healthy (circuit CLOSED), every call passes through with zero overhead. The breaker only activates after 5 consecutive failures — transparent under normal conditions.
-
-### What happens to rate limiting when the circuit is open?
-
-Rate limiting falls back to Postgres with bounded load. Limits remain enforced at slightly higher DB cost until Redis recovers and the circuit closes automatically.
-
-### How is this different from basic Redis retry logic?
-
-Retry logic still waits for each timeout (30s × retries). The circuit breaker cuts the connection immediately at 0ms after the failure threshold, preventing threadpool exhaustion across all pods simultaneously. Retries make slow-Redis worse; the circuit breaker contains it.
-
-### Is this available in LiteLLM OSS?
-
-Yes. The circuit breaker ships in LiteLLM OSS (Apache 2.0) by default since `v1.82.0`. [LiteLLM Enterprise](https://litellm.ai/enterprise) adds SSO/SCIM, air-gapped deployment, 24/7 SLA support, and advanced guardrails on top of the OSS foundation.
-
----
-
-## Conclusion
-
-Redis resilience is one layer of what makes LiteLLM a production-grade, reliable AI Gateway at scale. The circuit breaker pattern ensures infrastructure degradation stays contained — the right failure mode is a temporary cache miss rate bump, not a full outage. This is how AI Gateway infrastructure should behave under pressure: degrade gracefully, recover automatically, keep serving traffic. For teams with strict uptime and compliance requirements, [LiteLLM Enterprise](https://litellm.ai/enterprise) provides the additional controls needed for regulated production environments.
-
-## Recommended Reading
-
-- [LiteLLM AI Gateway — full feature overview](https://docs.litellm.ai/docs/simple_proxy)
-- [Load balancing and routing across 100+ LLM providers](https://docs.litellm.ai/docs/routing)
-- [Spend tracking and budget controls](https://docs.litellm.ai/docs/proxy/cost_tracking)

docs/my-website/blog/security_townhall_updates/index.md

@@ -143,41 +143,8 @@ This will ensure, your releases are safe, even when:
 - Tampered registry artifacts are published
 - Tag mutations are made after the release is published
 
-We believe that [Cosign](https://github.com/sigstore/cosign) is a good fit for this, and have shipped it in [PR #24683](https://github.com/BerriAI/litellm/pull/24683).
+We believe that [Cosign](https://github.com/sigstore/cosign) is a good fit for this, and have already begun working on it [PR](https://github.com/BerriAI/litellm/pull/24683).
 
-#### How to verify a Docker image with Cosign
-
-Starting from `v1.83.0-nightly`, all LiteLLM Docker images published to GHCR are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key that was introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).
-
-**Verify using the pinned commit hash (recommended):**
-
-A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:
-
-```bash
-cosign verify \
-  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
-  ghcr.io/berriai/litellm:<release-tag>
-```
-
-**Verify using a release tag (convenience):**
-
-Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
-
-```bash
-cosign verify \
-  --key https://raw.githubusercontent.com/BerriAI/litellm/<release-tag>/cosign.pub \
-  ghcr.io/berriai/litellm:<release-tag>
-```
-
-Replace `<release-tag>` with the version you are deploying (e.g. `v1.83.0-stable`).
-
-Expected output:
-
-```
-The following checks were performed on each of these signatures:
-  - The cosign claims were validated
-  - The signatures were verified against the specified public key
-```
 
 ### Avoid Compromised Packages
 

docs/my-website/blog/security_update_march_2026/index.md

@@ -708,40 +708,6 @@ The LiteLLM AI Gateway team has already taken the following steps:
 - Engaged Google's Mandiant security team to assist with forensic analysis of the build and publishing chain
 
 
-## Verify Docker image signatures
-
-Starting from `v1.83.0-nightly`, all LiteLLM Docker images published to GHCR are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).
-
-**Verify using the pinned commit hash (recommended):**
-
-A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:
-
-```bash
-cosign verify \
-  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
-  ghcr.io/berriai/litellm:<release-tag>
-```
-
-**Verify using a release tag (convenience):**
-
-Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
-
-```bash
-cosign verify \
-  --key https://raw.githubusercontent.com/BerriAI/litellm/<release-tag>/cosign.pub \
-  ghcr.io/berriai/litellm:<release-tag>
-```
-
-Replace `<release-tag>` with the version you are deploying (e.g. `v1.83.0-stable`).
-
-Expected output:
-
-```
-The following checks were performed on each of these signatures:
-  - The cosign claims were validated
-  - The signatures were verified against the specified public key
-```
-
 ## Verified safe versions
 
 We have audited every LiteLLM release published between v1.78.0 and v1.82.6 across both PyPI and Docker. Each artifact was verified by:

docs/my-website/docs/adding_provider/generic_prompt_management_api.md

@@ -378,7 +378,7 @@ if __name__ == "__main__":
 
 1. Install dependencies:
 ```bash
-uv add fastapi uvicorn
+pip install fastapi uvicorn
 ```
 
 2. Save the code above to `prompt_server.py`

docs/my-website/docs/benchmarks.md

@@ -5,55 +5,6 @@ import Image from '@theme/IdealImage';
 
 Benchmarks for LiteLLM Gateway (Proxy Server) tested against a fake OpenAI endpoint.
 
