PyPI · #3404 most downloaded on PyPI

open-webui

0.11.41.4M downloads/moopen-webui/open-webui ↗New releases in your daily digest, changelog included.

Open WebUI

Last release 13 days ago
21 Sep 2026
Ships on a steady schedule
a new release about every 4 weeks
Nearly every release is documented
notes for 60 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
2 years old
166 releases · first in 2024

Release timeline

166 releases since 2024

202420252026

Releases

0.11.421 Sept 2026Security2 sources agree
We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed secti…
Added

📉 Far smaller slim image. A slim build now comes down at around 175 MB, near enough 89% smaller than the last release, the local models, the packages around them and the tools that installed them all gone from it; what that changes about the way an instance behaves is set out under Changed below and in the documentation. Commit, Commit

📦 Smaller standard image. The image no longer carries a second copy of Python, two sets of fonts nothing ever loaded, packages nothing imports, or the tool that installed them, taking about 170 MB off a standard build. #29731, #29723, #29725, #29726, #29728, Commit, Commit, Commit, Commit

🧑‍💻 Skills from a terminal. Skills a connected terminal server offers now sit beside workspace skills everywhere skills are picked — the "$" and "/" menus, the integrations menu and the skills panel, each marked Terminal — and are used the same way: picking one puts its instructions, its folder and the files it ships with in front of the model, and a model that was only told a skill exists can open it itself. They follow whichever terminal is selected and clear when that changes. Commit

📔 Terminal instructions file. A model working with a terminal is now handed the AGENTS.md sitting in that terminal's home directory, read afresh at the start of every turn, so the instructions you keep beside your work reach the model without being pasted in. Commit, Commit

📇 Automatic skill discovery. Every skill you can reach is now listed to the model by name and description, and the full text of one is loaded only when it decides to use it; before, a skill you had not selected in the message box was invisible to it, and this applies to models with built-in tools on. Commit

🌄 Model background images. A workspace model can now carry a background image, uploaded in its editor and drawn behind the chat whenever that model is selected, sitting below a folder's own background and above your personal one, and it travels with the model through export and import. Commit

📓 Skill creation from a chat. Typing "/skills:create" in a chat that already has content, with a terminal selected, turns the workflow you just went through into a reusable skill written to ".agents/skills" under that terminal's root working directory rather than whatever folder the shell happens to sit in, and authored to Open WebUI's skill standards. Commit, Commit, Commit, Commit, Commit

🖥️ Terminal tabs per command. The terminal pane now carries a tab for each command a model is running alongside your own shell, so you can watch them as they go, move between them and take the shell yourself, each tab opening with the command that produced it. Opening the pane puts you in a tab, starting your shell where nothing else is running, and closing the last tab folds the pane away again. Commit, Commit, Commit, Commit

📂 Folder uploads to terminals. The file browser beside a terminal takes a folder now, dropped onto it or picked from the Upload Folder entry in its menus, and rebuilds what is inside it as it goes, subfolders and all, where before a drop uploaded only the files sitting loose at the top. Commit, Commit, Commit

⚖️ Side-by-side file comparison. Picking two files in the file browser lights up a Compare button that lays them side by side or one above the other, numbering the lines, marking what was added and removed down to the part of the line that changed, counting both, and letting you swap which is which or leave whitespace out of it, a choice it remembers; a terminal too old to offer the comparison says so rather than failing quietly. Commit, Commit

🌐 Suggested prompts in your language. A fresh install now offers its suggested starter prompts in the language the interface is set to, rather than the same four in English for everyone, and the model defaults panel carries a way back to those defaults once its own suggestions have been edited. Commit, Commit

📏 Exa result length cap. Web search through Exa can be held to a number of characters per result, set beside its key in the admin web search settings or as "EXA_MAX_CONTENT_LENGTH". Commit

🇪🇺 European web search option. Staan can now be picked as the web search provider, giving deployments that need search inside the EU an option they do not have to host themselves, configured from the admin web search settings or through "STAAN_API_KEY", "STAAN_MARKET" and "STAAN_MAX_SNIPPETS". #30138, #26006, #30303, #30301

