Commit graph

31808 commits

Author SHA1 Message Date
litellm-bot
dde3379475
[Infra] Harden branch: sync CI/CD files from main, remove attack surface
Automated supply-chain hardening:
- Sync .circleci/, .github/, build scripts from main
- Remove dead/dangerous files (security_scans.sh, .pre-commit-config.yaml, etc.)
- SHA256-verified NVM installs, pip --only-binary
2026-04-04 22:19:54 -07:00
yuneng-jiang
f49e4bf299 Merge pull request #21503 from BerriAI/litellm_sso_role_map
fix(sso): preserve SSO role regardless of role_mappings config
2026-02-19 16:36:12 -08:00
Ishaan Jaffer
a09d3e9162 _route_user_config_request fix 2026-02-07 12:30:58 -08:00
Ishaan Jaffer
272bd703a4 fix test 2026-02-07 12:25:40 -08:00
shin-bot-litellm
5fb7644d8e
fix(proxy): only create Router when models or search_tools exist (#20661)
Previously, PR #19818 (via #20205) removed the model_list check entirely,
causing Router to be created even with no models AND no search_tools.

This fix adds back a conditional check that creates the Router only when:
- There are models to route, OR
- There are search_tools configured

This preserves the PR #19818 goal (search-tools-only deployments) while
avoiding unnecessary Router creation when there's nothing to route.

Fixes test_add_and_delete_deployments[0-None]
2026-02-07 12:18:45 -08:00
Ishaan Jaffer
b6a75a1085 fix scans 2026-02-07 12:12:44 -08:00
Ishaan Jaffer
ef5579c636 bump v 2026-02-07 12:02:16 -08:00
Ishaan Jaff
14e2714162
Revert "perf: skip enterprise callback check when no dynamic disabling config…" (#20659)
This reverts commit ffc6af3f2f.
2026-02-07 11:52:07 -08:00
shin-bot-litellm
1477b4b46b
fix(tests): Add missing mocks for MCP IP filtering and updated APIs (#20652)
Fixes 15 failing tests in the MCP test suite:

1. **OAuth discoverable endpoints** (test_discoverable_endpoints.py):
   - Added autouse fixture to mock IPAddressUtils.get_mcp_client_ip
   - This bypasses IP-based access control which was blocking server lookup
   - Fixes: test_authorize_*, test_token_*, test_oauth_*, test_register_*

2. **A2A endpoints** (test_a2a_endpoints.py):
   - Fixed mock path for add_litellm_data_to_request
   - Was patching litellm_pre_call_utils but function is called from common_request_processing

3. **MCP guardrail handler** (test_mcp_guardrail_handler.py):
   - Updated tests to match new handler behavior
   - Handler now passes tools (not texts) to guardrail
   - Handler checks for mcp_tool_name (not messages array)

4. **MCP path-based segregation** (test_user_api_key_auth_mcp.py):
   - Added client_ip to get_auth_context unpacking (7 values now)
   - get_auth_context was updated to include client_ip

5. **MCP registry** (test_mcp_management_endpoints.py):
   - Added mock for get_filtered_registry (not just get_registry)
   - Registry endpoint uses get_filtered_registry for IP filtering

