Commit graph

53121 commits

Author SHA1 Message Date
Yujong Lee
7282494c30 fix(python-bridge): propagate cancellation from semantic embedding awaits
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 23:04:44 +00:00
Yujong Lee
0c5bbf8c37 Merge branch 'main' into litellm_rust_cache_s3
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 23:04:42 +00:00
ryan-crabbe-berri
a0d1f0236e
Merge pull request #42122 from BerriAI/litellm_db_callback_redaction_settings
fix(proxy): apply DB-stored callback redaction settings before logger init
2026-09-21 16:03:44 -07:00
yujonglee
ced2980529
Merge pull request #42308 from BerriAI/litellm_rust_secrets_hashicorp_vault
feat(rust): add HashiCorp Vault secret manager crate
2026-09-21 16:03:33 -07:00
Yujong Lee
d38514dfc6 test(cache-redis-semantic): pin shared-index behavior across embedding dimensions
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 23:02:23 +00:00
mateo-berri
37f1670a1e Merge remote-tracking branch 'origin/main' into litellm_logging_worker_flush_loop_change 2026-09-21 16:02:04 -07:00
berriai-litellm-provider-info-sync[bot]
c371617786
chore(prices): sync OpenRouter prices: 4 models, 3 deprecated
openrouter/bytedance-seed/seed-1.6: deprecation_date
openrouter/bytedance-seed/seed-1.6-flash: deprecation_date
openrouter/bytedance-seed/seed-2.0-code: deprecation_date
openrouter/deepseek/deepseek-v4-pro: input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
2026-09-21 23:01:01 +00:00
yujonglee
bb9eb58815
Merge pull request #42325 from BerriAI/litellm_gcs_native_cache 2026-09-21 15:59:14 -07:00
mateo-berri
e86ba8bbeb test(logging_worker): cover a same-loop flush and a repeated flush after a loop change 2026-09-21 15:56:09 -07:00
Yujong Lee
eec133dc27 Merge origin/main into litellm_rust_qdrant_semantic_cache
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:56:07 +00:00
yucheng
652bddfdc6 refactor(guardrails): satisfy the type-discipline gate in the video handler
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:55:01 +00:00
Yuneng Jiang
143725fc06
Merge remote-tracking branch 'origin/main' into litellm_config_read_source 2026-09-21 15:54:52 -07:00
Tin Chi Lo
467d13ebac fix(cli): preserve newer installed status lines during setup 2026-09-21 15:54:41 -07:00
Yujong Lee
0116a502bc Merge remote-tracking branch 'origin/main' into litellm_native_redis_semantic_cache
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:53:48 +00:00
Yujong Lee
90f93f76f4 Merge origin/main into litellm_valkey_semantic_native_cache
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:53:27 +00:00
Yujong Lee
911e320b95 Merge remote-tracking branch 'origin/main' into litellm_rust_cache_s3
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

# Conflicts:
#	litellm-rust/Cargo.lock
#	litellm-rust/Cargo.toml
#	litellm-rust/crates/python-bridge/Cargo.toml
#	litellm-rust/crates/python-bridge/src/cache/config.rs
#	litellm-rust/crates/python-bridge/src/cache/facade.rs
#	litellm-rust/crates/python-bridge/src/cache/handle.rs
#	litellm-rust/crates/python-bridge/src/cache/native.rs
#	tests/test_litellm_rust/test_cache.py
2026-09-21 22:53:07 +00:00
kerry-berri
5fb66e8d98
Merge pull request #42353 from BerriAI/litellm_xai_max_completion_tokens
fix(xai): accept max_completion_tokens as a supported param
2026-09-21 15:53:05 -07:00
Yujong Lee
636a60d3bb chore(rust): update merged workspace lockfile
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:51:14 +00:00
Yujong Lee
4e2047e9c5 chore: merge main into litellm_gcs_native_cache
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:51:05 +00:00
Yujong Lee
bd3a680469 merge(main): integrate upstream cache dependencies
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:51:05 +00:00
Yuneng Jiang
a5cce1b859
fix(proxy): let the config file win over the stored row in ui settings 2026-09-21 15:49:09 -07:00
yuneng-jiang
1a4e2b1698
Merge pull request #42326 from BerriAI/litellm_/code-change-investigation-c46585
feat(docker): add a quickstart compose file served from the product repo
2026-09-21 15:47:48 -07:00
ryan-crabbe-berri
0efcb9956d
Merge pull request #42278 from BerriAI/litellm_cherry_pick_password_breach_reset
feat(auth): breached password detection, self-service change-password and forced password reset
2026-09-21 15:47:46 -07:00
yucheng
dfc5ef70b4 test(e2e): retry a leaked video job until the guardrail sync deadline
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:47:14 +00:00
yucheng
a44befa8c5 test: skip avideo_generation in azure sdk client exhaustive check
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:47:14 +00:00
yucheng
8ffca3bd19 chore(ui): regenerate api types for video call types
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:47:14 +00:00
yucheng
9ae2fe2ea4 fix(guardrails): scan video prompts for key-attached guardrails on /v1/videos
/v1/videos dispatches call_type avideo_generation, which CallTypes did not
know and no guardrail translation handler covered, so the unified guardrail
hook returned the request unscanned. Add the video call types and an OpenAI
video guardrail translation package that scans the prompt for create, remix,
edit and extension requests