-
-LiteLLM Gateway has **8ms P95 latency** at 1k RPS (See benchmarks [here](#4-instances))
-
-## Machine Spec used for testing
-
-Each machine deploying LiteLLM had the following specs:
-
-- 4 CPU
-- 8GB RAM
-
-## Configuration
-
-- Database: PostgreSQL
-- Redis: Not used
-
-
-### 2 Instance LiteLLM Proxy
-
-In these tests the baseline latency characteristics are measured against a fake-openai-endpoint.
-
-#### Performance Metrics
-
-| **Type** | **Name** | **Median (ms)** | **95%ile (ms)** | **99%ile (ms)** | **Average (ms)** | **Current RPS** |
-| --- | --- | --- | --- | --- | --- | --- |
-| POST | /chat/completions | 200 | 630 | 1200 | 262.46 | 1035.7 |
-| Custom | LiteLLM Overhead Duration (ms) | 12 | 29 | 43 | 14.74 | 1035.7 |
-|  | Aggregated | 100 | 430 | 930 | 138.6 | 2071.4 |
-
-<!-- <Image img={require('../img/1_instance_proxy.png')} /> -->
-
-<!-- ## **Horizontal Scaling - 10K RPS**
-
-<Image img={require('../img/instances_vs_rps.png')} /> -->
-
-
-### 4 Instances
-
-| **Type** | **Name** | **Median (ms)** | **95%ile (ms)** | **99%ile (ms)** | **Average (ms)** | **Current RPS** |
-| --- | --- | --- | --- | --- | --- | --- |
-| POST | /chat/completions | 100 | 150 | 240 | 111.73 | 1170 |
-| Custom | LiteLLM Overhead Duration (ms) | 2 | 8 | 13 | 3.32 | 1170 |
-|  | Aggregated | 77 | 130 | 180 | 57.53 | 2340 |
-
-#### Key Findings
-- Doubling from 2 to 4 LiteLLM instances halves median latency: 200 ms → 100 ms.
-- High-percentile latencies drop significantly: P95 630 ms → 150 ms, P99 1,200 ms → 240 ms.
-- Setting workers equal to CPU count gives optimal performance.
-
-
 ## Setting Up Benchmarking with Network Mock
 
 The fastest way to benchmark proxy overhead is using `network_mock` mode. This intercepts outbound requests at the httpx transport layer and returns canned responses, no need for setting up a mock provider. 
@@ -90,8 +41,6 @@ litellm --config benchmark_config.yaml --port 4000 --num_workers 8
 python scripts/benchmark_mock.py --requests 2000 --max-concurrent 200 --runs 3
 ```
 
-Get the benchmarking script [here](https://github.com/BerriAI/litellm/blob/main/scripts/benchmark_mock.py)
-
 This measures pure proxy overhead on the hot path without any network latency to a real or fake provider.
 
 ## Setting Up a Fake OpenAI Endpoint
@@ -112,6 +61,38 @@ model_list:
       api_key: "test"
 ```
 
+### 2 Instance LiteLLM Proxy
+
+In these tests the baseline latency characteristics are measured against a fake-openai-endpoint.
+
+#### Performance Metrics
+
+| **Type** | **Name** | **Median (ms)** | **95%ile (ms)** | **99%ile (ms)** | **Average (ms)** | **Current RPS** |
+| --- | --- | --- | --- | --- | --- | --- |
+| POST | /chat/completions | 200 | 630 | 1200 | 262.46 | 1035.7 |
+| Custom | LiteLLM Overhead Duration (ms) | 12 | 29 | 43 | 14.74 | 1035.7 |
+|  | Aggregated | 100 | 430 | 930 | 138.6 | 2071.4 |
+
+<!-- <Image img={require('../img/1_instance_proxy.png')} /> -->
+
+<!-- ## **Horizontal Scaling - 10K RPS**
+
+<Image img={require('../img/instances_vs_rps.png')} /> -->
+
+
+### 4 Instances
+
+| **Type** | **Name** | **Median (ms)** | **95%ile (ms)** | **99%ile (ms)** | **Average (ms)** | **Current RPS** |
+| --- | --- | --- | --- | --- | --- | --- |
+| POST | /chat/completions | 100 | 150 | 240 | 111.73 | 1170 |
+| Custom | LiteLLM Overhead Duration (ms) | 2 | 8 | 13 | 3.32 | 1170 |
+|  | Aggregated | 77 | 130 | 180 | 57.53 | 2340 |
+
+#### Key Findings
+- Doubling from 2 to 4 LiteLLM instances halves median latency: 200 ms → 100 ms.
+- High-percentile latencies drop significantly: P95 630 ms → 150 ms, P99 1,200 ms → 240 ms.
+- Setting workers equal to CPU count gives optimal performance.
+
 ## `/realtime` API Benchmarks
 
