scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-16 23:41:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 103
40072 commits 2457 branches 1410 tags 2.9 GiB
Commit graph

40072 commits

This branch
This branch
All branches
Author SHA1 Message Date
michelligabriele
05a89b2c92
fix(ui): remove insecure ?token= URL handler from LoginPage to close session-fixation 2026-04-30 23:39:03 +02:00
user
719e891c3a coalesce malformed window reservation seeding 2026-04-30 14:38:37 -07:00
user
bb6d7c9715 fix(callbacks): preserve langfuse secret alias 2026-04-30 14:36:51 -07:00
user
258edac727 test(callbacks): cover upstream langfuse debug env 2026-04-30 14:34:39 -07:00
user
d19f342af7 chore(callbacks): satisfy langfuse type check 2026-04-30 14:32:41 -07:00
mateo-berri
46ba48e69a
fix(router): apply decoded provider for managed container IDs without model_id
Some checks failed
Unit Tests: Proxy DB Operations / assert-shard-coverage (push) Has been cancelled
Details
Unit Tests: Security / security (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / auth-checks (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / proxy-utils (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / budgets (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / custom-logging (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / db-and-spend (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / endpoints-and-responses (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / guardrails-hooks (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / jwt-and-keys (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / key-generation (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / logging-misc (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / proxy-runtime (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / proxy-server-core (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / schema-migration (push) Has been cancelled
Details 
A managed cntr_ ID can encode a non-OpenAI provider (e.g. azure) with an
empty model_id when streaming events have no router model_info.id. The
provider override was nested inside 'if model_id:', so such IDs unwrapped
the container_id but kept custom_llm_provider='openai', routing the
request to the wrong upstream. Hoist the override out of the model_id
guard.
 2026-04-30 21:29:38 +00:00
user
15d4d51453 chore(callbacks): guard dynamic integration hosts 2026-04-30 14:27:19 -07:00
user
5521af096e preserve database failure during reservation cleanup 2026-04-30 14:23:57 -07:00
user
0b71282985 address budget reservation review findings 2026-04-30 14:06:42 -07:00
user
87849b74b9 test(gemini): cover decoded delete file names 2026-04-30 14:03:54 -07:00
user
08705d2b3c stabilize lazy openapi snapshot 2026-04-30 13:58:43 -07:00
user
46183e6dc9 Merge remote-tracking branch 'origin/litellm_internal_staging' into codex/budget-race-enforcement-snapshot 2026-04-30 13:56:16 -07:00
user
19f8c1013b fix(gemini): validate fully decoded file names 2026-04-30 13:50:15 -07:00
user
0794ae67be avoid direct budget reservation db lookups 2026-04-30 13:49:59 -07:00
yuneng-jiang
256e05e474
Merge pull request #26849 from stuxf/fix/mcp-oauth-discovery-ssrf 
chore(mcp): SSRF guard on OAuth metadata discovery follow-up fetches
 2026-04-30 13:44:16 -07:00
yuneng-jiang
174c770b07
Merge pull request #26836 from stuxf/fix/byok-credential-encryption 
chore(mcp): encrypt user-scoped MCP credentials at rest
 2026-04-30 13:42:57 -07:00
user
6ca6220679 chore(proxy): split lazy openapi multi-method routes 2026-04-30 13:41:38 -07:00
user
ca50868b75 harden end-user and tag budget reservations 2026-04-30 13:37:10 -07:00
mateo-berri
33a051636d
tests(llm_translation): add Redis cassette persister with 24h TTL 
Stores VCR cassettes in Redis under litellm:vcr:cassette:<rel_path> with
a 24h expiry instead of YAML on disk. The TTL means each daily CI run
starts with an aged-out cache, naturally re-records against live providers,
and surfaces upstream API drift within a day without a manual `make`
re-record sweep. Opt-in via LITELLM_VCR_REDIS=1; default behaviour is
unchanged so local dev keeps the on-disk cassettes.

before_record_response now drops non-2xx responses so a transient 5xx or
429 from a provider can't poison the cache for the rest of the TTL window.
Vcr-marked tests bump litellm.num_retries to 3 during recording so
provider-SDK exponential backoff kicks in on the cache-miss path.

