Commit graph

49414 commits

Author SHA1 Message Date
dependabot[bot]
102dacdf17
chore(deps): bump the github-actions group across 1 directory with 19 updates
Some checks failed
LiteLLM Rust / rust-lint (push) Has been cancelled
LiteLLM Rust / rust-test (push) Has been cancelled
ai-gateway image / ai-gateway release image (push) Has been cancelled
Terraform Provider / gofmt, vet, build, test (push) Has been cancelled
Terraform Provider / Provider endpoints vs proxy OpenAPI schema (push) Has been cancelled
Bumps the github-actions group with 19 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `7.0.1` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `7.0.0` |
| [actions/cache](https://github.com/actions/cache) | `4.3.0` | `6.1.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.1` | `7.0.1` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4.2.1` | `8.0.1` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.4` | `7.0.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `5.0.0` | `7.0.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `3.34.1` | `4.38.0` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `3.34.1` | `4.38.0` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `3.34.1` | `4.38.0` |
| [CodSpeedHQ/action](https://github.com/codspeedhq/action) | `4.12.1` | `5.2.1` |
| [actions/github-script](https://github.com/actions/github-script) | `7.0.1` | `9.0.0` |
| [azure/setup-helm](https://github.com/azure/setup-helm) | `4.3.1` | `5.0.1` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.1` | `2.4.4` |
| [actions/stale](https://github.com/actions/stale) | `8.0.0` | `11.0.0` |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | `6.2.0` | `6.2.4` |
| [hashicorp/setup-terraform](https://github.com/hashicorp/setup-terraform) | `3.1.2` | `4.0.1` |
| [actions/setup-go](https://github.com/actions/setup-go) | `6.2.0` | `7.0.0` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.6` | `0.6.4` |



Updates `actions/checkout` from 4.2.2 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4.2.2...3d3c42e5aac5ba805825da76410c181273ba90b1)

Updates `actions/setup-python` from 5.6.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](a26af69be9...5fda3b95a4)

Updates `actions/cache` from 4.3.0 to 6.1.0
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](0057852bfa...55cc834586)

Updates `actions/upload-artifact` from 4.6.1 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](4cec3d8aa0...043fb46d1a)

Updates `actions/download-artifact` from 4.2.1 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](95815c38cf...3e5f45b2cf)

Updates `codecov/codecov-action` from 5.5.4 to 7.0.0
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](75cd11691c...fb8b3582c8)

Updates `actions/setup-node` from 5.0.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](a0853c2454...8207627860)

Updates `github/codeql-action/init` from 3.34.1 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](ebcb5b36de...b96794f015)

Updates `github/codeql-action/analyze` from 3.34.1 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](ebcb5b36de...b96794f015)

Updates `github/codeql-action/upload-sarif` from 3.34.1 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v3.34.1...b96794f015dfd88f77b49b1c93e0fa7110f94c63)

Updates `CodSpeedHQ/action` from 4.12.1 to 5.2.1
- [Release notes](https://github.com/codspeedhq/action/releases)
- [Changelog](https://github.com/CodSpeedHQ/action/blob/main/CHANGELOG.md)
- [Commits](1c8ae48435...373d686892)

Updates `actions/github-script` from 7.0.1 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7.0.1...3a2844b7e9c422d3c10d287c895573f7108da1b3)

Updates `azure/setup-helm` from 4.3.1 to 5.0.1
- [Release notes](https://github.com/azure/setup-helm/releases)
- [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md)
- [Commits](1a275c3b69...9bc31f4ebc)

Updates `ossf/scorecard-action` from 2.4.1 to 2.4.4
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](f49aabe0b5...2d1146689b)

Updates `actions/stale` from 8.0.0 to 11.0.0
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](1160a22402...4391f3da66)

Updates `aws-actions/configure-aws-credentials` from 6.2.0 to 6.2.4
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](e7f100cf4c...cbe3b39273)

