v1.95.0-rc.1

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.95.0-rc.1

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.95.0-rc.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.95.0-rc.1

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• fix(ui): keep cache leakage time range picker inline at narrow widths by @tin-berri in #34439
• feat(ui): show in the log drawer and session sidebar when an auto-router served a request by @tin-berri in #34434
• refactor(ui): migrate memory page to shadcn by @yuneng-berri in #34366
• refactor(ui): migrate budgets, skills, ui-theme to shadcn by @yuneng-berri in #34465
• refactor(ui): migrate access-groups, vector-stores, organizations to shadcn by @yuneng-berri in #34466
• refactor(ui): migrate logging-and-alerts, caching, policies to shadcn by @yuneng-berri in #34468
• feat(ui): standalone /connect route for MCP OAuth, decoupled from Chat UI flag by @tin-berri in #34334
• refactor(ui): migrate mcp-servers, tag-management, tool-policies to shadcn by @yuneng-berri in #34469
• test(e2e): pin the a2a bridge agent's Anthropic key so message/send works by @mubashir1osmani in #34512
• fix(guardrails/model_armor): handle None metadata in post_call _process_response (#34390) by @devin-ai-integration[bot] in #34405
• feat(anthropic): add Claude Opus 5 by @mateo-berri in #34518
• chore(ci): promote internal staging to main by @yuneng-berri in #34519
• test(a2a): assert the property agent returns listings, not just non-empty text by @devin-ai-integration[bot] in #34515
• fix(logging): stop scheduling sync failure_handler concurrently with async_failure_handler by @yassin-berriai in #34306
• fix(vertex): incrementally parse accumulated Gemini stream JSON to prevent multi-value wedge by @yassin-berriai in #34320
• test: replace deprecated gpt-5-codex with gpt-5.3-codex by @yuneng-berri in #34520
• fix(gateway): install bedrock-realtime extra for Nova Sonic realtime by @mubashir1osmani in #34426
• feat(proxy): add SAML 2.0 SSO for the admin UI by @yassin-berriai in #31429
• feat(guardrails): add run_in_parallel opt-in for concurrent pre_call and post_call guardrails by @noahnistler in #33770
• fix: handle explicit outputInfo: null in Vertex AI batch response by @yucheng-berri in #34473
• fix(otel): keep an MCP tool call in one trace, anchored to its own request by @yassin-berriai in #34537
• fix(ui): keep a key's MCP toolsets when saving an edit by @tin-berri in #34452
• fix(ui): bind key duration input to one Form.Item so pre-filled expiry submits by @ryan-crabbe-berri in #34521
• feat(ui): migrate the Create Organization form to shadcn and react-hook-form by @ryan-crabbe-berri in #34552
• refactor(ui): derive the dashboard object_permission type from the generated schema by @tin-berri in #34454
• test(e2e): cover MCP access-group tool selection at key creation by @mubashir1osmani in #34480
• test: remove tests that mutation analysis proved assert nothing by @yuneng-berri in #34475
• fix(ui): keep entity usage tabs aligned with their panels by @yuneng-berri in #34573
• fix(guardrails): stop reporting a no-op guardrail as applied on passthrough by @tin-berri in #34411
• fix(proxy): return 400 instead of 500 for chat completions without messages by @devin-ai-integration[bot] in #34547
• fix(guardrails): keep guardrail information in spend logs when the caller sends its own metadata by @tin-berri in #34458
• fix(responses): strip include_usage from stream_options instead of dropping the param by @devin-ai-integration[bot] in #34549
• fix(guardrails): add /v1/messages support for Straiker plugin by @yucheng-berri in #34548
• fix(proxy/batches): resolve managed unified input_file_id to storage_url with ownership check before dispatch by @yucheng-berri in #34474
