user 662d05531d fix(proxy): close three more org-boundary escape paths ... Continuation of Veria E3NpkuAd / Audit-B hardening. All three are the same anti-pattern PR #25904 already addressed for _user_is_org_admin and /user/delete: route-level gate trusts a caller-supplied scope field, handler operates on a different scope. 1. /user/update no longer silently creates a user when the target email doesn't exist. Pre-fix, an org admin could supply a fresh email + caller-chosen budget/models/metadata; the INSERT path created the user with no org attachment, bypassing /user/new's org/team authorization. Now require PROXY_ADMIN for the create branch; return 404 otherwise. Also fixes /user/bulk_update because it dispatches through the same _update_single_user_helper. 2. /team/bulk_member_add with all_users=true restricted to PROXY_ADMIN. The flag pulls every user in the database into the target team, ignoring org scope — any team admin could use it to capture every user across every org into their team. 3. /team/update now verifies destination-org admin rights. When the request carries an organization_id that differs from the team's current org, an org admin of the caller's current org could previously relocate the team into any other org (draining their resources, or capturing a team they once administered). Require PROXY_ADMIN or org-admin of the DESTINATION org for the relocation. Regression tests for #1 and #3; #2 covered by the existing bulk_add suite after the gate addition.		2026-04-17 00:36:28 +00:00
..
a2a_protocol	fix(a2a): default create_a2a_client timeout to DEFAULT_A2A_AGENT_TIMEOUT	2026-04-10 21:06:44 +03:00
anthropic_interface	style: run black formatter on entire codebase	2026-03-11 17:07:57 -03:00
assistants
batch_completion	fix: prompt registry	2026-02-18 00:34:54 +05:30
batches	Merge pull request #23957 from Sameerlite/litellm_vertex-cancel-batch	2026-03-20 23:32:50 +05:30
caching	Merge pull request #25665 from BerriAI/litellm_oss_staging_04_13_2026_p1	2026-04-14 23:50:08 +05:30
completion_extras	fix(lint): apply Black formatting to 14 files (#24532)	2026-03-31 07:45:55 -07:00
compression	fix(mypy): resolve type errors in compression/compress.py and __init__.py	2026-04-14 10:54:31 -07:00
containers	feat(containers): Azure routing, managed container IDs, delete response parsing (#25287)	2026-04-11 09:21:01 -07:00
endpoints/speech/speech_to_completion_bridge
evals	Root cause fix - migrate all logging update to use 1 function - for centralized kwarg updates (#23659)	2026-03-15 23:21:01 -07:00
experimental_mcp_client	refactor(mcp): reuse existing sessions for initialize instructions	2026-04-14 14:46:06 +03:00
files	Update streaming.py. Provide Type Annotation for empty dict	2026-04-11 13:04:25 -07:00
fine_tuning	address greptile review feedback (greploop iteration 1)	2026-03-27 20:04:41 +05:30
google_genai	Root cause fix - migrate all logging update to use 1 function - for centralized kwarg updates (#23659)	2026-03-15 23:21:01 -07:00
images	Root cause fix - migrate all logging update to use 1 function - for centralized kwarg updates (#23659)	2026-03-15 23:21:01 -07:00
integrations	Merge pull request #25665 from BerriAI/litellm_oss_staging_04_13_2026_p1	2026-04-14 23:50:08 +05:30
interactions	Root cause fix - migrate all logging update to use 1 function - for centralized kwarg updates (#23659)	2026-03-15 23:21:01 -07:00
litellm_core_utils	Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_yj_apr15	2026-04-16 09:17:20 -07:00
llms	Merge pull request #25871 from BerriAI/litellm_yj_apr15	2026-04-16 10:11:48 -07:00
ocr	Root cause fix - migrate all logging update to use 1 function - for centralized kwarg updates (#23659)	2026-03-15 23:21:01 -07:00
passthrough	style: run black formatter on entire codebase	2026-03-11 17:07:57 -03:00
proxy	fix(proxy): close three more org-boundary escape paths	2026-04-17 00:36:28 +00:00
proxy_auth	fix: prompt registry	2026-02-18 00:34:54 +05:30
rag	security: prevent API key leaks in error tracebacks, logs, and alerts	2026-04-14 23:09:17 +00:00
