Mateo Wang
4011367b39
Merge pull request #40986 from BerriAI/litellm_lit_7346_multi_choice_stream_guardrails
...
fix(guardrails): scan each choice's tool-call arguments apart on n>1 streams and log why a rewrite was discarded
2026-09-19 20:34:05 -07:00
Mateo Wang
9d7f77988a
Merge pull request #41974 from BerriAI/litellm_fix_startup_view_creation_race
...
fix(proxy): wait for the spend-log table before creating startup views
2026-09-19 20:33:49 -07:00
mateo-berri
19d77e2442
test(guardrails): type the recorder hook's request_data as a Mapping
2026-09-19 20:21:37 -07:00
kerry-berri
4e55e995e1
Merge pull request #42082 from BerriAI/litellm-providers/price-sync-openrouter
...
chore(prices): sync OpenRouter prices: 7 models, 6 deprecated
2026-09-19 20:12:30 -07:00
Mateo Wang
ef7da9b49f
Merge pull request #42072 from BerriAI/litellm_mcp_cold_worker_tools_call
...
fix(mcp): tools/call no longer 404s on a worker that has not served tools/list
2026-09-19 20:04:33 -07:00
mateo-berri
327447bc10
Merge remote-tracking branch 'origin/main' into litellm_fix_startup_view_creation_race
...
# Conflicts:
# tests/test_litellm/proxy/test_proxy_server.py
2026-09-19 20:02:33 -07:00
berriai-litellm-provider-info-sync[bot]
2271c83731
chore(prices): sync OpenRouter prices: 7 models, 6 deprecated
...
openrouter/baidu/ernie-4.5-vl-424b-a47b: deprecation_date
openrouter/deepseek/deepseek-r1-distill-llama-70b: deprecation_date
openrouter/deepseek/deepseek-v3.1-terminus: deprecation_date
openrouter/deepseek/deepseek-v3.2: deprecation_date
openrouter/deepseek/deepseek-v3.2-exp: deprecation_date
openrouter/deepseek/deepseek-v4-flash: input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/minimax/minimax-m2.1: deprecation_date
2026-09-20 03:00:53 +00:00
joshua-berri
8df260a13d
Merge pull request #42051 from BerriAI/litellm_mcp_oauth_e2e_3467_rework
...
test(e2e): restore MCP OAuth happy-path coverage (LIT-3467)
2026-09-20 02:50:14 +00:00
Mateo Wang
b4447096e4
Merge pull request #42067 from BerriAI/litellm_genai_adapter_response_schema_tool_params
...
fix(google_genai): forward response schema and tool parameters through the generateContent adapter
2026-09-19 19:43:32 -07:00
kerry-berri
a8790db419
Merge pull request #42077 from BerriAI/litellm-providers/price-sync-openrouter
...
chore(prices): sync OpenRouter prices: 2 models
2026-09-19 19:42:00 -07:00
Mateo Wang
79e25d1e96
Merge pull request #42045 from BerriAI/litellm_lit_8201_notfound_retry_policy
...
fix(router): add NotFoundErrorRetries so a retry policy can pin 404 retries
2026-09-19 19:37:45 -07:00
berriai-litellm-provider-info-sync[bot]
344ce9328b
chore(prices): sync OpenRouter prices: 2 models
...
openrouter/~deepseek/deepseek-pro-latest: max_tokens, max_output_tokens, input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/deepseek/deepseek-v4-pro-0813: max_tokens, max_output_tokens, off_peak_pricing, input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
2026-09-20 02:30:52 +00:00
mateo-berri
a3e9ed34fe
fix(mcp): gate the pre-call listing per tool, not per server
...
A tools/call on a cold worker listed the target server once and then never
again, so a later caller whose credentials expose a wider upstream catalog
got 404 for tools the first caller never had. Gate the pre-call listing on
whether this worker already exposes the requested tool, so callers with
different catalogs no longer mask each other. Removing the per-server guard
also drops the empty-listing case that re-listed on every call.
2026-09-19 19:29:33 -07:00
yuneng-jiang
09e14a485c
Merge pull request #42061 from BerriAI/litellm_fix_gcs_pub_sub_autorouter_golden
...
test(logging): add autorouter estimate keys to the GCS pub/sub spend-log golden
2026-09-19 19:22:41 -07:00
mateo-berri
5eb967d925
fix(google_genai): drop non-object tool parameters instead of forwarding them
2026-09-19 19:19:33 -07:00
Mateo Wang
5417abd586
Merge pull request #42011 from BerriAI/litellm_scrub_default_master_key
...
docs: stop advertising sk-1234 as the master key in shipped configs and examples
2026-09-19 19:05:31 -07:00
Mateo Wang
b6dd3d932c
Merge pull request #42019 from BerriAI/litellm_master_key_boot_enforcement
...