Updates `hashicorp/setup-terraform` from 3.1.2 to 4.0.1
- [Release notes](https://github.com/hashicorp/setup-terraform/releases)
- [Changelog](https://github.com/hashicorp/setup-terraform/blob/main/CHANGELOG.md)
- [Commits](b9cd54a3c3...dfe3c3f878)

Updates `actions/setup-go` from 6.2.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](7a3fe6cf4c...b7ad1dad31)

Updates `zizmorcore/zizmor-action` from 0.5.6 to 0.6.4
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](5f14fd08f7...cc914d7f37)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/stale
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: azure/setup-helm
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: CodSpeedHQ/action
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: hashicorp/setup-terraform
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-09-15 22:19:05 +00:00
Yassin Kortam
226b1e1bb9
Merge pull request #41288 from BerriAI/litellm_langsmith_preserve_events_during_flush
fix(langsmith): keep events appended during an in-flight flush instead of clearing them
2026-09-15 15:06:36 -07:00
Yassin Kortam
e36626174b
Merge pull request #41297 from BerriAI/litellm_return_400_on_lone_surrogate_input
fix(proxy): return 400 instead of 500 for lone surrogate escapes in request body
2026-09-15 15:04:08 -07:00
Yassin Kortam
579a30de83
Merge pull request #41300 from BerriAI/litellm_lit_1742_custom_provider_map_router
fix(router): accept custom_provider_map providers before the first completion call
2026-09-15 15:03:42 -07:00
Yassin Kortam
ee51be4db2
Merge pull request #41289 from BerriAI/litellm_fix_clientside_credential_deployment_scope
fix(router): stop registering a caller-supplied credential as a router deployment
2026-09-15 15:00:50 -07:00
Yassin Kortam
1b8daf20e0
Merge pull request #38268 from BerriAI/litellm_fix_xai_web_search_nested_filters
fix(xai): honor nested web_search filters on the xAI Responses API
2026-09-15 14:56:36 -07:00
Yassin Kortam
fa09de9e45
Merge pull request #41279 from BerriAI/litellm_reset_budget_decrement_spend
fix(proxy): reset budgets by decrementing pre-reset spend instead of zeroing rows
2026-09-15 14:45:03 -07:00
Yassin Kortam
c1e1d62903
Merge pull request #41291 from BerriAI/litellm_lit1643_auth_failure_user_agent
fix(proxy): keep client User-Agent on auth failure spend logs
2026-09-15 14:44:32 -07:00
yassin
0cc6968495 fix(router): accept custom_provider_map providers before the first completion call
get_llm_provider() and Router._add_deployment() only knew the built-in
provider_list and JSON providers, so a provider registered through
litellm.custom_provider_map was rejected until custom_llm_setup() had
run inside the first completion() call. Both now check the map directly.

Resolves LIT-1742

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 21:43:47 +00:00
tin-berri
ce1a4f896a
Merge pull request #41272 from BerriAI/litellm_fuse_v2_classifier_pr
feat(router): add Fuse V2 classifier after capability forecasting
2026-09-15 14:43:44 -07:00
yassin
e62ff9ebee fix(proxy): return 400 instead of 500 for lone surrogate escapes in request body
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 21:40:53 +00:00
Yassin Kortam
140229bc4a
Merge pull request #41230 from BerriAI/litellm_client_timeout_408_skips_cooldown
fix(router): stop counting caller-set timeout 408s toward deployment cooldown
2026-09-15 14:31:11 -07:00
yassin
afb6f8be65 fix(xai): treat an explicit empty web_search filters object as unrestricted
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 21:24:32 +00:00
Yassin Kortam
a6127d2363
Merge pull request #35180 from BerriAI/litellm_lit4995_vertex_rerank_search_units
fix(rerank): bill Vertex search_units from input records and give every rerank response a unique id
2026-09-15 14:23:23 -07:00
Yassin Kortam
5df127d483 fix(router): stop registering a caller-supplied credential as a router deployment
_handle_clientside_credential registered the per-request Deployment it built for
a client-supplied api_key/api_base via upsert_deployment, which added it to
self.model_list under the shared model_name. That made a request-scoped
credential a permanent, load-balanced deployment that any later caller of the
same model group could be routed onto, reaching the provider with someone
else's forwarded credential.

