Commit graph

36179 commits

Author SHA1 Message Date
Ryan Crabbe
3faf136c72
update 2026-04-06 09:06:07 -07:00
Yuneng Jiang
8ded621b35
chore: fixes
Some checks failed
Unit Tests: Caching (Redis) / caching-redis (push) Has been cancelled
Unit Tests: Proxy DB Operations / proxy-db (auth-checks, tests/proxy_unit_tests/test_auth_checks.py tests/proxy_unit_tests/test_user_api_key_auth.py, 20, 8) (push) Has been cancelled
Unit Tests: Proxy DB Operations / proxy-db (key-generation, tests/proxy_unit_tests/test_key_generate_prisma.py, 30, 0) (push) Has been cancelled
Unit Tests: Proxy DB Operations / proxy-db (remaining, tests/proxy_unit_tests --ignore=tests/proxy_unit_tests/test_key_generate_prisma.py --ignore=tests/proxy_unit_tests/test_auth_checks.py --ignore=tests/proxy_unit_tests/test_user_api_key_auth.py, 20, 8) (push) Has been cancelled
Unit Tests: Security / security (push) Has been cancelled
2026-04-05 00:31:31 -07:00
Ryan Crabbe
db456b33d0 fix: address review feedback on master key check
- Downgrade ValueError to critical log (no hard failure on startup)
- Change length threshold from 16 to 32 to match warning message
- Fix typo: reccomended -> recommended
- Remove unnecessary f-string prefix
2026-03-25 12:26:05 -07:00
Ryan Crabbe
5e42d4b9d8 fix: use == instead of is for string comparison in master key check
This is backwards incompatible - the proxy will now correctly reject
the default master key "sk-1234" in production, which may break
setups relying on the default key.
2026-03-25 11:57:43 -07:00
Ryan Crabbe
e3fb50818c fix: not allowing default master key to be used in prod, recommended master key should be at least 32 chars 2026-03-25 11:43:36 -07:00
Krrish Dholakia
7d7045cbc1 fix: cleanup 2026-03-25 09:20:25 -07:00
Krrish Dholakia
10a48f7655 docs: add tldr 2026-03-24 19:43:13 -07:00
ishaan-berri
d93ee444fd
Merge pull request #24541 from BerriAI/workflow-deletions
ci: remove publish-migrations and reset_stable workflows
2026-03-24 18:53:33 -07:00
Ishaan Jaffer
3e8a6f24b7 ci: remove all publish/deploy workflows as part of supply chain incident response 2026-03-24 18:03:04 -07:00
Ishaan Jaffer
3d5b1ecb3b ci: remove publish-migrations and reset_stable workflows 2026-03-24 17:59:07 -07:00
ishaan-berri
b26bc5a91c
Merge pull request #24540 from BerriAI/worktree-tingly-jumping-lovelace
docs: minor updates to security update blog post
2026-03-24 17:35:01 -07:00
ishaan-berri
e92edee7e7
Merge branch 'main' into worktree-tingly-jumping-lovelace 2026-03-24 17:34:51 -07:00
Ishaan Jaffer
f9d1f8cde6 docs: minor updates to security update blog post 2026-03-24 17:15:44 -07:00
Krrish Dholakia
4571f2a6c1 fix: add tldr to blog post 2026-03-24 16:54:59 -07:00
ishaan-berri
7455b115bf
Merge pull request #24537 from BerriAI/litellm_blog-security-incident
docs: add security update blog post for March 2026 supply chain incident
2026-03-24 16:07:45 -07:00
Ryan Crabbe
eaa025ef7d docs: add security update blog post for March 2026 supply chain incident 2026-03-24 15:54:35 -07:00
Krrish Dholakia
f9d29e4e4e fix(security_scans.sh): move to older trivvy version, based on https://github.com/BerriAI/litellm/issues/24518#issuecomment-4120401246 2026-03-24 11:19:15 -07:00
Krrish Dholakia
0af114fb3a
Merge pull request #24525 from BerriAI/litellm_pin_trivvy
fix(security_scans.sh): pin trivvy version
2026-03-24 09:15:34 -07:00
Krrish Dholakia
fb379865ab fix(security_scans.sh): pin trivvy version 2026-03-24 09:13:37 -07:00
Krish Dholakia
9343aeefca
Merge pull request #24413 from benlangfeld/patch-2
Correct documentation of completion_model
2026-03-23 22:42:03 -07:00
Krish Dholakia
3292d02aa4
Merge pull request #24460 from DmitriyAlergant/ci/skip-scheduled-workflows-on-forks
ci: skip scheduled workflows on forks
2026-03-23 19:54:50 -07:00
Krish Dholakia
14fffc2770
Merge pull request #24432 from BerriAI/krrishdholakia/project-id-tracking
feat(proxy): add project_alias tracking in callbacks
2026-03-23 19:24:44 -07:00
DmitriyAlergant
1310a275d2 ci: narrow codeql guard to schedule-only
Use event_name check so push/PR-triggered CodeQL scans still run on
forks — only the scheduled run is skipped.
2026-03-23 21:39:11 -04:00
DmitriyAlergant
91bc095e18 ci: skip scheduled workflows on forks
Add `if: github.repository == 'BerriAI/litellm'` guard to scheduled
jobs in stale.yml, codeql.yml, and create_daily_staging_branch.yml.