 End-to-end latency benchmarks for the `/realtime` endpoint tested against a fake realtime endpoint.
@@ -134,6 +115,17 @@ End-to-end latency benchmarks for the `/realtime` endpoint tested against a fake
 | **System** | 4 vCPUs, 8 GB RAM, 4 workers, 4 instances |
 | **Database** | PostgreSQL (Redis unused) |
 
+## Machine Spec used for testing
+
+Each machine deploying LiteLLM had the following specs:
+
+- 4 CPU
+- 8GB RAM
+
+## Configuration
+
+- Database: PostgreSQL
+- Redis: Not used
 
 ## Infrastructure Recommendations
 

docs/my-website/docs/caching/all_caches.md

@@ -23,7 +23,7 @@ import TabItem from '@theme/TabItem';
 
 Install redis
 ```shell
-uv add redis
+pip install redis
 ```
 
 For the hosted version you can setup your own Redis DB here: https://redis.io/try-free/
@@ -55,7 +55,7 @@ response2 = completion(
 For GCP Memorystore Redis with IAM authentication:
 
 ```shell
-uv add google-cloud-iam
+pip install google-cloud-iam
 ```
 
 ```python
@@ -150,7 +150,7 @@ response2 = completion(
 
 Install boto3
 ```shell
-uv add boto3
+pip install boto3
 ```
 
 Set AWS environment variables
@@ -187,7 +187,7 @@ response2 = completion(
 
 Install azure-storage-blob and azure-identity
 ```shell
-uv add azure-storage-blob azure-identity
+pip install azure-storage-blob azure-identity
 ```
 
 ```python
@@ -219,7 +219,7 @@ response2 = completion(
 
 Install redisvl client
 ```shell
-uv add redisvl==0.4.1
+pip install redisvl==0.4.1
 ```
 
 For the hosted version you can setup your own Redis DB here: https://redis.io/try-free/
@@ -366,7 +366,7 @@ response2 = completion(
 Install the disk caching extra:
 
 ```shell
-uv add "litellm[caching]"
+pip install "litellm[caching]"
 ```
 
 Then you can use the disk cache as follows.

