--- snapshot-1789251386+++ snapshot-1790029705@@ -2,7 +2,11 @@
Release notes from open-webui
-2026-08-31T14:55:42Z tag:github.com,2008:Repository/701547123/v0.11.3 2026-08-31T14:55:53Z
+2026-09-21T19:25:06Z tag:github.com,2008:Repository/701547123/v0.11.4 2026-09-21T19:25:21Z
+
+v0.11.4
+
+Added
- ๐ Far smaller slim image. A slim build now comes down at around 175 MB, near enough 89% smaller than the last release, the local models, the packages around them and the tools that installed them all gone from it; what that changes about the way an instance behaves is set out under Changed below and in the documentation. Commit, Commit
- ๐ฆ Smaller standard image. The image no longer carries a second copy of Python, two sets of fonts nothing ever loaded, packages nothing imports, or the tool that installed them, taking about 170 MB off a standard build. #29731, #29723, #29725, #29726, #29728, Commit, Commit, Commit, Commit
- ๐งโ๐ป Skills from a terminal. Skills a connected terminal server offers now sit beside workspace skills everywhere skills are picked โ the "$" and "/" menus, the integrations menu and the skills panel, each marked Terminal โ and are used the same way: picking one puts its instructions, its folder and the files it ships with in front of the model, and a model that was only told a skill exists can open it itself. They follow whichever terminal is selected and clear when that changes. Commit
- ๐ Terminal instructions file. A model working with a terminal is now handed the AGENTS.md sitting in that terminal's home directory, read afresh at the start of every turn, so the instructions you keep beside your work reach the model without being pasted in. Commit, Commit
- ๐ Automatic skill discovery. Every skill you can reach is now listed to the model by name and description, and the full text of one is loaded only when it decides to use it; before, a skill you had not selected in the message box was invisible to it, and this applies to models with built-in tools on. Commit
- ๐ Model background images. A workspace model can now carry a background image, uploaded in its editor and drawn behind the chat whenever that model is selected, sitting below a folder's own background and above your personal one, and it travels with the model through export and import. Commit
- ๐ Skill creation from a chat. Typing "/skills:create" in a chat that already has content, with a terminal selected, turns the workflow you just went through into a reusable skill written to ".agents/skills" under that terminal's root working directory rather than whatever folder the shell happens to sit in, and authored to Open WebUI's skill standards. Commit, Commit, Commit, Commit, Commit
- ๐ฅ๏ธ Terminal tabs per command. The terminal pane now carries a tab for each command a model is running alongside your own shell, so you can watch them as they go, move between them and take the shell yourself, each tab opening with the command that produced it. Opening the pane puts you in a tab, starting your shell where nothing else is running, and closing the last tab folds the pane away again. Commit, Commit, Commit, Commit
- ๐ Folder uploads to terminals. The file browser beside a terminal takes a folder now, dropped onto it or picked from the Upload Folder entry in its menus, and rebuilds what is inside it as it goes, subfolders and all, where before a drop uploaded only the files sitting loose at the top. Commit, Commit, Commit
- โ๏ธ Side-by-side file comparison. Picking two files in the file browser lights up a Compare button that lays them side by side or one above the other, numbering the lines, marking what was added and removed down to the part of the line that changed, counting both, and letting you swap which is which or leave whitespace out of it, a choice it remembers; a terminal too old to offer the comparison says so rather than failing quietly. Commit, Commit
- ๐ Suggested prompts in your language. A fresh install now offers its suggested starter prompts in the language the interface is set to, rather than the same four in English for everyone, and the model defaults panel carries a way back to those defaults once its own suggestions have been edited. Commit, Commit
- ๐ Exa result length cap. Web search through Exa can be held to a number of characters per result, set beside its key in the admin web search settings or as "EXA_MAX_CONTENT_LENGTH". Commit
- ๐ช๐บ European web search option. Staan can now be picked as the web search provider, giving deployments that need search inside the EU an option they do not have to host themselves, configured from the admin web search settings or through "STAAN_API_KEY", "STAAN_MARKET" and "STAAN_MAX_SNIPPETS". #30138, #26006, #30303, #30301
- ๐ฃ๏ธ Per-language names and descriptions. A model, tool, skill, function, banner or arena entry can now hold its name, description, starter prompts and valve labels once per language, written in a searchable table in its own editor or brought in as a JSON file, which is refused where a translation drops one of the placeholders the original fills in. The interface shows the wording for the language it is set to, and falls back to the plain text where that language has none. Commit, Commit, Commit, Commit
- โ๏ธ Interface text you can reword. An administrator can now replace the interface's own wording language by language from a panel in the admin settings, with a replacement refused where it drops one of the placeholders the original fills in. Commit
- ๐ Turning off the sign-in form. The box asking for an email address and a password can now be taken off the sign-in page from the authentication settings, where until now it could only be set before the server started, leaving single sign-on or a directory to sign people in. Commit
- ๐ท๏ธ Custom file metadata. Metadata attached to an uploaded file now travels with the pieces that file is split into and arrives with the retrieved sources, the oversized and internal fields left out, and an operator can name in "RAG_SOURCE_METADATA_KEYS" which of those fields the model itself gets to see alongside the text. #29499, #29486, Commit, #29502, #29696
- ๐๏ธ Quick delete shortcut. Holding Shift over a note in the list or grid, or over a row on the automations page, turns its trailing controls into a delete button, removing the entry in one click rather than the three the menu and its confirmation ask for. #29635, #29633, #29640, #29637
- ๐ Diffs are drawn as diffs. A diff or patch block in a reply is now laid out as one, with the file and hunk headings, the old and new line numbers, and the added and removed lines picked out down to the part of the line that changed, and a button to switch to the plain text and back. Commit
- โ๏ธ A formatting switch for notes. A note you can edit carries a Formatting switch in its menu: turned off, Markdown you type or paste stays as the characters you wrote, a paste keeps its plain text, and a web address is left as text, while formatting already in the note is untouched. Commit
- ๐๏ธ Admin model list filters. The models page in the admin settings can now be narrowed to the base models a connection offers or to the ones built in the workspace, alongside the filters for enabled, disabled, visible and hidden. Commit
- ๐ Settings search by name. The search box in settings now matches each setting's own name and description rather than a keyword list kept per page, in whichever language you are using and regardless of accents, it leaves out anything your permissions do not let you change, and opening a result no longer clears what you typed. Commit, Commit, Commit
- ๐ A model for every chat. Opening a conversation whose model has since been retired no longer leaves it stranded with nothing selected; it falls back to your default model, then the configured default, then the first one available, and a chat that still has a live model keeps it. #29757
- โก Non-blocking search. Searching the text of chats and knowledge, and the grep a model runs over a knowledge base, now run beside the rest of the server rather than in front of it, so a long search no longer keeps other requests waiting. #29621, Commit
- โด๏ธ Lighter shared note editing. Notes written by several people at once no longer echo every keystroke back to the server once per watcher; the traffic between editors falls by half with two of them and keeps falling as more join, so shared notes stay smooth as the room grows. #28185
- ๐ข Sorted knowledge listings. The "ls", "tree" and "find" commands a model runs over a knowledge base now sort by name and take "-t", "-S" and "-r" for newest first, largest first and reversed. #29840
- ๐ชช Authentication type header. A request to an OpenAI or Ollama connection now carries "X-OpenWebUI-Auth-Type", saying whether the person behind it signed in through the browser or called with an API key; its name is set with "FORWARD_USER_INFO_HEADER_AUTH_TYPE" and "{{AUTH_TYPE}}" works in custom headers. Commit
- ๐ก Follow-up ghost text. Once a reply has finished, the first of the follow-up questions it suggests now sits greyed inside the empty message box as well as under the reply: Tab writes it out, and typing anything of your own clears it away. Commit
- ๐ชต Model refusal logging. A request turned away with "Model not found" now writes a warning naming the account, the model and why it was refused, while the message the caller sees stays as vague as before. Commit
- ๐คฒ Cheaper chat requests behind Redis. Where several servers share their websocket traffic through Redis, a chat request no longer pulls the whole shared model list from Redis to ask about a couple of models; each worker keeps its own copy and refetches only when the list actually changed, so the cost stops growing with the number of models configured. #28176, #28167
- ๐ฝ Long conversations stream cheaper. Writing or reading a single message no longer loads, checks and rewrites the entire conversation to change a few hundred bytes, so streaming into a long chat stops getting more expensive as it grows, and the whole round trip a message event costs falls to a fraction on conversations of thousands of messages. #28184, #28169
- ๐งฑ In-place streaming appends. Streamed replies can be assembled with CPython's in-place string append, turned on with "ENABLE_CHAT_RESPONSE_STREAM_INPLACE_APPEND" and left off by default while it is rolled out gradually. Commit, Commit, #30066
- ๐ Direct connection guidance. The connections and integrations pages in the personal settings now say plainly that a direct connection leans on your browser session to keep requests running, which suits testing and temporary use rather than everyday work. Commit, Commit
- ๐ General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
- ๐ Translation updates. Translations for Japanese, Traditional Chinese, Korean, Finnish, Russian, Ukrainian, German, Spanish, Portuguese (Brazil), Arabic, Arabic (Bahrain), Azerbaijani, Bulgarian, Bengali, Tibetan, Bosnian, Catalan, Cebuano, Czech, Danish, Basque, Croatian, Dutch, Italian, Turkish, Simplified Chinese, Bosnian, Catalan, Danish, Estonian, Finnish, Galician, Croatian, Kabyle, Norwegian Bokmรฅl, Portuguese (Portugal), Romanian and Turkmen were enhanced and expanded.
