BerriAI/litellm v1.103.8 on GitHub

Important

The image-signing key has changed. Starting with this release, every Docker image and Helm chart is signed with the new cosign key from commit e82a3c6. Verifying with the previous key from commit 0112e53 will fail.

Update anything that pins the old cosign.pub: cosign verify scripts, CI checks, and admission policies such as Kyverno, Sigstore policy-controller or Connaisseur.

New cosign.pub SHA-256: e3fe3e08c44b16407fe0b37c43b4f8b603b3a0f4ee74c29e647bc022d762c2c0

Verify this release

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
  ghcr.io/berriai/litellm:v1.103.8

Same command for litellm-database, litellm-non_root and the docker.io/litellm/* images

What's new in 1.103.8

4 PRs. 1 fixed, 1 changed, 1 removed. 1 needs action

Action required

Deployment: Verify image signatures with the cosign.pub from commit e82a3c6, the previous key no longer matches (#48103)

Changes

Deployment: Removed the eMudhra root CA from every certificate bundle the SDK, proxy and Docker images trust (#47670, #47969)
Deployment: Changed the cosign key that signs Docker images and Helm charts to the one from commit e82a3c6 (#48103)
Logging and observability: Fixed the otel callback failing to initialize with OpenTelemetry 1.44 and newer (#42431)

Backport #48075 · Full changelog