docs/my-website/docs/completion/anthropic_advisor_tool.md

@@ -1,489 +0,0 @@
-# Advisor Tool
-
-Pair a faster executor model with a higher-intelligence advisor model that provides strategic guidance mid-generation.
-
-The advisor tool lets a fast, lower-cost executor model (Sonnet or Haiku) consult a high-intelligence advisor model (Opus 4.6) mid-generation. The advisor reads the full conversation and produces a plan or course correction — typically 400–700 text tokens — and the executor continues with the task.
-
-This pattern is well-suited for long-horizon agentic workloads (coding agents, computer use, multi-step research) where most turns are mechanical but having an excellent plan is crucial. You get close to advisor-solo quality while the bulk of token generation happens at executor-model rates.
-
-:::info Beta
-
-The advisor tool is in beta. Include `anthropic-beta: advisor-tool-2026-03-01` in your requests — LiteLLM adds this automatically when it detects the advisor tool in your `tools` array.
-
-:::
-
-## Supported Providers
-
-| Provider | Chat Completions API | Messages API | Notes |
-|----------|---------------------|--------------|-------|
-| **Anthropic API** | ✅ | ✅ | Native — runs server-side |
-| **OpenAI / Azure OpenAI** | ✅ | ✅ | LiteLLM orchestration loop |
-| **Amazon Bedrock** | ✅ | ✅ | LiteLLM orchestration loop |
-| **Google Vertex AI** | ✅ | ✅ | LiteLLM orchestration loop |
-| **Groq / Mistral / others** | ✅ | ✅ | LiteLLM orchestration loop |
-
-## How it works (LiteLLM native orchestration)
-
-For non-Anthropic providers, LiteLLM implements the advisor loop itself. The API you call is identical — LiteLLM handles everything transparently.
-
-When a request arrives with an `advisor_20260301` tool and a non-Anthropic provider, `AdvisorOrchestrationHandler` intercepts it. It translates the advisor tool into a regular function tool the provider understands, then runs an orchestration loop:
-
-```mermaid
-flowchart TD
-    A["Your request\ntools: advisor_20260301\nmodel: e.g. openai/gpt-4.1-mini"] --> B["AdvisorOrchestrationHandler\ntranslates advisor → regular fn tool"]
-
-    B --> C["EXECUTOR CALL\nopenai / bedrock / vertex / etc."]
-
-    C --> D{"executor calls\nadvisor tool?"}
-
-    D -->|"yes — tool_use\nname=advisor"| E{"max_uses\nexceeded?"}
-
-    E -->|no| F["ADVISOR SUB-CALL\nclaude-opus-4-6\nfull transcript forwarded\nno tools"]
-
-    F --> G["Inject advice as\ntool_result into history"]
-
-    G --> C
-
-    E -->|yes| H["AdvisorMaxIterationsError"]
-
-    D -->|"no — end_turn\nor other stop reason"| I["Clean final response\nno advisor blocks in output"]
-```
-
-**What LiteLLM does for you:**
-
-- Strips `advisor_20260301` from the outgoing request — the provider only sees a standard function tool named `advisor`
-- When the executor calls it, intercepts before the result reaches you, runs the advisor sub-call, and injects the advice
-- Strips any `advisor_tool_result` / `server_tool_use` blocks from message history on re-send so non-Anthropic providers never see Anthropic-specific types
-- Wraps the final response in an SSE stream if you requested `stream=True`
-- Enforces `max_uses` as a hard cap — `AdvisorMaxIterationsError` is raised if exceeded; `max_uses=0` disables the advisor entirely
-
-## Model Compatibility
-
-The executor and advisor models must form a valid pair. Currently the only supported advisor model is `claude-opus-4-6`.
-
-| Executor | Advisor |
-|----------|---------|
-| `claude-haiku-4-5-20251001` | `claude-opus-4-6` |
-| `claude-sonnet-4-6` | `claude-opus-4-6` |
-| `claude-opus-4-6` | `claude-opus-4-6` |
-
----
-
-## Chat Completions API
-
-### SDK Usage
-
-#### Basic Example
-
-```python showLineNumbers title="Advisor Tool — litellm.completion()"
-import litellm
-
-response = litellm.completion(
-    model="anthropic/claude-sonnet-4-6",
-    messages=[
-        {"role": "user", "content": "Build a concurrent worker pool in Go with graceful shutdown."}
-    ],
-    tools=[
-        {
-            "type": "advisor_20260301",
-            "name": "advisor",
-            "model": "claude-opus-4-6",
-        }
-    ],
-    max_tokens=4096,
-)
-
-print(response.choices[0].message.content)
-```
-
-#### With Optional Parameters
-
-```python showLineNumbers title="Advisor Tool with max_uses and caching"
-import litellm
-
-response = litellm.completion(
-    model="anthropic/claude-sonnet-4-6",
-    messages=[
-        {"role": "user", "content": "Build a REST API with authentication in Python."}
-    ],
-    tools=[
-        {
-            "type": "advisor_20260301",
-            "name": "advisor",
-            "model": "claude-opus-4-6",
-            "max_uses": 3,                             # cap advisor calls per request
-            "caching": {"type": "ephemeral", "ttl": "5m"},  # enable for 3+ calls per conversation
-        }
-    ],
-    max_tokens=4096,
-)
-```
-
-#### Streaming
-
-```python showLineNumbers title="Streaming with Advisor Tool"
-import litellm
-
-response = litellm.completion(
-    model="anthropic/claude-sonnet-4-6",
-    messages=[
-        {"role": "user", "content": "Implement a distributed rate limiter."}
-    ],
-    tools=[
-        {
-            "type": "advisor_20260301",
-            "name": "advisor",
-            "model": "claude-opus-4-6",
-        }
-    ],
-    max_tokens=4096,
-    stream=True,