Fixed
- ๐ก๏ธ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories
- ๐ Tokens stay out of logs. A failure part way through signing in with an identity provider no longer writes the credentials it was handed into the application log, recording the provider and the error it reported instead. #29709
- ๐ Sign-in role mapping. Roles sent by an identity provider were in some setups not applied, leaving an account at the default role, and a sign-in whose roles cannot be read is now refused rather than let through. Commit
- ๐ซ Blocked sign-in groups saved. Comma-separated group names typed into the blocked groups field now take effect once saved, where the save stored the text as written and the sign-in check then read it as nothing; a group name carrying a comma of its own survives a save too. Commit
- ๐ช Signing out ends the session. Signing out or having every token revoked left any live connection that account already had in place, and those are now cut at the same moment; a token already revoked can no longer be replayed to cut someone else's newer session. Commit
- ๐ก Diagrams and SVG stay on this origin. Mermaid diagrams and SVG previews, attached or uploaded, no longer follow references pointing at another origin, a picture, style or configuration line among them, and a diagram that reaches outside is refused with an error; a file whose drawing leans on an external sprite now shows that part blank. #30271
- ๐ฒ Terminal sessions follow access changes. A terminal connection now re-checks your access to it every ten seconds for as long as it stays open, so removing someone's permission or deactivating their account ends their live terminal on the next check, on every worker and not only the one they signed in through. Commit, Commit
- ๐ Connection model listing access. The endpoints that list the models on a single Ollama or OpenAI connection could be reached by a signed-in account of any role, and now check the caller's role. #29619
- ๐ Knowledge file access. A file's access through a knowledge base now follows its actual attachment alone, rather than also a collection name left behind on the file record. #29937
- ๐ณ Knowledge directories stay inside their base. A directory id supplied to the knowledge file routes is now refused where it belongs to a different knowledge base, where a caller-supplied id could reach into a directory tree outside the one being addressed. Commit, #29887
- ๐ช Cookie forwarding scope. A connection authenticating as the signed-in person is handed this instance's browser cookies only where its new Forward cookies switch is on, which an instance relying on it has to turn on after upgrading. Commit, Commit, Commit
- ๐๏ธ Revocation list fallback. Where the revocation list is kept in Redis and Redis cannot be reached, a token is now accepted rather than the request failing, so signing out may not take effect until Redis is back. Commit, Commit
- ๐ Home page chat drafts. A message typed into a chat started from the home page now comes back after a reload, text, uploads and all, where the draft was stored under a key the page never read again. #29762, #29760
- ๐๏ธ S3-hosted chat images. A chat image whose host echoes a Content-Encoding nothing asked for, an S3 or MinIO object uploaded with that metadata among them, no longer breaks the reply it sits in; it is sent as its link the way an unreachable image already was. #29623
- ๐ช Branch descent guard. Stepping between reply branches walked a chat's children without tracking where it had already been, so a history that pointed back at itself spun forever and locked the tab, and a child id with no message behind it threw; every one of the eleven places that walk now shares a single guarded helper. #30070
- ๐๏ธ Note save on exit. A note's title and its attachments save a moment after they change, and leaving the note inside that moment dropped the save, so the notes list kept showing the old title until the page was reloaded; the pending save now finishes before the next page opens. #29745, #29744
- ๐ท Attachments sent without text. Sending an image or a file with nothing typed to a model that has skills attached replaced the empty message with the list of skill names, so the model answered with its own catalogue instead of looking at what you sent. #30045, #30040
- ๐๏ธ SVG attachments read as text. An SVG attached to a chat went up as a picture and came back rejected by every model that tried to decode it, and is now read as its source text instead, which needs a model that accepts file uploads. #30102, #30100
- ๐ฉน Notes survive a small edit. Asked to add a section or change a few lines, a model would send the whole note back and lose the rest of it with nothing to undo, because the editing tool never said when to edit a range instead; it now spells out the range rules the handler already enforced. #30048
- ๐ Note paste placement. A plain paste replaced more of the note than was selected, and a paste into a code block broke out of the block instead of going inside it; both now land exactly where they were dropped. Commit
- ๐งฟ Insert into note on read-only notes. The Insert into note action no longer appears on a note you may only read, which offered it where it could not land. #30223, #30174
- ๐ค Note sharing survives a save. Saving a note you had been given access to took that sharing away, so the note went private and everyone else lost it. #30175
- ๐ Collaborative link handling. In a note two people are writing at once, a plain web address arriving from the other editor was turned into a link on your screen but not on theirs; it is now left as written. Commit
- ๐ Tika 4 document formatting. Where document extraction runs against a Tika server on version 4, the text now comes back as Markdown rather than a flat run of characters, so headings, lists and tables survive into what the model reads. Commit
- โณ Session expiry accuracy. A session with an identity provider now expires with the token it actually calls with, rather than whichever of its two tokens ran out first, which renewed it early and dropped it whenever that failed. Commit
- ๐งฉ Tool steps in finished replies. A reply that called tools showed each step as it ran, then lost them the moment the reply completed, because the provider's closing message replaced everything on screen rather than joining it; the closing message is now merged into what is already there, and a tool call is no longer mistaken for its own result. Commit, Commit
- ๐งญ Streamed replies follow along. A reply arriving over the response events now keeps the view at the bottom as it is written, as replies on the older path already did, unless you have scrolled up yourself. Commit, Commit
- ๐ฟ Tool results arrive when the tools are done. The results of a model's tool calls now reach the reply as soon as the round that produced them finishes, instead of being held back with the rest of the streaming until the throttle let them through, and a channel reply or a continuation no longer carries the picture data a tool handed the model. Commit
- ๐ง Tagged blocks while streaming. A reply using reasoning, solution or code interpreter tags briefly showed the raw tag text in the message as it arrived, because the chunk carrying it reached the browser before the cleaned output did; the cleaned output is now sent the moment a tag is taken out, and the code an interpreter block writes fills that block rather than the message body. Commit
- ๐ Excel in the code interpreter. Reading or writing a spreadsheet in code the browser runs failed outright because the library that handles them never reached the browser, and it is now shipped alongside the rest. #30140, #30130
- ๐ Bundled charts and formatting. Drawing a chart with seaborn in code the browser runs fetched the library over the internet at that moment rather than taking it from what ships, and the code editor's Format button failed outright for anyone who is not an administrator; both now work from what comes with the application, offline included. #30148, #30145
- ๐ Typed answer submission. In the card a model puts up to ask you a question, choosing one of its options on the last question sends your answers straight away, but typing your own into the Other box left Submit answers greyed out with no way to send it, and it now turns on as soon as that box has text. #29494, #29311
- ๐ฅ A truthful Recommended badge. The card a model puts up to ask you a question marks its first option Recommended, but nothing told the model that, so the badge fell on whichever option happened to be listed first; models are now asked to put the option they recommend there. #30196, #30195
- ๐๏ธ Partial settings permissions. An account barred from changing the interface settings can now save its system prompt, notifications, audio, keyboard shortcuts and pinned models, which were refused along with them. Commit
- ๐ง Speech file types kept. Saving the audio settings emptied the list of file types accepted for speech recognition, so transcription then turned away the recordings it had taken before. #30208
- ๐ป Group picker without permission. The picker for sharing a chat, a note or a knowledge base with a group was offered to accounts not allowed to share with groups, and is now hidden from them. #30189
- ๐๏ธ Per-field settings saves. Only the settings actually changed are now stored, rather than the whole object, so another tab's older copy no longer overwrites them and a default an administrator changes still reaches everyone, and pinning a model, reordering the list or picking a default from outside the settings window now saves the same way. Commit, #30183
- โ ๏ธ Failed settings feedback. Settings that could not be saved were shown as saved anyway until the page was reloaded, because the interface stored them locally without waiting on the server; a failure now raises an error and leaves the panel as it was. Commit
