scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-24 00:52:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 91
51484 commits 2663 branches 1420 tags 3.4 GiB
Commit graph

51484 commits

This branch
This branch
All branches
Author SHA1 Message Date
ryan-crabbe-berri
ecf17513fb refactor(proxy): rename the local development override to dangerously_permit_weak_or_unset_master_key so the name says exactly what it permits 2026-09-19 18:53:14 -07:00
ryan-crabbe-berri
99f99cfb46 fix(proxy): stop the boot when the requested master key migration fails, unless allow_requests_on_db_unavailable tolerates the outage 2026-09-19 18:10:52 -07:00
ryan-crabbe-berri
a6c51ba3de fix(proxy): never treat plaintext that base64-decodes to nothing as a ciphertext during the master key migration 
A string such as "*" or "..." has no base64 characters, so it decoded to no bytes and read as an empty plaintext under any key. The migration would have counted it and overwritten it with a ciphertext of the empty string. Also read from the writer database instead of a read replica, report a database error during the migration instead of crashing the boot, skip columns the connected schema lacks across every schema on the search path, cap the JSON walk depth for the recursion detector, and move the boot wiring into one tested function.
 2026-09-19 17:53:17 -07:00
ryan-crabbe-berri
38d776bd2b feat(proxy): re-encrypt stored secrets at boot from LITELLM_MIGRATE_FROM_MASTER_KEY so an unsafe key can be replaced while the proxy refuses to start 
Rotating through POST /key/regenerate needs a running proxy, which a refused boot does not have. The refusal now counts the stored values that decrypt under the unsafe key. When there are none it only asks for a new key. When there are some it also asks for LITELLM_MIGRATE_FROM_MASTER_KEY, and the next boot with a safe key re-encrypts them and logs that the variable can be deleted. Leaving the variable set afterwards is a no-op with one notice.
 2026-09-19 17:32:58 -07:00
ryan-crabbe-berri
fdd614d759 fix(proxy): tell users with an already exported master key to replace it in place, because it wins over .env 2026-09-19 14:22:52 -07:00
ryan-crabbe-berri
3c9c860de7 test(proxy): set the unsafe-proxy override at the remaining test boot sites and isolate the boot test from a leaked scheduler 2026-09-19 14:16:52 -07:00
ryan-crabbe-berri
0049a51f9b fix(proxy): import assert_never from typing_extensions for Python 3.10 and keep the lazy OpenAPI snapshot as generated by CI's Python 2026-09-19 13:56:43 -07:00
ryan-crabbe-berri
186ba50bce fix(proxy): point users who must rotate at the rotation guide before they save a new key 2026-09-19 13:49:32 -07:00
ryan-crabbe-berri
0415382f9e fix(proxy): word the config step so it also fits a config that already reads the environment 2026-09-19 13:45:11 -07:00
ryan-crabbe-berri
fe480533e8 feat(proxy)!: refuse to start with an unset, empty, or publicly known master key 
The proxy used to boot with no master key (every request accepted without
authentication) and with sk-1234, the key every example used. It now stops at
startup, before it connects to the database, and prints how to fix it: where the
bad key came from, a copy-pastable command that generates a secure key, and,
when the public key is also encrypting a database, a link to the rotation guide

general_settings.dangerously_allow_unsafe_proxy: true or
LITELLM_DANGEROUSLY_ALLOW_UNSAFE_PROXY=true starts the proxy anyway, for local
development. CI and test boots that rely on sk-1234 or on no key set it