feat(proxy)!: refuse to start with an unset, empty, or publicly known master key
2026-09-19 19:04:02 -07:00
ryan-crabbe-berri
ecf17513fb
refactor(proxy): rename the local development override to dangerously_permit_weak_or_unset_master_key so the name says exactly what it permits
2026-09-19 18:53:14 -07:00
mateo-berri
2e83871d54
test(guardrails): type the recorder hook's logging_obj as object
2026-09-19 18:52:28 -07:00
mateo-berri
47ebfa10a0
fix(google_genai): reuse the shared key filter for Gemini-only schema keys
2026-09-19 18:52:00 -07:00
mateo-berri
92ff54f134
fix(mcp): list a never-listed server before its first tools/call
...
The startup tool-name fill skips servers whose upstream wants the caller's
own token (true_passthrough, OAuth discovery), and mcp 2 no longer runs the
list handler before an uncached tools/call, so every uvicorn worker that had
not served tools/list answered 404 "Tool not found" for prefixed tools/call
and the REST server_id route on those servers.
On a resolution miss, execute_mcp_tool now lists the prefix-matched (or
server_id-requested) server once, with the caller's credentials, through the
existing tools/list path, then resolves as before. Listing failures fall
through to the existing 404, a worker that already listed the server never
re-lists it, and a server outside the caller's allowed set is never listed.
2026-09-19 18:49:26 -07:00
mateo-berri
810acdad97
chore(streaming): drop the redundant tool-call map comment and restore the OpenAPI snapshot
2026-09-19 18:35:11 -07:00
mateo-berri
fba179f2c0
fix(google_genai): forward response schema and tool parameters through the generateContent adapter
2026-09-19 18:31:09 -07:00
joshua-berri
daecea3eb8
Merge pull request #42050 from BerriAI/litellm_mcp_scoped_regressions_4506_rework
...
test(mcp): restore scoped execution and credential isolation regressions
2026-09-20 01:29:44 +00:00
Mateo Wang
93e39d5042
Merge pull request #42062 from BerriAI/litellm_pr38499_batch_retrieve_model_group
...
fix(router): stamp model_group when retrieving a batch, so batch tokens are attributable (internal copy of #38499 )
2026-09-19 18:23:06 -07:00
Yassin Kortam
56b3422cc2
Merge pull request #42046 from BerriAI/litellm_cost_poll_404_no_cooldown
2026-09-19 18:20:27 -07:00
Yassin Kortam
755f5c535d
Merge pull request #41994 from BerriAI/litellm_redis_spend_requeue_safety
2026-09-19 18:19:57 -07:00
yuneng-jiang
fba00f5084
Merge pull request #42054 from BerriAI/litellm_/release-ui-build-95a688
...
chore: rebuild Admin UI bundle from main (build kXnLzJ6ylsRPmgSkCkCKM)
2026-09-19 18:19:33 -07:00
Joshua Valluru
fdc4ad54c5
docs(mcp): remove duplicate regression coverage inventory
2026-09-19 18:18:37 -07:00
kerry-berri
faa2a71fba
Merge pull request #42063 from BerriAI/litellm-providers/price-sync-openrouter
...
chore(prices): sync OpenRouter prices: 2 models
2026-09-19 18:13:28 -07:00
ryan-crabbe-berri
99f99cfb46
fix(proxy): stop the boot when the requested master key migration fails, unless allow_requests_on_db_unavailable tolerates the outage
2026-09-19 18:10:52 -07:00
berriai-litellm-provider-info-sync[bot]
b652aaad4a
chore(prices): sync OpenRouter prices: 2 models
...
openrouter/deepseek/deepseek-v4-flash: input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/z-ai/glm-5.3: input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
2026-09-20 01:00:52 +00:00
mateo-berri
2a35dc5217
fix(guardrails): keep the undeliverable rewrite reason through copies and name the responses mismatch
2026-09-19 18:00:03 -07:00
Yuneng Jiang
98a3f45d21
chore: update Next.js build artifacts (2026-09-20 00:59 UTC, node v24.19.0)
2026-09-19 17:59:07 -07:00
mateo-berri
a114af2a26
fix(proxy): resolve the view setup gate through the search_path and set the row count before the views
2026-09-19 17:54:20 -07:00
ryan-crabbe-berri
a6c51ba3de
fix(proxy): never treat plaintext that base64-decodes to nothing as a ciphertext during the master key migration
...
A string such as "*" or "..." has no base64 characters, so it decoded to no bytes and read as an empty plaintext under any key. The migration would have counted it and overwritten it with a ciphertext of the empty string. Also read from the writer database instead of a read replica, report a database error during the migration instead of crashing the boot, skip columns the connected schema lacks across every schema on the search path, cap the JSON walk depth for the recursion detector, and move the boot wiring into one tested function.