Co-authored-by: Shin <shin@openclaw.ai>
2026-02-07 11:30:49 -08:00
Ishaan Jaffer
ef66a6cb62 fix security scans 2026-02-07 11:15:02 -08:00
ryan-crabbe
ffc6af3f2f
perf: skip enterprise callback check when no dynamic disabling configured (#20449)
Add cheap .get() guards in should_run_callback() to short-circuit
the expensive EnterpriseCallbackControls.is_callback_disabled_dynamically()
call. When neither litellm_disabled_callbacks nor x-litellm-disable-callbacks
header is set (the common case), the enterprise function is never entered,
reducing should_run_callback from ~485ms to ~93-165ms across 54k calls.
2026-02-07 11:12:47 -08:00
yuneng-jiang
fe30e8a7d0
Merge pull request #20653 from BerriAI/litellm_deleted_table_soft_budget
[Infra] Deleted Teams Table soft_budget
2026-02-07 11:12:15 -08:00
yuneng-jiang
5f680faa48 adding build files 2026-02-07 11:07:45 -08:00
yuneng-jiang
300d962d4c bump: version 0.4.32 → 0.4.33 2026-02-07 11:07:20 -08:00
yuneng-jiang
d9ac3b38ee adding migration for deleted teams soft budget 2026-02-07 11:07:06 -08:00
yuneng-jiang
87a75900a1 adding soft_budget to deleted teams table 2026-02-07 11:05:42 -08:00
Harshit Jain
37aee120a0
fixes content blocked by bedrock (#20606) 2026-02-07 11:02:12 -08:00
ryan-crabbe
862f0de839
perf: guard debug f-string in update_environment_variables to avoid evaluation when disabled (#20360) 2026-02-07 10:54:07 -08:00
ryan-crabbe
14c2b5da91
perf: replace enum construction with frozenset lookup in _is_streaming_request (#20302)
CallTypes(call_type) was constructing an enum from string on every call,
taking ~4.6µs/call (69.6% of function time). Replace with a frozenset
membership test for ~0.8µs/call (8.3x faster).
2026-02-07 10:50:57 -08:00
ryan-crabbe
606b9be0f7
perf: guard debug log f-strings and remove redundant dict copy in hot path (#19961)
Guard verbose_logger.debug() f-strings with isEnabledFor(logging.DEBUG)
checks in the router and cost calculation hot paths. Python evaluates
f-string arguments before the logging framework checks the log level,
causing expensive formatting on every request even with debug logging
disabled.

Changes:
- Remove redundant litellm_params.copy() in _completion/_acompletion
- Guard 5 debug logs in router.py (+ remove 1 duplicate log)
- Guard 6 debug logs in cost_calculator.py and utils.py
  - get_model_info(): formatted 50+ field dict every call
  - _apply_cost_margin(): called list(dict.keys()) every request

Profiled improvement: completion_cost 769µs → 637µs/call (-17.2%)
2026-02-07 10:40:29 -08:00
ryan-crabbe
616350f058
perf: Optimize get_litellm_params with sparse kwargs extraction (#19884)
* perf: Optimize get_litellm_params with sparse kwargs extraction

- Add _OPTIONAL_KWARGS_KEYS frozenset for O(1) lookups
- Replace 28 unconditional kwargs.get() calls with sparse extraction
- Only add kwargs keys that are actually present in the dict
- Simplify _get_base_model_from_litellm_call_metadata by removing redundant None checks

This reduces get_litellm_params() time by ~31% (743ms → 509ms across 6000 calls)
and Logging.__init__ total time by ~24% (1.61s → 1.23s).

* test: add unit tests for get_litellm_params sparse kwargs extraction
2026-02-07 10:38:43 -08:00
ryan-crabbe
874bafbbb4
perf: add early-exit guards in completion_cost for unused features (#20020)
* perf: add early-exit guards in completion_cost for unused features

Skip function calls to get_cost_for_built_in_tools, _apply_cost_discount,
_apply_cost_margin, and _store_cost_breakdown_in_logging_obj when their
respective features are not configured. Reduces completion_cost() time
by ~20% (4.39s → 3.53s over 6K requests) for the common case where
built-in tools, discounts, margins, and logging object are not active.

* fix: always call get_cost_for_built_in_tools regardless of standard_built_in_tools_params

The function can detect web search usage from the usage object (e.g.
server_tool_use.web_search_requests, prompt_tokens_details.web_search_requests)
even when standard_built_in_tools_params is None, so guarding on it can
under-count cost for providers like Vertex AI and Anthropic.

Adds regression test for completion_cost with web search in usage but
no standard_built_in_tools_params.
2026-02-07 10:10:00 -08:00
Ishaan Jaffer
1780b1716f filter_server_ids_by_ip 2026-02-07 10:08:20 -08:00
shin-bot-litellm
df299d3193
fix(tests): Fix flaky container and scientific notation tests (#20650)
* fix(tests): Mock async_container_create_handler for async router test

The test was mocking container_create_handler (sync), but
router.acreate_container uses _is_async=True which calls
async_container_create_handler. This caused the test to hit
the real OpenAI API.

Fixed by using AsyncMock on async_container_create_handler.

* fix(tests): Use uuid for unique model name in scientific notation test

The test was using a static "unique" model name which could cause
conflicts when running tests in parallel (-n 16 in CI). Using uuid
ensures truly unique names to prevent test pollution.