- ๐ Menu text scaling. The entries in the menus that drop down across the interface now scale with the rest of it, rather than staying at a fixed size while the menu around them grew. #29493, #29488
- ๐ช Account menu highlighting. An account menu entry carrying a pin button beside it now lights up across the whole row in the shared colour, and a long label no longer pushes the pin out of the menu. Commit
- ๐ฒ Shift-click file selection. Shift-clicking a file in the terminal's file browser now adds that range to what is already selected, and clicking through a selected file removes its range. Commit, Commit, Commit
- ๐ Attachment name collisions. Attaching a file to a message on an instance that puts attachments in a terminal's working directory replaced whatever file of that name was sitting there; the upload now takes the next free name, "report (1).pdf" beside "report.pdf", and the attachment shows the name it was saved under, though two uploads arriving at the same moment from different browsers can still land on the same name. Commit
- ๐ Failed upload feedback. A file that could not be written to the terminal now says so, rather than passing in silence while the browser refreshed as though it had arrived. Commit, Commit, Commit
- โ๏ธ Unchecked checkbox defaults. A prompt variable written as a checkbox with a default of false opened the form already ticked, as did False, "false", 0 and "0", because any non-empty default counted as ticked; it is now ticked only where the value really is true. #30037, #30036
- ๐ฏ Prefilled question timing. Opening a chat from a link holding a question sent it before the box had it, so a question naming a variable went off with the variable unfilled; the send now waits for the text to be in place and filled in. Commit, Commit
- ๐ Task list height. The list of steps a model works through ran as long as it needed and pushed the rest of the reply down the page; it now stops at a quarter of the window's height and scrolls within itself. Commit
- โ Escape key targeting. The shortcut for closing a dialog always shut the settings window, whichever dialog was actually in front, so a dialog opened from within settings took both away at once; each dialog now answers the shortcut for itself, as it already did for the escape key. #29830, #29817
- ๐น Message pair shortcut. The shortcut that adds an empty question and answer to a chat also sent whatever was typed in the message box, so the pair arrived alongside a message you had not meant to send yet. #30167
- ๐ฅ Collapsing the task list. Folding away the list of tasks under a reply also sent whatever you had typed in the message box. #30202
- ๐ฐ๏ธ Temporary chat links. A link carrying the temporary chat marker opened an ordinary chat, because the marker was written into the address but never read back when the page loaded, and such a link now opens the temporary chat it promises. Commit
- โจ๏ธ Recording a new shortcut. Pressing a key combination to record it as a shortcut also ran whatever that combination was already bound to, so setting one up did the thing you were trying to rebind. #30160
- ๐ Stale tab reload. A tab still running the previous build met an error page after the server was updated instead of loading the new one, because every image built from Docker carried the same version stamp; the stamp now follows the build, and a stale tab reloads as it was meant to. #29832, #29831
- ๐ Channel code headers. The bar naming a piece of code in a channel thread or its pinned messages now sits flush at the top of the panel, clipped to the block, rather than floating over the code as it scrolls. #29836, #29835
- ๐จ Duplicated proxy headers. A reply proxied from a terminal server or an OpenAI or Ollama connection no longer carries that server's own "Server" and "Date" headers, which had a reverse proxy in front logging a duplicate line for every one. #29841, #29824, #29843
- ๐ฃ Testing an image connection. The Verify button beside an image generation connection saved the whole image configuration first and then tested whichever engine was active rather than the connection beside it, and it now tests exactly that connection and changes nothing. Commit
- ๐ช Responses API tool strictness. A workspace tool, MCP server or OpenAPI server reaching a model on the Responses API was turned into a strict schema where it had never asked to be, so the model filled every optional field with empty strings, zeros and empty arrays, and search and filter tools were handed values where leaving them out was meant. #30046, #27750
- ๐ช Responses API tool calling. A forced tool choice sent to a connection on the Responses API went out in the wrong shape and was refused by providers that check it, and a tool call in a reply that was not streamed came back as empty text, so nothing reading the API ever saw it. #30095, #30085
- โ๏ธ Missing tools in links. Opening a chat from a link whose "tools" or "tool-ids" parameter names a tool that no longer exists, or that the account cannot see, kept that id in the selection and sent it with the message; ids matching no tool the account has are now dropped and the rest of the link works as before. #29803
- ๐ซ Model editor error messages. A workspace model that cannot be loaded for editing now says so, instead of sending you back with "You do not have permission to edit this model" whatever the real reason. #29694, #29629
- ๐ฅ Directory updates that were dropped. A change your identity provider sent as an add or a remove, or without naming the attribute it was changing, was accepted and then quietly discarded, so a rename or a deactivation never reached the account; those now take effect. Commit
- ๐๏ธ Directory request validation. A provisioning request carrying the wrong kind of value, or an attribute Open WebUI does not support, now comes back as an error instead of passing in silence, and a sync that changes nothing no longer marks the account as touched. Commit
- ๐ Model editor save button. Saving a workspace model whose model list could not be refreshed afterwards now reports the error and frees the Save button, rather than leaving it disabled and spinning though the model had been saved. Commit, Commit
- ๐ซฑ Rating a reply again. Switching a reply's rating from one thumb to the other kept the score and the reason given the first time, and rating a reply whose feedback had since been deleted failed outright; both now record the rating you just gave. #30075, #30077
- ๐ถ Sorting feedback by user. The User column in the admin feedback history did nothing when clicked, and now sorts by who left the feedback. #30191
- ๐ช Closing the Edit User dialog. Changes typed into the admin Edit User dialog and then abandoned showed on the row in the user list until the page was reloaded, and closing the dialog now drops them. #30193
- ๐ช Model defaults save. Saving the model defaults in the admin settings put the selected, pinned and ordered models back as they stood when the page was opened, undoing anything changed in between. #30206
- ๐ค A custom gender shown back. An account whose gender is a wording of its own came back to an empty dropdown in the account form, and the form now shows Custom with that wording beside it. #30215
- ๐๏ธ Clearing a calendar event. Emptying the repeat, the description or the location of a calendar event did not take and the old wording came back, and those fields can be cleared again. #30204
- ๐ Required prompt dropdowns. A prompt's form could be sent with a required dropdown left unchosen, and now asks you to pick something first. #30078
- ๐ซ Account form required fields. The account form now refuses to save with a required field left empty, the way the admin user dialog does, and a date of birth is no longer demanded of accounts that never set one. #30296, #30295
- ๐ Model clones keep their base. Cloning a model from the admin Models settings now carries the model it was built on, where the clone came out detached from it, and an arena model no longer offers Clone at all. #30080, #30079
- ๐งค Model sharing survives a save. Saving a model you cannot fully share no longer strips the access entries you cannot re-create, where an editor resending every stored entry had each one re-checked against what its author may grant, and a save from someone with narrow rights quietly took the model private for everyone else. Commit, #30093, #30087
- ๐ Prompt version saves. Saving a new version of a prompt without Set as Production leaves the live prompt exactly as it was, where the draft quietly took its place, and the editor now shows the production text the moment a version is set. #30231, #30230, #30233, #30232
- ๐ฌ Model description round trips. A workspace model whose description is switched from the default back to custom saves again, where the switch read the field as empty and the description was dropped on save. #30249, #30247
- ๐ Compaction threshold saves. The context compaction threshold set in general settings now reaches the model parameters, where the value never left the page. #30270, #30269
- ๐ข Speech engine defaults. Switching the text to speech engine now applies that engine's own default voice and model, where the change kept the previous engine's settings in place. #30289, #30288
- ๐ MinerU key in local mode. The document settings save again in local mode with the MinerU key left empty, where the form demanded a key it did not need. #30299, #30298
- ๐ซ Group dialog reset. The new-group dialog opens empty after a group is created, where the next one came up holding the group just made. #30280, #30279
- ๐งต Thread reply notifications. Clicking the notification for a reply written inside a thread dropped you at the bottom of the channel with the thread still shut and the reply nowhere in sight; it now opens the thread the reply belongs to. #29856, #29855
