merge main

[Sameerlite]

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

Type

🆕 New Feature
🐛 Bug Fix
🧹 Refactoring
📖 Documentation
🚄 Infrastructure
✅ Test

Changes

---

Note

High Risk
Touches authentication route resolution, team/JWT cache behavior, MCP ACLs, SigV4 pass-through bodies, and spend/cost calculation across many code paths—appropriate for a large main merge but needs careful regression testing.

Overview
This merge brings in OpenAI regional data-residency billing: api_base on eu. / us. OpenAI hosts is inferred into data_residency, threaded through logging and cost paths, and a 10% uplift is applied via regional_processing_uplift_multiplier_* on affected models (including batch and realtime).

Proxy hardening and correctness are a major theme: auth, MCP, pass-through, vector stores, spend logs, and health endpoints now resolve routes with get_request_route (ASGI scope["path"] + root_path) instead of request.url.path, so routing decisions match what FastAPI actually dispatches. Virtual keys with llm_api_routes can GET read-only MCP server discovery paths; team cache refresh deletes team_alias:* entries to avoid stale JWT-by-alias auth. Unified resource IDs parse model_id only at field boundaries (fixes mistaken matches inside file encodings). Pass-through can forward pre-signed raw bodies for SigV4 (e.g. Bedrock) and drops duplicate headers when custom headers override.

Secrets in admin APIs are masked on read (mask_sensitive_keys) for SSO OAuth secrets, Redis/Sentinel passwords, and Slack/SMTP alerting vars. Management endpoint OTEL spans are closed even when handlers lack an http_request param.

CI/infra: daily litellm_oss_agent_shin_MM_DD_YYYY branch workflow, separate proxy-server unit job, and widespread test/config updates for AWS account 941277531214, newer Bedrock/Claude model IDs, mocked Bedrock image gen, and model catalog tweaks (OpenRouter Xiaomi, supports_output_config, etc.).

^{Reviewed by Cursor Bugbot for commit c23b19f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Too many files changed for review. (122 files found, 100 file limit)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
4 out of 6 committers have signed the CLA.

✅ milan-berri
✅ mateo-berri
✅ yuneng-berri
✅ ryan-crabbe-berri
❌ yassin-berriai
❌ ishaan-berri
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: OTEL success span drops response data entirely
  • Restored response=dict(result) population in _emit_management_endpoint_otel_span on the success path so OTEL spans capture management endpoint response data, matching pre-refactor behavior.
• ✅ Fixed: Duplicate constant definition from merge artifact
  • Removed the duplicate _CREDENTIAL_LITELLM_PARAM_FIELDS assignment in litellm/proxy/auth/model_checks.py.

Preview (c23b19f09c)

diff --git a/litellm/proxy/auth/model_checks.py b/litellm/proxy/auth/model_checks.py
--- a/litellm/proxy/auth/model_checks.py
+++ b/litellm/proxy/auth/model_checks.py
@@ -14,9 +14,6 @@
 _CREDENTIAL_LITELLM_PARAM_FIELDS = set(CredentialLiteLLMParams.model_fields)
 
 
-_CREDENTIAL_LITELLM_PARAM_FIELDS = set(CredentialLiteLLMParams.model_fields)
-
-
 def _check_wildcard_routing(model: str) -> bool:
     """
     Returns True if a model is a provider wildcard.

diff --git a/litellm/proxy/management_helpers/utils.py b/litellm/proxy/management_helpers/utils.py
--- a/litellm/proxy/management_helpers/utils.py
+++ b/litellm/proxy/management_helpers/utils.py
@@ -471,10 +471,17 @@
         route = func.__name__
         request_body = {}
 
+    response: Optional[dict] = None
+    if exception is None and result is not None:
+        try:
+            response = dict(result)
+        except Exception:
+            response = None
+
     logging_payload = ManagementEndpointLoggingPayload(
         route=route,
         request_data=request_body,
-        response=None,
+        response=response,
         start_time=start_time,
         end_time=end_time,
         exception=exception,

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit c23b19f. Configure here.}

[cursor]

OTEL success span drops response data entirely

Medium Severity

The _emit_management_endpoint_otel_span function hardcodes response=None in ManagementEndpointLoggingPayload for successful calls. This prevents the result parameter from populating response data in OTEL success spans, unlike the prior implementation.

 

^{Reviewed by Cursor Bugbot for commit c23b19f. Configure here.}

[cursor]

Duplicate constant definition from merge artifact

Low Severity

The variable _CREDENTIAL_LITELLM_PARAM_FIELDS is assigned identically twice. This redundant declaration is likely a merge artifact and adds unnecessary code.

 

^{Reviewed by Cursor Bugbot for commit c23b19f. Configure here.}

[veria-ai]

Medium: MCP route allowlist bypass

This accepts any single segment after /v1/mcp/server/, which includes literal management routes such as /v1/mcp/server/health and /v1/mcp/server/submissions, not just /{server_id}. A virtual key restricted to allowed_routes=["llm_api_routes"] can now call those GET management endpoints; exclude reserved route names here or only apply the carve-out after confirming the request is being dispatched to the GET /v1/mcp/server/{server_id} handler.

[veria-ai]

PR overview

The PR still has an open authorization gap in MCP route handling: a virtual key limited to LLM API routes can reach certain GET management endpoints by using reserved path segments under /v1/mcp/server/. This creates a concrete allowlist bypass with potential exposure of management functionality such as health or submissions endpoints. No issues have been addressed yet, so this remains the current security blocker.

Open issues (1)

• litellm/proxy/auth/route_checks.py:448 — Medium: MCP route allowlist bypass This accepts any single segment after /v1/mcp/server/, which includes literal management routes suc

Fixed/addressed: 0 · PR risk: 7/10