scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-23 00:41:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 81
50309 commits 2669 branches 1413 tags 3.3 GiB
Commit graph

50309 commits

This branch
This branch
All branches
Author SHA1 Message Date
yassin
5f6702ee47 fix(mcp): admit an allowlisted initialize that fills the peek cap exactly and type the allowlist test helpers 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 22:22:19 +00:00
yassin
fb99e3dde3 Merge remote-tracking branch 'origin/main' into litellm_mcp_client_allowlist 2026-09-17 21:46:21 +00:00
yassin
c0f335d8ca fix(mcp): cap the body the client allowlist inspects at 64 KiB 
With mcp_allowed_clients set the gateway used to read the whole POST body to
find clientInfo.name, so an authenticated client could make the proxy buffer an
arbitrarily large payload. Inspection is now capped at MCP_ALLOWLIST_PEEK_MAX_BYTES
and a sessionless POST that exceeds the cap is rejected with 403 before routing,
while posts on an admitted session stream through unchanged

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 21:46:15 +00:00
Yassin Kortam
bc9f4fec5b
Merge pull request #41542 from BerriAI/litellm_bedrock_realtime_sdk_0_11 
fix(bedrock): support aws-sdk-bedrock-runtime 0.10/0.11 in Bedrock Realtime
 2026-09-17 14:26:39 -07:00
Yassin Kortam
1b4739c415
Merge pull request #41493 from BerriAI/litellm_bridge_mid_conversation_system_turns 
fix(anthropic-bridge): convert mid-conversation system turns to user turns on /v1/messages to chat completions
 2026-09-17 14:25:36 -07:00
yassin
d240a5b6bb test(mcp): import json at module level in the MCP allowlist tests 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 21:04:56 +00:00
yassin
6e84ff0cb2 fix(bedrock): keep raw SDK import failure out of the realtime client error 
Log the underlying ImportError server side and send the client only the installed
version, the supported range and the install hint

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 20:57:28 +00:00
yassin
14639bbb5a fix(mcp): read the whole initialize body under allowlist enforcement and surface a stored empty allowlist in the UI 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 20:55:09 +00:00
yassin
c085619f29 fix(mcp): pass the original receive to the SSE handler when no body was consumed 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 20:44:24 +00:00
yuneng-jiang
1dd4c13815
Merge pull request #41374 from BerriAI/litellm_fix_guardrail_lifecycle_untimed_entries 
fix(ui): keep untimed guardrail entries on the request lifecycle
 2026-09-17 13:44:18 -07:00
yuneng-jiang
efce8b0485
Merge pull request #41373 from BerriAI/litellm_fix_integration_conftest_import 
fix(tests): resolve the integration support package without run.py's PYTHONPATH
 2026-09-17 13:34:05 -07:00
yassin
a56390ed09 Merge remote-tracking branch 'origin/main' into litellm_bedrock_realtime_sdk_0_11 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

# Conflicts:
#	uv.lock
 2026-09-17 20:32:59 +00:00
yuneng-jiang
7fb3e73276
Merge pull request #41659 from BerriAI/litellm_/release-version-bump-229f45 
chore: bump litellm-proxy-extras 0.4.98 -> 0.4.99
 2026-09-17 13:30:19 -07:00
Yuneng Jiang
6544671a31
fix(ui): order each lifecycle phase on its own clock 2026-09-17 13:29:45 -07:00
yassin
fa1c1f27d9 docs(mcp): list client_allowlist.py in the mcp_server package map 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 20:27:03 +00:00
ryan-crabbe-berri
fbbddb922e
Merge pull request #41488 from BerriAI/litellm_bound_enduser_reset_invalidation 
fix(budgets): page end-user cache invalidation after a budget reset
 2026-09-17 13:21:23 -07:00
kerry-berri
87650bfe67
Merge pull request #41570 from BerriAI/litellm-providers/price-sync 
chore(prices): sync Together AI prices: 6 models, 6 deprecated [sync failed: Google Gemini]
 2026-09-17 13:15:52 -07:00
Yuneng Jiang
139c71f031
bump: litellm-proxy-extras 0.4.98 -> 0.4.99 2026-09-17 13:08:43 -07:00
yassin
f29be6e1ee fix(ui): save the MCP private ranges and client allowlist sequentially 
The proxy stores both fields with a whole-row read-modify-write of
general_settings, so two concurrent writes from one save can drop one
of them. Also drops docstrings and suppressions the diff did not need