- ๐ฝ Dropdown arrow spacing. The arrow in the dropdowns drawn no wider than their contents, among them the provider on a new connection, no longer overlaps the last characters of the longest choice. #29866, #29865
- ๐ง Lowercase header handling. Headers from an upstream that writes them in lower case, as anything served by uvicorn does, are now matched without regard to case, so "Content-Encoding" is stripped and clients stop failing to decompress a body the server had already decoded. #29843
- ๐ Complete chat stop. Where a chat had more than one task in flight, stopping it, deleting it, or closing a note being worked on could stop the first and leave the rest running to the end, both because a task that had already finished ended the round early and because the list being worked through was rewritten underneath it as each one was cleared away; every task is now stopped in turn, so a reply that was calling tools stops calling them rather than running on to its own limit, though instances sharing their state through Redis were not affected. Commit, #29844, #29816
- ๐๏ธ Channel code blocks. Where a model answers in a channel with structured output, the code inside it was drawn as plain highlighted text rather than in the editor every other message uses, so it could not be edited in place and a diff in it could not be opened for editing; it now renders the same way as everywhere else. #29861
- ๐ Code block edits on collapse. An unsaved edit inside a code block stays on screen when the block is folded away and opened again, where collapsing it showed the saved text though the edit was still pending. #30284, #30283
- ๐จ Code run errors with output. A code run that ends with an error now shows the error alongside what it printed, where a run that printed anything at all showed its error nowhere. #30286, #30285
- ๐ Reactions on read-only channels. The reaction picker no longer appears on a channel open to you as a viewer alone, matching the reply and menu options already hidden there. #30241, #30240
- ๐ฏ Knowledge search accuracy on PostgreSQL. A fresh install using PostgreSQL built its search index before a single piece of text existed to organise it around, so the index was never fit for the content that arrived afterwards and every search quietly returned the wrong passages; the index now waits until there is enough text to build on, and until then searches read everything exactly. An install already carrying such an index can restore it by rebuilding that one index. #30143, #30134
- ๐ Knowledge file filter on first click. The File content filter in a knowledge base now narrows the listing the first time it is clicked, where the first click only armed the checkbox and everything stayed listed until it was clicked again. #30211, #30210
- ๐ญ Knowledge base search recall. Where many knowledge bases are stored together, a search of one holding a small share of what is stored found only a small share of its matches, and the shortfall grew as the store did; the search now keeps looking until it has enough from the knowledge base you asked for, and "PGVECTOR_ITERATIVE_SCAN" switches that off or makes it strict. #30142, #30135
- ๐ชฃ Searches that found nothing. A knowledge search that came back empty never handed its database connection back, so enough of them left knowledge search failing outright until the server was restarted; connections are returned now on PostgreSQL and on openGauss alike. #30142, #30133, #30144
- ๐งฝ Knowledge folder deletion. Deleting a folder without moving what was in it up a level dropped the files from the listing but left their text in the search index and the files themselves in storage, so a model went on retrieving and citing pages from a folder that was no longer there; the text is now removed with the folder, and a file no other knowledge base holds is deleted with it unless file retention is switched on. Commit
- ๐ฆ Regex searches over chat and knowledge files. A pattern search now runs in time proportional to the text whatever the pattern, where a nasty expression could stall the search for good, and the patterns it accepts follow RE2's rules, with no lookarounds or backreferences and character classes matching ASCII only. Commit
- โฐ Automation schedule parsing. An automation whose rule puts the time in "DTSTART" is now read at that hour, rather than listed at midnight and opened at nine, which moved when it ran as soon as it was saved again. Commit
- โฒ๏ธ Recurrence counts and start dates. A rule repeating a set number of times, ten or a hundred, is read as the limited repeat it is, where any count beginning with a one was treated as one-shot, and a rule carrying its start date on the same line as its repeat text now follows the start you picked, on schedules and calendar events alike. #29262
- โ Stalled schedules and stuck tasks. A schedule whose rule takes too long to work out no longer holds up the round that evaluates it and is skipped with a warning, and background tasks shared through Redis now expire once their worker falls silent, after "REDIS_TASK_TTL" seconds. Commit
- ๐ฃ Model mention chips. A mention whose ID carried anything beyond letters, digits and a little punctuation, such as the brackets in some workspace model IDs, stayed on screen as the raw "<@โฆ>" text both in the box you type in and in the message once sent; any ID without a space in it is now drawn as a chip. #29864
- ๐ Multi-codepoint emoji. An emoji whose shortcode is several codepoints, the flags among them, is inserted whole, where only its first part reached the message. #30213, #30212
- ๐ Custom webhook names. A webhook target named with a space or a slash is now tidied the way an automatic name always was, so it can still be edited, deleted, made the default or tested afterwards. #29947
- ๐ช Paginated MCP tool lists. A server that hands its tools back a page at a time had only the first page read, so the rest were never offered to a model; the whole list is now collected before the tools are built. Commit
- ๐ญ Anthropic thinking blocks. Open WebUI's own thinking blocks are no longer forwarded to an OpenAI-compatible backend, which since 0.11.0 made a strict server such as NVIDIA Dynamo refuse an Anthropic client's second turn; signed blocks still pass through. #29849, #29799
- ๐จ๏ธ Channel model terminals. A model with a terminal chosen in the workspace had that choice honoured in a chat but dropped where it answered in a channel or ran as a channel automation, so it worked without one; it now carries the same terminal everywhere, alongside the tools, filters and features it already carried. Commit
- ๐งบ Deleted channel messages leave no quotes. Deleting a channel message now clears the quote of it sitting on every reply and drops it from the reply box, where a reply kept showing the deleted message and could still be sent addressed to it. #30314, #30313
- ๐ Terminal tools need a terminal. A model was offered the tools that read your terminal and type into it whether or not the chat had a terminal switched on and connected in your browser, so it could reach for one that was not there; those tools are now handed over only for the terminal the chat has open. Commit, Commit
- ๐ค Custom header encoding. The custom headers a connection sends are encoded once the values are filled in, so a person's name or group carrying anything beyond plain ASCII, a line break included, no longer breaks the request or reaches the other end as something else. Commit
- ๐ Chromium spellcheck corrections. Picking a suggestion from the browser's own spelling menu in the message box did nothing, or put the misspelling straight back, because a highlight meant for the notes editor was being drawn over the selection and rebuilding the text underneath it, taking the browser's spelling marks with it; that highlight is now kept out of the message box and only drawn where the editor is not in use. #29952, #29944
- ๐ IME composition while renaming. Confirming a chat rename with Enter or Escape part way through typing with an input method editor now finishes the composition without saving or cancelling the rename, where the key press acted at once. Commit
- ๐ณ Dotless host addresses. With local web fetching turned on, an address pointing at a container name on the same network, "http://apprise:8000" and the like, is now accepted rather than refused as invalid. #29945, #28161
- ๐ชง False skill mentions. Something written as "<$fh>" in a message, as Perl and other languages do, was taken for a mention of a skill and quietly removed before the model saw it, and drawn on screen as a chip; only mentions naming a skill that exists and is turned on are treated as mentions now. Commit
- ๐ Skill settings survive saving. Saving a skill from its editor cleared the tags and translations it carried and switched it back on where it had been disabled, and all of that now survives the save. #30185
- ๐ซฅ Webhook avatar forwarding. Turning "ENABLE_PROFILE_IMAGE_URL_FORWARDING" off stops browsers being sent on to outside picture addresses, and a channel webhook's picture was sent on regardless; it now serves the built-in picture like the rest, in the webhooks dialog as well as the message list, where the dialog had been sending every viewer's browser straight to the outside address. #29889, #29892
- ๐ช Statistics window origin. The window that shares chat statistics with the community accepted requests from any page that opened it and answered to anywhere; it now reads and replies only where the community site is at the other end. #29918
- ๐ผ๏ธ Tool image rendering. Where a tool answered with an image tucked inside an object or a list rather than on its own, the image was written into the conversation as its raw text, a single screenshot costing hundreds of thousands of tokens and crowding out everything else; such an image is now taken out wherever it sits and attached to the reply, so the model is handed the picture and you see it. An older fault that let every second image through untouched goes with it, and in a saved chat such an image is now kept as a file and referred to rather than written into the conversation itself, so the chat stays small. #29665, #29208, Commit
