# LiteLLM changelog

> One OpenAI-shaped interface — and one proxy — in front of 100+ model providers.

- Vendor: BerriAI
- Category: AI
- Official site: https://www.litellm.ai
- Tracked by: What's New (https://whatsnew.fyi/product/litellm)
- Harvested from: GitHub (BerriAI/litellm)
- Entries below: 11 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v1.96.0

- Date: 2026-08-10
- Version: v1.96.0
- Original notes: https://github.com/BerriAI/litellm/releases/tag/v1.96.0
- Permalink: https://whatsnew.fyi/product/litellm/releases/v1.96.0

- **added** — Add service_tier label to latency and spend metrics in Prometheus
- **fixed** — Keep keep-alive connector config when an aiohttp session is rebuilt
- **fixed** — Pin bundled postgres and redis to the bitnami legacy images in Helm
- **fixed** — Decide rawPredict passthrough streaming from the request body for Vertex
- **fixed** — Translate stop_sequences and disabled thinking for non-Claude targets in anthropic-adapter
- **added** — Publish a generated JSON schema for model_prices_and_context_window.json
- **fixed** — Allow /v1/messages for JWT teams by default
- **fixed** — Skip team model aliases that point at deleted deployments in proxy
- **fixed** — Report when a model write does not survive the post-write reload in proxy
- **fixed** — Reject model writes that corrupt an auto-router pseudo-model in proxy
- **fixed** — Serialize latency for non-chat responses in lowest-latency routing
- **fixed** — Preserve callback order in get_combined_callback_list for logging
- **fixed** — Honor explicit priority=0 in router acompletion
- **fixed** — Open the first content block with the real upstream type so reasoning-first streams start with thinking in anthropic-adapter
- **fixed** — Stop provisioning nested group ids as internal users in SCIM
- **fixed** — Size Object Permissions card grid by container width in UI
- **fixed** — Allow /key/update to identify the key by key_alias in proxy
- **added** — Split failed requests into their own series on the cache dashboard in UI
- **added** — Add shareable log links via log_id query param on the logs page in UI
- **added** — Add qwen3.7-plus and qwen3.7-max to the model cost map for dashscope

##### Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.96.0
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.96.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.96.0
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
##### What's Changed
* feat(prometheus): add service_tier label to latency and spend metrics by @yassin-berriai in https://github.com/BerriAI/litellm/pull/34966
* fix(aiohttp): keep keep-alive connector config when a session is rebuilt by @yassin-berriai in https://github.com/BerriAI/litellm/pull/34962
* fix(helm): pin bundled postgres and redis to the bitnamilegacy images by @yassin-berriai in https://github.com/BerriAI/litellm/pull/34963
* fix(vertex): decide rawPredict passthrough streaming from the request body by @tin-berri in https://github.com/BerriAI/litellm/pull/34672
* fix(anthropic-adapter): translate stop_sequences and disabled thinking for non-Claude targets by @tin-berri in https://github.com/BerriAI/litellm/pull/34589
* ci: publish a generated JSON schema for model_prices_and_context_window.json by @mateo-berri in https://github.com/BerriAI/litellm/pull/34816
* fix(jwt_auth): allow /v1/messages for JWT teams by default by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/34222
* fix(proxy): skip team model aliases that point at deleted deployments by @mateo-berri in https://github.com/BerriAI/litellm/pull/34993
* fix(proxy): report when a model write does not survive the post-write reload by @tin-berri in https://github.com/BerriAI/litellm/pull/34861
* fix(proxy): reject model writes that corrupt an auto-router pseudo-model by @tin-berri in https://github.com/BerriAI/litellm/pull/34151
* fix(router_strategy): serialize latency for non-chat responses in lowest-latency routing by @mihidumh in https://github.com/BerriAI/litellm/pull/33290
* fix(logging): preserve callback order in get_combined_callback_list by @Harsh23Kashyap in https://github.com/BerriAI/litellm/pull/33008
* fix(router): honor explicit priority=0 in acompletion by @Harsh23Kashyap in https://github.com/BerriAI/litellm/pull/33214
* fix(router_strategy): serialize latency for non-chat responses in lowest-latency routing by @tin-berri in https://github.com/BerriAI/litellm/pull/35048
* fix(anthropic-adapter): open the first content block with the real upstream type so reasoning-first streams start with thinking by @Napuh in https://github.com/BerriAI/litellm/pull/34433
* test(e2e): poll MCP tools across multi-worker lag by @mubashir1osmani in https://github.com/BerriAI/litellm/pull/35047
* fix(scim): stop provisioning nested group ids as internal users by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/34997
* chore(typing): clear basedpyright Any errors in proxy management endpoints by @mateo-berri in https://github.com/BerriAI/litellm/pull/35074
* fix(ui): size Object Permissions card grid by container width by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/35019
* fix(proxy): allow /key/update to identify the key by key_alias by @ryan-crabbe-berri i

_[Truncated at 4000 characters — full notes: https://github.com/BerriAI/litellm/releases/tag/v1.96.0]_

### v1.97.0-rc.1

- Date: 2026-08-08
- Version: v1.97.0-rc.1
- Original notes: https://github.com/BerriAI/litellm/releases/tag/v1.97.0-rc.1
- Permalink: https://whatsnew.fyi/product/litellm/releases/v1.97.0-rc.1
- Labels: Pre-release