BREAKING CHANGE: deployments with no master key, an empty one, or sk-1234 no
longer start until they set a real key or opt in to the override
 2026-09-19 13:44:00 -07:00
kerry-berri
b946d12ffd
Merge pull request #41996 from BerriAI/litellm-providers/price-sync-openrouter 
chore(prices): sync OpenRouter prices: 2 models
 2026-09-19 12:13:09 -07:00
yucheng-berri
4301ac4940
Merge pull request #41986 from BerriAI/litellm_revert_post_call_guardrail_context 
revert(guardrails): drop the scoped request conversation and tools from post-call scans (#41220)
 2026-09-19 12:06:30 -07:00
berriai-litellm-provider-info-sync[bot]
38b310b751
chore(prices): sync OpenRouter prices: 2 models 
openrouter/deepseek/deepseek-v4-flash: input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/qwen/qwen-plus-2025-07-28: supports_prompt_caching
 2026-09-19 19:00:52 +00:00
joshua-berri
eda1faba14
Merge pull request #41718 from BerriAI/litellm_mcp_dependency_gate_7737 
refactor(mcp): upgrade SDK2 while preserving legacy gateway behavior
 2026-09-19 18:53:19 +00:00
kerry-berri
c3fa53be8d
Merge pull request #41993 from BerriAI/litellm_remove_auto_merge_price_sync 
ci: remove auto-merge-price-sync workflow, the Devin sync automation merges price PRs
 2026-09-19 11:44:36 -07:00
yujonglee
f081e447a4
Merge pull request #41992 from BerriAI/litellm_deepseek_ocr_defaults 
fix(ocr): set DeepSeek OCR sampling defaults
 2026-09-19 11:42:49 -07:00
kerry-berri
b89a6fba4c
Merge pull request #41833 from BerriAI/litellm-providers/price-sync-openrouter 
chore(prices): sync OpenRouter prices: 172 models, 2 new
 2026-09-19 11:42:34 -07:00
kerry
987af6c66c ci: remove auto-merge-price-sync workflow, the Devin sync automation merges price PRs 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 18:33:06 +00:00
ryan-crabbe-berri
659cef0f57
Merge pull request #40729 from BerriAI/litellm_lit7572_top_keys_user_column 
fix(ui): show user attribution in Top Virtual Keys usage tables
 2026-09-19 11:32:35 -07:00
Yujong Lee
8c21a988b7 fix(ocr): set DeepSeek OCR sampling defaults 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 18:31:49 +00:00
berriai-litellm-provider-info-sync[bot]
a04ba30f7d
chore(prices): sync OpenRouter prices: 172 models, 2 new 
openrouter/~anthropic/claude-fable-latest: supports_web_search
openrouter/~anthropic/claude-haiku-latest: supports_web_search
openrouter/~anthropic/claude-opus-latest: supports_web_search
openrouter/~anthropic/claude-sonnet-latest: supports_web_search
openrouter/~deepseek/deepseek-flash-latest: max_tokens, max_output_tokens, input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/~deepseek/deepseek-v4-flash-latest: max_tokens, max_output_tokens, input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/~google/gemini-flash-latest: supports_web_search
openrouter/~google/gemini-pro-latest: supports_web_search
openrouter/~moonshotai/kimi-latest: input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/~openai/gpt-astra-latest: supports_web_search
openrouter/~openai/gpt-luna-latest: supports_web_search
openrouter/~openai/gpt-mini-latest: supports_web_search
openrouter/~openai/gpt-sol-latest: supports_web_search
openrouter/~openai/gpt-terra-latest: supports_web_search
openrouter/~x-ai/grok-latest: supports_web_search
openrouter/~z-ai/glm-latest: max_tokens, max_output_tokens, input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/anthropic/claude-3-haiku: supports_web_search
openrouter/anthropic/claude-fable-5: supports_web_search
openrouter/anthropic/claude-fable-5:batch: supports_web_search
openrouter/anthropic/claude-fable-5.1: supports_web_search
openrouter/anthropic/claude-fable-5.1:batch: supports_web_search
openrouter/anthropic/claude-haiku-4.5: supports_web_search
openrouter/anthropic/claude-haiku-4.5:batch: supports_web_search
openrouter/anthropic/claude-opus-4: supports_web_search
openrouter/anthropic/claude-opus-4.1: supports_web_search
openrouter/anthropic/claude-opus-4.1:batch: supports_web_search
openrouter/anthropic/claude-opus-4.5: supports_web_search
openrouter/anthropic/claude-opus-4.5:batch: supports_web_search
openrouter/anthropic/claude-opus-4.6: supports_web_search