- โฑ๏ธ Stopped reply state. Pressing stop saved the reply as finished while the parts inside it were still marked as running, so a block went on reading "Thinking..." or "Executing..." and came back that way after every reload; those parts are now closed off as the reply is stopped, and an open tab settles at once rather than only after a reload, while a tool call still waiting for your approval keeps its prompt. #29495, #29281
- ๐ฉบ Knowledge sync errors. A knowledge base sync that fails now names the file it happened on and what the browser said, rather than reporting nothing beyond "Error accessing directory". #29507
- ๐ง Terminal proxy restrictions. Requests passed through to a terminal server are now refused where they aim at that server's administrative endpoints, are not followed on to somewhere else, and are turned away where the path carries characters a parser would rewrite. Commit
- โ Malformed tool calls. Where a model asked for a tool with arguments that were not an object at all, a bare list or string, the reply stopped there; the model is now told what was wrong with the call and can try again. Commit
- ๐ก Broken stream reporting. Where something failed part way through streaming an answer out of "/api/chat/completions", the stream simply stopped, leaving a client waiting on an answer that would never finish; it now closes with an error and a proper end of stream. Commit
- ๐งท Chat unblocked after an error. A reply that failed, on a content filter or an exhausted quota, left the chat turning away everything you typed after it and stopped the message queue. Only the failed reply now ends, so the chat carries on and the other replies in a multi-model answer keep writing. Commit
- ๐ซ Empty failed replies in history. An assistant turn that ended in an error with nothing written is no longer handed back to the model as part of the conversation when you send your next message. Commit
- ๐ญ Empty page uploads. Adding a web address to a knowledge base that came back without any text failed with a bare "Error uploading file" and, where the upload itself was refused, left the row sitting in the list; the reason now reaches you as it was given, and the row is taken away. Commit
- ๐๏ธ Tool embed scope. The frames a tool call can ask to have shown, which run scripts of their own, were drawn wherever a message was rendered, a channel among them; they are now drawn only in the replies of the chat you are in, and never in a channel. #29985
- ๐ฐ Rejected picture addresses. A model entry carrying a picture address the server refuses no longer leaves that address in memory, where anyone signed in could pile them up. #29971
- ๐ Editing a stored image. Asking a model to edit an image this instance already holds now works whatever host its address names, where a container name, a default port or a self-composed host made the edit fail with a generic loading error. #29691, #29220
- ๐งช Memory replies carry less. The memory tool no longer hands the model each memory's stored metadata, and a memory now records the model's id rather than the whole model entry. Commit
- ๐ Memory fully off. With memory switched off, stored memories are no longer folded into a reply's context and the memory tools are no longer offered to the model, where both went on reaching it behind the switch. #30228, #30227
- ๐ง Memory review behind the switch. The background review that drafts new memories from a conversation no longer runs when memories are switched off or the account is barred from them, where it went on spending a task-model call every interval turn and failing at the write. #30309
- ๐๏ธ Terminal server save button. Saving a terminal server now waits for the save to finish before the dialog closes and cannot be set off twice by a second click. Commit
- ๐บ๏ธ Terminal file panel paths. The file panel beside a terminal now opens the file a model just wrote even when it is named with a relative path, where the panel could not match the name, jumped to the root and dragged the session's working directory with it. #30282, #30051
- ๐ด Forked chat folder. Forking a chat put the copy in the original's folder even where you cannot write to that folder; it is now created outside any folder unless you can. #30069
- ๐ชข Dropping a folder in place. Dragging a folder onto the folder it already sits in failed with "Folder already exists", and is now taken for the no-op it is. #30169
- ๐๏ธ Read-only folders read-only everywhere. A folder shared with you as a viewer no longer shows its edit controls on the empty-chat page, where they appeared and a save went through or failed depending on rights the page never checked. Commit
- ๐ฟ Deleting a folder, keeping chats. Removing a folder while keeping the chats inside it was refused for an account not allowed to delete chats, even though nothing was being deleted, and it now goes through. #30163
- ๐ท๏ธ Tag cleanup after deletion. An administrator deleting someone else's chat tidied unused tags out of their own account rather than the owner's, leaving the owner with tags nothing points at. #30171
- ๐ฑ Forking past an unfinished reply. A chat that held an interrupted reply anywhere in it refused every fork from then on and never recovered; forking now waits only on a reply actually being generated, and a turn paused for tool approval still forks with its prompt showing. #30131, #30128
- ๐พ Deleted tool memory. Deleting a tool or a function left the whole of its code in memory for as long as the server ran; it is now let go of along with the rest. #29983
- ๐ Sign-in rate limiting. Counting sign-in attempts through Redis no longer stops the whole worker until Redis answers, so a slow Redis stops freezing every other request with it. #29977
- โป๏ธ Session pool cleanup. The task that clears out abandoned websocket sessions now carries on through an error from Redis instead of ending for good, and stops properly at shutdown. #29976, #29979
- ๐ฐ๏ธ Direct connections across workers. A reply streamed over a direct connection no longer goes quiet part way through where several servers share their websocket traffic through Redis; the events it lives on now travel between workers the way the rest already did. Commit
- ๐ซง Empty document ids. A save arriving for a document with no id at all was filed against that empty id and never cleared, so anyone signed in could pile them up; nothing is filed for it now. #29980
- ๐ฌ Page fetch CPU spin. Fetching a page through the browser-driven loader never returned where that page opened a WebSocket, holding a worker thread at full CPU for the life of the process and costing another core on every further fetch, which left the whole instance slow. #30050, #30024
- ๐ Duplicate search tracebacks. A vector database outage wrote a full traceback twice for every collection and query pair, turning one outage into hundreds of identical stack traces per message on every replica; a single record now names every collection that failed. #29981
- ๐งฏ Page fetch logging. Fetching a page through the browser-driven loader filled the log with tracebacks where the page closed while it was still pulling pieces of itself, as sites behind Cloudflare and similar do; those requests are now let go of before the page closes. #29325, #28869
- ๐ค Tool export scope. Exporting all tools at once returned every tool the account could see, the source of a tool shared for reading included; it now returns only the tools it may edit, matching the single-tool export and the way models already export. #29310
- ๐ณ๏ธ Partial workspace exports. Exporting the prompts or the models from the workspace wrote out only the page you happened to be looking at, so most of them were quietly left out of the file; both now export everything you are allowed to. #30187
- ๐งณ Imported chats keep more. A chat brought back from an export arrived unpinned and unarchived and without the variables it was saved with, and all three now survive the round trip. #30155, #30151
- ๐๏ธ Unarchiving from search. The menu on a search result offered to archive a chat that was already archived and said it had been archived when it had been brought back, and it now names and reports whichever of the two it did. #30177
- ๐ Folder filters with no match. A chat search narrowed by a folder name that matches no folder now finds nothing, where the folder filter was quietly dropped and every chat came back. #30273, #29959
- ๐งน Sidebar after bulk actions. Archiving, deleting or unarchiving every chat at once, or importing a batch of them, left the folders and the pinned chats in the sidebar showing what was no longer there until the page was reloaded, and a bulk action that failed no longer reports success. Commit
- ๐ Model pictures follow model access. The picture belonging to a model is now shown only to people who can see that model, where anyone signed in could fetch it and tell an existing model from an unknown one by which picture came back. #29700
- ๐ช Webhook pictures follow channel access. The picture belonging to a channel webhook is now shown only to people with access to that channel, where anyone signed in could fetch it or be sent on to wherever it pointed, and it is refused outright where channels are turned off. #29703
- ๐ Safer Word document previews. Previewing a Word document no longer renders an HTML sub-document embedded inside it, and a link in one opens only where it points at a web address, a mail address or a telephone number. #29699