---------

Co-authored-by: Shin <shin@openclaw.ai>
2026-02-07 09:57:08 -08:00
Ishaan Jaffer
5efbed3939 fix schema 2026-02-07 09:39:55 -08:00
Ishaan Jaffer
7dcbc8d5be add migration 2026-02-07 09:39:55 -08:00
ryan-crabbe
8c7051686b
perf: optimize get_standard_logging_metadata with set intersection (#19685)
* perf: Optimize get_standard_logging_metadata with set intersection

- Cache StandardLoggingMetadata.__annotations__.keys() as module-level frozenset
- Use set intersection to iterate only keys present in both metadata and supported keys
- Single lookup for user_api_key instead of 3 separate .get() calls

Results:
- get_standard_logging_metadata: 1.55s → 1.41s (9.2% faster)

* test: add unit tests for get_standard_logging_metadata non-string user_api_key handling
2026-02-07 09:35:03 -08:00
shin-bot-litellm
9eb71574d8
fix(tests): Fix sendgrid email tests to properly mock httpx client (#20628)
* fix(tests): Fix sendgrid email tests to properly mock httpx client

The tests were potentially hitting the real SendGrid API because the mock
was patching get_async_httpx_client() but the actual client could be cached
or the mock timing could be off.

Fix by directly replacing logger.async_httpx_client after instantiation,
which guarantees the mock is used regardless of caching or initialization
timing issues.

Changes:
- Replace mock_httpx_client fixture with simpler mock_async_client fixture
- Directly inject mock client into logger instance after creation
- Remove respx decorator (no longer needed with direct injection)
- Simplify test structure while maintaining same assertions

* fix(lint): remove unused imports from SendGrid test
2026-02-07 09:19:02 -08:00
ryan-crabbe
d77d525ce7
perf: add LRU cache to normalize_request_route (#19812)
Add @lru_cache(maxsize=256) to eliminate redundant regex work for
repeated routes. Reduces time from 1.04s to ~0s for 6,006 calls.
2026-02-07 09:18:57 -08:00
shin-bot-litellm
02a33ab998
fix(lint): extract helper function to reduce statement count in call_tool_rest_api (#20629)
Extract the allowed MCP servers resolution logic with IP filtering into
a dedicated helper function _resolve_allowed_mcp_servers_with_ip_filter.

This reduces the statement count in call_tool_rest_api from 51 to under
50, fixing the ruff PLR0915 (too many statements) lint error.

Co-authored-by: Shin <shin@openclaw.ai>
2026-02-07 09:18:38 -08:00
yuneng-jiang
94b609277c
Merge pull request #20648 from BerriAI/ui_build_yj_feb7
[Infra] UI Build for Release
2026-02-07 09:13:20 -08:00
yuneng-jiang
58cd53b600 chore: update Next.js build artifacts (2026-02-07 17:06 UTC, node v22.16.0) 2026-02-07 09:06:33 -08:00
Sameer Kankute
f5ed7826a4
Merge pull request #20637 from BerriAI/litellm_blog_claude_4_6
Update opus 4.6 blog with adaptive thinking
2026-02-07 13:09:56 +05:30
Sameer Kankute
8741512183 Update opus 4.6 blog with adaptive thinking 2026-02-07 13:07:20 +05:30
yuneng-jiang
a427a2b89e
Merge pull request #20634 from BerriAI/litellm_ui_team_budget_settings
[Feature] UI - Team Settings: Soft Budget + Alerting Emails
2026-02-06 21:44:21 -08:00
yuneng-jiang
8ae1fe32c4 fixing test 2026-02-06 20:47:43 -08:00
yuneng-jiang
e968e3798c team settings soft budget and alerting emails 2026-02-06 20:40:52 -08:00
Ishaan Jaffer
51af66fdb2 ui new buil 2026-02-06 19:15:29 -08:00
shin-bot-litellm
537f7af583
fix(test): update deprecated gemini embedding model (#20621)
Replace text-embedding-004 with gemini-embedding-001.