This matches the existing pattern in auto_update_price_and_context_window.yml
and prevents these workflows from running unnecessarily on fork repositories.
2026-03-23 21:29:00 -04:00
Krrish Dholakia
26d162ccf4 fix(test): add user_api_key_project_alias to spend logs expected keys
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-23 18:12:50 -07:00
Krrish Dholakia
742e176611 docs(reasoning_content.md): update guide 2026-03-23 17:23:14 -07:00
Krish Dholakia
8a3aa4d31c
Merge pull request #24434 from BerriAI/krrishdholakia/prometheus-spend-metadata
feat(prometheus): include spend_logs_metadata in custom labels
2026-03-23 16:52:59 -07:00
Krrish Dholakia
dd0e7dcca8 test(prometheus): add tests for spend_logs_metadata in custom labels
Verify that spend_logs_metadata is correctly merged into combined_metadata
and flows through to Prometheus custom labels. Tests cover: basic extraction,
precedence when keys overlap, all three metadata sources combined, and None
handling.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-23 11:02:21 -07:00
Krrish Dholakia
7fa623df91 feat(prometheus): include spend_logs_metadata in custom labels
Add spend_logs_metadata to combined_metadata in Prometheus logger so
custom metadata from x-litellm-spend-logs-metadata header can be used
in Prometheus custom labels.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-23 10:59:18 -07:00
Krrish Dholakia
6809213957 feat(proxy): add project_alias tracking through callback metadata pipeline
Thread project_alias alongside project_id through the metadata pipeline so
callbacks receive the human-readable project name. DRY up duplicate metadata
dict construction in proxy_track_cost_callback and pass_through_endpoints by
reusing get_sanitized_user_information_from_key — future metadata fields only
need adding in one place.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-23 10:44:17 -07:00
Krish Dholakia
63425b4cb4
Merge pull request #23910 from michelligabriele/fix/guardrail-post-call-logging
fix(proxy): post-call guardrail response not captured for logging
2026-03-23 09:21:28 -07:00
michelligabriele
fa7ccf0893 fix(test): add request_data param to test mock + black formatting 2026-03-23 15:43:05 +01:00
michelligabriele
9a231bd758 fix(proxy): use real request_data in Responses API streaming fallback path 2026-03-23 15:39:23 +01:00
michelligabriele
4625ccbaa2 fix(proxy): anchor metadata dict in _process_response/_process_error so pop() mutates the real dict 2026-03-23 15:39:23 +01:00
michelligabriele
d8fd9a20ed fix(proxy): address Greptile review — streaming request_data, OCR backward compat, test coverage
- Pass request_data to end-of-stream process_output_streaming_response call
- Restore inputs.update() in OCR handler for third-party guardrail providers
- Add streaming end-to-end test for guardrail logging passthrough
2026-03-23 15:39:23 +01:00
michelligabriele
ae454fd700 fix(proxy): OpenAI Moderation post-call guardrail response not captured for logging
Two independent bugs prevented post-call OpenAI Moderation guardrail
results from reaching downstream logging callbacks (Langfuse, Datadog).