• fix(guardrails): derive tokens_saved when Headroom compression service omits it by @tin-berri in #34578
• refactor(ui): migrate routing groups table onto the shared DataTable by @yuneng-berri in #34571
• fix(proxy): attribute org spend for team-linked credentials minted without org_id by @ryan-crabbe-berri in #34577
• fix(proxy/batches): make managed-file resolution additive, restore fall-back for missing-row and lookup errors by @yucheng-berri in #34584
• fix(bedrock-mantle): backfill usage on non-streaming /v1/messages responses by @devin-ai-integration[bot] in #34446
• fix(proxy): cap /v1/tool/spend window at 30 days and bound every SpendLogs read by @tin-berri in #34582
• feat(passthrough): record cost and usage reported by the upstream target by @yuneng-berri in #34590
• fix(logs): scope and bound the End User filter on the logs page by @yuneng-berri in #34579
• feat(ui): deep-link virtual key detail view via ?key= query param by @ryan-crabbe-berri in #34591
• revert(ui): return Models + Endpoints tabs to in-memory routing, keep the ?model drill-in by @ryan-crabbe-berri in #34629
• fix(proxy): merge model-level guardrails before pre_call_hook by @hclsys in #29654
• fix(router): don't cool down parent deployment on advisor sub-call failure by @devin-ai-integration[bot] in #33792
• test(e2e): cover /vllm chat passthrough against a hosted backend by @mubashir1osmani in #34432
• test(e2e): point four suites at models the providers still serve by @mubashir1osmani in #34567
• test(e2e): make the bedrock guardrail test match the guardrail it points at by @mubashir1osmani in #34568
• fix(otel): stamp an MCP tool failure on the request that carried it by @yassin-berriai in #34551
• test(e2e): set reasoning_effort=none for gpt-5.6 chat tool calls by @mubashir1osmani in #34569
• test(e2e): cover /v1/images/edits by @mubashir1osmani in #34476
• chore(deps): bump gitpython and postcss to advisory-clear versions by @yuneng-berri in #34634
• fix(proxy): hash caller-supplied key in key update audit log object_id by @yucheng-berri in #34632
• test(e2e): cover /openai chat passthrough cost logging by @mubashir1osmani in #34470
• fix(proxy): global max_budget ignores budget_duration; enforce against the resettable proxy budget row by @ryan-crabbe-berri in #33732
• fix(mcp): use a toolset row's stored tool name as written by @tin-berri in #34559
• fix(auth): route JWT default-team into memberships instead of the create payload by @ryan-crabbe-berri in #33082
• ci: drop the docker SERVER_ROOT_PATH e2e job for a unit test by @devin-ai-integration[bot] in #34642
• test: stop bedrock tool acompletion tests from making real network calls by @ryan-crabbe-berri in #34644
• fix(proxy): stop litellm/proxy from shadowing installed packages on sys.path by @yassin-berriai in #34656
• fix(cost-optimization): swap methodology Collapse for a shadcn HoverCard by @tin-berri in #34598
• fix(ci): scope UI lint to the files a PR actually changed by @mateo-berri in #34600
• fix(mcp): stop leaking upstream server credentials in tool-call 403 by @tin-berri in #34340
• fix(batches): paginate managed batch list by unified_object_id cursor by @devin-ai-integration[bot] in #34192
• fix(e2e): stop tests from breaking the shared proxy for every suite after them by @mubashir1osmani in #34664
• fix(cost-optimization): anchor the savings line at a $0 range start by @tin-berri in #34453
• fix(bedrock): stop replaying expired Google OIDC tokens to STS on guardrail auth by @yucheng-berri in #34637
• chore: bump litellm-enterprise 0.1.51 -> 0.1.52, litellm-proxy-extras 0.4.80 -> 0.4.81 by @yuneng-berri in #34669
• chore(ui): rebuild Next.js build artifacts by @yuneng-berri in #34671
• fix(azure_ai): advertise 1M context window for Claude Opus 4.6+ on Foundry by @devin-ai-integration[bot] in #34556
