merge main - #27037

Merged

Sameerlite merged 554 commits into

litellm_fix_stateful_statless_mcpfrom

litellm_internal_staging

May 2, 2026

This pull request is big! We're only showing the most recent 250 commits

Commits on May 1, 2026

[Fix] Responses API: Omit Empty Body On DELETE
yuneng-berri
committed
bd63824
tests(vcr): force pure-httpx transport when VCR is active
mateo-berri
committed
265a94c
Merge pull request #26949 from BerriAI/litellm_/condescending-hawking-19bdeb
ryan-crabbe-berri
authored
76e43b7
Refresh Redis TTL on counter writes and skip stale in-memory on Redis miss

Michael Riad Zaky
authored and
Michael Riad Zaky
committed
9f08db9
Invalidate spend counters on budget reset

Michael Riad Zaky
authored and
Michael Riad Zaky
committed
fed5f36
Match docstring style on async_increment_cache

Michael Riad Zaky
authored and
Michael Riad Zaky
committed
ff2a938
Reorder counter invalidation to run after DB write

Michael Riad Zaky
authored and
Michael Riad Zaky
committed
4e26835
Merge pull request #26914 from BerriAI/litellm_googleGenContentHooks
Michael-RZ-Berri
authored
e4fb325
fix(responses): omit empty JSON body on DELETE response API requests
mateo-berri
committed
8bdc46e
Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_vcr-cassette-llm-tests-af37
mateo-berri
committed
722a1a9
Fix add_model_file_id_mappings when router returns single deployment dict
shivamrawat1
committed
e72eac9
harden partial budget reservation cleanup
stuxf
committed
38ebd4d
Merge pull request #26829 from BerriAI/litellm_budgetEnforcementMultiPod
Michael-RZ-Berri
authored
05e6402
Merge remote-tracking branch 'origin/litellm_internal_staging' into codex/budget-race-enforcement-greptile-fix
stuxf
committed
64fadc3
Merge branch 'litellm_internal_staging' into litellm_metrics_auth
shivamrawat1
committed
b75820b
skip invalid budget window reservations
stuxf
committed
46068be
tests(vcr): assert response shape, not exact bytes, in replay tests
mateo-berri
committed
95bce9a
Merge branch 'litellm_internal_staging' into litellm_batch_model_id_mapping
shivamrawat1
committed
b4df0e2
Merge branch 'litellm_internal_staging' into litellm_metrics_auth
shivamrawat1
committed
f4211ff
tests(vcr): patch vcrpy aiohttp record path instead of forcing httpx transport
mateo-berri
committed
687ff32
Merge pull request #26826 from BerriAI/litellm_health_status_pagination
yuneng-berri
authored
ebbe2f4
tests(vcr): drop redundant comments and docstrings
mateo-berri
committed
6728746
fix: close TOCTOU window in batch + dynamic rate limiters

krrish-berri-2
and
claude
committed
dbe5c3b
Merge branch 'litellm_internal_staging' of https://github.com/BerriAI/litellm into litellm_auth_bypass_tag_based_routing
harish-berri
committed
7c86e60
feat(rate-limit): atomic check-and-increment-by-N for multi-process safety