🗣️ Per-language names and descriptions. A model, tool, skill, function, banner or arena entry can now hold its name, description, starter prompts and valve labels once per language, written in a searchable table in its own editor or brought in as a JSON file, which is refused where a translation drops one of the placeholders the original fills in. The interface shows the wording for the language it is set to, and falls back to the plain text where that language has none. Commit, Commit, Commit, Commit

✏️ Interface text you can reword. An administrator can now replace the interface's own wording language by language from a panel in the admin settings, with a replacement refused where it drops one of the placeholders the original fills in. Commit

🔓 Turning off the sign-in form. The box asking for an email address and a password can now be taken off the sign-in page from the authentication settings, where until now it could only be set before the server started, leaving single sign-on or a directory to sign people in. Commit

🏷️ Custom file metadata. Metadata attached to an uploaded file now travels with the pieces that file is split into and arrives with the retrieved sources, the oversized and internal fields left out, and an operator can name in "RAG_SOURCE_METADATA_KEYS" which of those fields the model itself gets to see alongside the text. #29499, #29486, Commit, #29502, #29696

🗑️ Quick delete shortcut. Holding Shift over a note in the list or grid, or over a row on the automations page, turns its trailing controls into a delete button, removing the entry in one click rather than the three the menu and its confirmation ask for. #29635, #29633, #29640, #29637

🔀 Diffs are drawn as diffs. A diff or patch block in a reply is now laid out as one, with the file and hunk headings, the old and new line numbers, and the added and removed lines picked out down to the part of the line that changed, and a button to switch to the plain text and back. Commit

✒️ A formatting switch for notes. A note you can edit carries a Formatting switch in its menu: turned off, Markdown you type or paste stays as the characters you wrote, a paste keeps its plain text, and a web address is left as text, while formatting already in the note is untouched. Commit

🎛️ Admin model list filters. The models page in the admin settings can now be narrowed to the base models a connection offers or to the ones built in the workspace, alongside the filters for enabled, disabled, visible and hidden. Commit

🔍 Settings search by name. The search box in settings now matches each setting's own name and description rather than a keyword list kept per page, in whichever language you are using and regardless of accents, it leaves out anything your permissions do not let you change, and opening a result no longer clears what you typed. Commit, Commit, Commit

🆘 A model for every chat. Opening a conversation whose model has since been retired no longer leaves it stranded with nothing selected; it falls back to your default model, then the configured default, then the first one available, and a chat that still has a live model keeps it. #29757

⚡ Non-blocking search. Searching the text of chats and knowledge, and the grep a model runs over a knowledge base, now run beside the rest of the server rather than in front of it, so a long search no longer keeps other requests waiting. #29621, Commit

✴️ Lighter shared note editing. Notes written by several people at once no longer echo every keystroke back to the server once per watcher; the traffic between editors falls by half with two of them and keeps falling as more join, so shared notes stay smooth as the room grows. #28185

🔢 Sorted knowledge listings. The "ls", "tree" and "find" commands a model runs over a knowledge base now sort by name and take "-t", "-S" and "-r" for newest first, largest first and reversed. #29840

🪪 Authentication type header. A request to an OpenAI or Ollama connection now carries "X-OpenWebUI-Auth-Type", saying whether the person behind it signed in through the browser or called with an API key; its name is set with "FORWARD_USER_INFO_HEADER_AUTH_TYPE" and "{{AUTH_TYPE}}" works in custom headers. Commit

💡 Follow-up ghost text. Once a reply has finished, the first of the follow-up questions it suggests now sits greyed inside the empty message box as well as under the reply: Tab writes it out, and typing anything of your own clears it away. Commit

🪵 Model refusal logging. A request turned away with "Model not found" now writes a warning naming the account, the model and why it was refused, while the message the caller sees stays as vague as before. Commit

🤲 Cheaper chat requests behind Redis. Where several servers share their websocket traffic through Redis, a chat request no longer pulls the whole shared model list from Redis to ask about a couple of models; each worker keeps its own copy and refetches only when the list actually changed, so the cost stops growing with the number of models configured. #28176, #28167