- **security** — Respect AZURE_AUTHORITY_HOST and derive the Azure Monitor audience per cloud in azure_sentinel
- **fixed** — Pass SSE-KMS key through to the batch input-file S3 upload in bedrock
- **fixed** — Stop indexing choices[0] on choiceless streaming chunks in anthropic adapter
- **fixed** — Normalize /v1/completions and /v1/responses batch records in bedrock
- **fixed** — Return the real status code when a credential update is rejected in proxy
- **fixed** — Improve Headroom /v1/compress HTTP 404 diagnostics in proxy
- **fixed** — Invalidate cached project object on project update and delete in proxy
- **added** — Add apply_user_budget_to_team_keys opt-in in proxy
- **fixed** — Stop alerting on health probes that lose the planned engine-restart race in proxy
- **fixed** — Stop pooled clients persisting cookies on the aiohttp jar in http
- **fixed** — Bound fallback-walk work and error-log volume in router
- **fixed** — Add AZURE_SENTINEL_AUTHORITY_HOST as a Sentinel scoped override in azure_sentinel
- **fixed** — Derive config agent ids from agent_name so grants survive secret rotation in proxy
- **fixed** — Deny agent access when key and team grants resolve to nothing in proxy
- **fixed** — Align agent list annotation and test with the tuple return type in a2a
- **added** — Show user email or alias in usage data export in ui
- **added** — Track turns per complexity tier in auto-router
- **fixed** — Restore snippet text in native web_search_tool_result blocks in websearch
- **fixed** — Resolve entity access groups in the model listing endpoints in proxy
- **fixed** — Let access groups be a team's only model source with hover provenance in ui

##### Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.97.0-rc.1
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.97.0-rc.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.97.0-rc.1
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
##### What's Changed
* fix(azure_sentinel): respect AZURE_AUTHORITY_HOST and derive the Azure Monitor audience per cloud by @yucheng-berri in https://github.com/BerriAI/litellm/pull/36137
* fix(bedrock): pass SSE-KMS key through to the batch input-file S3 upload by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/35148
* fix(anthropic adapter): stop indexing choices[0] on choiceless streaming chunks by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/35314
* fix(bedrock): normalize /v1/completions and /v1/responses batch records by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/35675
* fix(proxy): return the real status code when a credential update is rejected by @yucheng-berri in https://github.com/BerriAI/litellm/pull/36166
* fix(proxy): improve Headroom /v1/compress HTTP 404 diagnostics by @aayush598 in https://github.com/BerriAI/litellm/pull/35952
* fix(proxy): invalidate cached project object on project update and delete by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/36028
* feat(proxy): add apply_user_budget_to_team_keys opt-in by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/36102
* fix(proxy): stop alerting on health probes that lose the planned engine-restart race by @yassin-berriai in https://github.com/BerriAI/litellm/pull/36141
* test(docker): gate the componentized gateway and backend images on an arbitrary-uid offline boot by @yassin-berriai in https://github.com/BerriAI/litellm/pull/36136
* fix(http): stop pooled clients persisting cookies on the aiohttp jar too by @yassin-berriai in https://github.com/BerriAI/litellm/pull/36149
* fix(router): bound fallback-walk work and error-log volume by @yassin-berriai in https://github.com/BerriAI/litellm/pull/36148
* ci: wire credential_endpoints tests into the proxy endpoints job by @cursor[bot] in https://github.com/BerriAI/litellm/pull/36187
* docs(keys): document /key/info fields and clarify budget_reset_at is the next reset by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/36127
* fix(azure_sentinel): add AZURE_SENTINEL_AUTHORITY_HOST as a Sentinel scoped override by @yucheng-berri in https://github.com/BerriAI/litellm/pull/36165
* docs(pr-template): add a User Flow section with authoring instructions by @mateo-berri in https://github.com/BerriAI/litellm/pull/36162
* fix(proxy): derive config agent ids from agent_name so grants survive secret rotation by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/36020
* chore(ui): regenerate schema.d.ts for the /key/info docstring update by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/36210
* build(deps): bump gitpython to 3.1.58 to clear osv-scan on staging by @devin-ai-integration[bot] in https://github.com/

_[Truncated at 4000 characters — full notes: https://github.com/BerriAI/litellm/releases/tag/v1.97.0-rc.1]_

### v1.94.2

- Date: 2026-08-08
- Version: v1.94.2
- Original notes: https://github.com/BerriAI/litellm/releases/tag/v1.94.2
- Permalink: https://whatsnew.fyi/product/litellm/releases/v1.94.2

##### Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.94.2
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.94.2/cosign.pub \
  ghcr.io/berriai/litellm:v1.94.2
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
##### What's Changed
* chore(release): backport #35835, #35844 to stable/1.94.x and cut 1.94.2 by @yuneng-berri in https://github.com/BerriAI/litellm/pull/36237


**Full Changelog**: https://github.com/BerriAI/litellm/compare/v1.94.1...v1.94.2

### v1.97.0-dev.2

- Date: 2026-08-07
- Version: v1.97.0-dev.2
- Original notes: https://github.com/BerriAI/litellm/releases/tag/v1.97.0-dev.2
- Permalink: https://whatsnew.fyi/product/litellm/releases/v1.97.0-dev.2
- Labels: Pre-release

- **added** — Add role capability gating to UI and migrate Tool Policies route
- **added** — Make reminder marker pair configurable in auto-router
- **added** — Derive a default auto-router savings baseline from the hardest tier in spend tracking
- **added** — Let operators rename the four complexity tiers in complexity_router
- **added** — Let operators replace the LLM classifier's system prompt in auto-router
- **added** — Make the gateway middleware the source of truth for successful requests in SGR
- **changed** — Inject the fetch client's base URL instead of reading it at import in UI
- **changed** — Perform python, dashboard, and gen-api checks concurrently in pre-commit
- **fixed** — Name enable_jwt_auth when a JWT-shaped key is rejected
- **fixed** — Update anthropic model presets in UI
- **fixed** — Switch to the dashboard node floor via nvm or fnm in bootstrap
- **fixed** — Self-heal handler clients closed after cache eviction
- **fixed** — Keep OpenAI prompt cache token details through usage reassembly in cost tracking
- **fixed** — Bill gpt-5.6 prompt cache reads at the cache read rate
- **fixed** — Account for Responses API usage in batches
- **fixed** — Skip rows without file objects in managed-files
- **fixed** — Redact fallback tracebacks at the call site and cover the sync deferred stream in router
- **fixed** — Recover from an interrupted Prisma toolchain install in migrations
- **fixed** — Give proxy_admin_viewer read parity with proxy_admin in proxy
- **fixed** — Make the env-key doc gate see get_secret_bool reads in CI
- **fixed** — Keep the connected DB client when a startup health check fails in proxy

##### Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.97.0-dev.2
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.97.0-dev.2/cosign.pub \
  ghcr.io/berriai/litellm:v1.97.0-dev.2
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
##### What's Changed
* feat(ui): add role capability gating, migrate Tool Policies route by @yuneng-berri in https://github.com/BerriAI/litellm/pull/35812
* refactor(ui): inject the fetch client's base url instead of reading it at import by @yuneng-berri in https://github.com/BerriAI/litellm/pull/35802
* chore: remove unused .flake8 config and flake8 dev dependency by @mateo-berri in https://github.com/BerriAI/litellm/pull/35888
* chore: stop advising pre-commit and bootstrap by @mateo-berri in https://github.com/BerriAI/litellm/pull/35884
* fix(auth): name enable_jwt_auth when a JWT-shaped key is rejected by @yassin-berriai in https://github.com/BerriAI/litellm/pull/35831
* feat(auto-router): make reminder marker pair configurable by @akapur99 in https://github.com/BerriAI/litellm/pull/35874
* fix(UI): update anthropic model presets by @tin-berri in https://github.com/BerriAI/litellm/pull/35896
* fix(bootstrap): switch to the dashboard node floor via nvm or fnm by @mateo-berri in https://github.com/BerriAI/litellm/pull/35895
* perf(pre-commit): run python, dashboard, and gen-api checks concurrently by @mateo-berri in https://github.com/BerriAI/litellm/pull/35903
* feat(spend): derive a default auto-router savings baseline from the hardest tier by @tin-berri in https://github.com/BerriAI/litellm/pull/35907
* fix(http_handler): self-heal handler clients closed after cache eviction by @mateo-berri in https://github.com/BerriAI/litellm/pull/35862
* fix(cost_tracking): keep OpenAI prompt cache token details through usage reassembly by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/34812
* fix(cost): bill gpt-5.6 prompt cache reads at the cache read rate by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/34957
* fix(batches): account for Responses API usage by @rimysore in https://github.com/BerriAI/litellm/pull/35367
* ci: retry Codecov uploads and stop failing jobs on OIDC token flakes by @mateo-berri in https://github.com/BerriAI/litellm/pull/35251
* feat(complexity_router): let operators rename the four complexity tiers by @akapur99 in https://github.com/BerriAI/litellm/pull/35893
* chore(lint): zero stale ruff and LIT headroom and strip inert type: ignore comments by @mateo-berri in https://github.com/BerriAI/litellm/pull/35928
* chore(lint): zero out seven more purely local basedpyright rules by @mateo-berri in https://github.com/BerriAI/litellm/pull/35927
* chore(ui): zero stale headroom on local dashboard eslint budgets by @mateo-berri in https://github.com/BerriAI/litellm/pull/35929
* fix(managed-files): skip rows without file objects by @rimysore in https://github.com/BerriAI/litellm/pull/35365
* fix(router): redact fallback tracebacks at the call site and cover the sync deferred stream by @yassin-berriai in

_[Truncated at 4000 characters — full notes: https://github.com/BerriAI/litellm/releases/tag/v1.97.0-dev.2]_

### v1.97.0-dev.1

- Date: 2026-08-05
- Version: v1.97.0-dev.1
- Original notes: https://github.com/BerriAI/litellm/releases/tag/v1.97.0-dev.1
- Permalink: https://whatsnew.fyi/product/litellm/releases/v1.97.0-dev.1
- Labels: Pre-release

- **added** — Resolve Cursor thinking/fast model-name suffixes on /cursor/chat/completions endpoint
- **added** — Add non-streaming response toggle to playground
- **added** — Apply default organization to new teams from default team settings
- **added** — Expose session affinity configuration in the complexity router UI and default it to off
- **added** — Add prompt moderation, response-text blocking, streaming buffer, and failure logging to Rubrik guardrails
- **added** — Add custom metadata validation hook for team create and update
- **added** — Add net auto-router savings to the cost-optimization dashboard
- **added** — Show auto-router savings on the cost-optimization dashboard
- **fixed** — Stop logging when disable_logging is called for team callbacks
- **fixed** — Backfill null user_email on existing users during JWT auth
- **fixed** — Block Playground page for viewer roles on direct URL access
- **fixed** — Close evicted LLM clients so their connections are reclaimed
- **fixed** — Apply key/team router_settings.model_group_alias
- **fixed** — Read team callback dd_* params from kwargs instead of blocked dynamic params
- **fixed** — Redact credential headers from request logging copies
- **fixed** — Render Responses API request and response in the logs drawer
- **fixed** — Hide guardrail review buttons from non-admin users
- **fixed** — Stop forwarding no-op toolSpec.strict to Converse for Bedrock
- **fixed** — Reject an auto-router keyword rule left empty instead of dropping it
- **fixed** — Attribute blocked requests to the caller that made them in Rubrik guardrails
- **fixed** — Forward client headers to the provider on /v1/responses
- **fixed** — Read what a request cost from the record instead of pricing it again
- **changed** — Install hiredis so redis-py parses replies with its C parser

##### Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.97.0-dev.1
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.97.0-dev.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.97.0-dev.1
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
##### What's Changed
* feat(proxy): resolve Cursor thinking/fast model-name suffixes on /cursor/chat/completions by @mateo-berri in https://github.com/BerriAI/litellm/pull/35554
* fix(team-callbacks): actually stop logging when disable_logging is called by @yucheng-berri in https://github.com/BerriAI/litellm/pull/35520
* refactor(lint): drop redundant !s f-string conversion flags and fix displaced import-group comments by @mateo-berri in https://github.com/BerriAI/litellm/pull/35546
* fix(proxy): backfill null user_email on existing users during JWT auth by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/34588
* feat(playground): add non-streaming response toggle by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/35560
* feat(teams): apply default organization to new teams from default team settings by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/35540
* fix(ui): block Playground page for viewer roles on direct URL access by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/35676
* fix(caching): close evicted LLM clients so their connections are reclaimed by @yassin-berriai in https://github.com/BerriAI/litellm/pull/35492
* chore(deps): update brace-expansion, postcss, and gitpython to current patch releases by @yuneng-berri in https://github.com/BerriAI/litellm/pull/35692
* refactor(ui): rename the create MCP server component to PascalCase by @yuneng-berri in https://github.com/BerriAI/litellm/pull/35686
* fix(openai): drop undefined Union from owns_wrapped_http_client annotation by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/35706
* fix(openai): drop the undefined Union from owns_wrapped_http_client by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/35704
* chore(ui): note Google's Agent Platform rename in vector store setup by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/28076
* fix(proxy): apply key/team router_settings.model_group_alias by @yassin-berriai in https://github.com/BerriAI/litellm/pull/35486
* feat(complexity_router): default session affinity off and expose it in the UI by @tin-berri in https://github.com/BerriAI/litellm/pull/35714
* fix(datadog): read team callback dd_* params from kwargs instead of blocked dynamic params (#35115 port) by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/35687
* refactor(ui): extract the MCP create form's logic and field groups by @yuneng-berri in https://github.com/BerriAI/litellm/pull/35694
* test(ui): tier the MCP create tests into unit and integration by @yuneng-berri in https://github.com/BerriAI/litellm/pull/35697
* fix(proxy): redact credential headers from request logging copies by @yucheng-berri in https://github.com/BerriAI/litellm/pull/35678
* feat(guardrails/rubr

_[Truncated at 4000 characters — full notes: https://github.com/BerriAI/litellm/releases/tag/v1.97.0-dev.1]_

### v1.95.0

- Date: 2026-08-03
- Version: v1.95.0
- Original notes: https://github.com/BerriAI/litellm/releases/tag/v1.95.0
- Permalink: https://whatsnew.fyi/product/litellm/releases/v1.95.0

- **added** — Track prompt compression saved tokens in daily spend aggregates
- **added** — Route native Anthropic /messages through Rust behind LITELLM_RUST env var
- **added** — Expose Anthropic Messages route (POST /v1/messages) on the axum gateway
- **added** — Port OpenAI Responses API WebSockets to litellm-rust
- **added** — Port BaseAWSLLM auth (credential resolution + SigV4) to litellm-core as a base provider
- **added** — Add return_raw_model_name toggle for response model field in complexity-router
- **added** — Implement always-on aggregate gateway DCR discovery front door
- **added** — Add configuration tabs to the Cost Optimization page in UI
- **added** — Raise /spend/logs/v2 page_size cap to 1000
- **added** — Implement identity-only session tokens for the gateway DCR front door
- **added** — Forward bedrock_tags to CreateModelInvocationJob for batch jobs
- **changed** — Migrate the litellm-rust workspace (core, ai-gateway, python-bridge) from Rust edition 2021 to edition 2024
- **changed** — Implement audio transcription via rust core (py->rust bridge) for Bedrock
- **fixed** — Treat malformed cost-map token limits as absent on /v1/models
- **fixed** — Send v4 ingestion header for otel callback in Langfuse
- **fixed** — Restore Content-Type application/json header for Fireworks AI (fixes 415)
- **fixed** — Hide guardrail group headers when only one group has entries in UI

##### Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.95.0
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.95.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.95.0
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
##### What's Changed
* feat(spend): track prompt compression saved tokens in daily spend aggregates by @tin-berri in https://github.com/BerriAI/litellm/pull/33810
* test(e2e): assert the long budget window keeps blocking after the short window resets by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/33832
* feat(messages): route native Anthropic /messages through Rust behind LITELLM_RUST env var by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/33848
* test(e2e): cover credential-backed /v1/messages request by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/33863
* feat(rust): expose Anthropic Messages route (POST /v1/messages) on the axum gateway by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/33880
* feat(rust): 1:1 port of OpenAI Responses API WebSockets to litellm-rust by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/33849
* fix(proxy): treat malformed cost-map token limits as absent on /v1/models by @yuneng-berri in https://github.com/BerriAI/litellm/pull/33903
* feat(rust): port BaseAWSLLM auth (credential resolution + SigV4) to litellm-core as a base provider by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/33888
* feat(complexity-router): add return_raw_model_name toggle for response model field by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/33875
* feat(mcp): always-on aggregate gateway DCR discovery front door by @tin-berri in https://github.com/BerriAI/litellm/pull/33174
* fix(langfuse): send v4 ingestion header for otel callback by @yucheng-berri in https://github.com/BerriAI/litellm/pull/33907
* feat(ui): add configuration tabs to the Cost Optimization page by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/33899
* test(e2e): guard destructive spend-log truncate behind an explicit opt-in by @yassin-berriai in https://github.com/BerriAI/litellm/pull/33751
* chore(rust): migrate the litellm-rust workspace (core, ai-gateway, python-bridge) from Rust edition 2021 to edition 2024 by @vineetpuranik in https://github.com/BerriAI/litellm/pull/33940
* fix(fireworks_ai): restore Content-Type application/json header (fixes 415) by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/33929
* feat(spend): raise /spend/logs/v2 page_size cap to 1000 by @yuneng-berri in https://github.com/BerriAI/litellm/pull/33994
* feat(mcp): identity-only session tokens for the gateway DCR front door by @tin-berri in https://github.com/BerriAI/litellm/pull/33182
* test(e2e): cover key regeneration rotating to a working new key by @yassin-berriai in https://github.com/BerriAI/litellm/pull/34000
* test(e2e): cover tag creation persisting for spend categorization by @yassin-berriai in https://github.