krrish-berri-2
and
claude
committed
dd57ae6
cap budget reservations to remaining headroom
stuxf
committed
405de46
avoid stale local spend counters after redis misses
stuxf
committed
15d845c
finalize budget reservations after counter updates
stuxf
committed
c28e093
Merge pull request #25499 from BerriAI/litellm_vertex_request_metadata_labels
Sameerlite
authored
72ddbce
Merge pull request #26222 from BerriAI/litellm_anthropic-json-mode-nonstreaming-mixed-tools
Sameerlite
authored
efa33bf
fallback to plain org cache for spend counters
stuxf
committed
dcfde1b
skip invalid budget window counter increments
stuxf
committed
4f87699
add budget reservation disable flag
stuxf
committed
f30bfcf
remove budget reservation disable flag
stuxf
committed
ce17639
address budget reservation review edges
stuxf
committed
b53adf7
bump: version 0.4.69 → 0.4.70
yuneng-berri
committed
dd549d9
uv lock
yuneng-berri
committed
6da13ef
feat(mcp): enforce org-level MCP server and toolset permissions
Sameerlite
committed
b540a71
Merge pull request #26961 from BerriAI/yj_bump_apr30
shin-berri
authored
9397409
fix(mcp): address Greptile P1/P2 findings in org-level permission enforcement
Sameerlite
committed
8398952
harden budget reservation edge cases
stuxf
committed
0b1ea9e
fix(mcp): cache negative org object_permission lookups to avoid per-request DB hits
Sameerlite
committed
03f6818
Merge pull request #26962 from BerriAI/litellm_internal_staging
yuneng-berri
authored
934ecdc
chore(proxy): align resource model auth checks
stuxf
committed
336fe82
chore(proxy): satisfy auth model checks CI
stuxf
committed
3b54012
chore(proxy): stabilize lazy openapi snapshot
stuxf
committed
a5135b1
test(proxy): cover resource model extraction fallbacks
stuxf
committed
0704f67
test(proxy): narrow media resource decoding
stuxf
committed
6ef2694
handle bad reservation counters after spend write
stuxf
committed
66c0fe2
test(proxy): cover lazy openapi operation ids
stuxf
committed
f51dd68
fix(cache): persist and replay streamed Responses API requests (#24580)

ohnoah
authored and
Sameerlite
committed
8947a74
fix: resolve access group names in _filter_models_by_team_id (#25224)

gowtham2809
authored and
Sameerlite
committed
262782f
fix(bedrock): handle document content blocks in Converse API message conversion (#24644)

authored and
Sameerlite
committed
f49c91e
feat(xai): add parallel_tool_calls to supported params (#25106)

ushiromiya-lion
authored and
Sameerlite
committed
ec38f2b
Fix prompt factory
Sameerlite
committed
d2346b5
Fix lint and ruff
Sameerlite
committed
9416291
[Fix] Release Workflow: Detect SemVer-Style Pre-Release Dev Tags
yuneng-berri
committed
cc91799
degrade budget reservation cache failures
stuxf
committed
403bbc3
Merge pull request #26805 from BerriAI/litellm_auth_bypass_tag_based_routing
yuneng-berri
authored
eab0075
track reservation entry before counter write
stuxf
committed
83ed317
chore(proxy): close router-settings-override fallback smuggling path

stuxf
and
claude
committed
a5b7eee
chore(guardrails): tighten tool permission checks
stuxf
committed
150a34f
Merge remote-tracking branch 'upstream/main' into fix/router-override-trust
stuxf
committed
cc9700f
chore(guardrails): satisfy tool permission typing
stuxf
committed
5e7c9e6
fix(proxy): hardcode mock-testing strip list to avoid cyclic import

stuxf
and
claude
committed
e60a72e
chore(proxy): stabilize lazy openapi snapshot
stuxf
committed
8538193
test: fix Bedrock PDF tool-result bytes assertion in factory test
Sameerlite
committed
900ef45
test: include response key in response.completed chunk for ID hook test
Sameerlite
committed
15288f3
feat(embedding): default OpenAI-path encoding_format to float
Sameerlite
committed
8473b70
test(embedding): align local_testing OpenAI encoding_format default
Sameerlite
committed
a1f0823
docs(embedding): document encoding_format default and env override
Sameerlite
committed
809b83c
Fix code
Sameerlite
committed
5c72a95
fix(caching): defer streaming cache-hit callbacks for all stream=True
Sameerlite
committed
e0398ca
fix: replace hardcoded url

krrish-berri-2
authored and
Sameerlite
committed
3ae92fb
fix(llm translation): redact Gemini API key from URL query params in error traces (#24943)

