v1.109.1

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. This release is signed with the key introduced in commit e82a3c6.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the published signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
  ghcr.io/berriai/litellm:v1.109.1

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.109.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.109.1

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• security(proxy): backport #51254 to stable/1.109.x by @shrey-berri in #51264
• chore: bump litellm 1.109.0 -> 1.109.1 by @yuneng-berri in #51298

Full Changelog: v1.109.0...v1.109.1