_[Truncated at 4000 characters — full notes: https://github.com/BerriAI/litellm/releases/tag/v1.95.0]_

### v1.96.0-rc.1

- Date: 2026-08-03
- Version: v1.96.0-rc.1
- Original notes: https://github.com/BerriAI/litellm/releases/tag/v1.96.0-rc.1
- Permalink: https://whatsnew.fyi/product/litellm/releases/v1.96.0-rc.1
- Labels: Pre-release

- **fixed** — Annotate connected-app reachability on the gateway connect page
- **fixed** — Recover the tool-name prefix boundary from registered prefixes
- **fixed** — Exclude skipped tests from coverage-registry numerator
- **added** — Expose classifier context window fields on Auto-Router screens
- **fixed** — Deny MCP access when a named entitlement cannot be read
- **added** — Add generic list handler for /management/v1
- **fixed** — Dispose recycled client sessions deterministically
- **added** — Source the ID-JAG subject from the user's stored SSO assertion
- **fixed** — Run bedrock guardrail on MCP tool calls in during_mcp_call mode
- **fixed** — Drop unsupported prisma select kwarg from team lookup
- **added** — Add GET /management/v1/budgets
- **fixed** — Do not send duplicate thoughtSignature copies to Gemini
- **added** — Show which log rows are the auto-router's own classifier calls
- **fixed** — Nest source object in Claude Code marketplace settings snippet
- **added** — Add sorting, filtering and search to the budgets page
- **fixed** — Keep the session view open when selecting a log inside it
- **fixed** — Enforce tool entitlements on every MCP tool dispatch path
- **fixed** — Raise aiohttp floor to 3.14.2 to clear pooled-connection timeouts
- **fixed** — Drop unsupported prisma select kwarg from key lookup
- **fixed** — Stop model writes 500ing on another pod's delete
- **fixed** — Show pass through route selections and match team id substrings in team search
- **changed** — Gate all mock testing request params behind a single config flag
- **fixed** — Align team member add with existing user provisioning rules
- **added** — Add global exclude_metrics and exclude_labels options for prometheus
- **added** — Let AI API keys read /model/info
- **fixed** — Keep config-defined agents registered and accept the documented agents: key

##### Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.96.0-rc.1
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.96.0-rc.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.96.0-rc.1
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
##### What's Changed
* fix(mcp): annotate connected-app reachability on the gateway connect page by @tin-berri in https://github.com/BerriAI/litellm/pull/34867
* fix(mcp): recover the tool-name prefix boundary from registered prefixes by @tin-berri in https://github.com/BerriAI/litellm/pull/34673
* fix(e2e): exclude skipped tests from coverage-registry numerator by @yuneng-berri in https://github.com/BerriAI/litellm/pull/35327
* feat(ui): expose classifier context window fields on Auto-Router screens (LIT-5036) by @tin-berri in https://github.com/BerriAI/litellm/pull/35315
* fix(mcp): deny MCP access when a named entitlement cannot be read by @yassin-berriai in https://github.com/BerriAI/litellm/pull/35160
* feat(proxy): add generic list handler for /management/v1 by @yuneng-berri in https://github.com/BerriAI/litellm/pull/35308
* fix(aiohttp): dispose recycled client sessions deterministically by @yassin-berriai in https://github.com/BerriAI/litellm/pull/33428
* test(e2e): skip the three Datadog MCP tool-call tests pending LIT-5052 by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/35380
* feat(mcp): source the ID-JAG subject from the user's stored SSO assertion by @yassin-berriai in https://github.com/BerriAI/litellm/pull/35147
* test(e2e): skip the throughput SLO load test pending LIT-5054 by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/35381
* fix(guardrails): run bedrock guardrail on MCP tool calls in during_mcp_call mode by @yassin-berriai in https://github.com/BerriAI/litellm/pull/35149
* fix(tool-management): drop unsupported prisma select kwarg from team lookup by @yuneng-berri in https://github.com/BerriAI/litellm/pull/35293
* feat(proxy): add GET /management/v1/budgets by @yuneng-berri in https://github.com/BerriAI/litellm/pull/35310
* fix(gemini): do not send duplicate thoughtSignature copies to Gemini by @mgeorgaklis in https://github.com/BerriAI/litellm/pull/35004
* feat(ui): show which log rows are the auto-router's own classifier calls by @tin-berri in https://github.com/BerriAI/litellm/pull/35304
* fix(ui): nest source object in Claude Code marketplace settings snippet by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/35322
* fix(type-discipline): exempt values frozen in place by tuple/frozenset/MappingProxyType from LIT002 by @mateo-berri in https://github.com/BerriAI/litellm/pull/35325
* feat(ui): add sorting, filtering and search to the budgets page by @yuneng-berri in https://github.com/BerriAI/litellm/pull/35309
* fix(ui): keep the session view open when selecting a log inside it by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/35399
* fix(mcp): enforce tool entitlements on every MCP tool dispatch path by @yassin-berriai in https://github.com/BerriAI/litellm/pull/35156

_[Truncated at 4000 characters — full notes: https://github.com/BerriAI/litellm/releases/tag/v1.96.0-rc.1]_

### v1.95.0-rc.3

- Date: 2026-08-01
- Version: v1.95.0-rc.3
- Original notes: https://github.com/BerriAI/litellm/releases/tag/v1.95.0-rc.3
- Permalink: https://whatsnew.fyi/product/litellm/releases/v1.95.0-rc.3
- Labels: Pre-release

- **security** — All LiteLLM Docker images are now signed with cosign for verification
- **fixed** — Advertise 1M context window for Claude Opus 4.6+ on Azure AI Foundry
- **added** — Send RFC 8707 resource indicators on upstream OAuth legs in MCP
- **fixed** — Resolve judge_model credentials via lazy Router lookup in llm_as_a_judge guardrails
- **fixed** — Center vertical toolbar dividers in UI
- **fixed** — Restore the Add MCP Server dialog size and header spacing in UI
- **fixed** — Truncate long team names in the models table team dropdown in UI
- **fixed** — Resolve dashboard base URL from environment instead of hardcoding localhost in e2e UI tests
- **changed** — Bump gitpython to 3.1.55 and brace-expansion to 5.0.8
- **fixed** — Preserve cache_control breakpoints in comprsr write-back for guardrails
- **fixed** — Pass explicit Python version request to uv tool install
- **changed** — Move the logs end-user filter onto /management/v1 endpoint
- **fixed** — Match exact class in callback dedup so a custom subclass does not block a built-in logger
- **fixed** — Populate cache write token metrics for OpenAI-style usage in Prometheus
- **fixed** — Validate default team values in Default User Settings in UI
- **fixed** — Sanitize per-key callback config out of logged metadata in proxy
- **fixed** — Roll up tool spend daily instead of scanning SpendLogs in proxy
- **fixed** — Keep one chat completion id per stream and always stream completed responses in responses_bridge
- **fixed** — Compress content-parts messages in headroom guardrail for Anthropic traffic
- **fixed** — Release the pre-routing strategy slot when a deployment is replaced or deleted in router

##### Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.95.0-rc.3
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.95.0-rc.3/cosign.pub \
  ghcr.io/berriai/litellm:v1.95.0-rc.3
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
##### What's Changed
* chore(ci): promote internal staging to main by @mateo-berri in https://github.com/BerriAI/litellm/pull/32884
* chore(ci): promote internal staging to main by @yuneng-berri in https://github.com/BerriAI/litellm/pull/33308
* chore(ci): promote internal staging to main by @yuneng-berri in https://github.com/BerriAI/litellm/pull/33425
* chore(ci): promote internal staging to main by @yuneng-berri in https://github.com/BerriAI/litellm/pull/33491
* chore(ci): promote internal staging to main by @yuneng-berri in https://github.com/BerriAI/litellm/pull/33640
* chore(ci): promote internal staging to main by @yuneng-berri in https://github.com/BerriAI/litellm/pull/33868
* chore(ci): promote internal staging to main by @yuneng-berri in https://github.com/BerriAI/litellm/pull/34200
* chore(ci): promote internal staging to main by @yuneng-berri in https://github.com/BerriAI/litellm/pull/34450
* chore(ci): promote internal staging to main by @yuneng-berri in https://github.com/BerriAI/litellm/pull/34519
* fix(azure_ai): advertise 1M context window for Claude Opus 4.6+ on Foundry by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/34556
* feat(mcp): send RFC 8707 resource indicators on upstream OAuth legs by @tin-berri in https://github.com/BerriAI/litellm/pull/34265
* fix(guardrails): resolve judge_model credentials via lazy Router lookup in llm_as_a_judge by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/34509
* style(ui): match MCP Servers tabs to the dashboard's line tab pattern by @yuneng-berri in https://github.com/BerriAI/litellm/pull/34685
* fix(ui): center vertical toolbar dividers by @yuneng-berri in https://github.com/BerriAI/litellm/pull/34684
* fix(ui): restore the Add MCP Server dialog size and header spacing by @yuneng-berri in https://github.com/BerriAI/litellm/pull/34679
* fix(ui): truncate long team names in the models table team dropdown by @yuneng-berri in https://github.com/BerriAI/litellm/pull/34689
* fix(e2e/ui): resolve dashboard base URL from env instead of hardcoding localhost by @mubashir1osmani in https://github.com/BerriAI/litellm/pull/34739
* chore(deps): bump gitpython to 3.1.55 and brace-expansion to 5.0.8 by @yuneng-berri in https://github.com/BerriAI/litellm/pull/34798
* fix(guardrails): preserve cache_control breakpoints in compresr write-back by @tin-berri in https://github.com/BerriAI/litellm/pull/34660
* fix(install): pass an explicit Python version request to uv tool install by @tin-berri in https://github.com/BerriAI/litellm/pull/34750
* refactor(management): move the logs end-user filter onto /management/v1 by @yuneng-berri in https://github.com/BerriAI/litellm/pull/34691
* fix: match exact class in callback dedup so a custom subclass does not block a built-in logger b

_[Truncated at 4000 characters — full notes: https://github.com/BerriAI/litellm/releases/tag/v1.95.0-rc.3]_

### v1.96.0-dev.2

- Date: 2026-07-31
- Version: v1.96.0-dev.2
- Original notes: https://github.com/BerriAI/litellm/releases/tag/v1.96.0-dev.2
- Permalink: https://whatsnew.fyi/product/litellm/releases/v1.96.0-dev.2
- Labels: Pre-release

- **security** — Docker images are now signed with cosign for verification
- **fixed** — Adjust gpt-5.6-terra and gpt-5.6-luna prices according to OpenAI's latest article
- **fixed** — Stamp provider on embedding cache-hit spend logs
- **fixed** — Run post_call guardrails on /v1/messages streaming via unified guardrail translation
- **fixed** — Correct Kimi K2.5/K2.6/K2.7 max output token limits for fireworks_ai
- **added** — Extend keyless gateway OAuth flow to per-server MCP URL paths
- **fixed** — Request stream usage upstream by default and strip it from client streams
- **changed** — Move the v3 limiter per-request stash off request metadata onto a ContextVar
- **fixed** — Stop compressing the turn the model must act on in guardrails/headroom
- **fixed** — Let the internal user and org forms save sub-cent budgets
- **fixed** — Serve config guardrails from list and info endpoints without a DB and make their ids stable
- **fixed** — Split mixed stream chunks by payload kind for Anthropic
- **fixed** — Give ComplexityRouter LLM classifier prior-turn context
- **added** — Mark the auto-router's own classifier calls in spend logs
- **fixed** — Bind litellm_metadata by reference in function_setup so guardrail info reaches spend logs
- **added** — Support SSE-KMS encryption params on both S3 logging paths
- **fixed** — Preserve config-defined policies across DB sync and expose them via list APIs
- **fixed** — Correct gpt-5.6 prices for openai, bedrock, and flex long context
- **fixed** — Bill the fast service tier at the priority rate
- **fixed** — Map all documented in-stream error codes to real HTTP statuses

##### Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.96.0-dev.2
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.96.0-dev.2/cosign.pub \
  ghcr.io/berriai/litellm:v1.96.0-dev.2
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
##### What's Changed
* fix(pricing): adjust gpt-5.6-terra and gpt-5.6-luna prices according to OpenAI's latest article by @lihugang in https://github.com/BerriAI/litellm/pull/35258
* fix(caching): stamp provider on embedding cache-hit spend logs by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/35282
* fix(proxy): run post_call guardrails on /v1/messages streaming via unified guardrail translation by @mateo-berri in https://github.com/BerriAI/litellm/pull/35260
* fix(fireworks_ai): correct Kimi K2.5/K2.6/K2.7 max output token limits by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/35174
* feat(mcp)!: extend keyless gateway OAuth flow to per-server MCP URL paths by @tin-berri in https://github.com/BerriAI/litellm/pull/34856
* fix(proxy): request stream usage upstream by default and strip it from client streams by @mateo-berri in https://github.com/BerriAI/litellm/pull/35290
* refactor(rate-limits): move the v3 limiter per-request stash off request metadata onto a ContextVar by @mateo-berri in https://github.com/BerriAI/litellm/pull/35278
* test(e2e): skip the batch rate-limiter spend-row test pending LIT-5027 by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/35301
* fix(guardrails/headroom): stop compressing the turn the model must act on by @tin-berri in https://github.com/BerriAI/litellm/pull/35294
* fix(ui): let the internal user and org forms save sub-cent budgets by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/35302
* fix(guardrails): serve config guardrails from list and info endpoints without a DB and make their ids stable by @mateo-berri in https://github.com/BerriAI/litellm/pull/35259
* fix(anthropic): split mixed stream chunks by payload kind by @yucheng-berri in https://github.com/BerriAI/litellm/pull/35289
* fix: give ComplexityRouter LLM classifier prior-turn context (LIT-4981) by @tin-berri in https://github.com/BerriAI/litellm/pull/35185
* feat(spend-logs): mark the auto-router's own classifier calls by @tin-berri in https://github.com/BerriAI/litellm/pull/35300
* fix(logging): bind litellm_metadata by reference in function_setup so guardrail info reaches spend logs by @yucheng-berri in https://github.com/BerriAI/litellm/pull/35292
* feat(s3): support SSE-KMS encryption params on both S3 logging paths by @yucheng-berri in https://github.com/BerriAI/litellm/pull/35291
* fix(policy_engine): preserve config-defined policies across DB sync and expose them via list APIs by @mateo-berri in https://github.com/BerriAI/litellm/pull/35263
* test: fix order-dependent flake in passthrough guardrail call-type test by @mateo-berri in https://github.com/BerriAI/litellm/pull/35317
* fix(pricing): correct gpt-5.6 prices for openai, bedrock, and flex long context by @mubashir1osmani

_[Truncated at 4000 characters — full notes: https://github.com/BerriAI/litellm/releases/tag/v1.96.0-dev.2]_

### v1.95.0-rc.2

- Date: 2026-07-31
- Version: v1.95.0-rc.2
- Original notes: https://github.com/BerriAI/litellm/releases/tag/v1.95.0-rc.2
- Permalink: https://whatsnew.fyi/product/litellm/releases/v1.95.0-rc.2
- Labels: Pre-release

- **added** — Add Meta Model API provider and muse-spark-1.1
- **added** — Add Azure GPT-5.6 (sol/terra/luna) pricing and metadata
- **added** — Add /v1/messages to supported_endpoints schema enum
- **added** — Add dcr_bridge column and plumbing for client-forwarded auth modes in MCP
- **added** — Add shared composable DataTable component to UI
- **added** — Relay upstream 401 on client-forwarded pass-through tool calls in MCP
- **added** — Add dcr_bridge authorize and token relay redirect handling with mandatory S256 in MCP
- **added** — Add dcr_bridge discovery facade and register relay in MCP
- **added** — Add sealed envelope module for dcr_bridge client-held credentials in MCP
- **added** — Emit the gen_ai.client.operation.exception event on failed LLM calls in OTEL
- **added** — Configure the coordination redis independently of the response cache in proxy
- **added** — Make coordination redis a first-class chart and terraform surface in deploy
- **fixed** — Mask credentials embedded in guardrail_response before persist
- **fixed** — Honor store_prompts_in_spend_logs for guardrail_information in spend-logs
- **fixed** — Sum multi-round session cost in logs UI
- **fixed** — Stop persisting the DCR client onto true_passthrough and oauth_delegate server rows in MCP
- **fixed** — Fail closed and surface semantic filter context window errors in MCP
- **fixed** — Keep mid-conversation system messages in place for Claude Invoke in Bedrock
- **fixed** — Add coordination_redis routes to component allowlist in proxy
- **fixed** — Build redis usage cache from REDIS_* env when cache backend is not Redis in proxy

##### Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.95.0-rc.2
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.95.0-rc.2/cosign.pub \
  ghcr.io/berriai/litellm:v1.95.0-rc.2
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
##### What's Changed
* test(e2e): lower realtime server-VAD threshold to 0.5 by @mubashir1osmani in https://github.com/BerriAI/litellm/pull/32710
* fix(guardrails): mask credentials embedded in guardrail_response before persist (LIT-4314) by @yucheng-berri in https://github.com/BerriAI/litellm/pull/32687
* feat: add Meta Model API provider and muse-spark-1.1 (day-0) by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/32701
* feat(models): add Azure GPT-5.6 (sol/terra/luna) pricing and metadata by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/32678
* ci: skip backend unit tests on ui-only PRs without stranding required checks by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/32532
* refactor(ui): colocate cost-tracking and prompts components into _components/ by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/32716
* refactor(ui): colocate tag-management and vector-stores views, keeping the shared selectors by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/32719
* refactor(ui): colocate the policies view, keeping PolicySelector shared by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/32720
* test: add /v1/messages to supported_endpoints schema enum by @tin-berri in https://github.com/BerriAI/litellm/pull/32739
* fix(spend-logs): honor store_prompts_in_spend_logs for guardrail_information (LIT-4314) by @yucheng-berri in https://github.com/BerriAI/litellm/pull/32688
* fix(spend): sum multi-round session cost in logs UI by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/32796
* refactor(ui): colocate agents and guardrails views, keeping shared selectors and types by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/32728
* fix(mcp): stop persisting the DCR client onto true_passthrough and oauth_delegate server rows by @tin-berri in https://github.com/BerriAI/litellm/pull/32735
* fix(e2e): batch credentials wiring and compose harness for live proxy suite by @mubashir1osmani in https://github.com/BerriAI/litellm/pull/32744
* feat(mcp): add dcr_bridge column and plumbing for client-forwarded auth modes by @tin-berri in https://github.com/BerriAI/litellm/pull/32745
* chore(ui): make knip trustworthy and enforce dead-code in CI by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/32727
* build(pre-commit): regenerate eslint-metrics.json instead of failing on drift by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/32717
* feat(mcp): relay upstream 401 on client-forwarded pass-through tool calls by @tin-berri in https://github.com/BerriAI/litellm/pull/32556
* feat(ui): add shared composable DataTable component by @yuneng-berri in https://github.com/BerriAI/litellm/pull/32680
* fix(mcp): fail closed an

