pypi / litellm
litellm
What changed in litellm 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
7 breaking18 security39 new APIs and options7 behavior and defaults30 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initlitellm 1101 changes
Breaking changes 7
Adds display_name to credentials and makes credential_name immutable on PATCH.
Bedrock serves gpt-5.6+ chat completions natively by default; gpt-oss and grok can opt into chat_completions/.
Retires the integrated ROI calculator.
Upstream HTTP 402 responses map to PaymentRequiredError, and deployments returning 402 are cooled down.
Tracing now returns only data from SQL queries.
stdio MCP servers are disabled by default.
Rebrands the Voyage integration to VoyageAI by MongoDB and routes MongoDB keys to ai.mongodb.com.
Security 18
Federation credentials using a token file or inline token fail closed when a rule or organization ID is missing.
The gateway issues rotating refresh tokens and provides a revocation endpoint.
LiteLLM Docker images are signed with cosign; verify an image using the published public key, preferably from the pinned commit hash.
Adds a deny list for custom pass-through endpoints.
Proxy administrators can limit which models an end user is allowed to call.
Enforces the prohibition on internal users creating models.
Adds a startup gate for FIPS mode, with provider assertion and loud password migration failure.
Guardrail litellm_params secrets are encrypted at rest.
Adds an LLM Shield guardrail for PII redaction and rehydration.
MCP servers no longer receive the caller's LiteLLM key.
OAuth clients are bound to their upstream issuer.
When set, search tools are denied by default.
Search tool litellm_params are encrypted at rest.
This opt-in setting enables least-privilege vector store access by denying access by default.
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
LiteLLM: Authentication Bypass via Host Header Injection
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
LiteLLM: MCP Proxy Has Improper Authentication
New APIs and options 39
Adds logging_only mode for the Akto guardrail.
Allows Anthropic workload identity federation to be configured from the dashboard.
The exporter requires operator credentials and names an Arize project on every export; per-team sampling rates are honored in fan-out.
Team and key Arize callbacks can choose the OTLP transport.
Adds an asynchronous SDK helper for running a tool loop.
Maps a JWT to the user's existing virtual key when registering automatically.
Proxy limits can cap batch file records, daily batch uploads, and per-file downloads.
Adds Bespoke Nimble gateway and OSS classifier support.
Adds Bespoke Nimble gateway support.
Auto routing can be configured to account for cache state.
Tracing supports Claude agent SDK traces with agent name, logo, and chat content.
A one-command quickstart starts the gateway, Postgres, and the admin UI.
Enables forwarding the LiteLLM user ID as the user to Fireworks.
ROI features add GitLab sources and branch cost attribution.
Adds a minimal in-process tool-calling loop.
The migrationJob supports custom labels, annotations, command, and args.
Adds Laya gateway and OSS classifier provider support.
Enterprise LiteAdmin MCP is embedded in LiteLLM images.
Adds configuration for which metadata fields are stored in LiteLLM_SpendLogs.
Adds a scope setting to observe input, output, or both in logging-only guardrail mode.
MCP adds portable pagination for the catalog.
Adds translation of MCP input requests and binding of continuations.
Adds rate limiting for all MCP operations and an RPM limit at the server level.
Mistral Large 4 (Le Chonk) is supported.
Adds OpenAI as a Decisions provider behind a shared Decisions format.
Allows OpenAI workload identity federation to be configured from the LLM Credentials and Add Model forms.
Exposes per-project, per-model gauges for rate limits allowed and used.
Series can be capped for every labeled metric.
Redis hash-tag grouping for the v3 rate limiter is available as an opt-in.
Reka is available as an OpenAI-compatible provider.
Adds SDK helpers for running a tool loop.
Adds rerank support for Scaleway.
Adds per-mode stream_scope support for guardrails, including Bedrock streaming and pass-through fixes.
Adds support for upstream OAuth client metadata identities when using MCP.
Adds a unified decisions endpoint for Jev-compatible providers.
Serves the OpenAI Decisions format at this endpoint.
Serves the System One format at this endpoint; the OpenAI format is served at /v1/decisions.
Gemini multimodal embeddings now accept file content blocks containing video_metadata.
Adds workload identity federation and pluggable identity sources for Anthropic.
Behavior and default changes 7
Provides an opt-in route for gpt-oss and grok on Bedrock.
Background interaction billing settlement is durable across pods.
Each Nova Sonic assistant sentence is forwarded once over the realtime API.
Streamed prompt-based JSON tool calls are converted into real tool calls.
Transcript guardrails run on raw-path transcription sessions using a transcription-safe block.
The UI renders team_metadata_schema keys as fixed labels.
Serves a Codex-native model catalog with per-model service_tiers.
Fixes and other changes 30
Keeps tool_result next to tool_use when continuing with an Anthropic previous_response_id.
Marks background responses stale_expired when the provider returns 404.
Prices a base64 PDF document per page instead of as one image.
Saves file details for every batch output file so that files can be listed and retrieved.
Maps Scheduled batch jobs to in_progress when retrieving job status.
Tool schemas sent to Converse models have lookaround regex patterns removed when those models reject them.
Falls back to bedrock-mantle for Claude token counting when bedrock-runtime cannot count the model.
The bridge now honors request cache controls and preserves prompt cache reuse.
ClickHouse tracing storage configuration is unified.
The proxy exits when DATABASE_URL is set but the Prisma toolchain is missing.
CLI and Claude Code gateway sign-in can proceed on nodes where the admin UI is disabled.
Drops encrypted reasoning when a fallback target cannot decrypt it.
Bedrock model pricing includes cross-region rows for glm 5.3.
Keeps idle Responses websockets open until a configurable session limit.
Keeps include_fallback_errors off the provider call on the synchronous Router path.
Forwards the inline-tools beta to Vertex and Anthropic.
Mistral Large 4 (Le Chonk) is added to the supported model catalog.
nova 2.5 sonic is added to Bedrock model pricing.
The /openai_passthrough endpoint uses OpenAI workload identity federation tokens.
The Router now honors a per-request fallbacks list during a mid-stream fallback.
Accepts team-scoped models by their public name.
Missing required parameters, invalid pagination, and unknown IDs return 4xx instead of 500.
Preserves prompt cache breakpoints and maps input_audio blocks in the chat-to-Responses bridge.
Reads the supports_audio_output cost-map key when checking audio output support.
Resumes synchronous streaming fallbacks without retrying the primary deployment.
Unified guardrails now run on image edit requests.
Vector store file listings now return managed file IDs.
Realtime sessions now dial the multi-region Live API host.
Proxy fixes from #44243 and #44508 were backported to the stable 1.105.x release.
Fixes for responses were backported to the stable 1.103.x release.