Commit graph

18680 commits

Author SHA1 Message Date
Yassin Kortam
6d8a960e1d
Merge pull request #41667 from BerriAI/litellm_mcp_client_allowlist
feat(mcp): allowlist MCP client applications at the gateway
2026-09-18 17:48:36 -07:00
kerry
d74e1bb445 fix(timing): union provider timing windows and anchor detailed pre-processing at receive time
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:48:17 +00:00
mateo-berri
f213855558 refactor: drop the docstrings from the websocket relay and its tests 2026-09-18 17:44:32 -07:00
mateo-berri
3911d62bbe fix(vertex_ai): prune a discarded turn's id once its marker is delivered 2026-09-18 17:44:28 -07:00
Mateo Wang
a6e3a72ed8
Merge pull request #41870 from BerriAI/litellm_bedrock_openai_gpt_min_max_tokens
fix(bedrock): clamp maxTokens to the 16-token minimum for OpenAI GPT and xAI Grok models on Converse
2026-09-18 17:44:18 -07:00
kerry
99659e9e7e test(bedrock): drop redundant recorder docstring
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:43:51 +00:00
yassin
75b290969b fix(router): enforce model tpm limits against shared redis usage across replicas
The model tpm pre-call check read only the in-memory counter, so each proxy replica enforced the limit against its own traffic and the deployment admitted up to N times the configured tpm across N replicas. Read the shared Redis counter when the local counter is under the limit, keep the local counter authoritative when it is already at the limit, and fall back to local usage when Redis is unavailable

Supersedes #40854, Fixes #40291

Co-authored-by: Jahanzeb-git <jahanzebahmed2002@gmail.com>
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:41:55 +00:00
yassin
aa0fb915d0 fix(rate_limiter): render the 429 reset time in UTC as labelled
The proxy rate limiters formatted the reset epoch with a naive datetime.fromtimestamp, which reads the process timezone, and then appended a literal UTC suffix. A proxy running outside UTC returned a local wall-clock time labelled as UTC in the 429 body and reset_at header. Convert with tz=timezone.utc in both the request limiter and the batch limiter so the label is true

Co-authored-by: Priyansh Nandwana <nandwana.priyansh103@gmail.com>
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:40:51 +00:00
Devin AI
890e5feabe test(e2e): keep e2e_config formatting untouched
Co-Authored-By: bot_apk <apk@cognition.ai>
2026-09-19 00:38:57 +00:00
Devin AI
c1bd5ba91d test(e2e): share the Linear readonly tool constant and fail fast on unexpected consent
Co-Authored-By: bot_apk <apk@cognition.ai>
2026-09-19 00:38:28 +00:00
Yujong Lee
a3aceec2f8 fix(rust): match Python proxy, ssl_verify and client expiry behavior in the http pool
Honor environment proxies whenever Python would use httpx (sync calls, HTTP/2, aiohttp disabled), apply the per-call ssl_verify argument, ignore empty or missing SSL env values the way http_handler.py does, expire pooled clients after an hour so rotated certificates reload, keep the client certificate off media downloads, and decline instead of raising when a litellm global has an unexpected type
2026-09-18 17:37:08 -07:00
joshua
a873ead5d3 test(mcp): read SDK2 snake_case fields on CallToolResult
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:36:03 +00:00
Devin AI
6c8f1c22e0 test(e2e): cover MCP OAuth happy path through gateway
Co-Authored-By: bot_apk <apk@cognition.ai>
2026-09-19 00:35:56 +00:00
yucheng
95c1d5b0a6 feat(otel v2): name and re-root the kept generation under llm_only, widening to the account's widest scope
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:33:46 +00:00
mateo-berri
8b1f78fa08 fix(vertex_ai): drop a cleared turn's queued transcripts and carry its billed seconds 2026-09-18 17:30:57 -07:00
mateo-berri
50629ff5ca Merge branch 'main' of https://github.com/BerriAI/litellm into litellm_jwt_token_exchange_grant
# Conflicts:
#	tests/test_litellm/proxy/auth/test_auth_checks.py
2026-09-18 17:30:38 -07:00
Mateo Wang
cda022ca68
Merge pull request #40243 from zoroyihan7/fix-responses-stream-error-events
fix(responses): emit typed streaming failure events
2026-09-18 17:29:57 -07:00
Yujong Lee
542ad7dbac fix(ocr): forward the supplied client on the Python path and build pooled clients outside the lock
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:27:54 +00:00
kerry
e91f17ac3a Merge remote-tracking branch 'origin/main' into litellm_lit_8128_off_peak_pricing_schema 2026-09-19 00:27:52 +00:00
Mateo Wang
f6d4766ebe
Merge pull request #41878 from BerriAI/litellm_requeue_daily_spend_without_redis_buffer
fix(proxy): requeue daily spend rows when the commit fails without the Redis buffer
2026-09-18 17:27:36 -07:00
kerry-berri
92d01fa568
Merge pull request #41901 from BerriAI/litellm_off_peak_pricing_integration_tests
test(integration): cover off-peak pricing on a live proxy
2026-09-18 17:26:51 -07:00
kerry
6b082d3a01 test(bedrock): type the SigV4 request recorder and drop caller-owned mutation
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:25:01 +00:00
mateo-berri
cdc0e57e93 fix(websearch_interception): surface a failed search as a web_search_tool_result_error block and end the turn 2026-09-18 17:24:52 -07:00
mateo-berri
59f7a00cf6 fix(claude_code_gateway): scope the protobuf body skip to the OTLP routes and match the metrics middleware on the route path 2026-09-18 17:23:59 -07:00
mateo-berri
5030214671 Merge origin/main into litellm_fix_responses_ws_encrypted_content_affinity
Resolves the conflicts with the WebSocket request defaults from main (PR #41881):
the relay keeps both custom_llm_provider and request_defaults, and a masked
response.create frame is re-serialized when the defaults changed it.

