LiteLLM v1.104.0

v1.104.0
Changed 1
  • Serialize /model/info listing once with orjson
Fixed 10
  • Stop wrapper_async submitting the sync success handler twice
  • Stop re-sending un-resendable spend batches from the Redis buffer
  • Skip cooldown for background response cost poll 404s
  • Stamp model_group when retrieving a batch so batch tokens are attributable
  • Add NotFoundErrorRetries so a retry policy can pin 404 retries
  • Forward response schema and tool parameters through the generateContent adapter
Removed 1
  • Remove the dead telemetry flag from the SDK, proxy CLI and configs
Security 4
  • Add breached password detection to password policy
  • Add self-service password change and plug plaintext password leaks
  • Force password reset for breached or admin-set passwords
  • Refuse to start with an unset, empty, or publicly known master key

From LiteLLM

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.104.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.104.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
What's Changed
New Contributors

…

View original

Upgraded? How did it go?

Discussion