LiteLLM is moving to Rust 🦀Read the latest updates.›

LiteLLM v1.106.3, v1.105.4 and v1.103.8 change the image-signing key and drop the eMudhra root CA

Deploy this version

Docker

docker run \
-e LITELLM_MASTER_KEY=sk-<paste-a-long-random-key> \
-e DATABASE_URL=postgresql://<user>:<password>@<host>:5432/<dbname> \
-e STORE_MODEL_IN_DB=True \
-p 4000:4000 \
docker.litellm.ai/berriai/litellm:1.106.3

Pip

pip install litellm==1.106.3

This release is published as ghcr.io/berriai/litellm:v1.106.3. See the GitHub release and the full releases page

v1.106.3 is a patch release on top of v1.106.2. It moves image signing to a new cosign key and removes the eMudhra root CA from every certificate bundle on stable/1.106.x. There are no new database migrations. The v1.106.3 tag points at 4fa8bf1

The image-signing key has changed

Starting with this release, every Docker image and Helm chart is signed with the cosign key from commit e82a3c6. Verifying with the previous key from commit 0112e53 fails. Update anything that pins the old cosign.pub, such as cosign verify scripts, CI checks and admission policies.

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.3

What's Changed

• Every certificate bundle the SDK, proxy and Docker images trust no longer includes the eMudhra root CA - PR #47670, PR #47969, PR #48139
• Docker images and Helm charts are signed with the cosign key from commit e82a3c6. The previous key from commit 0112e53 no longer verifies them - PR #48103

These changes and the version bump are backported in PR #48078 and PR #48142

Full Changelog

https://github.com/BerriAI/litellm/compare/v1.106.2...v1.106.3