openrouter/anthropic/claude-opus-4.6:batch: supports_web_search
openrouter/anthropic/claude-opus-4.7: supports_web_search
openrouter/anthropic/claude-opus-4.7:batch: supports_web_search
openrouter/anthropic/claude-opus-4.8: supports_web_search
openrouter/anthropic/claude-opus-4.8:batch: supports_web_search
openrouter/anthropic/claude-opus-5: supports_web_search
openrouter/anthropic/claude-opus-5:batch: supports_web_search
openrouter/anthropic/claude-sonnet-4: supports_web_search
openrouter/anthropic/claude-sonnet-4.5: supports_web_search
openrouter/anthropic/claude-sonnet-4.5:batch: supports_web_search
openrouter/anthropic/claude-sonnet-4.6: supports_web_search
openrouter/anthropic/claude-sonnet-4.6:batch: supports_web_search
openrouter/anthropic/claude-sonnet-5: supports_web_search
openrouter/anthropic/claude-sonnet-5:batch: supports_web_search
openrouter/deepseek/deepseek-v4-flash: input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/deepseek/deepseek-v4-flash-0731: input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/deepseek/deepseek-v4-flash-vision-exp: max_tokens, max_output_tokens
openrouter/deepseek/deepseek-v4-pro: max_tokens, max_output_tokens, input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/deepseek/deepseek-v4.1-flash: off_peak_pricing, input_cost_per_token, output_cost_per_token, cache_read_input_token_cost
openrouter/google/gemini-2.5-flash: supports_web_search
openrouter/google/gemini-2.5-flash-image: supports_web_search
openrouter/google/gemini-2.5-flash-lite: supports_web_search
openrouter/google/gemini-2.5-flash-lite:batch: supports_web_search
openrouter/google/gemini-2.5-flash:batch: supports_web_search
openrouter/google/gemini-2.5-pro: supports_web_search
openrouter/google/gemini-2.5-pro-preview: supports_web_search
openrouter/google/gemini-2.5-pro:batch: supports_web_search
openrouter/google/gemini-3-flash-preview: supports_web_search
openrouter/google/gemini-3-flash-preview:batch: supports_web_search
openrouter/google/gemini-3-pro-image: supports_web_search
openrouter/google/gemini-3-pro-image-preview: supports_web_search
 2026-09-19 18:31:02 +00:00
ryan-crabbe-berri
82fd632153 test(ui): share one chart bar lookup across Top Virtual Keys tests 
The key_exists chart test added a second direct DOM lookup for the Recharts bars, which exposes no role or label, and pushed testing-library/no-node-access over its budget (709 > 707). Both chart tests now go through one helper
 2026-09-19 11:22:01 -07:00
kerry-berri
fc5f6c4b50
Merge pull request #41964 from BerriAI/litellm_registry_audit_20260919 
fix(model_prices): drop anthropic deprecation floors and correct azure gpt-4.1-nano retirement date
 2026-09-19 11:18:32 -07:00
yucheng-berri
2542ea0320
Merge pull request #41787 from BerriAI/litellm_llm_guard_proxy_call_types 
fix(llmguard): accept proxy async call types
 2026-09-19 11:17:21 -07:00
ryan-crabbe-berri
89bf870225 fix(ui): stop Top Virtual Keys from opening keys that are not in the database 
/user/daily/activity now reports key_exists on each api key's metadata, true
only when the key is in the active key table that /key/info reads. Top Virtual
Keys renders the Key ID as plain text with an explanatory tooltip and ignores
chart bar clicks when key_exists is false, so deleted keys and CLI/SSO session
keys no longer dead-end on a "Key not found in database" toast
 2026-09-19 11:08:21 -07:00
Devin AI
107ec2706b style(ui): format Top Virtual Keys aggregation test 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 11:04:46 -07:00
Devin AI
88799f6f80 fix(ui): fall back to user id in Top Virtual Keys user column 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 11:04:46 -07:00
Devin AI
e93fe60512 fix(ui): hide Top Virtual Keys user column when rows carry no user 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 11:04:26 -07:00
Devin AI
3d805e5166 fix(ui): show user attribution in Top Virtual Keys usage tables 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 11:04:26 -07:00
yucheng-berri
2886b8ee27
Merge pull request #41939 from BerriAI/litellm_responses_missing_input_400 
* fix(proxy): return 400 instead of 500 for /v1/responses without input

