v1.93.0-dev.1

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.93.0-dev.1

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.93.0-dev.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.93.0-dev.1

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• feat(mcp): add entra_obo profile to the token_exchange (OBO) arm by @tin-berri in #31983
• chore(lint): zero out crash-class pyright rules and ban new type: ignore comments by @mateo-berri in #32152
• fix(headroom guardrail): log real token/compression stats instead of "allow" by @krrish-berri-2 in #32158
• fix(anthropic_messages): forward provider response headers on streaming /v1/messages responses by @mateo-berri in #32160
• fix(bedrock): emit SSE error event when invoke Messages stream ends without message_stop by @mateo-berri in #32159
• test(e2e): migrate access-control and inference-endpoint regression tests by @mubashir1osmani in #32016
• test(e2e): close coverage gaps across chat/responses, provider features, batches, prometheus, and langfuse eviction by @mubashir1osmani in #32165
• chore: add latest model rule to CLAUDE.md by @mateo-berri in #32164
• ci: gate CircleCI jobs on changed paths by @ryan-crabbe-berri in #32080
• fix(e2e): register batch + rust OCR deployments via /model/new by @mubashir1osmani in #32166
• fix: merge websearch tool params by @krrish-berri-2 in #32162
• test: de-flake langfuse callbacks-in-db e2e test by @yuneng-berri in #32167
• feat(router): add separate ITPM/OTPM deployment rate limits by @Sameerlite in #31952
• fix(streaming): surface in-body error payloads on OpenAI-compatible streams by @yassin-berriai in #32237
• fix(ui): reflect persisted "Store Prompts in Spend Logs" toggle on load by @devin-ai-integration[bot] in #32145
• feat(ui): add cost optimization feedback banner to models page by @krrish-berri-2 in #32174
• fix(spend): filter /global/spend/report by team_id when group_by=team by @yuneng-berri in #32170
• fix(guardrails): send only new messages since last assistant turn to CrowdStrike AIDR by @ryan-crabbe-berri in #31974
• feat(helm): support user-defined volumes and volumeMounts in microservices chart by @yassin-berriai in #32233
• fix(proxy): resolve os.environ/ refs for all AWS auth params in DB-sourced models by @yucheng-berri in #32256
• fix(main): forward verbosity param to chat completion providers by @mateo-berri in #32254
• feat(ui): flag experimental dashboard pages on the draft deprecation list by @ryan-crabbe-berri in #32132
• fix(proxy): stop CacheCodec dropping null fields on cache round-trip by @ryan-crabbe-berri in #32207
• feat(complexity_router): add custom_technical_keywords config by @mateo-berri in #32262
• fix(security): hash Bearer-prefixed API keys in spend logs by @devin-ai-integration[bot] in #31799
• test(e2e): probe the full spend read surface including schema-hidden routes by @mubashir1osmani in #32267
• fix(azure): build responses input_items url with path before query string by @mateo-berri in #32270
• fix(responses_id_security): decrypt response ids for input_items follow-ups by @mateo-berri in #32269
• fix(responses): map upstream 4xx on cancel to client error instead of 500 by @mateo-berri in #32271
• fix(docker): bump wolfi-base digest for glibc 2.43-r10 by @yuneng-berri in #32277
• fix(mcp): stamp oauth2_flow=authorization_code when persisting a DCR client registration by @tin-berri in #32283
• fix(logging): classify allm_passthrough_route as async to prevent duplicate success callbacks by @yucheng-berri in #32265
• fix(mcp): forward short OAuth state upstream, keep session in a cookie by @tin-berri in #32146
• fix(bedrock): honor AWS auth params in realtime handler by @mateo-berri in #32275
• feat(pricing): add azure data-zone and long-context pricing for gpt-5.4/5.5 by @devin-ai-integration[bot] in #32279
• fix(model_armor): scan MCP tool calls for pre_mcp_call / during_mcp_call modes by @yucheng-berri in #32296
• feat(jwt): fall back to DB team memberships when JWT has no team claims by @mateo-berri in #31356
• fix(responses-bridge): custom tool round-trip and allowlist preservation for Codex CLI by @mateo-berri in #32258
• feat(mcp): persist oauth2_flow explicitly on create instead of inferring it at read time by @tin-berri in #32288
• fix(dynamic_rate_limiter): make test_priority_reservation deterministic across minute rollover by @mateo-berri in #32299
• feat(vertex_ai): add Google Cloud Speech-to-Text Chirp 3 transcription support by @mateo-berri in #32274
• feat(mcp): startup backfill stamping oauth2_flow on legacy null rows by @tin-berri in #32290
