# What changed in litellm

> 101 changes in litellm 1 from its official release notes, upgrade guides and advisories: 7 breaking, 18 security, 39 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/pypi/litellm/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## litellm 1

### Breaking changes

- Adds display_name to credentials and makes credential_name immutable on PATCH. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Bedrock serves gpt-5.6+ chat completions natively by default; gpt-oss and grok can opt into chat_completions/. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Retires the integrated ROI calculator. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Upstream HTTP 402 responses map to PaymentRequiredError, and deployments returning 402 are cooled down. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Tracing now returns only data from SQL queries. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- stdio MCP servers are disabled by default. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Rebrands the Voyage integration to VoyageAI by MongoDB and routes MongoDB keys to ai.mongodb.com. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)

### Security

- Federation credentials using a token file or inline token fail closed when a rule or organization ID is missing. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- The gateway issues rotating refresh tokens and provides a revocation endpoint. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- LiteLLM Docker images are signed with cosign; verify an image using the published public key, preferably from the pinned commit hash. (1.103.5, 1.105.1, 1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0), [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.103.5), [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.105.1)
- Adds a deny list for custom pass-through endpoints. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Proxy administrators can limit which models an end user is allowed to call. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Enforces the prohibition on internal users creating models. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds a startup gate for FIPS mode, with provider assertion and loud password migration failure. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Guardrail litellm_params secrets are encrypted at rest. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds an LLM Shield guardrail for PII redaction and rehydration. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- MCP servers no longer receive the caller's LiteLLM key. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- OAuth clients are bound to their upstream issuer. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- When set, search tools are denied by default. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Search tool litellm_params are encrypted at rest. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- This opt-in setting enables least-privilege vector store access by denying access by default. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters (1.88.6 … 1.96.2) — [security advisory](https://github.com/advisories/GHSA-3CV6-JPF6-8222)
- LiteLLM: Authentication Bypass via Host Header Injection (1.84.0) — [security advisory](https://github.com/advisories/GHSA-4XPC-PV4P-PM3W)
- LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback (1.84.0) — [security advisory](https://github.com/advisories/GHSA-7488-6R32-C95Q)
- LiteLLM: MCP Proxy Has Improper Authentication (1.84.0) — [security advisory](https://github.com/advisories/GHSA-4JCJ-7X88-M979)

### New APIs and options

- Adds logging_only mode for the Akto guardrail. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Allows Anthropic workload identity federation to be configured from the dashboard. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- The exporter requires operator credentials and names an Arize project on every export; per-team sampling rates are honored in fan-out. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Team and key Arize callbacks can choose the OTLP transport. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds an asynchronous SDK helper for running a tool loop. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Maps a JWT to the user's existing virtual key when registering automatically. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Proxy limits can cap batch file records, daily batch uploads, and per-file downloads. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds Bespoke Nimble gateway and OSS classifier support. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds Bespoke Nimble gateway support. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Auto routing can be configured to account for cache state. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Tracing supports Claude agent SDK traces with agent name, logo, and chat content. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- A one-command quickstart starts the gateway, Postgres, and the admin UI. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Enables forwarding the LiteLLM user ID as the user to Fireworks. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- ROI features add GitLab sources and branch cost attribution. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds a minimal in-process tool-calling loop. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- The migrationJob supports custom labels, annotations, command, and args. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds Laya gateway and OSS classifier provider support. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Enterprise LiteAdmin MCP is embedded in LiteLLM images. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds configuration for which metadata fields are stored in LiteLLM_SpendLogs. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds a scope setting to observe input, output, or both in logging-only guardrail mode. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- MCP adds portable pagination for the catalog. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds translation of MCP input requests and binding of continuations. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds rate limiting for all MCP operations and an RPM limit at the server level. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Mistral Large 4 (Le Chonk) is supported. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds OpenAI as a Decisions provider behind a shared Decisions format. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Allows OpenAI workload identity federation to be configured from the LLM Credentials and Add Model forms. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Exposes per-project, per-model gauges for rate limits allowed and used. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Series can be capped for every labeled metric. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Redis hash-tag grouping for the v3 rate limiter is available as an opt-in. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Reka is available as an OpenAI-compatible provider. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds SDK helpers for running a tool loop. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds rerank support for Scaleway. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds per-mode stream_scope support for guardrails, including Bedrock streaming and pass-through fixes. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds support for upstream OAuth client metadata identities when using MCP. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds a unified decisions endpoint for Jev-compatible providers. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Serves the OpenAI Decisions format at this endpoint. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Serves the System One format at this endpoint; the OpenAI format is served at /v1/decisions. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Gemini multimodal embeddings now accept file content blocks containing video_metadata. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Adds workload identity federation and pluggable identity sources for Anthropic. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)

### Behavior and default changes

- Provides an opt-in route for gpt-oss and grok on Bedrock. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Background interaction billing settlement is durable across pods. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Each Nova Sonic assistant sentence is forwarded once over the realtime API. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Streamed prompt-based JSON tool calls are converted into real tool calls. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Transcript guardrails run on raw-path transcription sessions using a transcription-safe block. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- The UI renders team_metadata_schema keys as fixed labels. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Serves a Codex-native model catalog with per-model service_tiers. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)

### Fixes and other changes

- Keeps tool_result next to tool_use when continuing with an Anthropic previous_response_id. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Marks background responses stale_expired when the provider returns 404. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Prices a base64 PDF document per page instead of as one image. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Saves file details for every batch output file so that files can be listed and retrieved. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Maps Scheduled batch jobs to in_progress when retrieving job status. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Tool schemas sent to Converse models have lookaround regex patterns removed when those models reject them. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Falls back to bedrock-mantle for Claude token counting when bedrock-runtime cannot count the model. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- The bridge now honors request cache controls and preserves prompt cache reuse. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- ClickHouse tracing storage configuration is unified. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- The proxy exits when DATABASE_URL is set but the Prisma toolchain is missing. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- CLI and Claude Code gateway sign-in can proceed on nodes where the admin UI is disabled. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Drops encrypted reasoning when a fallback target cannot decrypt it. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Bedrock model pricing includes cross-region rows for glm 5.3. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Keeps idle Responses websockets open until a configurable session limit. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Keeps include_fallback_errors off the provider call on the synchronous Router path. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Forwards the inline-tools beta to Vertex and Anthropic. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Mistral Large 4 (Le Chonk) is added to the supported model catalog. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- nova 2.5 sonic is added to Bedrock model pricing. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- The /openai_passthrough endpoint uses OpenAI workload identity federation tokens. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- The Router now honors a per-request fallbacks list during a mid-stream fallback. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Accepts team-scoped models by their public name. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Missing required parameters, invalid pagination, and unknown IDs return 4xx instead of 500. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Preserves prompt cache breakpoints and maps input_audio blocks in the chat-to-Responses bridge. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Reads the supports_audio_output cost-map key when checking audio output support. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Resumes synchronous streaming fallbacks without retrying the primary deployment. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Unified guardrails now run on image edit requests. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Vector store file listings now return managed file IDs. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Realtime sessions now dial the multi-region Live API host. (1.106.0) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.106.0)
- Proxy fixes from #44243 and #44508 were backported to the stable 1.105.x release. (1.105.1) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.105.1)
- Fixes for responses were backported to the stable 1.103.x release. (1.103.5) — [release notes](https://github.com/BerriAI/litellm/releases/tag/v1.103.5)