v1.83.3.rc.1

LiteLLM Releases / 4/9/2026

📰 NewsDeveloper Stack & InfrastructureTools & Practical Usage

Key Points

  • LiteLLM v1.83.3.rc.1 Docker images are signed using Sigstore/cosign, and the article explains how to verify signatures either by pinned commit hash (recommended) or by the release tag (convenient).
  • The recommended verification method uses a commit-pinned public key URL, emphasizing that commit hashes are cryptographically immutable for stronger assurance.
  • The alternative tag-based verification is simpler to read but depends on repository tag protection rules.
  • The release notes include UI fixes, such as wiring a team_id filter to a key alias dropdown on the Virtual Keys tab and adding a paginated team search to a usage page filter.
  • Expected verification output confirms cosign claim validation and signature verification against the specified public key.

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.83.3.rc.1

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.83.3.rc.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.83.3.rc.1

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

Full Changelog: v1.83.2-nightly...v1.83.3.rc.1