litellm v1.103.8

LiteLLM is an open-source Python library and proxy server that lets applications call many AI model providers through one interface, and its 1.103.8 patch release carries two security changes that operators need to act on (release notes). The first removes the eMudhra root certificate authority from every certificate bundle the SDK, proxy and Docker images trust. A bundle is the list of authorities whose certificates software accepts when it opens an encrypted HTTPS connection. According to the pull request, the signing keys for eight eMudhra intermediate authorities leaked on October 17, and anyone holding them could issue a certificate for any website (PR 47670). Because LiteLLM still trusted the root those intermediates chain to, a forged certificate for a provider such as OpenAI would have been accepted. In general, software that accepts a forged certificate can be intercepted by someone in the network path, who can then read or alter the traffic. The fix requires a newer certifi release, updates the Rust trust store and moves the Docker base image to one without that root. Servers that still rely on the root will now fail to connect, which the author describes as the intended result.

The second change replaces the key used to sign LiteLLM's Docker images and Helm charts. Those signatures, made with a tool called cosign, let an operator confirm that an image really came from the project before running it. Images are now signed with a new key from commit `e82a3c6`, and checking them against the previous key will fail, so cosign scripts, CI checks and cluster admission policies such as Kyverno that pin the old public key need updating (PR 48103). The pull request calls this a key rotation but gives no reason, and a follow-up issue asks why the key changed and whether the old one is still trusted. The release also fixes the OpenTelemetry logging callback, which had failed to start with OpenTelemetry 1.44 and newer.