💽 Long conversations stream cheaper. Writing or reading a single message no longer loads, checks and rewrites the entire conversation to change a few hundred bytes, so streaming into a long chat stops getting more expensive as it grows, and the whole round trip a message event costs falls to a fraction on conversations of thousands of messages. #28184, #28169

🧱 In-place streaming appends. Streamed replies can be assembled with CPython's in-place string append, turned on with "ENABLE_CHAT_RESPONSE_STREAM_INPLACE_APPEND" and left off by default while it is rolled out gradually. Commit, Commit, #30066

📘 Direct connection guidance. The connections and integrations pages in the personal settings now say plainly that a direct connection leans on your browser session to keep requests running, which suits testing and temporary use rather than everyday work. Commit, Commit

🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

🌐 Translation updates. Translations for Japanese, Traditional Chinese, Korean, Finnish, Russian, Ukrainian, German, Spanish, Portuguese (Brazil), Arabic, Arabic (Bahrain), Azerbaijani, Bulgarian, Bengali, Tibetan, Bosnian, Catalan, Cebuano, Czech, Danish, Basque, Croatian, Dutch, Italian, Turkish, Simplified Chinese, Bosnian, Catalan, Danish, Estonian, Finnish, Galician, Croatian, Kabyle, Norwegian Bokmål, Portuguese (Portugal), Romanian and Turkmen were enhanced and expanded.

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories

🔑 Tokens stay out of logs. A failure part way through signing in with an identity provider no longer writes the credentials it was handed into the application log, recording the provider and the error it reported instead. #29709

🔐 Sign-in role mapping. Roles sent by an identity provider were in some setups not applied, leaving an account at the default role, and a sign-in whose roles cannot be read is now refused rather than let through. Commit

🚫 Blocked sign-in groups saved. Comma-separated group names typed into the blocked groups field now take effect once saved, where the save stored the text as written and the sign-in check then read it as nothing; a group name carrying a comma of its own survives a save too. Commit

🚪 Signing out ends the session. Signing out or having every token revoked left any live connection that account already had in place, and those are now cut at the same moment; a token already revoked can no longer be replayed to cut someone else's newer session. Commit

🛡 Diagrams and SVG stay on this origin. Mermaid diagrams and SVG previews, attached or uploaded, no longer follow references pointing at another origin, a picture, style or configuration line among them, and a diagram that reaches outside is refused with an error; a file whose drawing leans on an external sprite now shows that part blank. #30271

📲 Terminal sessions follow access changes. A terminal connection now re-checks your access to it every ten seconds for as long as it stays open, so removing someone's permission or deactivating their account ends their live terminal on the next check, on every worker and not only the one they signed in through. Commit, Commit

🔒 Connection model listing access. The endpoints that list the models on a single Ollama or OpenAI connection could be reached by a signed-in account of any role, and now check the caller's role. #29619

🔏 Knowledge file access. A file's access through a knowledge base now follows its actual attachment alone, rather than also a collection name left behind on the file record. #29937

🌳 Knowledge directories stay inside their base. A directory id supplied to the knowledge file routes is now refused where it belongs to a different knowledge base, where a caller-supplied id could reach into a directory tree outside the one being addressed. Commit, #29887

🍪 Cookie forwarding scope. A connection authenticating as the signed-in person is handed this instance's browser cookies only where its new Forward cookies switch is on, which an instance relying on it has to turn on after upgrading. Commit, Commit, Commit

🗝️ Revocation list fallback. Where the revocation list is kept in Redis and Redis cannot be reached, a token is now accepted rather than the request failing, so signing out may not take effect until Redis is back. Commit, Commit

🗒 Home page chat drafts. A message typed into a chat started from the home page now comes back after a reload, text, uploads and all, where the draft was stored under a key the page never read again. #29762, #29760

🏞️ S3-hosted chat images. A chat image whose host echoes a Content-Encoding nothing asked for, an S3 or MinIO object uploaded with that metadata among them, no longer breaks the reply it sits in; it is sent as its link the way an unreachable image already was. #29623