Vedanshu7
authored and
Sameerlite
committed
f460746
feat: add Qohash Nexus guardrail hook (#24927)

authored and
Sameerlite
committed
49ec6ab
fix(cost): pass service_tier through azure and azure_ai cost calculation (#24926)

michelligabriele
authored and
Sameerlite
committed
1b6914d
fix(proxy): include team membership budget in combined_view for RPM/TPM (#24925)

milan-berri
authored and
Sameerlite
committed
7e58c71
fix(gemini): handle Gemini Files API URIs without fetching (#24922)

authored and
Sameerlite
committed
9d6983c
fix(azure): forward api_version to aembedding() for Azure AI Foundry v1 endpoints (#24911)

Sameerlite
and
claude
committed
b8f5189
chore: fixes

yuneng-berri
authored and
Sameerlite
committed
9b90fc0
Fix import error
Sameerlite
committed
b0ac74c
Fix import error
Sameerlite
committed
b3fdb5c
Fix import error
Sameerlite
committed
a86938a
Fix code qa
Sameerlite
committed
ed853e1
Fix ruff errors
Sameerlite
committed
319180f
Fix ruff errors
Sameerlite
committed
8c55c54
adding crusoe to litellm

acheamponge
authored and
Sameerlite
committed
caa0db3
refactor(crusoe): simplify to JSON-based provider registration

authored and
Sameerlite
committed
d492d8f
Apply suggestion from @greptile-apps[bot]

authored and
Sameerlite
committed
6ae7929
Apply suggestion from @greptile-apps[bot]

authored and
Sameerlite
committed
9d64cc8
fix: remove trailing slash from CRUSOE_API_BASE and unused sys import

acheamponge
authored and
Sameerlite
committed
d731349
fix(crusoe): fix docs trailing slash, test state pollution, missing __init__.py

acheamponge
authored and
Sameerlite
committed
9039eb1
fix(crusoe): sync backup model cost map with main file

authored and
Sameerlite
committed
133512d
feat(crusoe): add supports_reasoning flag for DeepSeek-R1 and Kimi-K2-Thinking

authored and
Sameerlite
committed
51f8e5a
fix(crusoe): add param_mappings for max_completion_tokens → max_tokens

acheamponge
authored and
Sameerlite
committed
2805572
fix(crusoe): remove trailing slashes from API base URLs and fix list indentation

acheamponge
authored and
Sameerlite
committed
6e1e624
fix(crusoe): split Custom API Base docs into two independent examples

acheamponge
authored and
Sameerlite
committed
e08b8ef
fix(crusoe): fix streaming doc model typo and add supports_vision for Gemma 3

acheamponge
authored and
Sameerlite
committed
f8ba2d7
fix code qa
Sameerlite
committed
99d075d
Fix black
Sameerlite
committed
3eccede
Fix greptile review
Sameerlite
committed
475220e
Fix greptile review
Sameerlite
committed
5feb600
feat(vertex_ai): Model Garden OpenAPI for publisher model ids
Sameerlite
committed
1981352
Fix reviews
Sameerlite
committed
71e2b6f
correct model map
Sameerlite
committed
e656b2a
fix(gemini): follow provider defaults for Gemini 3 thinking
Sameerlite
committed
8d9db7b
Fix greptile review
Sameerlite
committed
0a9c076
Fix black
Sameerlite
committed
e942ef6
Merge pull request #26984 from BerriAI/litellm_internal_staging
Sameerlite
authored
a94ae62
Merge pull request #26950 from BerriAI/litellm_batch_model_id_mapping
mateo-berri
authored
dddbfd5
Merge pull request #26402 from BerriAI/litellm_azure-container-file-routing-fix
mateo-berri
authored
6552e3c
Remove dead embedding encoding fallback
cursoragent
committed
df41973
Fix org MCP permission ceiling escalation
cursoragent
committed
fca21a9
Merge pull request #25270 from BerriAI/litellm_oss_staging_04_06_2026
mateo-berri
authored
026ee88
Merge pull request #26202 from BerriAI/litellm_token_verification_query_opt
harish-berri
authored
32ab390
Merge pull request #26076 from BerriAI/litellm_vertex_model_garden_xai_openapi
mateo-berri
authored
a155ea1
Unify secret redaction patterns
cursoragent
committed
97cfb4f
fix(mcp): preserve oauth2 m2m auth for tools routes (#26871)
Sameerlite
authored
8300657
fix(embeddings): allow omitting encoding_format via env sentinel none