The per-request Deployment still gets its own stable id for cooldown and
logging identity; it is just never registered with the router.

Resolves LIT-7811
2026-09-15 14:18:03 -07:00
mrinal
4c179f2f59 test(langsmith): type the flush race test and cancel its periodic task
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 21:17:36 +00:00
Yassin Kortam
d35af8d302
Merge pull request #38682 from BerriAI/devin_ai_1787937848_tf_team_member_fields
feat(terraform): add tpm_limit, rpm_limit, budget_duration, allowed_models to litellm_team_member_add
2026-09-15 14:12:25 -07:00
yassin
595bec46ff fix(router): time fallback-hop 408s against now, not the previous hop's end_time
The failure logger skips fallback hops (has_logged_async_failure is already set), so
model_call_details.end_time still belongs to the previous hop and predates this hop's
api_call_start_time. The fallback cooldown guard measured a negative elapsed time and
cooled down deployments for caller-set timeouts.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 21:11:40 +00:00
yassin
2f719fec52 test(router): run the fallback provider-408 cooldown regression inside an event loop
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 21:11:40 +00:00
yassin
5da497f4ac fix(router): only exempt 408s that arrive after the caller's timeout from cooldown
client_side_timeout records that the caller configured a timeout, not that
the timeout fired. A 408 the provider returns before that deadline is a
deployment failure and must still count toward cooldown.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 21:11:40 +00:00
mateo-berri
a9c422735f fix(router): stop counting caller-set timeout 408s toward deployment cooldown
A 408 produced by a timeout the caller set (a timeout body field or an
x-litellm-timeout header, which the proxy marks as client_side_timeout)
says nothing about the deployment's health, yet the router's primary
failure callback counted it toward allowed_fails and cooled the
deployment down. The fallback path already skipped it.

The marker never reached that callback because get_litellm_params drops
kwargs outside OPTIONAL_KWARGS_KEYS, so it is listed there now, and
deployment_callback_on_failure returns before the failure counter when
is_caller_timeout_408 holds. A 408 from a timeout the deployment or the
provider set still counts and still cools the deployment down.
2026-09-15 21:02:15 +00:00
yassin
0746cdbf2c refactor(terraform): drop explanatory comments from team_member_add
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 21:02:12 +00:00
yassin
5645e17b4f feat(terraform): add tpm_limit, rpm_limit, budget_duration, allowed_models to litellm_team_member_add
budget_duration and allowed_models ride on /team/member_add. tpm_limit and rpm_limit are sent through /team/member_update, the only endpoint that accepts them. Removing any of the four from config sends an explicit clear (null, or an empty list for allowed_models) since member_update is a merge-patch. The resource ID is set before the post-add limits call so a failure there taints the resource instead of orphaning the memberships

