v1.96.0-rc.1

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.96.0-rc.1

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.96.0-rc.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.96.0-rc.1

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• fix(mcp): annotate connected-app reachability on the gateway connect page by @tin-berri in #34867
• fix(mcp): recover the tool-name prefix boundary from registered prefixes by @tin-berri in #34673
• fix(e2e): exclude skipped tests from coverage-registry numerator by @yuneng-berri in #35327
• feat(ui): expose classifier context window fields on Auto-Router screens (LIT-5036) by @tin-berri in #35315
• fix(mcp): deny MCP access when a named entitlement cannot be read by @yassin-berriai in #35160
• feat(proxy): add generic list handler for /management/v1 by @yuneng-berri in #35308
• fix(aiohttp): dispose recycled client sessions deterministically by @yassin-berriai in #33428
• test(e2e): skip the three Datadog MCP tool-call tests pending LIT-5052 by @ryan-crabbe-berri in #35380
• feat(mcp): source the ID-JAG subject from the user's stored SSO assertion by @yassin-berriai in #35147
• test(e2e): skip the throughput SLO load test pending LIT-5054 by @ryan-crabbe-berri in #35381
• fix(guardrails): run bedrock guardrail on MCP tool calls in during_mcp_call mode by @yassin-berriai in #35149
• fix(tool-management): drop unsupported prisma select kwarg from team lookup by @yuneng-berri in #35293
• feat(proxy): add GET /management/v1/budgets by @yuneng-berri in #35310
• fix(gemini): do not send duplicate thoughtSignature copies to Gemini by @mgeorgaklis in #35004
• feat(ui): show which log rows are the auto-router's own classifier calls by @tin-berri in #35304
• fix(ui): nest source object in Claude Code marketplace settings snippet by @devin-ai-integration[bot] in #35322
• fix(type-discipline): exempt values frozen in place by tuple/frozenset/MappingProxyType from LIT002 by @mateo-berri in #35325
• feat(ui): add sorting, filtering and search to the budgets page by @yuneng-berri in #35309
• fix(ui): keep the session view open when selecting a log inside it by @ryan-crabbe-berri in #35399
• fix(mcp): enforce tool entitlements on every MCP tool dispatch path by @yassin-berriai in #35156
• fix(deps): raise aiohttp floor to 3.14.2 to clear pooled-connection timeouts by @yuneng-berri in #35337
• fix(tag-management): drop unsupported prisma select kwarg from key lookup by @yuneng-berri in #35288
• fix(proxy): stop model writes 500ing on another pod's delete by @ryan-crabbe-berri in #35400
• fix(ui): show pass through route selections and match team id substrings in team search by @devin-ai-integration[bot] in #35319
• chore(typing): replace Any kwargs unpacking with validated model parsing by @mateo-berri in #35397
• feat(proxy)!: gate all mock testing request params behind a single config flag by @yuneng-berri in #35423
• chore(typing): clear 2.4k basedpyright errors across 15 Any hotspot files by @mateo-berri in #35452
• fix(proxy): align team member add with existing user provisioning rules by @yuneng-berri in #35435
• feat(prometheus): add global exclude_metrics and exclude_labels options by @devin-ai-integration[bot] in #34201
• feat(proxy): let AI API keys read /model/info by @yuneng-berri in #35473
• chore(proxy): remove duplicate Sequence import in team endpoints by @yuneng-berri in #35479
• fix(a2a): keep config-defined agents registered and accept the documented agents: key by @yassin-berriai in #35163
• ci: run unit tests on pushes to main and litellm_internal_staging by @yuneng-berri in #35475
• chore: bump litellm-enterprise 0.1.52 -> 0.1.53 by @yuneng-berri in #35476
• chore(ui): rebuild committed Admin UI bundle by @yuneng-berri in #35484
• fix(rate-limit): enforce token limits when the pre-call increment is zero by @shivamrawat1 in #35422
• fix(helm): render pod-level securityContext on the migration Job by @yassin-berriai in #35482
• fix(router): honor request-level num_retries over a deployment's litellm_params value by @yassin-berriai in #35483
• fix(spend): bound each spend-log write statement by payload bytes by @yassin-berriai in #34956
• feat(proxy): bound DB statement and lock time via general_settings by @yassin-berriai in #35496
• fix(bedrock): cache AssumeRole credentials per attributed identity by @yassin-berriai in #35467
• feat(complexity_router): let the classifier see assistant turns and rate what a short reply approves by @tin-berri in #35471
• feat(proxy): push config sync to pods via redis pub/sub by @mateo-berri in #35436
• test(e2e): derive the throughput SLO per replica and surface locust's error breakdown by @yassin-berriai in #35494
• feat(helm): add pod-hardening and migration-Job knobs to the componentized chart by @yassin-berriai in #35489
• fix(docker): bake prisma offline in the componentized migrations image by @yassin-berriai in #35485
• fix(batches): encode public model group on background-created output file ids by @devin-ai-integration[bot] in #35406
• fix(componentized): honor USE_DDTRACE in the gateway and backend deployments by @yassin-berriai in #35490
• fix(helm): give gateway and backend probes an explicit timeoutSeconds by @yassin-berriai in #35497
• fix(ci): let the E2E proxy accept the mock testing params its suite sends by @yuneng-berri in #35511
• test(proxy): separate the member_add permission gate from the provisioning gate by @yuneng-berri in #35507
• test(logging): pin routing_decision and internal_call_origin in the gcs pubsub spend log fixture by @yuneng-berri in #35506
• feat(ui): expose the assistant-turn classifier context switch on Auto-Router screens by @tin-berri in #35500
• test(proxy): assert _delete_deployment's still-desired id set instead of a delete count by @yuneng-berri in #35505
• refactor(complexity_router): drop the tier-rubric override, close the rubric on the window it was given by @tin-berri in #35504
• fix(deps): move pydantic-settings into the base dependencies by @yuneng-berri in #35518
• refactor(lint): apply every safe ruff autofix and zero 28 strict-rule budgets by @mateo-berri in #35495
• build(makefile): swap npm ci for npm install so bootstrap no-ops on unchanged ui deps by @mateo-berri in #35509
• fix(team-callbacks): report API-registered callbacks from GET /team/{team_id}/callback by @yucheng-berri in #35512
• fix(ui): land general login on the keys dashboard, send MCP consent to /ui/connect by @tin-berri in #35523
• build(makefile): run bootstrap before pre-commit lint by @mateo-berri in #35547
• chore: rebuild Admin UI bundle by @yuneng-berri in #35550
• test(e2e): skip the strict-priority and throughput SLO tests pending LIT-5118 / LIT-5119 by @ryan-crabbe-berri in #35575
• test(e2e): poll key spend to a deadline in budget reset advances tests by @ryan-crabbe-berri in #35572
• chore(ci): promote internal staging to main by @yuneng-berri in #35501

Full Changelog: v1.96.0-dev.2...v1.96.0-rc.1