Sameerlite
and
cursoragent
committed
4523f6a
fix(mcp): survive Redis JSON round-trip for cached org object_permission

Sameerlite
and
cursoragent
committed
f883729
Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_fix-config-update-targeted-upserts
yuneng-berri
committed
650821b
Merge pull request #25980 from BerriAI/litellm_metrics_auth
harish-berri
authored
c8fb77f
Merge remote-tracking branch 'origin/litellm_internal_staging' into HEAD
stuxf
committed
2ed4b59
fix(projects): project dropdown empty for internal_user (3 bugs) (#26664)
ishaan-berri
authored
32704ff
chore(security): close two unaddressed SSRF cases

stuxf
and
claude
committed
0d4875d
fix: block path traversal SSRF in BitBucket, Arize Phoenix, and AssemblyAI clients (#26943)
ishaan-berri
authored
fdd9f3d
Fix: trigger fallbacks on mid-stream httpx.TimeoutException
ryan-crabbe-berri
committed
35133e3
fix(security): close P1 recursion-DoS + P2 hostname leak in SSRF fixes

stuxf
and
claude
committed
90fd791
Merge pull request #24340 from BerriAI/litellm_staging_03_21_2026
yuneng-berri
authored
0258246
refactor: scope /health response to caller's models and tidy display fields (#26935)

authored
b14e1d7
review: address atomic limiter review feedback

krrish-berri-2
and
claude
committed
6496e58
fix(ui): add Your Usage view for admin users on usage page (#26746)
ishaan-berri
authored
c06cc56
fix: scope CLI stored token to base_url to prevent cross-domain credential leakage (#26945)
ishaan-berri
authored
231c430
fix(rate-limit): fail closed on unrecognized OVER_LIMIT descriptor

krrish-berri-2
and
claude
committed
eba0cdf
Merge pull request #26998 from BerriAI/litellm_stream_timeout_midstream_fallback
ryan-crabbe-berri
authored
34b3402
[Test] Anthropic: Use Repo PDF Fixture For test_async_pdf_handling_with_file_id
yuneng-berri
committed
d769e81
Update tests/llm_translation/base_llm_unit_tests.py

yuneng-berri
and
greptile-apps[bot]
authored
a7a1127
tests(vcr): isolate cassette redis to CASSETTE_REDIS_URL
mateo-berri
committed
4c69557
review: separate ttl_seconds from window_size_seconds in atomic ARGV

krrish-berri-2
and
claude
committed
ca3e659
Merge pull request #26643 from BerriAI/litellm_fix-config-update-targeted-upserts
yuneng-berri
authored
b1fcdb6
tests(vcr): make redis persister resilient to transient outages
mateo-berri
committed
a7e8189
tests(vcr): add LITELLM_VCR_VERBOSE per-test hit/miss reporting
mateo-berri
committed
cf4c9ed
fix(health): return 503 when targeted model has no healthy endpoints or DB is disconnected
ryan-crabbe-berri
committed
7635955
tests(vcr): only persist cassette on test pass to avoid poisoning cache
mateo-berri
committed
ff63bdb
fix(health): filter background-cache result by targeted model before 503 check
ryan-crabbe-berri
committed
3340533
tests(vcr): opt out tests that observe live cross-call provider state
mateo-berri
committed
8c01b02
[Test] Anthropic: Use jsDelivr CDN For PDF Fixture URL To Preserve Content-Type
yuneng-berri
committed
feb238b
Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_fix_pdf_file_id_test
yuneng-berri
committed
f13b7af
tests(vcr): refuse to persist cassettes past 50 episodes
mateo-berri
committed
a47c4e7
test(health): tighten happy-path 200 assertions to exact equality
ryan-crabbe-berri
committed
21e19bf
Merge remote-tracking branch 'origin/litellm_fix_pdf_file_id_test' into litellm_fix_pdf_file_id_test
yuneng-berri
committed
42cc765
fix(tests): use github-hosted PDF fixture for Anthropic Files API test
mateo-berri
committed
225d01c
[Fix] Image Handling: Fall Back To URL Extension When Server Returns Octet-Stream
yuneng-berri
committed
019f5ee
chore: retrigger PR checks
stuxf
committed
60996eb
Revert "[Fix] Image Handling: Fall Back To URL Extension When Server Returns Octet-Stream"
yuneng-berri
committed
5cd1272
fix(auth): support JWT issuer verification, scope-warning when unscoped