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 21:02:12 +00:00
Devin AI
d415c2856f style: ruff format
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 21:02:10 +00:00
Devin AI
3cb5ceb98c fix(xai): honor nested web_search filters on the xAI Responses API
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 21:02:10 +00:00
yassin
fad11fa66e fix(proxy): keep client User-Agent on auth failure spend logs
Auth gate rejections are raised before add_litellm_data_to_request stamps the caller User-Agent and SpendLogsMetadata dropped the field, so failure spend logs and prometheus labels could not identify an abusive client. Stamp requester_ip_address and user_agent on the failure hook payload and carry user_agent through spend log metadata. Request scopes without a headers entry are tolerated.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 21:02:06 +00:00
Yassin Kortam
79d4d4d8f5
Merge pull request #38278 from BerriAI/litellm_fix_xai_chat_web_search_live_search
fix(xai): stop sending web_search_options to xAI's retired Live Search path
2026-09-15 14:01:13 -07:00
Yassin Kortam
1debb438f5
Merge pull request #40310 from BerriAI/litellm_lit7223_reconcile_before_db
fix(proxy): reconcile budget reservation before enqueuing spend to the DB
2026-09-15 13:57:55 -07:00
yassin
113e43b87a Merge remote-tracking branch 'origin/main' into litellm_fix_xai_chat_web_search_live_search 2026-09-15 20:46:51 +00:00
yassin
4ba136946c Merge remote-tracking branch 'origin/main' into litellm_lit7223_reconcile_before_db 2026-09-15 20:46:14 +00:00
yassin
5e0629793e chore(xai): drop explanatory comment from responses bridge check
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 20:43:59 +00:00
Yassin Kortam
e6af62aaac
Merge pull request #40997 from BerriAI/litellm_batch_tpd_limit
feat(proxy): add tpd_limit (tokens per day) for batch submissions
2026-09-15 13:39:45 -07:00
Yassin Kortam
5199f4fca2
Merge pull request #40191 from BerriAI/litellm_fix_streaming_guardrail_block_logging
fix(proxy): log blocked streaming guardrail responses as failures, not success
2026-09-15 13:39:23 -07:00
mrinal
4a8986dd72 fix(langsmith): keep events appended during an in-flight flush instead of clearing them
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 20:38:35 +00:00
Yassin Kortam
cdb4eaac59
Merge pull request #40262 from BerriAI/litellm_lit_7190_inline_token_counts
fix(proxy): run the remaining inline token counts off the event loop
2026-09-15 13:38:00 -07:00
yassin
95cc3bfabb Merge remote-tracking branch 'origin/main' into litellm_fix_xai_chat_web_search_live_search 2026-09-15 20:27:48 +00:00
yassin
46bd3d40d7 refactor(logging): bill an assembled stream on the failure log via a public Logging method
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 20:23:50 +00:00
kerry-berri
7d3917dbf4
Merge pull request #41269 from BerriAI/litellm_ban_vendor_fact_pinning_tests
test: drop tests that pin vendor facts and add the CLAUDE.md rule
2026-09-15 13:16:55 -07:00
Yassin Kortam
367393405c
Merge pull request #41170 from BerriAI/litellm_prometheus_401_failed_requests_metric
fix(prometheus): count 401 auth failures in litellm_proxy_failed_requests_metric
2026-09-15 13:13:49 -07:00
Yassin Kortam
0e5be275b0
Merge pull request #41283 from BerriAI/litellm_writer_pinned_raw_sql_writes
fix(proxy): keep access-group raw SQL writes on the writer while writer_unavailable is stale
2026-09-15 13:13:30 -07:00
Tin Chi Lo
9352d24863 fix(router): accept fenced Fuse classifier verdicts 2026-09-15 13:11:56 -07:00
Tin Chi Lo
56b20525f5 fix(router): honor Fuse task context and fallback policy 2026-09-15 13:11:56 -07:00
Tin Chi Lo
92bece2baa fix(router): expose exact Fuse v2 forecast metadata 2026-09-15 13:11:56 -07:00
Tin Chi Lo
909a7cd515 fix(schema): regenerate Fuse snapshot with CI Python 2026-09-15 13:11:55 -07:00
Tin Chi Lo
902b2e7ef8 feat(router): add experimental joint LLM V2 classifier 2026-09-15 13:11:55 -07:00
yassin
7095373dd5 fix(proxy): only discard parked stream logging for errors the failure path logs
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 20:10:19 +00:00
jesus
ec799686a4 style(proxy): ruff format utils.py
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 20:10:19 +00:00
jesus
0949f24eef refactor(proxy): tighten deferred stream logging discard docstring
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 20:10:18 +00:00
jesus
8b24d4c24f fix(proxy): log blocked streaming guardrail responses as failures, not success
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 20:10:18 +00:00
Devin AI
abd1ea1b1c test(proxy): trim reset budget race test comments
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-15 20:06:29 +00:00