- ๐ฆ Citation link schemes. A source attached to a reply now opens only where it points at a web address, falling back to the panel that shows the source rather than following anything else. #29701
- ๐ Citation chips inside formatted text. A citation inside bold, italic or linked text now renders its chip, where the formatting took it and the citation vanished from the sentence. #30278, #30277
- ๐ Saving a tool or function. Saving a tool or function in the admin pages no longer fails with a missing module error from the built-in code formatter, which was not installing everything it needed. #29503
- ๐ ๏ธ Tool request duplication. A tool that writes through an address carrying part of its input no longer has that part repeated in the body of the request as well, which servers checking their input strictly turned away, so those calls now go through. #29717, #29716
- ๐ Answers survive on Apple Silicon. Asking a question that searches a knowledge base with a locally run reranking model no longer takes the whole server down on a Mac, losing the answer and the connection with it. #29735, #29722
- ๐ Web results stop being cited. Pages a web search only listed are no longer offered to the model as things to cite, which had it attaching a result id to text from a different result and the citations panel resolving that to a title that looked right. #29631, #29627
- ๐ SearchApi errors, news and links. Web search through searchapi.io now reports a bad key instead of coming back empty, reads the news results it returns alongside its ordinary ones, and hands the web loader the resolved destination link, so citations stop pointing at a redirect page. #30308, #30305
- ๐ผ Honest version checks. An instance that cannot reach the release listing now says the check failed, instead of reporting whatever it is running as the newest version and recording nothing about it. #29626, #29580
- ๐๏ธ Arena models report their errors. A message to an arena model whose provider answers with an error now shows that error in the chat, where it used to fail on something unrelated and leave the real reason unsaid, and titles and tags no longer break the same way. #29662, #29658
- ๐ณ๏ธ Nameless tool calls fail once. A model endpoint that sends a tool call with no name at all now has that call fail on the spot, rather than the missing name being kept, stored with the message and sent back on the next turn for the endpoint to reject. #29690, #29686
- ๐งน Direct connections stop leaking listeners. A server talking to a direct connection no longer leaves a listener behind for every request that ends any way but a clean finish, which grew without limit while a connection kept failing. #29509
- ๐ Cheaper model refreshes. The model registry shared through Redis is now written only when the models themselves change, rather than on every refresh because of the countdown Ollama attaches to a model it holds in memory. Commit
- โ๏ธ Continued reply text. Asking for the rest of a cut-off reply in a temporary chat replaced what was on screen with only the new text, because the message being continued was read back from the saved chat it did not have. It is now taken from the request before the model is called, the continuation joins the same message instead of arriving as a second one, on a connection whose provider is set to llama.cpp the model is told to carry on from the text it is handed rather than repeat it back, opening the result in the message editor no longer shows a line break where the two halves meet, and, where haptic feedback is switched on, a continuation buzzes as it streams like any other reply. Commit, Commit, Commit, Commit, Commit, Commit, Commit
- ๐ Cancelled edits keep attachments. Cancelling the edit of a message no longer strips the files attached to it, where dropping the edit took the attachments down with it. #30281, #30192
- ๐๏ธ Faster media page reads. The browser-driven loader pulled every image, video and font a page referenced down through the server before any text was extracted, so a page carrying a few dozen audio players took ten seconds or timed out. Those requests are now dropped before they are made, and the same page comes back in under three seconds, having pulled 4 MB where it used to pull 55. #29742, #29741
- ๐ Starting a note from search. Starting a note from the search box now works when you are already on the notes page, keeps the whole of what you typed including characters such as ampersands and hashes, and no longer makes a further note each time the browser back button is pressed. #29645, #29642
- ๐ฑ Apple device replies. An assistant reply no longer comes up blank in a home screen app, an in-app browser or a desktop-class window on Apple devices, where the check that avoided the drawing fault only recognised Safari itself. #29734, #29688, #26712
- ๐ Single source relevance. A reply drawing on a single source now shows how relevant that source is, where the figure appeared only once a second source joined it and so looked as though it came and went. #29647, #29646
- ๐ง Arduino sketches upload to knowledge. A sketch file now reaches the plain text reader like the C++ and header files beside it, rather than being handed to a document extraction server that could make nothing of it and failing the upload. #29673, #29670
- ๐ฐ Docling conversion failures. A file that Docling refuses or fails to convert now fails the upload with the reason Docling gave, rather than breaking with a raw error or quietly filing a placeholder that was then indexed and handed to the model in place of the file. #30107, #29808
- ๐ Uploaded text kept as written. A file whose text contains escape sequences such as the one standing for a non-breaking space is now stored and read by the model exactly as it was written, rather than having some of them rewritten depending on where in the file they sat. #29736, #29732
- ๐ฆ Readable slash command labels. The entries in the slash command menu no longer show as white text on a white background in the light theme. #29512, #29510
- โจ๏ธ Literal arrow sequences. A sequence such as three hyphens after a less-than sign is now shown as the characters it is made of rather than drawn as an arrow, which had text look changed when it never was. #29595, #29594
- ๐๏ธ Editing an image you uploaded. An image already held by Open WebUI can now be used with image editing, where fetching its own link back over the network could fail on a private network or without a sign-in. Commit
- ๐ผ Playground image edits. Editing an image in the Images playground now works, where every attempt came back rejected since the request carried its fields under a heading the endpoint never read. Commit
- ๐จ A tidier attach webpage dialog. The row holding the Add button no longer carries a grey band of its own between the address box and the button, matching every other dialog. #29664, #29663
- ๐ฑ๏ธ A plain note date. The date under a note title no longer shows a pointing hand or announces itself as something to press, having never done anything when clicked. #29708
- ๐ Folder backgrounds on creation. The background image picked in the Create Folder dialog now arrives on the folder when it is created from the sidebar, where the image was discarded unless the dialog was opened from an existing folder. #30218, #30217
- ๐ Delete Chat shortcut everywhere. The keyboard shortcut that deletes the open chat now works wherever the chat was opened from, where it did nothing unless the chat's row happened to be on screen in the sidebar at that moment. #30165, #30164
- ๐ฎ Retired chat variables. A model whose system prompt no longer declares a variable a previous prompt did stops asking for it, where every new chat kept opening the dialog and refusing to send until a value was entered. #30173, #30172
- ๐๏ธ Compact hover previews in Safari. Holding over a chat in the sidebar shows the small preview every other browser shows, rather than one laid out at the width and spacing of a full conversation. #29734
- ๐ Visible title generation faults. When a new chat's automatic title cannot be generated, the reason now reaches the log at the default level, rather than only under debug logging where a broken feature looked the same as a switched-off one. #30106, #29533
Changed
- ๐ชถ Slim starts with nothing configured. The slim image leaves out the local models and the libraries around them, and still starts and holds a conversation on its defaults; the features that leaned on those models each need an external service of their own. Commit
- ๐๏ธ Slim database support. The slim image runs on SQLite, its default, or on PostgreSQL; pointed at MySQL, MariaDB or another engine, or started with AWS RDS IAM logins switched on, it stops with an error instead of starting, and those deployments need the standard image. Commit
- ๐ Slim file storage. The slim image keeps files on local storage, its default; configured for an S3, Google Cloud or Azure bucket, it stops with an error instead of starting, and those deployments need the standard image. Commit
- ๐งฎ Slim searches only through pgvector. Knowledge search on the slim image needs PostgreSQL with pgvector, and configured for another vector store the instance still starts, and the failure arrives the first time something is searched rather than at startup. Commit, Commit
- ๐ง Slim embedding requirements. The slim image carries no embedding or reranking model, so knowledge needs OpenAI, Ollama or Azure OpenAI embeddings and an external reranker, falling back to plain cosine scoring where none is set. Commit
- โ๏ธ Slim document splitting. Splitting a document along a downloaded tokenizer is unavailable on the slim image, which leaves splitting by character or by token count. Commit
- ๐ Slim document readers. The slim image reads text, Markdown, CSV, HTML and XML files as they are; uploading a PDF, a Word file or a presentation fails unless one of the external document extractors is configured. Commit