• feat(mcp): send RFC 8707 resource indicators on upstream OAuth legs by @tin-berri in #34265
• fix(guardrails): resolve judge_model credentials via lazy Router lookup in llm_as_a_judge by @devin-ai-integration[bot] in #34509
• style(ui): match MCP Servers tabs to the dashboard's line tab pattern by @yuneng-berri in #34685
• fix(ui): center vertical toolbar dividers by @yuneng-berri in #34684
• fix(ui): restore the Add MCP Server dialog size and header spacing by @yuneng-berri in #34679
• fix(ui): truncate long team names in the models table team dropdown by @yuneng-berri in #34689
• fix(e2e/ui): resolve dashboard base URL from env instead of hardcoding localhost by @mubashir1osmani in #34739
• chore(deps): bump gitpython to 3.1.55 and brace-expansion to 5.0.8 by @yuneng-berri in #34798
• fix(guardrails): preserve cache_control breakpoints in compresr write-back by @tin-berri in #34660
• fix(install): pass an explicit Python version request to uv tool install by @tin-berri in #34750
• refactor(management): move the logs end-user filter onto /management/v1 by @yuneng-berri in #34691
• fix: match exact class in callback dedup so a custom subclass does not block a built-in logger by @yucheng-berri in #34804
• fix(prometheus): populate cache write token metrics for OpenAI-style usage by @yucheng-berri in #34803
• chore(typing): clear 2.7k basedpyright Any errors across 15 hotspot files by @mateo-berri in #34745
• test(e2e): stop racing control-plane writes across the mcp, a2a, guardrail and passthrough suites by @mubashir1osmani in #34833
• fix(ui): validate default team values in Default User Settings by @ryan-crabbe-berri in #34815
• fix(proxy): sanitize per-key callback config out of logged metadata by @yuneng-berri in #32583
• fix(proxy): roll up tool spend daily instead of scanning SpendLogs by @tin-berri in #34675
• fix(responses_bridge): keep one chat completion id per stream and always stream completed responses by @devin-ai-integration[bot] in #34539
• fix(guardrails): compress content-parts messages in headroom guardrail (Anthropic traffic) by @tin-berri in #34586
• fix(router): release the pre-routing strategy slot when a deployment is replaced or deleted by @shivamrawat1 in #34564
• fix(guardrails): classify all 4xx HTTPException guardrail blocks as intervened by @devin-ai-integration[bot] in #33821
• chore: rebuild Admin UI bundle for release by @yuneng-berri in #34859
• test: unstale the reasoning-effort grid count and the responses bridge test by @yuneng-berri in #34868
• test(e2e): realign Admin UI specs with the MCP dialog and keyless landing by @yuneng-berri in #34870
• test(e2e): unblock the ui suite, fix the mcp registration race, park two known product bugs by @mubashir1osmani in #34853
• test(e2e): make MCP and prometheus e2e tests robust to data-plane sync lag by @ryan-crabbe-berri in #34854
• Fix cache leakage card layout to keep date picker on right by @tin-berri in #34885
• fix(gateway): route /a2a through the gateway component by @ryan-crabbe-berri in #34958
• fix(e2e): poll for both spend rows before asserting the cache-hit contract by @ryan-crabbe-berri in #34968
• test(e2e): skip passthrough headers test until stage can route custom paths to provider creds by @ryan-crabbe-berri in #34980
• feat(ui): mark Cost Optimization as beta in the left nav by @yuneng-berri in #34984
• fix(proxy): avoid DB outage during planned RDS IAM rotation by @mubashir1osmani in #34749
• chore(ci): promote internal staging to main by @yuneng-berri in #34864
• test(e2e): bound the post-/model/new servable wait at 40s by @yuneng-berri in #35020
• test(e2e): poll MCP tools across multi-worker lag (#35047) by @yuneng-berri in #35049

Full Changelog: v1.95.0-dev.2...v1.95.0-rc.1