Phoenix 20.26 blocks compromised LiteLLM and certifi roots

Arize Phoenix shipped four releases between October 21 and October 25, 2026: 20.24.0, 20.25.0, 20.26.0 and 20.26.1. The reason to upgrade is supply-chain hygiene: Phoenix now refuses the LiteLLM 1.107.0 wheels that shipped a credential stealer and requires a certifi bundle without the compromised emSign roots. The rest is smaller: browser errors reach the server log, and the server's own telemetry carries its version.

Release facts

Security and dependency changes (20.24.0)

• LiteLLM 1.107.0 is excluded. Every LiteLLM specifier now carries !=1.107.0, because, as PR 17087 puts it, the 1.107.0 PyPI wheels "shipped a credential stealer". PyPI has pulled that version; the pin also covers installs of the evals [dev] and [test] extras, which the repository's three-day install cooldown never protected. Phoenix's own lock file stays on LiteLLM 1.105.1.
• certifi floor. arize-phoenix and arize-phoenix-client now require certifi>=2026.10.18, which drops the emSign roots behind the compromised eMudhra intermediates (PR 17093). The PR notes that pip install -U leaves a transitive certifi in place, so without a floor existing environments would keep the old bundle.
• Patched Node for contributors. The JavaScript workspace now refuses to run pnpm on Node versions older than the October 2026 security release (24.22.1, or 26.12.1 on the 26.x line). This affects people building Phoenix from source, not the Docker image.

Other changes

• Browser errors in the server log (20.24.0). Uncaught frontend errors are posted to a new internal POST /client_errors route and written as one ERROR record on the phoenix.client_errors logger, rate-limited per IP (PR 17005). Useful if you run Phoenix for a team and only see server logs.
• service.version on server telemetry (20.26.0). The OpenTelemetry resource for Phoenix's own server telemetry now includes service.version, so self-hosted operators can split traces and logs by release.
• Server fixes (20.25.0). A workaround for a graphql-core 3.3.0 subfield cache collision in multi-root queries, and a formatted ID in the experiments 404 message.
• Playground and docs (20.26.0, 20.26.1). MiniMax text model presets were refreshed, arize-phoenix-evals moved to 3.9.3, and new tracing pages cover Pipecat and Microsoft Agent Framework.

Most of 20.25.0 and 20.26.0's feature list is an internal "factory" that turns triaged GitHub issues into pull requests with managed agents. It changes how the Phoenix team works, not what you deploy.

Questions

Do I need to act if I never installed LiteLLM 1.107.0? Upgrading is still the simple fix: it guarantees the bad version can't be resolved and pulls in the certifi floor. If you did install LiteLLM 1.107.0 anywhere, treat the credentials on that machine as exposed.

Does the certifi change break anything? Only connections that relied on the removed emSign roots. The PR notes that certifi 2026.10.19 restores three of the four roots.

Is Phoenix open source? PyPI lists the Elastic License 2.0, a source-available license. The GitHub API does not report a recognized license for the repository.

More on the Phoenix hub, the earlier Phoenix 20.23 launch and the agent infra category. Related observability tools: Langfuse and Opik.