The old model was deprecated and returns 404:
'models/text-embedding-004 is not found for API version v1beta'

Co-authored-by: Shin <shin@openclaw.ai>
2026-02-06 18:35:40 -08:00
shin-bot-litellm
54618c5511
fix(mypy): resolve type checking errors in 5 files (#20627)
- a2a_protocol/exception_mapping_utils.py: Fix type ignore comment for None assignment
- caching/redis_cache.py: Add type ignore for async ping return type
- caching/redis_cluster_cache.py: Add type ignore for async ping return type
- llms/deprecated_providers/palm.py: Add type ignore for palm.generate_text
- proxy/auth/handle_jwt.py: Add type ignore for jwt.decode options argument

All changes add appropriate type: ignore comments to handle library typing inconsistencies.
2026-02-06 18:34:55 -08:00
Ishaan Jaffer
36be0044dc docs 2026-02-06 18:30:17 -08:00
Ishaan Jaff
1b24a0fdd7
docs (#20626) 2026-02-06 18:24:21 -08:00
yuneng-jiang
271877ffb5
Merge pull request #20623 from BerriAI/litellm_user_id_fix
[Fix] /key/list user_id Empty String Edge Case
2026-02-06 18:06:59 -08:00
Alexsander Hamir
0d7465694d
Add OpenAI/Azure release test suite with HTTP client lifecycle regression detection (#20622) 2026-02-06 18:03:05 -08:00
Ishaan Jaff
9b1ccc0608
[Feat] IP-Based Access Control for MCP Servers (#20620)
* update MCPAuthenticatedUser

* add available_on_public_internet for MCPs

* update claude.md

* init IPAddressUtils

* init available_on_public_internet

* add on REST endpoints

* filter with IP

* TestIsInternalIp

* _extract_mcp_headers_from_request

* init get_mcp_client_ip

* _get_general_settings

* allowed_server_ids

* address PR comments

* get_mcp_server_by_name fix

* fix server

* fix review comments

* get_public_mcp_servers

* address _get_allowed_mcp_servers

* test fix

* fix linting

* inint ui types

* add ui for managing MCP private/public

* add ui

* fixes

* add to schema

* add types

* fix endpoint

* add endpoint

* update manager

* test mcp

* dont use external party for ip address
2026-02-06 17:58:24 -08:00
yuneng-jiang
4d1b5d80ae fixing user_id 2026-02-06 17:55:45 -08:00
Ishaan Jaff
81146472cb
[Feat] MCP Gateway - Allow setting MCP Servers as Private/Public available on Internet (#20607)
* update MCPAuthenticatedUser

* add available_on_public_internet for MCPs

* update claude.md

* init IPAddressUtils

* init available_on_public_internet

* add on REST endpoints

* filter with IP

* TestIsInternalIp

* _extract_mcp_headers_from_request

* init get_mcp_client_ip

* _get_general_settings

* allowed_server_ids

* address PR comments

* get_mcp_server_by_name fix

* fix server

* fix review comments

* get_public_mcp_servers

* address _get_allowed_mcp_servers
2026-02-06 17:51:20 -08:00
shin-bot-litellm
29990c88ba
fix(mypy): resolve missing return statements and type casting issues (#20618)
* fix(mypy): resolve missing return statements and type casting issues

* fix(pangea): use elif to prevent UnboundLocalError and handle None messages

Address Greptile review feedback:
- Make branches mutually exclusive using elif to prevent input_messages from being overwritten
- Handle case where data.get('messages') returns None to avoid passing invalid payload to Pangea API

---------

Co-authored-by: Shin <shin@openclaw.ai>
2026-02-06 17:49:35 -08:00
Krish Dholakia
ba74e6d9d2
Add http support to custom code guardrails + Unified guardrails for MCP + Agent guardrail support (#20619)
* fix: fix styling

* fix(custom_code_guardrail.py): add http support for custom code guardrails

allows users to call external guardrails on litellm with minimal code changes (no custom handlers)

Test guardrail integrations more easily

* feat(a2a/): add guardrails for agent interactions

allows the same guardrails for llm's to be applied to agents as well

* fix(a2a/): support passing guardrails to a2a from the UI

* style(code-editor): allow editing custom code guardrails on ui + add examples of pre/post calls for custom code guardrails

* feat(mcp/): support custom code guardrails for mcp calls

allows custom code guardrails to work on mcp input

* feat(chatui.tsx): support guardrails on mcp tool calls on playground
2026-02-06 17:34:32 -08:00
Simon Sadedin
0a55571f75
[Feat] add au version of claude-opus-4-6 to model cost map (#20566)
Notes: General support for Opus 4.6 was added in #20506 however
it omitted the AU (australian) specific instance profile used
in Bedrock. This change only adds the the au id. It is copied
from the US model settings which is consistent with past
additions of this regional model profile.
2026-02-06 16:06:33 -08:00