-)
-
-for chunk in response:
-    if chunk.choices[0].delta.content:
-        print(chunk.choices[0].delta.content, end="")
-```
-
-:::note Streaming behavior
-
-The advisor sub-inference does not stream. The executor's stream pauses while the advisor runs, then the full advisor result arrives in a single event. Executor output resumes streaming afterward.
-
-:::
-
-#### Multi-Turn Conversation
-
-```python showLineNumbers title="Multi-Turn with Advisor Tool"
-import litellm
-
-tools = [
-    {
-        "type": "advisor_20260301",
-        "name": "advisor",
-        "model": "claude-opus-4-6",
-    }
-]
-
-messages = [
-    {"role": "user", "content": "Build a concurrent worker pool in Go with graceful shutdown."}
-]
-
-response = litellm.completion(
-    model="anthropic/claude-sonnet-4-6",
-    messages=messages,
-    tools=tools,
-    max_tokens=4096,
-)
-
-# Append the full response (includes server_tool_use + advisor_tool_result blocks)
-messages.append({"role": "assistant", "content": response.choices[0].message.content})
-
-# Continue the conversation — keep the same tools array
-messages.append({"role": "user", "content": "Now add a max-in-flight limit of 10."})
-
-response2 = litellm.completion(
-    model="anthropic/claude-sonnet-4-6",
-    messages=messages,
-    tools=tools,
-    max_tokens=4096,
-)
-```
-
-:::tip Auto-strip on follow-up turns
-
-LiteLLM automatically strips `advisor_tool_result` blocks from message history when the advisor tool is not present in the current request. This prevents the Anthropic 400 error that would otherwise occur.
-
-:::
-
-### AI Gateway Usage
-
-#### Proxy Configuration
-
-```yaml showLineNumbers title="config.yaml"
-model_list:
-  - model_name: claude-sonnet
-    litellm_params:
-      model: anthropic/claude-sonnet-4-6
-      api_key: os.environ/ANTHROPIC_API_KEY
-```
-
-#### Client Request via Proxy
-
-```python showLineNumbers title="Advisor Tool via AI Gateway"
-from openai import OpenAI
-
-client = OpenAI(
-    api_key="your-litellm-proxy-key",
-    base_url="http://0.0.0.0:4000/v1"
-)
-
-response = client.chat.completions.create(
-    model="claude-sonnet",
-    messages=[
-        {"role": "user", "content": "Implement a distributed rate limiter in Python."}
-    ],
-    tools=[
-        {
-            "type": "advisor_20260301",
-            "name": "advisor",
-            "model": "claude-opus-4-6",
-        }
-    ],
-    max_tokens=4096,
-)
-```
-
----
-
-## Messages API
-
-### SDK Usage
-
-#### Basic Example
-
-```python showLineNumbers title="Advisor Tool — litellm.anthropic.messages"
-import asyncio
-import litellm
-
-async def main():
-    response = await litellm.anthropic.messages.acreate(
-        model="anthropic/claude-sonnet-4-6",
-        messages=[
-            {"role": "user", "content": "Build a concurrent worker pool in Go with graceful shutdown."}
-        ],
-        tools=[
-            {
-                "type": "advisor_20260301",
-                "name": "advisor",
-                "model": "claude-opus-4-6",
-            }
-        ],
-        max_tokens=4096,
-    )
-    print(response)
-
-asyncio.run(main())
-```
-
-#### Streaming
-
-```python showLineNumbers title="Messages API Streaming with Advisor Tool"
-import asyncio
-import json
-import litellm
-
-async def main():
-    response = await litellm.anthropic.messages.acreate(
-        model="anthropic/claude-sonnet-4-6",
-        messages=[
-            {"role": "user", "content": "Implement a distributed rate limiter."}
-        ],
-        tools=[
-            {
-                "type": "advisor_20260301",
-                "name": "advisor",
-                "model": "claude-opus-4-6",
-            }
-        ],
-        max_tokens=4096,
-        stream=True,
-    )
-
-    async for chunk in response:
-        if isinstance(chunk, bytes):
-            for line in chunk.decode("utf-8").split("\n"):
-                if line.startswith("data: "):
-                    try:
-                        print(json.loads(line[6:]))
-                    except json.JSONDecodeError:
-                        pass
-
-asyncio.run(main())
-```
-
-### AI Gateway Usage
-
-#### Proxy Configuration
-
-```yaml showLineNumbers title="config.yaml"
-model_list:
-  - model_name: claude-sonnet
-    litellm_params:
-      model: anthropic/claude-sonnet-4-6
-      api_key: os.environ/ANTHROPIC_API_KEY
-```
-
-#### Client Request via Proxy (Anthropic SDK)
-
-```python showLineNumbers title="Advisor Tool via AI Gateway (Anthropic SDK)"
-import anthropic
-
-client = anthropic.Anthropic(
-    api_key="your-litellm-proxy-key",
-    base_url="http://0.0.0.0:4000"
-)
-
-response = client.beta.messages.create(
-    model="claude-sonnet",
-    max_tokens=4096,
-    betas=["advisor-tool-2026-03-01"],
-    messages=[
-        {"role": "user", "content": "Build a concurrent worker pool in Go with graceful shutdown."}
-    ],
-    tools=[
-        {
-            "type": "advisor_20260301",
-            "name": "advisor",
-            "model": "claude-opus-4-6",
-        }
-    ],
-)
-print(response)
-```
-
-#### Non-Anthropic Provider (LiteLLM orchestration loop)
-
-```python showLineNumbers title="Advisor Tool with OpenAI executor"
-import asyncio
-import litellm
-
-async def main():
-    # executor: openai/gpt-4.1-mini  |  advisor: claude-opus-4-6
-    # LiteLLM runs the orchestration loop automatically