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(proxy): validate input before starting background responses polling

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(proxy): validate responses input after prompt template expansion

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: yucheng <yucheng@berri.ai>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 11:02:30 -07:00
yucheng
c38dda2b2f fix(llmguard): drop call types the proxy never routes through moderation 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 17:57:47 +00:00
tin-berri
77a4624f13
Merge pull request #41920 from BerriAI/litellm_claude_auto_cache_providers 
fix(caching): scope automatic breakpoints to supported Claude transports
 2026-09-19 12:54:30 -05:00
yucheng-berri
b6758159dd
Merge pull request #41982 from BerriAI/litellm_otel_v2_langfuse_embedding_output 
* fix(otel v2): summarize embedding vectors as Langfuse observation output

The v2 LLM span built its output only from response choices, so /v1/embeddings
rendered a Langfuse generation with input, usage and cost but a blank output.
Embedding calls now carry an EmbeddingOutput(count, dimensions) summary that the
Langfuse mapper serializes as the observation output, and they are exported with
the embedding observation type instead of generation. Chat and Responses output
mapping is unchanged.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(otel v2): keep embedding observations typed as generation in Langfuse

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: yucheng <yucheng@berri.ai>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 10:53:13 -07:00
Joshua Valluru
78e1103bb8 fix(ci): preserve shared runner setup time allowance 2026-09-19 10:46:38 -07:00
yucheng
537cdaf487 Revert "Merge pull request #41220 from BerriAI/litellm_post_call_guardrail_context" 
This reverts commit e40b90bbfa, reversing
changes made to d8d5437f55.
 2026-09-19 17:45:15 +00:00
Joshua Valluru
8f3562ed9c ci(mcp): consolidate integration tests into shared workflow 2026-09-19 10:41:36 -07:00
yucheng
c4d6c3046e fix(otel v2): keep embedding observations typed as generation in Langfuse 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 17:38:20 +00:00
yuneng-jiang
d0f60fcdec
Merge pull request #41985 from BerriAI/litellm_config_shadows_db_warning 
feat(proxy): say when a stored setting is ignored because the config file owns it
 2026-09-19 10:36:01 -07:00
Yassin Kortam
4487a9915b
Merge pull request #41915 from BerriAI/litellm_distributed_tpm_shared_redis_check 
fix(router): enforce model tpm limits against shared redis usage across replicas
 2026-09-19 10:22:25 -07:00
Yuneng Jiang
7353b779c2
feat(proxy): say when a stored setting is ignored because the config file owns it 
The config file winning over the database was silent. An admin who had set
a value through the UI and later pinned the same key in the file saw their
stored value quietly stop applying, with nothing said at boot and nothing
said when a later write was refused.

Startup now warns once per key whose stored value differs from the file's,
naming the key and what to do about it. The refusal raised on a write to a
config-owned key carries the same sentence, so the log and the 400 read
identically, and both call out that a stored value exists and will never be
applied. The /config/update refusal gained the same detail.

Keys the file does not declare are untouched: the database still owns them,
and a stored value equal to the file's is not worth a warning.
 2026-09-19 10:20:31 -07:00
yujonglee
bd82d73ca1
Merge pull request #41981 from BerriAI/litellm_rust_typed_pyo3 
refactor(rust): use typed pyo3 APIs instead of getattr/import strings
 2026-09-19 10:09:34 -07:00
Tin Chi Lo
2b086dc7aa fix(caching): scope automatic breakpoints to supported Claude transports 2026-09-19 09:55:38 -07:00
yujonglee
209a780992
Merge pull request #41977 from BerriAI/litellm_rust_sealed_request_textract 
feat(rust): add Amazon Textract to litellm.ocr and sign provider requests after host hooks
 2026-09-19 09:53:07 -07:00
yucheng
c5181f6178 fix(otel v2): summarize embedding vectors as Langfuse observation output 
The v2 LLM span built its output only from response choices, so /v1/embeddings
rendered a Langfuse generation with input, usage and cost but a blank output.
Embedding calls now carry an EmbeddingOutput(count, dimensions) summary that the
Langfuse mapper serializes as the observation output, and they are exported with
the embedding observation type instead of generation. Chat and Responses output
mapping is unchanged.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 16:52:25 +00:00
Yujong Lee
619a19b8a2 refactor(rust): use typed pyo3 APIs instead of getattr/import strings 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 16:46:34 +00:00
Joshua Valluru
fb56a14cd4 chore(mcp): merge main with unit test timeout safeguards 2026-09-19 09:42:08 -07:00
kerry-berri
5d28684016
Merge pull request #41966 from BerriAI/litellm-providers/price-sync-azure 
chore(prices): sync Azure prices: 5 models, 5 deprecated
 2026-09-19 09:41:53 -07:00
Devin AI
2f1c8669ec fix(model_prices): drop anthropic "not sooner than" floors from deprecation_date 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-09-19 16:40:05 +00:00
kerry-berri
6718fd67fb
Merge pull request #41328 from BerriAI/litellm_e2e_cost_calculation_scripted_provider 
test(integration): literal request/response cost tracking suite on a test-owned cost map
 2026-09-19 09:40:04 -07:00
Mateo Wang
f9d4979d21
Merge pull request #41946 from BerriAI/litellm_deflake_20260919 2026-09-19 09:38:25 -07:00