- ๐๏ธ Slim speech requirements. The slim image carries neither local Whisper nor local voices, so speech to text and text to speech need an external engine before they will work. Commit
- ๐ธ๏ธ Slim web page fetching. The slim image carries no headless browser, so a web page is fetched over plain HTTP or through an external loader, and a page that draws itself with JavaScript comes back with less of its content than on the standard image. Commit, Commit
- ๐ Slim leaves out DDGS. DDGS, the metasearch provider that needs no key of its own, is not carried in the slim image, so web search there needs a provider with a key. Commit
- ๐ฅ Slim code interpreter packages. The slim image leaves out the code interpreter's packages, so the browser fetches numpy, pandas, matplotlib, scikit-learn and the rest from "cdn.jsdelivr.net" and the interpreter stops working where that is blocked. Commit
- ๐งฐ Slim git requirements. The slim image no longer carries git, so a tool or function whose requirements point at a "git+https://" address fails to install and needs the standard image or a published package. Commit
- ๐งบ LangChain community removal. The readers for text, HTML, Word, CSV, PDF and Azure Document Intelligence are now written here rather than taken from "langchain-community", which is no longer installed; a tool or function importing it has to name it in its own requirements from now on. Commit
- ๐งพ Undeclared package imports. Packages that sat in the image only by accident, among them nltk, pymongo, the Google Drive client and the Gemini SDK, are no longer installed, so a tool or function importing one must name it in its own requirements. #29725, #29726, Commit
- ๐ Model ID whitespace. A workspace model whose ID contains a space or a tab is now refused in the editor, through the API and on import; one already stored goes on answering but cannot be saved again until it is recreated. Commit
- ๐๏ธ Link scheme rendering. A link in a reply, a citation or a web search result is now rendered only where it points at a web address, a mail address, a telephone number or somewhere inside this instance; anything else, an "ftp://" address or an application link such as "obsidian://" or "vscode://" among them, is shown as the text it is. Two old oddities go with it: a source written as "HTTP://" now becomes a link, and a filename merely containing the letters http no longer becomes one that leads nowhere. #29890
- ๐งฒ Integrations tab is opt-in. The Integrations tab in personal settings, where tool and terminal connections of your own are managed, is now hidden until an administrator turns on Direct Integrations under Integrations or sets "ENABLE_DIRECT_INTEGRATIONS", and hiding it leaves existing connections working. Commit, Commit
- ๐ก Image connection check endpoint. The endpoint that checks an image generation connection has moved and now takes the connection to test in the request itself, so anything calling the old address needs updating. Commit
github-actions[bot] tag:github.com,2008:Repository/701547123/v0.11.3 2026-08-31T14:55:53Z
v0.11.3
@@ -38,8 +42,4 @@
v0.9.5
-Added
- ๐ก๏ธ Redirect-based SSRF protection. All outbound HTTP requests now block 3xx redirects by default via a new
AIOHTTP_CLIENT_ALLOW_REDIRECTS environment variable, preventing redirect-based SSRF where a public URL silently redirects to internal addresses (RFC 1918, loopback, cloud-metadata endpoints). Affected call sites include web fetch, image loading, OAuth discovery, tool server execution, and code interpreter login. #24491 - ๐ก๏ธ Iframe content security policy. Administrators can now configure a Content-Security-Policy for all srcdoc iframes (Artifacts, tool embeds, file previews, citation modals) via the
IFRAME_CSP environment variable, restricting what LLM-generated or user-uploaded HTML can load and execute inside previews. Commit - ๐๏ธ Granular markdown rendering controls. Users can now independently disable Markdown rendering for user messages and assistant responses from Interface settings, preventing unintended formatting when pasting text that contains Markdown-sensitive characters. Commit
- ๐ง Terminal proxy response headers. Administrators can now inject custom response headers into terminal proxy responses via the
TERMINAL_PROXY_HEADERS environment variable (JSON object), enabling deployment-specific security headers like sandbox policies for proxied content. Commit - ๐ Channel streaming and tool support. Mentioning a model in a Channel now streams responses in real time and supports the full chat completion pipeline, including native and default function calling, built-in tools (web search, image generation), user tools, MCP tools, filters, and RAG knowledge injection โ the same capabilities available in standard chats.
Fixed
- ๐ Notes create and open reliability. Creating new notes and opening existing notes no longer fails with a TypeError caused by
is_pinned being passed to the SQLAlchemy model on create, and passed twice to NoteResponse on read. #24484, #24486 - ๐ Skill public sharing permission enforcement. Creating or updating skills now filters access grants through the
sharing.public_skills permission, preventing non-admin users from making skills publicly accessible without the required permission. #24494 - ๐ Calendar public sharing permission enforcement. Creating or updating calendars now filters access grants through a new
sharing.public_calendars permission, preventing users from making calendars publicly readable or writable without explicit admin-granted sharing permission. #24493 - ๐ Feedback user attribution spoofing. Submitting evaluation feedback can no longer forge the
user_id field through mass-assignment, preventing authenticated users from attributing ratings to other users and corrupting Elo leaderboard rankings and admin feedback exports. #24508 - ๐ก๏ธ Image URL redirect-based SSRF. Chat messages containing image URLs no longer follow 3xx redirects to internal addresses during base64 conversion, closing the most reachable redirect-based SSRF variant that required no special permissions or feature flags. #24524
- ๐ก๏ธ Collection write access on file processing. The
process_file and process_files_batch retrieval endpoints now enforce collection write-access checks before embedding content, preventing authenticated users from injecting file content into another user's knowledge-base collection. #24524 - ๐ Tool source code update authorization. Updating a tool's Python source code now requires
workspace.tools or workspace.tools_import permission, preventing users with only a write-access grant from overwriting executable tool code while still allowing metadata edits. #24513 - ๐ Channel message ownership enforcement. Updating or deleting messages in group and DM channels now requires message ownership, preventing channel members from tampering with or silently removing other members' messages. #24506
- ๐ Channel pin write permission. Pinning and unpinning messages on standard channels now requires write permission instead of read permission, preventing read-only users from modifying pinned content. #24521
- ๐ก๏ธ Image generation URL validation. Generated image URLs are now validated through
validate_url() before fetching, aligning the defense-in-depth posture with sibling image-loading paths. #24518 - ๐ Model params exposure for read-only users. The per-model API endpoint now strips the
params dict (including system prompts) from responses to callers without write access, preventing read-only users from viewing admin-curated model configuration. #24525 - ๐ก๏ธ URL parser SSRF bypass. URL validation now rejects backslash, tab, CR, and LF characters that cause urllib and requests/aiohttp to disagree on the target host, closing a parser-confusion SSRF bypass. #24534
- ๐ก๏ธ Profile image MIME-type allowlist. Serving profile images from data URIs now enforces a strict MIME-type allowlist (PNG, JPEG, GIF, WEBP by default, configurable via
PROFILE_IMAGE_ALLOWED_MIME_TYPES) and sets X-Content-Type-Options: nosniff, preventing stored-XSS through SVG or other executable content types. Commit - ๐ File ownership in folder and knowledge attachments. Attaching files to folders or knowledge bases now verifies per-file read access, and folder file lists in chat middleware are filtered to entries the caller can read, preventing unauthorized file content from being injected into RAG context. Commit
- ๐ Shared chat access for owners and admins. Chat owners can now view and clone their own shared chats without requiring an explicit access grant, and administrators can manage shared chat access controls on any chat. Commit, Commit
- ๐งต Legacy chat history self-healing. Loading legacy conversations now automatically detects broken parent-link graphs in migrated message records, merges missing messages from the embedded JSON history, and backfills them to the normalized table so future loads use the fast path without data loss. Commit
- ๐๏ธ Filter selector reactivity. Model filter checkboxes now derive state reactively from the current filter list and selected IDs instead of capturing a one-time snapshot at mount, so checkboxes update correctly when model contexts or filter configurations change at runtime. Commit
- ๐ Portuguese (Brazil) translation updates. Translations for newly added UI items were added along with a consistency pass across existing entries. #24503
Changed
- ๐งน Removed unauthenticated retrieval status endpoint. The unauthenticated
GET /api/v1/retrieval/ status endpoint has been removed as dead code โ retrieval configuration is already available through authenticated admin endpoints. #24497 - ๐ PR template issue requirement. Pull requests now require a linked Issue or Discussion reference, ensuring better traceability for all contributions. PRs without a linked issue or discussion may be closed without review.