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 20:05:35 +00:00
yassin
21cafc8780 refactor(mcp): validate initialize body and general_settings with pydantic in the client allowlist 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 19:53:33 +00:00
kerry
86c5627d66 Merge remote-tracking branch 'origin/main' into litellm-providers/price-sync 2026-09-17 19:51:01 +00:00
kerry-berri
decbb96382
Merge pull request #41635 from BerriAI/litellm_together_successor_test_drop_deprecation_pin 
test(together_ai): stop pinning successor deprecation status
 2026-09-17 12:50:50 -07:00
kerry-berri
c5b0d6218d
Merge pull request #41633 from BerriAI/litellm_non_string_model_spend_tracking 
fix(proxy): reject non-string model with 400 and log its spend as unknown-model
 2026-09-17 12:49:23 -07:00
kerry
427d08470f test(together_ai): stop pinning successor deprecation status 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 19:40:00 +00:00
kerry
27dd1a02aa fix(proxy): reject non-string model with 400 and log its spend as unknown-model 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 19:37:14 +00:00
yuneng-jiang
dbc6c1cfaa
Merge pull request #37983 from etiennechabert/litellm_add_spendlogs_api_key_startTime_index 
perf(spend_tracking): index LiteLLM_SpendLogs by (api_key, startTime)
 2026-09-17 12:35:28 -07:00
yassin
99eeb813c4 Merge remote-tracking branch 'origin/main' into litellm_mcp_client_allowlist 2026-09-17 19:34:42 +00:00
yassin
5e7888f44d fix(ui): save MCP allowed clients independently of private IP ranges 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 19:34:42 +00:00
yassin
177e6a0a97 test(anthropic-bridge): bound role reads instead of wall-clock time in the long system run test 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 19:34:16 +00:00
kerry
5e5e5086f0 Merge remote-tracking branch 'origin/main' into litellm-providers/price-sync 2026-09-17 19:29:18 +00:00
kerry-berri
0f5bc0ffa9
Merge pull request #41627 from BerriAI/litellm_fireworks_minimax_m3_vision_tests 
test(fireworks_ai): stop pinning vision support on minimax-m3
 2026-09-17 12:28:23 -07:00
Yuneng Jiang
9207c9a3d8
Merge remote-tracking branch 'origin/main' into litellm_add_spendlogs_api_key_startTime_index 
# Conflicts:
#	litellm-proxy-extras/litellm_proxy_extras/schema.prisma
#	litellm/proxy/schema.prisma
#	schema.prisma
 2026-09-17 12:20:26 -07:00
yujonglee
dc81cf57f7
Merge pull request #41550 from BerriAI/new-ocr-mapping2 
refactor(ocr): mirror Python provider layout and preserve tests
 2026-09-17 12:18:02 -07:00
Yujong Lee
cd4d78a26a fix(ocr): narrow public error attribute writes and cover callback failure mapping 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 19:06:28 +00:00
yassin
2fea3f53b7 perf(anthropic-bridge): reorder mid-conversation system runs in a single pass 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 19:06:06 +00:00
joshua-berri
1e7b03a6ed
Merge pull request #41619 from BerriAI/litellm_fix_mcp_guardrail_context_4889 
fix(mcp): preserve request-selected guardrails during tool execution
 2026-09-17 19:04:04 +00:00
joshua-berri
f075417643
Merge pull request #41609 from BerriAI/litellm_fix_mcp_health_permissions_4504 
fix(mcp): restrict health discovery to virtual key grants
 2026-09-17 19:03:50 +00:00
kerry
6d20e68706 test(fireworks_ai): stop pinning vision support on minimax-m3 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 18:57:50 +00:00
yassin
a705e0396e refactor(mcp): type the allowlist 403 body and replay consumed messages immutably 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 18:55:47 +00:00
kerry-berri
ab03850666
Merge pull request #41623 from BerriAI/litellm_lit_8010_mock_response_provider_custom_pricing 
fix(mock_completion): keep the resolved provider so router custom pricing resolves for azure_ai deployments
 2026-09-17 11:49:33 -07:00
yassin
47be6c8aeb feat(mcp): allowlist client applications for MCP gateway access 
Adds the mcp_allowed_clients general setting, enforced against the
clientInfo.name each MCP client sends in its initialize request. A client
not on the list, or one that does not identify itself, is rejected with
403 before any stateful session is created. The setting is configurable
from config.yaml and from the Admin UI MCP network settings page

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 18:34:36 +00:00
Yujong Lee
1f0c10147d merge: port OCR request validation and upstream error mapping onto main's dispatch layout 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 18:33:20 +00:00
yujonglee
d5b8400aa9
Merge pull request #41479 from BerriAI/litellm_rust_bridge_declarative_route_catalog 
refactor(rust_bridge): declarative route catalog and shared runtime selection
 2026-09-17 11:18:36 -07:00
Yujong Lee
15f0d83305 merge: take main's e2e team allow-list settle helper 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 18:16:46 +00:00
Yujong Lee
766f45e0eb merge: resolve conflicts with main for anthropic layout rename 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 18:09:27 +00:00
Yujong Lee
b26935416a Merge remote-tracking branch 'github/main' into litellm_rust_bridge_declarative_route_catalog 
# Conflicts:
#	tests/e2e/access_control/test_model_access_group_e2e.py
 2026-09-17 11:08:08 -07:00
kerry
3cf42f6565 test(mock_completion): cover the provider inference fallback for direct calls 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 18:07:58 +00:00
yassin
7c6fd3090f Merge remote-tracking branch 'origin/main' into litellm_bridge_mid_conversation_system_turns 2026-09-17 18:07:06 +00:00
yassin
99667ad633 fix(anthropic-bridge): keep mid-conversation system turns when the target declares supports_mid_conversation_system 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-17 18:06:55 +00:00
Yujong Lee
b170d61b8d route stuff through dispatch no direct main 2026-09-17 11:06:46 -07:00