Keeps the first-frame routing hints (input, previous_response_id) out of the
deployment request defaults so they never get injected into later frames on the
same connection, with a regression test.
2026-09-18 17:23:59 -07:00
Yujong Lee
b2d6cd1fcf refactor(rust): read litellm HTTP globals through one Python shim and tighten the http pool
Drop the core ocr() facade so VertexAuth and the http pool stay out of litellm-core's
public API, move the http Error enum to error.rs, and inject the media DNS resolver into
HttpClientPool instead of a per-call builder hook the cache key ignored.

The bridge now reads litellm.* HTTP settings only through litellm/rust_bridge/settings.py,
pinned by python_settings.json, while env overrides stay in Rust. This adds the Python
default User-Agent, parses string ssl_verify globals like get_ssl_verify, drops per-call
ssl_verify that Python OCR never honored, and removes the unused request_timeout.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-18 17:23:26 -07:00
Mateo Wang
9b342cdd40
Merge pull request #41868 from BerriAI/litellm_config_update_rejects_config_owned_keys
fix(proxy): refuse config-owned keys on POST /config/update
2026-09-18 17:23:23 -07:00
kerry
f836bb481d test(integration): keep cost diagnostics and widen shard timeout
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:19:11 +00:00
kerry
1961cbcb6c fix(timing): subtract every provider attempt from receive-anchored overhead
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:18:13 +00:00
ryan-crabbe-berri
1073b9eff7
Merge pull request #41354 from BerriAI/litellm_lit_3269_project_spend_tracking
fix(proxy): track project spend and enforce project budgets additively
2026-09-18 17:17:28 -07:00
kerry
69f9106759 test(integration): move scripted-provider cost suite into cost shard
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:16:12 +00:00
mateo-berri
12120fe59b refactor(bedrock): inline maxTokens clamp and cover inference-profile ARNs in tests 2026-09-18 17:11:29 -07:00
kerry
83d89aa134 test(integration): cover off-peak pricing on a live proxy
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:10:22 +00:00
kerry
37da5b6f4d fix(bedrock): sign batch retrieve and cancel with deployment credentials when AWS_BEARER_TOKEN_BEDROCK is set
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:10:17 +00:00
mateo-berri
febe9aec65 fix(responses): book a rejected WebSocket connection as a failed request 2026-09-18 17:10:01 -07:00
joshua
7410d00d2e merge(main): resolve mcp server.py import conflict and relock
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-19 00:08:33 +00:00
yucheng-berri
500e880a40
Merge pull request #41895 from BerriAI/litellm_openai_moderations_model_default
Co-authored-by: yucheng <yucheng@berri.ai>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-18 17:06:41 -07:00
ryan-crabbe-berri
4bb1ae115b
Merge pull request #41347 from BerriAI/litellm_team_member_budget_link_default
fix(team): apply team_member_budget updates to members still on the team default
2026-09-18 17:06:25 -07:00
jesus
82e3f3980d refactor(auth): resolve org identity through an auth_checks helper
Some checks failed
LiteLLM Rust / rust-lint (push) Has been cancelled
LiteLLM Rust / rust-test (push) Has been cancelled
LiteLLM Rust / rust-wheel (push) Has been cancelled
Terraform Modules / fmt, validate, test (aws) (push) Has been cancelled
Terraform Modules / fmt, validate, test (gcp) (push) Has been cancelled
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-18 23:59:33 +00:00
mateo-berri
dc11c34e3a Merge remote-tracking branch 'origin/main' into litellm_vertex_chirp3_streaming_stt 2026-09-18 16:56:02 -07:00
mateo-berri
3d7a771ea7 fix(vertex_ai): apply finals before interims and refresh the token per stream 2026-09-18 16:53:06 -07:00
joshua
8d8efe7203 style(mcp): satisfy lint and type budgets for the SDK 2 port
Format the ported files, annotate mutable wire payloads, give the e2e
OAuth client the SDK 2 httpx2/AuthorizationCodeResult API, tighten the
transport-streams alias to the two-stream SDK 2 shape, and add a
test-quality reason for the MockTransport factory injection.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-18 23:49:23 +00:00
Mateo Wang
ff7dc86947
Merge pull request #41892 from BerriAI/litellm_gemini_contentless_candidate_finish_reason
Some checks failed