Bug 1: process_output_response() created a throwaway request_data dict,
so guardrail info written by @log_guardrail_information was discarded.
Fixed by threading the real request_data from the unified guardrail
dispatcher through all 13 BaseTranslation handlers, with litellm_metadata
injection preserved for third-party guardrails (Zscaler, Prompt Security).
Also extended to process_output_streaming_response for consistency.

Bug 2: The @log_guardrail_information decorator collapsed the full
moderation API response (categories, scores, flagged status) to "allow".
Fixed by overriding _process_response/_process_error on
OpenAIModerationGuardrail to stash and log the full response, following
the established Model Armor pattern.
2026-03-23 15:39:22 +01:00
Ben Langfeld
847c12e4f5
Update docs/my-website/docs/proxy/config_settings.md
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-03-23 11:06:09 -03:00
Ben Langfeld
5a846c2e64
Correct documentation of completion_model
See https://github.com/BerriAI/litellm/issues/21554
2026-03-23 10:59:18 -03:00
yuneng-jiang
c89496f378
Merge pull request #24342 from BerriAI/litellm_yj_march_21_2026
[Fix] UI - Teams: Table refresh, infinite dropdown, leftnav migration
2026-03-21 23:36:21 -07:00
yuneng-jiang
38d477507d remove outdated e2e test 2026-03-21 23:14:53 -07:00
yuneng-jiang
6bb08883af adding poetry lock 2026-03-21 23:01:28 -07:00
yuneng-jiang
fa65433c8c bump: version 1.82.5 → 1.82.6 2026-03-21 22:56:09 -07:00
yuneng-jiang
d91980dc45 adding build 2026-03-21 22:55:04 -07:00
yuneng-jiang
071c8641de bump: version 0.4.59 → 0.4.60 2026-03-21 22:54:41 -07:00
yuneng-jiang
88a4c7aeaf bump: version 0.4.58 → 0.4.59 2026-03-21 22:54:38 -07:00
yuneng-jiang
34d079910b chore: update Next.js build artifacts (2026-03-22 05:53 UTC, node v22.16.0) 2026-03-21 22:53:50 -07:00
yuneng-jiang
9073daeebc [Fix] UI - TeamDropdown: Match org dropdown styling and fix test mock
- Use Select.Option with font-medium alias + Text secondary ID to match OrganizationDropdown
- Default page size to 20
- Add useInfiniteTeams mock to AddModelForm tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-21 22:52:16 -07:00
yuneng-jiang
aea8e32048 [Fix] UI: Team table refresh, infinite team dropdown, leftnav for dashboard routes
- OldTeams: refresh table via fetchTeamsV2 after team create instead of appending
- TeamDropdown: rewrite with useInfiniteTeams for paginated fetch, scroll-to-load, and debounced search
- Update all TeamDropdown consumers to use the new self-fetching API
- Dashboard layout: switch from Sidebar2 to SidebarProvider (leftnav)
- Leftnav: add MIGRATED_PAGES routing for path-based navigation (api-reference)
- Navbar: remove chat button

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-21 22:05:26 -07:00
yuneng-jiang
9963b31e07 Revert "fix(proxy): restore per-entity breakdown in aggregated daily activity endpoint"
This reverts commit 9c3fab24ad.
2026-03-21 21:37:29 -07:00
yuneng-jiang
f5194b5ce3
Merge pull request #24334 from BerriAI/litellm_yj_march_21_2026
[Infra] Build UI for release
2026-03-21 18:03:38 -07:00