-    response = await litellm.anthropic.messages.acreate(
-        model="openai/gpt-4.1-mini",
-        messages=[
-            {"role": "user", "content": "Implement a Python LRU cache with O(1) get and put."}
-        ],
-        tools=[
-            {
-                "type": "advisor_20260301",
-                "name": "advisor",
-                "model": "claude-opus-4-6",
-                "max_uses": 3,
-            }
-        ],
-        max_tokens=1024,
-        custom_llm_provider="openai",
-    )
-    # Final response is clean — no advisor tool_use blocks
-    print(response["content"][0]["text"])
-
-asyncio.run(main())
-```
-
----
-
-## Response Structure
-
-A successful advisor call returns `server_tool_use` and `advisor_tool_result` blocks in the assistant content:
-
-```json title="Response with advisor blocks"
-{
-  "role": "assistant",
-  "content": [
-    {
-      "type": "text",
-      "text": "Let me consult the advisor on this."
-    },
-    {
-      "type": "server_tool_use",
-      "id": "srvtoolu_abc123",
-      "name": "advisor",
-      "input": {}
-    },
-    {
-      "type": "advisor_tool_result",
-      "tool_use_id": "srvtoolu_abc123",
-      "content": {
-        "type": "advisor_result",
-        "text": "Use a channel-based coordination pattern. The tricky part is draining in-flight work during shutdown: close the input channel first, then wait on a WaitGroup..."
-      }
-    },
-    {
-      "type": "text",
-      "text": "Here's the implementation using a channel-based coordination pattern..."
-    }
-  ]
-}
-```
-
-Pass the full assistant content, including advisor blocks, back on subsequent turns. LiteLLM handles this automatically through `provider_specific_fields`.
-
----
-
-## Cost Control
-
-Advisor calls run as a separate sub-inference billed at the advisor model's rates. Usage is reported in `usage.iterations[]`:
-
-```json title="Usage with advisor sub-inference"
-{
-  "usage": {
-    "input_tokens": 412,
-    "output_tokens": 531,
-    "iterations": [
-      {
-        "type": "message",
-        "input_tokens": 412,
-        "output_tokens": 89
-      },
-      {
-        "type": "advisor_message",
-        "model": "claude-opus-4-6",
-        "input_tokens": 823,
-        "output_tokens": 1612
-      },
-      {
-        "type": "message",
-        "input_tokens": 1348,
-        "output_tokens": 442
-      }
-    ]
-  }
-}
-```
-
-Top-level `usage` reflects executor tokens only. Advisor tokens appear in `iterations` entries with `type: "advisor_message"` and are billed at Opus rates.
-
-**Tips:**
-- Enable `caching` on the tool definition only when you expect 3+ advisor calls per conversation; it costs more than it saves below that threshold.
-- Use `max_uses` to cap advisor calls per request. Once reached, the executor continues without further advice.
-- For conversation-level caps, count advisor calls client-side. When you reach your limit, remove the advisor tool from `tools`.
-
----
-
-## Recommended System Prompt
-
-For coding and agent tasks, Anthropic recommends prepending these blocks to your system prompt for consistent advisor timing and optimal cost/quality:
-
-```text title="Timing guidance (prepend to system prompt)"
-You have access to an `advisor` tool backed by a stronger reviewer model. It takes NO parameters — when you call advisor(), your entire conversation history is automatically forwarded. They see the task, every tool call you've made, every result you've seen.
-
-Call advisor BEFORE substantive work — before writing, before committing to an interpretation, before building on an assumption. If the task requires orientation first (finding files, fetching a source, seeing what's there), do that, then call advisor. Orientation is not substantive work. Writing, editing, and declaring an answer are.
-
-Also call advisor:
-- When you believe the task is complete. BEFORE this call, make your deliverable durable: write the file, save the result, commit the change.
-- When stuck — errors recurring, approach not converging, results that don't fit.
-- When considering a change of approach.
-
-On tasks longer than a few steps, call advisor at least once before committing to an approach and once before declaring done. On short reactive tasks where the next action is dictated by tool output you just read, you don't need to keep calling.
-```
-
-```text title="Advice weight guidance (add after timing block)"
-Give the advice serious weight. If you follow a step and it fails empirically, or you have primary-source evidence that contradicts a specific claim, adapt. A passing self-test is not evidence the advice is wrong.
-
-If you've already retrieved data pointing one way and the advisor points another: don't silently switch. Surface the conflict in one more advisor call — "I found X, you suggest Y, which constraint breaks the tie?"
-```
-
-To reduce advisor output length by 35–45% without losing quality, add:
-
-```text title="Cost reduction (optional, add before timing block)"
-The advisor should respond in under 100 words and use enumerated steps, not explanations.
-```
-
----
-
-## Additional Resources
-
-- [Anthropic Advisor Tool Documentation](https://platform.claude.com/docs/en/agents-and-tools/tool-use/advisor-tool)
-- [LiteLLM Tool Calling Guide](https://docs.litellm.ai/docs/completion/function_call)