Tests cover the three surfaces we depend on in CI: serialize/deserialize
roundtrip via the real vcrpy serializer, TTL is actually applied to saved
keys, cache miss raises CassetteNotFoundError so vcrpy falls through to
record mode, and 2xx-only filtering across the status-code matrix
(2xx kept, 3xx/4xx/5xx dropped, with 429 and 503 explicitly pinned).
 2026-04-30 20:28:11 +00:00
user
eca1f252e2 chore(proxy): stabilize lazy openapi snapshot ids 2026-04-30 13:27:29 -07:00
user
fd409f84b1 chore(proxy): refresh lazy openapi snapshot 2026-04-30 13:24:06 -07:00
user
e1f39674f3 Merge remote-tracking branch 'origin/litellm_internal_staging' into codex/provider-url-destination-guard 2026-04-30 13:20:44 -07:00
user
ec07fbbb4b chore(providers): keep URL model guard config-only 2026-04-30 13:20:41 -07:00
user
d75f62a17c chore(providers): add guarded URL model migration path 2026-04-30 13:17:09 -07:00
yuneng-jiang
4ff8f0e901
Merge pull request #26851 from stuxf/codex/fix-callback-env-secret-resolution 
chore(proxy): block env callback refs in key metadata
 2026-04-30 13:11:32 -07:00
yuneng-jiang
aa76ab2df7
Merge pull request #26862 from stuxf/codex/control-field-sanitization 
chore(proxy): harden request control fields
 2026-04-30 13:10:58 -07:00
Michael-RZ-Berri
9637d8c17b
Merge pull request #26802 from BerriAI/litellm_lazyLoadedFrontPage 
[Feat / Fix] Lazy loaded imports, lazy loaded front page
 2026-04-30 13:04:42 -07:00
user
5ec925b02b chore(providers): guard URL-valued model destinations 2026-04-30 13:03:56 -07:00
yuneng-jiang
08541f49ee
Merge pull request #26910 from BerriAI/litellm_fix/drop-milvus-db-params 
fix: drop milvus dbName and partitionNames from MILVUS_OPTIONAL_PARAMS
 2026-04-30 12:53:18 -07:00
Yassin Kortam
d84b35cc40
Merge pull request #26906 from BerriAI/litellm_fix/validate-aws-region 
fix: validate aws region name
 2026-04-30 12:52:31 -07:00
user
51a3e90451 fix(mcp): reuse safe URL fetch for OAuth discovery 2026-04-30 12:42:52 -07:00
Cursor Agent
8111dbe2b1
Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_oss_staging_04_25_2026
Some checks failed
Unit Tests: Caching (Redis) / caching-redis (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / assert-shard-coverage (push) Has been cancelled
Details
Unit Tests: Security / security (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / proxy-utils (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / auth-checks (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / budgets (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / custom-logging (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / db-and-spend (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / endpoints-and-responses (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / guardrails-hooks (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / jwt-and-keys (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / key-generation (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / logging-misc (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / proxy-runtime (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / proxy-server-core (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / schema-migration (push) Has been cancelled
Details 
# Conflicts:
#	litellm/model_prices_and_context_window_backup.json
#	model_prices_and_context_window.json