Unit Tests: Proxy DB Operations / custom-logging (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / db-and-spend (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / endpoints-and-responses (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / proxy-server-core (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / guardrails-hooks (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / jwt-and-keys (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / key-generation (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / logging-misc (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / proxy-runtime (push) Blocked by required conditions
Unit Tests: Proxy DB Operations / proxy-utils (push) Blocked by required conditions
Unit Tests / caching-local (push) Waiting to run
Unit Tests / core-utils (push) Waiting to run
Unit Tests / enterprise-package (push) Waiting to run
Unit Tests / enterprise-routing (push) Waiting to run
Unit Tests / integrations (push) Waiting to run
Unit Tests / All Other Providers (push) Waiting to run
Unit Tests / Vertex AI (push) Waiting to run
Unit Tests / misc (push) Waiting to run
Unit Tests / proxy-auth (push) Waiting to run
Unit Tests / proxy-endpoints (push) Waiting to run
Unit Tests / proxy-extras (push) Waiting to run
Unit Tests / proxy-infra (push) Waiting to run
Unit Tests / proxy-server (push) Waiting to run
Unit Tests / responses-caching-types (push) Waiting to run
GitHub Actions Security Analysis / zizmor (push) Waiting to run
Issue label sync / sync-issue-labels-tests (push) Has been cancelled
Issue label sync / sync-issue-labels (push) Has been cancelled
Terraform Modules / fmt, validate, test (aws) (push) Has been cancelled
Terraform Modules / fmt, validate, test (gcp) (push) Has been cancelled
VS Code Extension / vscode-extension (push) Has been cancelled
fix(gemini): preserve candidates with finishReason and no content (#40477)
2026-09-18 16:34:46 -07:00
joshua
0d2963fe89 test(mcp): update MCP suites for SDK2 handler signatures and ctx var
Call handlers with ServerRequestContext and params models, seed the
litellm contextvar instead of the removed SDK request_ctx, forward
headers/auth through the httpx2 MockTransport factory, and add
regressions for handler registration, context propagation, and modern
protocol-version rejection.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-18 23:34:30 +00:00
yucheng
c7028761aa fix(proxy): keep queued moderation running past a V1 pre_call guardrail
Some checks failed
LiteLLM Rust / rust-lint (push) Has been cancelled
LiteLLM Rust / rust-test (push) Has been cancelled
LiteLLM Rust / rust-wheel (push) Has been cancelled
Terraform Modules / fmt, validate, test (aws) (push) Has been cancelled
Terraform Modules / fmt, validate, test (gcp) (push) Has been cancelled
A V1 CustomGuardrail with moderation_check pre_call returned out of
during_call_hook before asyncio.gather, abandoning already-queued
CustomLogger moderation coroutines and skipping every later callback.
Skip only that guardrail instead.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-18 23:33:29 +00:00
yucheng
c4272d894f style(team): wrap the roster audit helper comprehensions at 120 columns
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-18 23:29:11 +00:00
yucheng
209eba6718 feat(team): carry team_alias on member add, delete and role-change audit payloads
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-09-18 23:28:39 +00:00
mateo-berri
c6c8aed3f8 fix(proxy): drop only the daily spend batch whose failure cannot be re-sent, requeue the unsent ones 2026-09-18 16:22:04 -07:00
yucheng
e5d02fecf7 chore: merge litellm_openai_moderations_model_default (#41895) into litellm_prompt_injection_llm_api_check_dispatch 2026-09-18 23:19:21 +00:00
mateo-berri
01d8d3c218 fix(claude_code_gateway): wrap managed settings in the uuid, checksum, settings envelope the client requires
Some checks failed
LiteLLM Rust / rust-lint (push) Has been cancelled
LiteLLM Rust / rust-test (push) Has been cancelled
LiteLLM Rust / rust-wheel (push) Has been cancelled
Terraform Modules / fmt, validate, test (aws) (push) Has been cancelled
Terraform Modules / fmt, validate, test (gcp) (push) Has been cancelled
Terraform Provider / gofmt, vet, build, test (push) Has been cancelled
Terraform Provider / Provider endpoints vs proxy OpenAPI schema (push) Has been cancelled
2026-09-18 16:18:15 -07:00