realtime_api	Root cause fix - migrate all logging update to use 1 function - for centralized kwarg updates (#23659)	2026-03-15 23:21:01 -07:00
rerank_api	Root cause fix - migrate all logging update to use 1 function - for centralized kwarg updates (#23659)	2026-03-15 23:21:01 -07:00
responses	fix(ci): resolve mypy and ruff lint failures	2026-04-15 21:12:51 -07:00
router_strategy	fix(router): discard oldest entry when trimming latency list in lowest_latency strategy (#25548)	2026-04-14 23:37:49 +05:30
router_utils	fix(router): don't create litellm_metadata for non-Responses API calls in encrypted_content_affinity_check (#25347)	2026-04-08 21:11:19 -07:00
search	Root cause fix - migrate all logging update to use 1 function - for centralized kwarg updates (#23659)	2026-03-15 23:21:01 -07:00
secret_managers	address review feedback	2026-04-11 21:52:39 -07:00
skills	Root cause fix - migrate all logging update to use 1 function - for centralized kwarg updates (#23659)	2026-03-15 23:21:01 -07:00
types	fix(utils): allowed_openai_params must not forward unset params as None (#25777)	2026-04-16 19:04:26 +05:30
vector_store_files	Root cause fix - migrate all logging update to use 1 function - for centralized kwarg updates (#23659)	2026-03-15 23:21:01 -07:00
vector_stores	Root cause fix - migrate all logging update to use 1 function - for centralized kwarg updates (#23659)	2026-03-15 23:21:01 -07:00
videos	[Staging] - Ishaan March 17th (#23903)	2026-03-18 15:09:01 -07:00
__init__.py	fix(mypy): resolve type errors in compression/compress.py and __init__.py	2026-04-14 10:54:31 -07:00
_internal_context.py	fix(proxy): harden request parameter handling	2026-04-16 01:38:12 +00:00
_lazy_imports.py	style: run black formatter on entire codebase	2026-03-11 17:07:57 -03:00
_lazy_imports_registry.py	feat: add sagemaker_nova provider for Amazon Nova models on SageMaker (#21542)	2026-03-14 15:10:01 -07:00
_logging.py	security: prevent API key leaks in error tracebacks, logs, and alerts	2026-04-14 23:09:17 +00:00
_redis.py	Litellm ishaan march23 - MCP Toolsets + GCP Caching fix (#25146) (#25155)	2026-04-04 16:23:21 -07:00
_redis_credential_provider.py	Litellm ishaan march23 - MCP Toolsets + GCP Caching fix (#25146) (#25155)	2026-04-04 16:23:21 -07:00
_service_logger.py	style: run black formatter on entire codebase	2026-03-11 17:07:57 -03:00
_uuid.py
_version.py
anthropic_beta_headers_config.json	Fix tests + add docs	2026-04-16 21:45:31 +05:30
anthropic_beta_headers_manager.py	Refactor: Filtering beta header after transformation	2026-03-16 10:47:15 +05:30
blog_posts.json	docs(blog): add WebRTC blog post link	2026-03-13 17:54:33 +05:30
budget_manager.py
constants.py	Merge pull request #25867 from BerriAI/litellm_day_0_opus_4.7_support	2026-04-16 09:42:11 -07:00
cost.json
cost_calculator.py	fix(mypy): use explicit None check for cache rate values to satisfy type checker	2026-04-14 19:03:56 -07:00
exceptions.py	style: run black formatter on entire codebase	2026-03-11 17:07:57 -03:00
main.py	Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_yj_apr15	2026-04-16 09:17:20 -07:00
model_prices_and_context_window_backup.json	Merge pull request #25867 from BerriAI/litellm_day_0_opus_4.7_support	2026-04-16 09:42:11 -07:00
mypy.ini
policy_templates_backup.json	feat(add-new-block_code_execution-guardrail): prevent agent from executing code (#22154)	2026-02-25 22:02:14 -08:00
provider_endpoints_support_backup.json	feat(search): add Serper (serper.dev) as search provider (#23112)	2026-03-09 08:40:37 -07:00
py.typed
router.py	fix(router): pass custom_llm_provider to get_llm_provider for unprefixed model names (#25334)	2026-04-08 21:27:13 -07:00
scheduler.py	style: run black formatter on entire codebase	2026-03-11 17:07:57 -03:00
setup_wizard.py	Add support for opus 4.7 with new effort levels	2026-04-16 20:45:45 +05:30
timeout.py
utils.py	Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_yj_apr15	2026-04-16 09:17:20 -07:00