Tools
LiteLLM v1.100.0 deletes prompt_token_calculator and signs every image with cosign
Alongside the security fixes, v1.100.0 (2026-09-06) carries a breaking removal: PR #38132 deletes `prompt_token_calculator` outright, immediately after #38130 fixed it to count Claude models again. Every LiteLLM Docker image is now cosign-signed with the key introduced in commit 0112e53, and the release notes give both a pinned-commit verification command (cryptographically immutable) and a tag-based one that relies on tag protection. Also in this release: vector-store upload security controls enforced on /v1/rag/ingest (#38135), and Bing Grounding added as a search provider (#38119).
Source
↳ Follow the thread