Repository navigation
chore(release): sync stable/1.103.x to v1.103.1 - #43824
Conversation
chore: bump litellm 1.103.0 -> 1.103.1
Backport of BerriAI/litellm-private#5 (12981f93d3) onto stable/1.103.x, applied as the PR's net diff so main-only intermediate refactors stay out.
…check This line's ruff strict budget has no headroom for the one TRY004 the backport adds; the raise reports missing configuration, not a bad type.
refactor(auth): bind UI/CLI session tokens to their own AES-GCM context (stable/1.103.x)
GitHub Actions
Waiting
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| ) | ||
|
|
||
| decrypted_token: Final = decrypt_value_helper(hashed_token, key="ui_hash_key", exception_type="debug") | ||
| decrypted_token: Final = decrypt_bearer_token(hashed_token, prefix=LITELLM_SESSION_TOKEN_PREFIX) |
There was a problem hiding this comment.
UI and CLI sessions issued before this change do not have the new litellm_login_ prefix, so this decoder rejects them even while they are still valid. After an upgrade, users must log in again; during a rolling deployment, authentication can succeed or fail depending on which proxy handles the request. CLI sessions last up to 24 hours by default. Preserve compatibility or make this format change operator-controlled, as the repository requires for backwards-incompatible changes.
Rule Used: What: avoid backwards-incompatible changes without user-controlled flags Why: This breaks current behaviour for users using existing functionality Example of BAD: this PR (#22164) introduced run_post_custom... (source)
Knowledge Base Used: Proxy authentication and authorization
| testDir: ".", | ||
| testMatch: ["**/*.spec.ts", "**/*.setup.ts"], | ||
| testIgnore: ["**/*.test.*", "**/integrationCritical/**"], | ||
| testIgnore: ["**/*.test.*", "**/integrationCritical/**", "oidc/**"], |
There was a problem hiding this comment.
The main Playwright config now excludes oidc/**, but the repository's CI jobs and UI test runner do not invoke the separate OIDC config. The new dashboard and CLI login specs can run manually, but they provide no automated signal when those journeys regress. A dedicated CI invocation would make this coverage effective.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
![renovate[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…03.2) (#328) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/berriai/litellm](https://images.chainguard.dev/directory/image/wolfi-base/overview) ([source](https://github.com/BerriAI/litellm)) | patch | `v1.103.1` → `v1.103.2` | --- ### Release Notes <details> <summary>BerriAI/litellm (ghcr.io/berriai/litellm)</summary> ### [`v1.103.2`](https://github.com/BerriAI/litellm/releases/tag/v1.103.2) [Compare Source](BerriAI/litellm@v1.103.1...v1.103.2) #### Verify Docker Image Signature All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](BerriAI/litellm@0112e53). **Verify using the pinned commit hash (recommended):** A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key: ```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \ ghcr.io/berriai/litellm:v1.103.2 ``` **Verify using the release tag (convenience):** Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules: ```bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/v1.103.2/cosign.pub \ ghcr.io/berriai/litellm:v1.103.2 ``` Expected output: ``` The following checks were performed on each of these signatures: - The cosign claims were validated - The signatures were verified against the specified public key ``` *** #### What's Changed - chore(release): sync stable/1.103.x to v1.103.1 by [@​yuneng-berri](https://github.com/yuneng-berri) in [#​43824](BerriAI/litellm#43824) - fix(proxy): backport [#​40541](BerriAI/litellm#40541), [#​43642](BerriAI/litellm#43642), and [#​43656](BerriAI/litellm#43656) to stable/1.103.x for v1.103.2 by [@​devin-ai-integration](https://github.com/devin-ai-integration)\[bot] in [#​43897](BerriAI/litellm#43897) - fix(anthropic): backport [#​42152](BerriAI/litellm#42152) and [#​42288](BerriAI/litellm#42288) to stable/1.103.x by [@​devin-ai-integration](https://github.com/devin-ai-integration)\[bot] in [#​43662](BerriAI/litellm#43662) - fix(proxy): backport [#​43962](BerriAI/litellm#43962) to stable/1.103.x by [@​yuneng-berri](https://github.com/yuneng-berri) in [#​43984](BerriAI/litellm#43984) **Full Changelog**: <BerriAI/litellm@v1.103.1...v1.103.2> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTUuMTMiLCJ1cGRhdGVkSW5WZXIiOiI0NC4xMTUuMTMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlL2NvbnRhaW5lciIsInR5cGUvcGF0Y2giXX0=--> Reviewed-on: https://git.greyrock.io/todd/home-ops/pulls/328
This branch is waiting to be deployed
2 participants
TLDR
Problem this solves:
stable/1.103.xis behind the publishedv1.103.1tagv1.103.1shippedHow it solves it:
stable/1.103.xto the exact commitv1.103.1was built fromv1.103.1tagMerge with a merge commit so the tagged commits land unchanged; a squash would give the branch a tree that matches
v1.103.1under a different SHAType
Infrastructure