_[Truncated at 4000 characters — full notes: https://github.com/BerriAI/litellm/releases/tag/v1.95.0-rc.2]_

### v1.96.0-dev.1

- Date: 2026-07-31
- Version: v1.96.0-dev.1
- Original notes: https://github.com/BerriAI/litellm/releases/tag/v1.96.0-dev.1
- Permalink: https://whatsnew.fyi/product/litellm/releases/v1.96.0-dev.1
- Labels: Pre-release

- **added** — Add service_tier label to latency and spend metrics in Prometheus
- **fixed** — Keep keep-alive connector config when an aiohttp session is rebuilt
- **fixed** — Pin bundled postgres and redis to bitnamilegacy images in Helm
- **fixed** — Decide rawPredict passthrough streaming from the request body for Vertex
- **fixed** — Translate stop_sequences and disabled thinking for non-Claude targets in anthropic-adapter
- **added** — Publish a generated JSON schema for model_prices_and_context_window.json
- **fixed** — Allow /v1/messages for JWT teams by default
- **fixed** — Skip team model aliases that point at deleted deployments in proxy
- **fixed** — Report when a model write does not survive the post-write reload in proxy
- **fixed** — Reject model writes that corrupt an auto-router pseudo-model in proxy
- **fixed** — Serialize latency for non-chat responses in lowest-latency routing
- **fixed** — Preserve callback order in get_combined_callback_list logging
- **fixed** — Honor explicit priority=0 in router acompletion
- **fixed** — Open the first content block with the real upstream type so reasoning-first streams start with thinking in anthropic-adapter
- **fixed** — Stop provisioning nested group ids as internal users in SCIM
- **fixed** — Size Object Permissions card grid by container width in UI
- **fixed** — Allow /key/update to identify the key by key_alias in proxy
- **added** — Split failed requests into their own series on the cache dashboard in UI
- **added** — Add shareable log links via log_id query param on the logs page in UI

##### Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.96.0-dev.1
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.96.0-dev.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.96.0-dev.1
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
##### What's Changed
* feat(prometheus): add service_tier label to latency and spend metrics by @yassin-berriai in https://github.com/BerriAI/litellm/pull/34966
* fix(aiohttp): keep keep-alive connector config when a session is rebuilt by @yassin-berriai in https://github.com/BerriAI/litellm/pull/34962
* fix(helm): pin bundled postgres and redis to the bitnamilegacy images by @yassin-berriai in https://github.com/BerriAI/litellm/pull/34963
* fix(vertex): decide rawPredict passthrough streaming from the request body by @tin-berri in https://github.com/BerriAI/litellm/pull/34672
* fix(anthropic-adapter): translate stop_sequences and disabled thinking for non-Claude targets by @tin-berri in https://github.com/BerriAI/litellm/pull/34589
* ci: publish a generated JSON schema for model_prices_and_context_window.json by @mateo-berri in https://github.com/BerriAI/litellm/pull/34816
* fix(jwt_auth): allow /v1/messages for JWT teams by default by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/34222
* fix(proxy): skip team model aliases that point at deleted deployments by @mateo-berri in https://github.com/BerriAI/litellm/pull/34993
* fix(proxy): report when a model write does not survive the post-write reload by @tin-berri in https://github.com/BerriAI/litellm/pull/34861
* fix(proxy): reject model writes that corrupt an auto-router pseudo-model by @tin-berri in https://github.com/BerriAI/litellm/pull/34151
* fix(router_strategy): serialize latency for non-chat responses in lowest-latency routing by @mihidumh in https://github.com/BerriAI/litellm/pull/33290
* fix(logging): preserve callback order in get_combined_callback_list by @Harsh23Kashyap in https://github.com/BerriAI/litellm/pull/33008
* fix(router): honor explicit priority=0 in acompletion by @Harsh23Kashyap in https://github.com/BerriAI/litellm/pull/33214
* fix(router_strategy): serialize latency for non-chat responses in lowest-latency routing by @tin-berri in https://github.com/BerriAI/litellm/pull/35048
* fix(anthropic-adapter): open the first content block with the real upstream type so reasoning-first streams start with thinking by @Napuh in https://github.com/BerriAI/litellm/pull/34433
* test(e2e): poll MCP tools across multi-worker lag by @mubashir1osmani in https://github.com/BerriAI/litellm/pull/35047
* fix(scim): stop provisioning nested group ids as internal users by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/34997
* chore(typing): clear basedpyright Any errors in proxy management endpoints by @mateo-berri in https://github.com/BerriAI/litellm/pull/35074
* fix(ui): size Object Permissions card grid by container width by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/35019
* fix(proxy): allow /key/update to identify the key by key_alias by @r

_[Truncated at 4000 characters — full notes: https://github.com/BerriAI/litellm/releases/tag/v1.96.0-dev.1]_