stuxf
and
claude
committed
e55401e
fix(health): validate model_id against scoped model_list in cache-path resolver
ryan-crabbe-berri
committed
038b180
tests(vcr): emit verbose verdicts to un-redirected stderr
mateo-berri
committed
c05c865
Merge pull request #26996 from stuxf/chore/ssrf-polling-and-nested-config
yuneng-berri
authored
f34a275
fix(tests): host PDF fixture via jsDelivr with proper application/pdf MIME
mateo-berri
committed
965185c
Merge pull request #26969 from stuxf/codex/tool-permission-guardrail-fix
yuneng-berri
authored
42122b8
Merge branch 'litellm_yj_may1' into codex/file-endpoint-model-auth
yuneng-berri
authored
9e501ed
Merge pull request #26963 from stuxf/codex/file-endpoint-model-auth
yuneng-berri
authored
2fca7ad
Merge pull request #27003 from BerriAI/litellm_health-endpoint-non200-on-failure
ryan-crabbe-berri
authored
610f79d
Merge branch 'litellm_yj_may1' into codex/vector-store-tenant-guard
yuneng-berri
authored
38fae65
[Fix] Tests: Move Misplaced Import in Lazy OpenAPI Snapshot Test
yuneng-berri
committed
4825d94
Merge pull request #27010 from BerriAI/yj/fix-lazy-openapi-snapshot-merge
yuneng-berri
authored
058d717
Merge pull request #26930 from stuxf/codex/vector-store-tenant-guard
yuneng-berri
authored
df17ffc
Merge pull request #26109 from mubashir1osmani/kaboom
ryan-crabbe-berri
authored
5e96120
style: black format test_deferred_guardrail_logging.py
ryan-crabbe-berri
committed
a1fd150
tests(vcr): emit per-test verdicts via xdist controller's terminalreporter
mateo-berri
committed
53f71fb
Merge branch 'litellm_yj_may1' into codex/budget-race-enforcement
yuneng-berri
authored
c2cea58
Merge pull request #26845 from stuxf/codex/budget-race-enforcement
yuneng-berri
authored
b25732f
fix(proxy): close project hijacking and key org IDOR

stuxf
and
claude
committed
1b27568
Merge pull request #27000 from BerriAI/litellm_fix_pdf_file_id_test
yuneng-berri
authored
ebd335d
tests(vcr): drop redundant comments and docstrings
mateo-berri
committed
80415b4
Merge branch 'litellm_internal_staging' into litellm_vcr-cassette-llm-tests-af37
mateo-berri
authored
0543953
fix(prometheus): quote api_key for PromQL string literal in spend lookup

stuxf
and
claude
committed
6a5ecaf
[Fix] Auth: Restore Request-Context Model Resolution In Skip-Budget Helper
yuneng-berri
committed
d8f556e
Merge branch 'litellm_yj_may1' into codex/integration-host-credential-guard
yuneng-berri
authored
eca6feb
Merge pull request #26921 from stuxf/codex/integration-host-credential-guard
yuneng-berri
authored
ae90651
Merge pull request #26954 from BerriAI/claude/lucid-margulis-e99b6b
yuneng-berri
authored
dc681b9
Merge pull request #26860 from stuxf/fix/provider-path-traversal
yuneng-berri
authored
3583ac1
fix(mcp): run pre_call_tool_check on OpenAPI/local-registry path (VERIA-7)