github-actions[bot] tag:github.com,2008:Repository/701547123/v0.9.4 2026-05-09T07:50:17Z
-
-v0.9.4
-
-Fixed
- ๐ Chat scroll position on load. Opening a chat conversation now reliably scrolls to the bottom of the message history, fixing a regression caused by
content-visibility: auto where estimated element sizes prevented the initial scroll from reaching the true bottom.
github-actions[bot]+Added
- ๐ก๏ธ Redirect-based SSRF protection. All outbound HTTP requests now block 3xx redirects by default via a new
AIOHTTP_CLIENT_ALLOW_REDIRECTS environment variable, preventing redirect-based SSRF where a public URL silently redirects to internal addresses (RFC 1918, loopback, cloud-metadata endpoints). Affected call sites include web fetch, image loading, OAuth discovery, tool server execution, and code interpreter login. #24491 - ๐ก๏ธ Iframe content security policy. Administrators can now configure a Content-Security-Policy for all srcdoc iframes (Artifacts, tool embeds, file previews, citation modals) via the
IFRAME_CSP environment variable, restricting what LLM-generated or user-uploaded HTML can load and execute inside previews. Commit - ๐๏ธ Granular markdown rendering controls. Users can now independently disable Markdown rendering for user messages and assistant responses from Interface settings, preventing unintended formatting when pasting text that contains Markdown-sensitive characters. Commit
- ๐ง Terminal proxy response headers. Administrators can now inject custom response headers into terminal proxy responses via the
TERMINAL_PROXY_HEADERS environment variable (JSON object), enabling deployment-specific security headers like sandbox policies for proxied content. Commit - ๐ Channel streaming and tool support. Mentioning a model in a Channel now streams responses in real time and supports the full chat completion pipeline, including native and default function calling, built-in tools (web search, image generation), user tools, MCP tools, filters, and RAG knowledge injection โ the same capabilities available in standard chats.
Fixed
- ๐ Notes create and open reliability. Creating new notes and opening existing notes no longer fails with a TypeError caused by
is_pinned being passed to the SQLAlchemy model on create, and passed twice to NoteResponse on read. #24484, #24486 - ๐ Skill public sharing permission enforcement. Creating or updating skills now filters access grants through the
sharing.public_skills permission, preventing non-admin users from making skills publicly accessible without the required permission. #24494 - ๐ Calendar public sharing permission enforcement. Creating or updating calendars now filters access grants through a new
sharing.public_calendars permission, preventing users from making calendars publicly readable or writable without explicit admin-granted sharing permission. #24493 - ๐ Feedback user attribution spoofing. Submitting evaluation feedback can no longer forge the
user_id field through mass-assignment, preventing authenticated users from attributing ratings to other users and corrupting Elo leaderboard rankings and admin feedback exports. #24508 - ๐ก๏ธ Image URL redirect-based SSRF. Chat messages containing image URLs no longer follow 3xx redirects to internal addresses during base64 conversion, closing the most reachable redirect-based SSRF variant that required no special permissions or feature flags. #24524
- ๐ก๏ธ Collection write access on file processing. The
process_file and process_files_batch retrieval endpoints now enforce collection write-access checks before embedding content, preventing authenticated users from injecting file content into another user's knowledge-base collection. #24524 - ๐ Tool source code update authorization. Updating a tool's Python source code now requires
workspace.tools or workspace.tools_import permission, preventing users with only a write-access grant from overwriting executable tool code while still allowing metadata edits. #24513 - ๐ Channel message ownership enforcement. Updating or deleting messages in group and DM channels now requires message ownership, preventing channel members from tampering with or silently removing other members' messages. #24506
- ๐ Channel pin write permission. Pinning and unpinning messages on standard channels now requires write permission instead of read permission, preventing read-only users from modifying pinned content. #24521
- ๐ก๏ธ Image generation URL validation. Generated image URLs are now validated through
validate_url() before fetching, aligning the defense-in-depth posture with sibling image-loading paths. #24518 - ๐ Model params exposure for read-only users. The per-model API endpoint now strips the
params dict (including system prompts) from responses to callers without write access, preventing read-only users from viewing admin-curated model configuration. #24525 - ๐ก๏ธ URL parser SSRF bypass. URL validation now rejects backslash, tab, CR, and LF characters that cause urllib and requests/aiohttp to disagree on the target host, closing a parser-confusion SSRF bypass. #24534
- ๐ก๏ธ Profile image MIME-type allowlist. Serving profile images from data URIs now enforces a strict MIME-type allowlist (PNG, JPEG, GIF, WEBP by default, configurable via
PROFILE_IMAGE_ALLOWED_MIME_TYPES) and sets X-Content-Type-Options: nosniff, preventing stored-XSS through SVG or other executable content types. Commit - ๐ File ownership in folder and knowledge attachments. Attaching files to folders or knowledge bases now verifies per-file read access, and folder file lists in chat middleware are filtered to entries the caller can read, preventing unauthorized file content from being injected into RAG context. Commit
- ๐ Shared chat access for owners and admins. Chat owners can now view and clone their own shared chats without requiring an explicit access grant, and administrators can manage shared chat access controls on any chat. Commit, Commit
- ๐งต Legacy chat history self-healing. Loading legacy conversations now automatically detects broken parent-link graphs in migrated message records, merges missing messages from the embedded JSON history, and backfills them to the normalized table so future loads use the fast path without data loss. Commit
- ๐๏ธ Filter selector reactivity. Model filter checkboxes now derive state reactively from the current filter list and selected IDs instead of capturing a one-time snapshot at mount, so checkboxes update correctly when model contexts or filter configurations change at runtime. Commit
- ๐ Portuguese (Brazil) translation updates. Translations for newly added UI items were added along with a consistency pass across existing entries. #24503
Changed
- ๐งน Removed unauthenticated retrieval status endpoint. The unauthenticated
GET /api/v1/retrieval/ status endpoint has been removed as dead code โ retrieval configuration is already available through authenticated admin endpoints. #24497 - ๐ PR template issue requirement. Pull requests now require a linked Issue or Discussion reference, ensuring better traceability for all contributions. PRs without a linked issue or discussion may be closed without review.
github-actions[bot]