Co-authored-by: Mateo Wang <mateo-berri@users.noreply.github.com>
 2026-04-30 19:37:57 +00:00
user
35bbca60b0 chore(proxy): default sensitive routes to auth 2026-04-30 12:22:48 -07:00
mateo-berri
860843953d
fix(vertex_ai): default missing items on array schemas
Some checks failed
Unit Tests: Proxy DB Operations / proxy-db (auth-checks, tests/proxy_unit_tests/test_auth_checks.py tests/proxy_unit_tests/test_user_api_key_auth.py, 20, 8) (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / proxy-db (key-generation, tests/proxy_unit_tests/test_key_generate_prisma.py, 30, 0) (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / proxy-db (proxy-utils, tests/proxy_unit_tests/test_proxy_utils.py, 20, 8) (push) Has been cancelled
Details
Unit Tests: Proxy DB Operations / proxy-db (remaining, tests/proxy_unit_tests --ignore=tests/proxy_unit_tests/test_key_generate_prisma.py --ignore=tests/proxy_unit_tests/test_auth_checks.py --ignore=tests/proxy_unit_tests/test_user_api_key_auth.py --ignore=tests/proxy_unit_tests/test_p… (push) Has been cancelled
Details
Unit Tests: Security / security (push) Has been cancelled
Details 
Vertex rejects array schemas without an items field
(GenerateContentRequest.tools[*].function_declarations[*].parameters...items: missing field).
This happened for tool params containing anyOf branches like {"type": "array"}
with no items, including the case where convert_anyof_null_to_nullable
strips an empty items entry. Default missing items to {"type": "object"}
in process_items so the same default applies to bare arrays and
arrays nested inside anyOf.
 2026-04-30 19:16:12 +00:00
harish-berri
4dc950a242 fix linting 2026-04-30 19:11:29 +00:00
user
b31182f62a chore(proxy): preserve readiness compatibility 2026-04-30 12:05:09 -07:00
harish-berri
54f762eeeb remove unrelated debugger tooling 2026-04-30 19:05:04 +00:00
harish-berri
8df24b5413
Merge branch 'litellm_internal_staging' into litellm_token_verification_query_opt 2026-04-30 12:04:08 -07:00
Claude
3e73381449
fix(router): always unwrap managed container_id even when model_id is empty 
Managed cntr_... IDs can be encoded with an empty model_id (e.g. streaming
responses without router metadata, or target_model_names=[]). The previous
guard only unwrapped when model_id was truthy, so the raw cntr_... token
leaked to the upstream provider, which rejects it.

Always swap in decoded["response_id"] when it differs from the input, and
keep the model_id check only for deciding whether to fan out via
_ageneric_api_call_with_fallbacks.
 2026-04-30 18:59:33 +00:00
yuneng-jiang
3c060364fb
Merge pull request #26840 from stuxf/codex/mcp-oauth-root-visibility 
chore(mcp): tighten OAuth root endpoint resolution
 2026-04-30 11:59:03 -07:00
yuneng-jiang
a9db887bdd
Merge pull request #26843 from stuxf/codex/fix-onboarding-invite-token 
chore(auth): harden invite-link onboarding token flow
 2026-04-30 11:56:26 -07:00
user
c8325ff007 chore(proxy): guard sensitive public endpoints 2026-04-30 11:52:47 -07:00
Yassin Kortam
dfc080f580 fix: drop milvus dbName and partitionNames from MILVUS_OPTIONAL_PARAMS 2026-04-30 11:51:32 -07:00
yuneng-jiang
0efa8b8828
Merge pull request #26854 from stuxf/fix/team-authz-available-team-bypass 
chore(team): close authz bypass via the available-team check
 2026-04-30 11:47:19 -07:00
user
b67a81da47 test(proxy): align favicon remote asset expectations 2026-04-30 11:46:45 -07:00
yuneng-jiang
d51d96f405
Merge pull request #26859 from stuxf/chore/audit-log-team-callback-mutations 
chore(team): audit-log team-callback admin mutations
 2026-04-30 11:46:31 -07:00
Cursor Agent
21c7864d75
Fix Vertex label metadata fallback 2026-04-30 18:44:03 +00:00
harish-berri
1b9b918399 Merge branch 'litellm_internal_staging' of https://github.com/BerriAI/litellm into litellm_pyroscope_tag_wrapper 2026-04-30 18:37:09 +00:00
Yassin Kortam
d47948ab23 fix: validate aws region name 2026-04-30 11:35:30 -07:00
user
b8a141cefd fix(static-assets): stop serving stale logo cache 2026-04-30 11:34:25 -07:00