• docs(github): note greptile runs automatically and require commit hashes in proof of fix by @mateo-berri in #32303
• test(e2e): add management suite covering key/team/user/org lifecycle and route permissions by @mubashir1osmani in #32300
• fix(streaming): stamp completion_start_time on first chunk for /v1/messages and /v1/responses by @yucheng-berri in #32284
• fix(mcp_semantic_filter): keep tool names whole in filter response header by @tin-berri in #32282
• fix(batches): price anthropic passthrough message batches correctly in batch cost job by @mateo-berri in #32307
• fix(proxy): trigger gateway fallbacks on local rate limit errors by @devin-ai-integration[bot] in #31788
• fix(responses): surface upstream error status on get instead of 500 by @mateo-berri in #32287
• fix(caching): pass only metadata to valkey semantic async embedding by @shivamrawat1 in #32295
• refactor(helm): move litellm-helm chart to helm/ and drop deploy folder by @yassin-berriai in #32234
• feat(cache): back the Redis URL and Database Index UI fields end-to-end by @yuneng-berri in #32075
• fix(proxy): wire general_settings SSRF allowlist to litellm globals by @Sameerlite in #32243
• fix(mcp): alias/display-name tool routing, REST filters, BYOK auth by @Sameerlite in #32320
• fix(gateway): keep the Prometheus /metrics Mount in the gateway route trim by @yassin-berriai in #32317
• fix(mcp): defer proxy import so completion(tools=...) works without proxy extras by @yassin-berriai in #32339
• fix(proxy): recover Prisma DB reconnect loop when client is disconnected by @yassin-berriai in #32323
• fix(responses): stop scheduling sync success_handler concurrently with async_success_handler by @yassin-berriai in #32239
• feat(otel): stamp gen_ai.response.time_to_first_chunk on streaming LLM spans by @yassin-berriai in #32236
• feat(terraform): vendor terraform-provider-litellm as source of truth with endpoint drift CI by @yassin-berriai in #32241
• docs(claude): note UI dev server command in run guidance by @ryan-crabbe-berri in #32344
• fix(mcp): apply semantic filter to expanded litellm_proxy tools and show filtered-out count by @tin-berri in #32285
• feat(budget): throttle keys after spend limit instead of revoking access by @yassin-berriai in #31300
• fix(spend): bound the logs-tab pagination count to stop full-window scans by @yassin-berriai in #31825
• refactor(ui): switch shadcn primitives from Radix to Base UI by @ryan-crabbe-berri in #32124
• feat(mcp)!: oauth2_flow read verbatim from DB rows and required in config; inference reduced to the request-time backstop by @tin-berri in #32292
• fix(bedrock): preserve stream param and decode SSE for bedrock mantle streaming by @mateo-berri in #32141
• chore: bump litellm-enterprise 0.1.47 -> 0.1.48, litellm 1.92.0 -> 1.93.0 by @yuneng-berri in #32349
• fix(main): stop per-request custom pricing from clobbering shared model_cost pricing by @mateo-berri in #32163
• fix(mcp): stop 'Team doesn't exist' warnings for UI dashboard sessions by @tin-berri in #32348
• ci(codspeed): re-enable benchmarks on litellm_internal_staging by @yassin-berriai in #32340
• feat(MCP/UI): add OAuth flow selector on the MCP edit page by @tin-berri in #32298
• test(ui): characterize DataTable behavior before shadcn reskin by @ryan-crabbe-berri in #32208
• test(e2e): add coverage registry and collector by @yuneng-berri in #32304
• fix(vertex_ai): build full request path when custom api_base has no path by @mateo-berri in #32367
• docs(CLAUDE.md): warn that harness-injected PR template copies strip HTML comments by @mateo-berri in #32373
• fix(vertex_ai): return create_vertex_url result directly for openai-path partner models with custom api_base by @mateo-berri in #32380
• feat(mcp): support oauth2_token_exchange auth type via REST API and dashboard by @tin-berri in #31772
• test(realtime): assert guardrail block on backend wire traffic instead of model refusal wording by @mateo-berri in #32388
• fix(bedrock): stop stale SigV4 headers clobbering fresh signature on strip-and-retry re-sign by @mateo-berri in #32371
• fix(mcp): apply outbound concurrency limit to OBO tool calls by @tin-berri in #32071
• test(ui): pin token-exchange field visibility to the oauth2_token_exchange auth type by @tin-berri in #32385
• feat(mcp): let users select the entra_obo token_exchange profile in the UI and API by @tin-berri in #32144
• chore(ci): promote internal staging to main by @yuneng-berri in #32400

Full Changelog: v1.92.0-rc.1...v1.93.0-dev.1