LiteLLM

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit `0112e53`.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

``bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \ ghcr.io/berriai/litellm:v1.104.0 ``

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

``bash cosign verify \ --key https://raw.githubusercontent.com/BerriAI/litellm/v1.104.0/cosign.pub \ ghcr.io/berriai/litellm:v1.104.0 ``

Expected output:

``` The following checks were performed on each of these signatures:

• The cosign claims were validated
• The signatures were verified against the specified public key

```

---

What's Changed

• build(deps): re-suppress GHSA-h7x2-h6g9-p789 in osv-scan, mlflow still has no fixed release by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/41036
• feat(auth): add breached password detection to password policy by @ojensen-berri in https://github.com/BerriAI/litellm/pull/39321
• feat(auth): add self-service password change and plug plaintext password leaks by @ojensen-berri in https://github.com/BerriAI/litellm/pull/39562
• feat(auth): force password reset for breached or admin-set passwords by @ojensen-berri in https://github.com/BerriAI/litellm/pull/40107
• perf(proxy): serialize /model/info listing once with orjson by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/41061
• fix(utils): stop wrapper_async submitting the sync success handler twice by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/41058
• test(integration): native responses and messages cost cases by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/42010
• fix(proxy): stop re-sending un-resendable spend batches from the Redis buffer by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/41994
• fix(router): skip cooldown for background response cost poll 404s by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/42046
• fix(router): stamp model_group when retrieving a batch, so batch tokens are attributable (internal copy of #38499) by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/42062
• test(mcp): restore scoped execution and credential isolation regressions by @joshua-berri in https://github.com/BerriAI/litellm/pull/42050
• feat(proxy)!: refuse to start with an unset, empty, or publicly known master key by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/42019
• docs: stop advertising sk-1234 as the master key in shipped configs and examples by @ryan-crabbe-berri in https://github.com/BerriAI/litellm/pull/42011
• test(logging): add autorouter estimate keys to the GCS pub/sub spend-log golden by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/42061
• fix(router): add NotFoundErrorRetries so a retry policy can pin 404 retries by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/42045
• chore(prices): sync OpenRouter prices: 2 models by @berriai-litellm-provider-info-sync[bot] in https://github.com/BerriAI/litellm/pull/42077
• fix(google_genai): forward response schema and tool parameters through the generateContent adapter by @devin-ai-integration[bot] in https://github.com/BerriAI/litellm/pull/42067
• test(e2e): restore MCP OAuth happy-path coverage (LIT-3467) by @joshua-berri in https://github.com/BerriAI/litellm/pull/42051
• fix(mcp): tools/call no longer 404s on a worker that has n