docs/my-website/docs/completion/message_sanitization.md

@@ -401,7 +401,7 @@ response = litellm.completion(
 
 3. Ensure you're using a recent version of LiteLLM:
    ```bash
-   uv add --upgrade-package litellm litellm
+   pip install --upgrade litellm
    ```
 
 ### Unexpected Dummy Tool Results

docs/my-website/docs/completion/prompt_compression.md

@@ -1,123 +0,0 @@
-# Prompt Compression (`compress()`)
-
-Use `litellm.compress()` to shrink long conversation history before calling `completion()`.
-
-The function keeps high-relevance and recent context, replaces low-relevance content with lightweight stubs, and returns a retrieval tool so the model can request full content only when needed.
-
-## Quickstart
-
-```python
-import litellm
-
-messages = [
-    {"role": "system", "content": "You are a coding assistant."},
-    {"role": "user", "content": "# auth.py\n" + "def authenticate():\n    pass\n" * 2000},
-    {"role": "user", "content": "# utils.py\n" + "def helper():\n    pass\n" * 2000},
-    {"role": "user", "content": "Fix the bug in auth.py"},
-]
-
-compressed = litellm.compress(
-    messages=messages,
-    model="gpt-4o",
-    compression_trigger=1000,
-    compression_target=500,
-)
-
-response = litellm.completion(
-    model="gpt-4o",
-    messages=compressed["messages"],
-    tools=compressed["tools"],
-)
-```
-
-## What It Returns
-
-`compress()` returns a dictionary with:
-
-- `messages`: compressed conversation messages
-- `original_tokens`: token count before compression
-- `compressed_tokens`: token count after compression
-- `compression_ratio`: fraction of tokens removed
-- `cache`: key-value mapping of stub key -> original full content
-- `tools`: retrieval tool definition (`litellm_content_retrieve`) for on-demand restoration
-
-## Parameters
-
-- `messages` (`List[dict]`, required): input conversation messages
-- `model` (`str`, required): model name used for token counting
-- `compression_trigger` (`int`, default `200000`): compress only if input token count exceeds this
-- `compression_target` (`Optional[int]`, default `70% of compression_trigger`): desired post-compression token budget
-- `embedding_model` (`Optional[str]`): if set, combines BM25 + embedding relevance scoring
-- `embedding_model_params` (`Optional[dict]`): additional kwargs passed to `litellm.embedding()`
-- `compression_cache` (`Optional[DualCache]`): optional cache used by embedding scoring
-
-## Behavior Notes
-
-- Messages below `compression_trigger` are passed through unchanged.
-- System messages, the last user message, and the last assistant message are always preserved.
-- If a relevant message does not fully fit the remaining budget, `compress()` may keep a truncated version of it.
-- Compressed-out content is never lost; it is stored in `cache` and addressable by `litellm_content_retrieve`.
-
-## Handling Retrieval Tool Calls
-
-If the model calls `litellm_content_retrieve`, look up the requested key in `compressed["cache"]` and return that value as tool output.
-
-```python
-import json
-
-tool_call = response.choices[0].message.tool_calls[0]
-args = json.loads(tool_call.function.arguments)
-full_content = compressed["cache"][args["key"]]
-```
-
-## Performance
-
-Benchmarked on [SWE-bench Lite](https://huggingface.co/datasets/princeton-nlp/SWE-bench_Lite_bm25_27K) (real GitHub issues with ~27k tokens of BM25-retrieved repo context per problem).
-
-### Claude Opus — 5 problems, trigger=10k
-
-| Metric | Baseline | Compressed | Delta |
-|---|---|---|---|
-| File overlap | 1.000 | 1.000 | +0.000 |
-| Exact file match | 100% | 100% | +0.0% |
-| Hunk overlap | 0.582 | 0.361 | -0.221 |
-| Content similarity | 0.367 | 0.373 | +0.006 |
-| Avg prompt tokens | 30,828 | 6,890 | -77.7% |
-| Avg cost/problem | $0.488 | $0.136 | **-72.0%** |
-
-**Key takeaways:**
-
-- **File-level targeting is fully preserved** — the model edits the same files with or without compression.
-- **Content similarity matches baseline** — the actual lines changed are comparable.
-- **Hunk overlap drops modestly** (-0.221) — the model targets the right files but may edit slightly different line ranges with less surrounding context.
-- **72% cost savings** with 78% token reduction.
-
-### Metrics explained
-
-| Metric | What it measures |
-|---|---|
-| **File overlap** | Fraction of gold-patch files present in the generated patch |
-| **Exact file match** | Whether the generated patch touches exactly the same set of files |
-| **Hunk overlap** | Fraction of gold hunk line ranges covered by generated hunks |
-| **Content similarity** | Jaccard similarity of changed lines (added/removed) between gold and generated patches |
-
-### Running the SWE-bench eval
-
-```bash
-# 5-problem quick check
-python tests/eval_swe_bench.py --model claude-opus-4-20250514 --problems 5
-
-# Custom trigger/target
-python tests/eval_swe_bench.py --model gpt-4o --problems 20 \
-    --compression-trigger 15000 --compression-target 10000
-
-# With embedding scoring
-python tests/eval_swe_bench.py --model gpt-4o --problems 10 \
-    --embedding-model text-embedding-3-small
-```
-
-### Running the HumanEval-style eval
-
-```bash
-python scripts/eval_compression.py --model gpt-4o --problems 5
-```

