ypollak2/llm-router

v9.1.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 9d LLM Frameworks

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

ai-routing anthropic claude claude-code cost-optimization gemini

+7 more

litellm llm llm-router mcp-server model-router ollama openai

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Strict quota guard blocks native Claude processing unless explicitly permitted, fixing several routing leakage issues.

Changes in this release

Type	Severity	Summary	CVE
Feature	Low	Adds strict quota guard via zero_claude mode setting. Adds strict quota guard via zero_claude mode setting. Source: llm_adapter@2026-05-25 Confidence: high	—
Feature	Low	Adds explicit native escalation prefixes (claude:, native:, opus:). Adds explicit native escalation prefixes (claude:, native:, opus:). Source: llm_adapter@2026-05-25 Confidence: high	—
Bugfix
Bugfix	Medium	Fixes continuation quota leakage for transition prompts. Fixes continuation quota leakage for transition prompts. Source: llm_adapter@2026-05-25 Confidence: high	—
Bugfix	Medium	Prevents fail‑open execution; blocks in strict mode on failures. Prevents fail‑open execution; blocks in strict mode on failures. Source: llm_adapter@2026-05-25 Confidence: high	—
Bugfix	Medium	Updates legacy shell install script to use canonical auto‑route hook. Updates legacy shell install script to use canonical auto‑route hook. Source: llm_adapter@2026-05-25 Confidence: high	—
Bugfix	Low	Ignores whitespace‑only prompts in strict mode. Ignores whitespace‑only prompts in strict mode. Source: llm_adapter@2026-05-25 Confidence: high	—
Bugfix	Low	Ensures release staging includes documentation and installer changes. Ensures release staging includes documentation and installer changes. Source: llm_adapter@2026-05-25 Confidence: high	—

Full changelog

v9.1.0 - Strict Zero-Claude Routing (2026-05-25)

Added

Strict quota guard - set mode: zero_claude in ~/.llm-router/routing.yaml, or set LLM_ROUTER_ZERO_CLAUDE=true, to ensure automatic routes either execute externally or block before native Claude can process the prompt.
Explicit native escalation - prefix a prompt with claude:, native:, or opus: to intentionally permit a native Claude Code turn while strict mode is enabled.

Fixed

Continuation quota leakage - substantive requests beginning with transitions such as "great, now I want..." no longer bypass routing as continuations.
Fail-open execution - failed direct execution, unavailable external tool-agent execution, and MCP-only handoffs now block in strict mode instead of exposing the prompt to native Claude.
Blank prompt handling - whitespace-only submissions are ignored in strict mode instead of producing a misleading block message.
Legacy shell install path - scripts/install.sh now installs the canonical packaged auto-route hook rather than the stale project hook copy.
Release staging - scripts/release.py now includes documentation and installer script changes in its release commit staging set.

Security Fixes

Prevents continuation prompts from bypassing routing (continuation quota leakage)
Blocks fail‑open execution paths in strict mode, avoiding unintended Claude processing

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track ypollak2/llm-router

Get notified when new releases ship.

About ypollak2/llm-router

Subscription-aware LLM router for Claude Code. Routes tasks to 20+ providers (OpenAI, Gemini, Groq, Ollama, Codex) based on complexity classification, Claude subscription pressure, and cost. Free tasks stay on Claude subscription; expensive tasks fall back to the cheapest capable model. Includes 30 MCP tools, 6 auto-routing hooks, semantic dedup cache, prompt caching, daily spend cap, and a live web dashboard.

All releases →

Related context

Related tools

Earlier breaking changes

v9.2.0 Changes auto‑route directive from advisory "DO NOT SKIP" to hard constraint with explicit blocked tools list.
v9.2.0 Breaks permanent downgrade of enforcement after first Edit/Write; v13 now requires per‑turn routing.