v1.99.1

BerriAI/litellmv1.99.1Sep 2, 2026by yuneng-berri

AI Summary

This is a Docker-only release without a PyPI package, featuring an OpenTelemetry v2 fix that adds cache token counts to spans to correct spend under-counting. The rolling `latest` and `main-stable` image tags have been updated to point to this version.

Key Highlights

Docker-only release (no PyPI package)
OpenTelemetry v2 spans now emit cache token counts
Rolling image tags updated to 1.99.1
Images signed with cosign

New Features

OpenTelemetry cache token count reporting fix

Full Release Notes

## Docker-only release

**This release ships container images only. There is no PyPI package for `1.99.1`.**

`pip install litellm==1.99.1` will not resolve — install the images below, or stay on `1.99.0` on PyPI. The git tag and this release exist so the images are traceable to an exact commit.

| Image | Tags |
|---|---|
| `ghcr.io/berriai/litellm` · `docker.io/litellm/litellm` | `1.99.1`, `v1.99.1` |
| `ghcr.io/berriai/litellm-database` · `docker.io/litellm/litellm-database` | `1.99.1`, `v1.99.1` |
| `ghcr.io/berriai/litellm-non_root` · `docker.io/litellm/litellm-non_root` | `1.99.1`, `v1.99.1` |

This is the newest stable image, so the rolling `latest` and `main-stable` image tags now point at `1.99.1`.

It carries one fix on top of `1.99.0`: OpenTelemetry v2 spans now emit cache token counts (`gen_ai.usage.cache_creation.input_tokens` and `gen_ai.usage.cache_read.input_tokens`) alongside the cache cost that was already reported. If you compute spend from OTel token counts rather than from LiteLLM's own cost fields, prompt-caching workloads were previously under-counted.

---
## Verify Docker Image Signature

All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit `0112e53`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).

**Verify using the pinned commit hash (recommended):**

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.99.1
```

**Verify using the release tag (convenience):**

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

```bash
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.99.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.99.1
```

Expected output:

```
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
```

---
## What's Changed
* chore(release): backport #38716 to stable/1.99.x and cut 1.99.1 by @yuneng-berri in https://github.com/BerriAI/litellm/pull/39179


**Full Changelog**: https://github.com/BerriAI/litellm/compare/v1.99.0...v1.99.1