stuxf
and
claude
committed
5daf016
Merge pull request #26841 from stuxf/fix/mcp-xff-trust-gate
yuneng-berri
authored
8363fe0
[Fix] Proxy: Repair Stale HTTP_METHODS Reference In Lazy OpenAPI Snapshot
yuneng-berri
committed
61a3923
Merge pull request #26838 from BerriAI/litellm_vcr-cassette-llm-tests-af37
yuneng-berri
authored
d07cdd4
[Fix] Tests: Align Bedrock count-tokens endpoint assertions with URL-encoded model id
yuneng-berri
committed
8eca934
fix(mcp): use canonical proxy_logging_obj, deny when MCP server is unresolvable

stuxf
and
claude
committed
8ee599a
Merge pull request #27017 from BerriAI/fix/bedrock-count-tokens-url-encoded-test-assertions
yuneng-berri
authored
2573fcd
Merge pull request #26976 from BerriAI/litellm_default_embedding_encoding_format
mateo-berri
authored
0b87bdf
Update litellm/router.py

mateo-berri
and
greptile-apps[bot]
authored
87fa332
Merge pull request #27012 from BerriAI/litellm_fix-post-call-guardrail
ryan-crabbe-berri
authored
4503dd1
Merge pull request #26077 from BerriAI/litellm_vertex_cached_content_mutual_exclusion
mateo-berri
authored
6458fe1
fix: scope key access_group_ids override by team's assigned groups
ryan-crabbe-berri
committed
f17d779
Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_clean_litellm_oss_staging_04_01_2026
mateo-berri
committed
04e96a9
[Fix] Proxy: Skip Personal Budget Hook When Reservation Covers Counter
yuneng-berri
committed
a12b424
Merge pull request #27021 from BerriAI/litellm_/vigilant-bohr-3adf26
yuneng-berri
authored
4ebe782
Fix syntax errors from botched merge in router.py
mateo-berri
committed
36f03f1
Merge remote-tracking branch 'origin/litellm_internal_staging' into litellm_/pensive-bartik-e24048
yuneng-berri
committed
c78144c
Merge pull request #26924 from BerriAI/litellm_fix_ui_session_fixation_url_token
yuneng-berri
authored
d1fc398
Merge branch 'litellm_internal_staging' into litellm_access-group-routing-fix
mateo-berri
committed
860f6b5
Merge pull request #26929 from BerriAI/litellm_fix_service_account_user_id_bypass
yuneng-berri
authored
fba38d0
Merge pull request #25856 from BerriAI/litellm_clean_litellm_oss_staging_04_01_2026
mateo-berri
authored
628ce9d
[Fix] RBAC: Drop management_routes Write Fallback for Admin Viewer
yuneng-berri
committed
6499fa7
fix(tests): anchor VCR redis cassette key to repo root

claude
authored and
cursoragent
committed
6be7b77
fix: gate key access_group override on group's own assignment
ryan-crabbe-berri
committed
bf4c250
Merge pull request #27024 from BerriAI/litellm_yj_may1
yuneng-berri
authored
57dd389
Merge pull request #26846 from BerriAI/litellm_/pensive-bartik-e24048
yuneng-berri
authored
8ed6c0c
Merge litellm_internal_staging into litellm_/flamboyant-mendeleev-481c14
yuneng-berri
committed
5f87e82
[Fix] Proxy/Key Management: Honor team_member_permissions /key/list In /key/list Endpoint
yuneng-berri
committed
b8cf48a
Merge pull request #27025 from BerriAI/litellm_fix-redis-key-generation-d88e
yuneng-berri
authored
12c9a47
Fix access-group bypass via litellm-model fallback path
mateo-berri
committed
9d945fe

Commits on May 2, 2026