Resolves LIT-6685

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:47:14 +00:00
Yujong Lee
ed8d4441a5 fix(python-bridge): harden Qdrant facade projection guards
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:44:47 +00:00
mateo-berri
212ab630b8 fix(logging_worker): make flush() survive an event loop change
flush() awaited join() on whatever queue the worker held, even one bound to
an event loop that has since closed. Its unfinished counter is never
decremented on the new loop, so the first flush() after a loop change hung
until pytest-timeout killed it and every later one raised "is bound to a
different event loop" from the queue's Event. The CircleCI unit job has
been red on every branch since the first tests that flush without
enqueueing landed, and an SDK script that flushes from a second
asyncio.run() hangs the same way.

flush() now goes through start() first, which carries the tasks stranded
on the previous loop onto the current one and guarantees a worker there to
drain them, the same loop-change handling every other entry point already
had.
2026-09-21 15:44:26 -07:00
yujonglee
403b4be40e
Merge pull request #42311 from BerriAI/litellm_native_disk_cache 2026-09-21 15:43:58 -07:00
kerry
fee8f38ccc Merge remote-tracking branch 'origin/main' into litellm_xai_max_completion_tokens 2026-09-21 22:42:12 +00:00
ryan-crabbe-berri
a776d0d722
Merge pull request #41561 from chopratejas/fix-responses-guardrail-custom-tool-output-writeback
fix(responses): patch custom_tool_call_output in place on guardrail write-back
2026-09-21 15:40:34 -07:00
kerry-berri
5c2c1766a4
Merge pull request #42349 from BerriAI/litellm-providers/price-sync-openrouter
chore(prices): sync OpenRouter prices: 3 models
2026-09-21 15:40:29 -07:00
yuneng-jiang
17f9f5c3e6
Merge pull request #42339 from BerriAI/litellm_stale_test_fix_budget_status_and_bad_db_url
test: fix stale budget-status and bad-database-url assertions
2026-09-21 15:38:55 -07:00
kerry
32c63e332e Revert "fix(xai): accept max_completion_tokens as a supported param"
This reverts commit 4ff251e6b1.
2026-09-21 22:38:29 +00:00
joshua-berri
3353c57e76
Merge pull request #42292 from BerriAI/litellm_extract_mcp_operation_context_7741
refactor(mcp): extract explicit operation context and dispatch
2026-09-21 22:38:07 +00:00
mateo-berri
51aa021c6e fix(mcp): return camelCase tool keys from /v1/mcp/tools after the SDK 2 upgrade
SDK 2 spells the Tool model's Python attributes in snake_case behind camelCase aliases, so dumping attribute names handed scripts input_schema and output_schema instead of the inputSchema and outputSchema v1.102.0 returned. Dump each tool by its MCP wire aliases, as the other list routes do, and pin the shape with a regression test. Also drop an unused tools dict in the Responses MCP stream iterator.
2026-09-21 15:38:06 -07:00
kerry
4ff251e6b1 fix(xai): accept max_completion_tokens as a supported param
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:37:40 +00:00
Yujong Lee
21d1604e64 fix(cache): honor controls and tenant metadata in valkey semantic bridge
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:33:11 +00:00
yassin
82eef2fcca fix(proxy): scope agent permissions to invoking caller
An agent key that echoes the x-litellm-user-id / x-litellm-team-id headers
forwarded by /a2a is capped at that user's and team's models, MCP servers
and agents, on top of its own grants and access group ceiling. The echoed
ids only narrow, and nested A2A hops forward the original human caller

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:32:32 +00:00
berriai-litellm-provider-info-sync[bot]
cf7988a2df
chore(prices): sync OpenRouter prices: 3 models
openrouter/~z-ai/glm-flash-latest: max_tokens, max_output_tokens, input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/deepseek/deepseek-v4-pro: input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/z-ai/glm-5.3-flash: max_tokens, max_output_tokens, input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
2026-09-21 22:31:01 +00:00
Yujong Lee
2ab4b25588 fix(python-bridge): update cache test handle stubs for merged backends
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:30:29 +00:00
kerry
5c0589207c fix(xai): accept max_completion_tokens as a supported param
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:30:13 +00:00
ryan-crabbe-berri
dac88cc6d0 fix(auth): keep blanket wildcards and team-less jwts out of the passthrough grant
A team_allowed_routes entry that names no path segment, such as * or /*, is a blanket grant like a named route group, so it no longer opens auth=true passthroughs. The grant in the shared route check now also requires a team on the JWT token, because team_allowed_routes should not apply to a JWT that resolved no team
2026-09-21 15:28:25 -07:00
ryan
8a1c6e49fb feat(auth): only allow password-login dashboard sessions to call /user/password/change
Password login now stamps login_method=username_password into the UI session key
metadata, and change_password rejects any caller that is not a litellm-dashboard
key carrying that marker with 403 before the user row is read. SSO sessions and
user-associated virtual keys can no longer use the endpoint as a current_password
guessing oracle. The forced-reset session is still minted by the password login
path, so it keeps access to the endpoint

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:22:12 +00:00
Yujong Lee
1dfd54579b fix(python-bridge): keep the Azure Blob default TTL mismatch check
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:18:59 +00:00
Yujong Lee
02cc4da252 test(rust): keep s3 parity test edits scoped to the mock handler change
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:18:18 +00:00
Yujong Lee
ae32609b54 refactor(cache-qdrant-semantic): inject the shared LiteLLM HTTP client into the embedder
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:18:13 +00:00
Yujong Lee
a286106f4f fix(rust): isolate explicit s3 keys from env tokens and treat 403 misses
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:17:11 +00:00
Yujong Lee
2a3ae253d4 refactor(rust): fold disk arms into shared match patterns
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-21 22:14:22 +00:00