docs/my-website/docs/contributing.md

@@ -29,7 +29,7 @@ general_settings:
 Start the proxy on port 4000:
 
 ```bash
-uv run litellm --config config.yaml --port 4000
+poetry run litellm --config config.yaml --port 4000
 ```
 
 The UI comes pre-built in the repo. Access it at `http://localhost:4000/ui`

docs/my-website/docs/default_code_snippet.md

@@ -16,7 +16,7 @@ If you want to use the non-hosted version, [go here](https://docs.litellm.ai/doc
 
 
 ```
-uv add litellm
+pip install litellm
 ```
 
 <QueryParamReader/>

docs/my-website/docs/extras/contributing_code.md

@@ -41,7 +41,7 @@ git clone https://github.com/BerriAI/litellm.git
 Step 2: Install dev dependencies
 
 ```shell
-uv sync --group dev --extra proxy
+poetry install --with dev --extras proxy
 ```
 
 ### 2. Adding tests

docs/my-website/docs/index.md

@@ -9,10 +9,6 @@ import TabItem from '@theme/TabItem';
 import NavigationCards from '@site/src/components/NavigationCards';
 import Image from '@theme/IdealImage';
 
-:::note Security Update
-The Trivy supply-chain compromise has been contained :tada: . All affected packages have been deleted and current releases are free of the compromised code/component. Please refer to our [Security Townhall](/blog/security-townhall-updates) for a deeper understanding of the problem, and [CI/CD v2](/blog/ci-cd-v2-improvements) for how we're improving moving forward.
-:::
-
 <Image style={{padding: '10px', margin: '0 0 2.5rem'}} img={require('../img/hero.png')} />
 
 **LiteLLM** is an open-source library that gives you a single, unified interface to call 100+ LLMs — OpenAI, Anthropic, Vertex AI, Bedrock, and more — using the OpenAI format.
@@ -30,13 +26,13 @@ The Trivy supply-chain compromise has been contained :tada: . All affected packa
 ## Installation
 
 ```shell
-uv add litellm
+pip install litellm
 ```
 
 To run the full Proxy Server (LLM Gateway):
 
 ```shell
-uv tool install 'litellm[proxy]'
+pip install 'litellm[proxy]'
 ```
 
 ---
@@ -340,7 +336,7 @@ The proxy is a self-hosted OpenAI-compatible gateway. Any client that works with
 #### Step 1 — Start the proxy
 
 <Tabs>
-<TabItem value="cli" label="LiteLLM CLI">
+<TabItem value="pip" label="pip">
 
 ```shell
 litellm --model huggingface/bigcode/starcoder

docs/my-website/docs/integrations/letta.md

@@ -16,7 +16,7 @@ Letta allows you to build LLM agents that can:
 ## Prerequisites
 
 ```bash
-uv add letta litellm
+pip install letta litellm
 ```
 
 ## Quick Start
@@ -910,7 +910,7 @@ for model in models:
 ```
 
 ### Common SDK Issues
-- **Import errors**: Ensure `uv add litellm letta` is run
+- **Import errors**: Ensure `pip install litellm letta` is run
 - **Model format**: Use `provider/model` format (e.g., `openai/gpt-4`)
 - **API key format**: Different providers have different key formats
 - **Rate limits**: Implement exponential backoff for retries

docs/my-website/docs/langchain/langchain.md

@@ -5,7 +5,7 @@ import TabItem from '@theme/TabItem';
 
 ## Pre-Requisites
 ```shell
-!uv add litellm langchain
+!pip install litellm langchain
 ```
 ## Quick Start