2026-09-19 17:53:17 -07:00
kerry-berri
d1773d96e9
Merge pull request #42058 from BerriAI/litellm-providers/price-sync-openrouter
...
chore(prices): sync OpenRouter prices: 5 models
2026-09-19 17:41:47 -07:00
mateo-berri
867a4df347
fix(proxy): claim a finished batch's per-model budget charge atomically
...
A finished batch reports its whole cost on every poll. The charge-once
marker is now taken with one atomic increment on the shared cache, so two
workers polling the same batch at once cannot both charge it, and the
marker's TTL is refreshed on every poll so a batch polled within every
budget window is never charged again after the marker's first expiry.
2026-09-19 17:41:19 -07:00
mateo
144cf9a9ba
test(logging): add autorouter estimate keys to the GCS pub/sub spend-log golden
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-20 00:38:42 +00:00
yucheng-berri
82ddab2405
Merge pull request #41840 from BerriAI/litellm_team_audit_lifecycle
...
fix(team): emit audit events for member_delete and role changes and carry the final roster on team create
2026-09-19 17:37:16 -07:00
mateo-berri
114fc16554
merge: origin/main into litellm_lit_7346_multi_choice_stream_guardrails
2026-09-19 17:34:43 -07:00
ryan-crabbe-berri
38d776bd2b
feat(proxy): re-encrypt stored secrets at boot from LITELLM_MIGRATE_FROM_MASTER_KEY so an unsafe key can be replaced while the proxy refuses to start
...
Rotating through POST /key/regenerate needs a running proxy, which a refused boot does not have. The refusal now counts the stored values that decrypt under the unsafe key. When there are none it only asks for a new key. When there are some it also asks for LITELLM_MIGRATE_FROM_MASTER_KEY, and the next boot with a safe key re-encrypts them and logs that the variable can be deleted. Leaving the variable set afterwards is a no-op with one notice.
2026-09-19 17:32:58 -07:00
yuneng-jiang
1f28813c4d
Merge pull request #42053 from BerriAI/litellm_nova_sonic_v2_e2e_model
...
test(e2e): point the Nova Sonic realtime test at nova-2-sonic
2026-09-19 17:31:07 -07:00
berriai-litellm-provider-info-sync[bot]
260990629a
chore(prices): sync OpenRouter prices: 5 models
...
openrouter/deepseek/deepseek-v4-flash: input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/qwen/qwen3.5-35b-a3b: max_tokens, max_output_tokens, supports_prompt_caching, input_cost_per_token, output_cost_per_token
openrouter/qwen/qwen3.5-9b: max_tokens, max_output_tokens
openrouter/qwen/qwen3.8-27b: input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/z-ai/glm-5.2: input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
2026-09-20 00:30:47 +00:00
yucheng-berri
2ec5c2c7cd
Merge pull request #41740 from BerriAI/litellm_otel_v2_langfuse_llm_spans_only
...
feat(otel v2): opt-in llm_only span scope for Langfuse destinations and the operator Langfuse exporter
2026-09-19 17:24:50 -07:00
Yuneng Jiang
9f84382a24
test(e2e): cite the source and date for the pinned Nova Sonic model id
...
AGENTS.md allows a vendor-owned literal only when its source and date are cited
next to it. A live realtime test cannot avoid naming a model, so record how the
id was checked, and record that a retired id fails as a hang rather than an
error so the next reader does not start by suspecting litellm.
2026-09-19 17:20:00 -07:00
mateo-berri
1b8f704035
fix(proxy): await the cancelled view setup task quietly and assert it starts at boot
...
Use contextlib.suppress for the cancelled task in stop_view_setup_task, make the legacy prisma setup test inject a plain mock for the synchronous start_view_setup_task and assert it is called, and drop the docstrings the branch added to tests
2026-09-19 17:17:18 -07:00
kerry-berri
75f4c11444
Merge pull request #42006 from BerriAI/litellm-providers/price-sync-openrouter
...
chore(prices): sync OpenRouter prices: 2 models
2026-09-19 17:11:50 -07:00
yucheng
de70cf842a
fix(team): run the role update and budget upsert in one transaction under the team lock
...
LiteLLM Rust / rust-lint (push) Has been cancelled
LiteLLM Rust / rust-test (push) Has been cancelled
LiteLLM Rust / rust-wheel (push) Has been cancelled
Terraform Provider / gofmt, vet, build, test (push) Has been cancelled
Terraform Provider / Provider endpoints vs proxy OpenAPI schema (push) Has been cancelled
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-20 00:04:32 +00:00
Joshua Valluru
368401e85c
test(e2e): complete OAuth triggers and preserve failure diagnostics
2026-09-19 17:03:38 -07:00