🪆 Branch descent guard. Stepping between reply branches walked a chat's children without tracking where it had already been, so a history that pointed back at itself spun forever and locked the tab, and a child id with no message behind it threw; every one of the eleven places that walk now shares a single guarded helper. #30070

🗒️ Note save on exit. A note's title and its attachments save a moment after they change, and leaving the note inside that moment dropped the save, so the notes list kept showing the old title until the page was reloaded; the pending save now finishes before the next page opens. #29745, #29744

📷 Attachments sent without text. Sending an image or a file with nothing typed to a model that has skills attached replaced the empty message with the list of skill names, so the model answered with its own catalogue instead of looking at what you sent. #30045, #30040

🖍️ SVG attachments read as text. An SVG attached to a chat went up as a picture and came back rejected by every model that tried to decode it, and is now read as its source text instead, which needs a model that accepts file uploads. #30102, #30100

🩹 Notes survive a small edit. Asked to add a section or change a few lines, a model would send the whole note back and lose the rest of it with nothing to undo, because the editing tool never said when to edit a range instead; it now spells out the range rules the handler already enforced. #30048

📋 Note paste placement. A plain paste replaced more of the note than was selected, and a paste into a code block broke out of the block instead of going inside it; both now land exactly where they were dropped. Commit

🧿 Insert into note on read-only notes. The Insert into note action no longer appears on a note you may only read, which offered it where it could not land. #30223, #30174

🤝 Note sharing survives a save. Saving a note you had been given access to took that sharing away, so the note went private and everyone else lost it. #30175

🌍 Collaborative link handling. In a note two people are writing at once, a plain web address arriving from the other editor was turned into a link on your screen but not on theirs; it is now left as written. Commit

📑 Tika 4 document formatting. Where document extraction runs against a Tika server on version 4, the text now comes back as Markdown rather than a flat run of characters, so headings, lists and tables survive into what the model reads. Commit

⏳ Session expiry accuracy. A session with an identity provider now expires with the token it actually calls with, rather than whichever of its two tokens ran out first, which renewed it early and dropped it whenever that failed. Commit

🧩 Tool steps in finished replies. A reply that called tools showed each step as it ran, then lost them the moment the reply completed, because the provider's closing message replaced everything on screen rather than joining it; the closing message is now merged into what is already there, and a tool call is no longer mistaken for its own result. Commit, Commit

🧭 Streamed replies follow along. A reply arriving over the response events now keeps the view at the bottom as it is written, as replies on the older path already did, unless you have scrolled up yourself. Commit, Commit

🚿 Tool results arrive when the tools are done. The results of a model's tool calls now reach the reply as soon as the round that produced them finishes, instead of being held back with the rest of the streaming until the throttle let them through, and a channel reply or a continuation no longer carries the picture data a tool handed the model. Commit

🧗 Tagged blocks while streaming. A reply using reasoning, solution or code interpreter tags briefly showed the raw tag text in the message as it arrived, because the chunk carrying it reached the browser before the cleaned output did; the cleaned output is now sent the moment a tag is taken out, and the code an interpreter block writes fills that block rather than the message body. Commit

📗 Excel in the code interpreter. Reading or writing a spreadsheet in code the browser runs failed outright because the library that handles them never reached the browser, and it is now shipped alongside the rest. #30140, #30130

📀 Bundled charts and formatting. Drawing a chart with seaborn in code the browser runs fetched the library over the internet at that moment rather than taking it from what ships, and the code editor's Format button failed outright for anyone who is not an administrator; both now work from what comes with the application, offline included. #30148, #30145

🙋 Typed answer submission. In the card a model puts up to ask you a question, choosing one of its options on the last question sends your answers straight away, but typing your own into the Other box left Submit answers greyed out with no way to send it, and it now turns on as soon as that box has text. #29494, #29311

🥇 A truthful Recommended badge. The card a model puts up to ask you a question marks its first option Recommended, but nothing told the model that, so the badge fell on whichever option happened to be listed first; models are now asked to put the option they recommend there. #30196, #30195

🎚️ Partial settings permissions. An account barred from changing the interface settings can now save its system prompt, notifications, audio, keyboard shortcuts and pinned models, which were refused along with them. Commit

🎧 Speech file types kept. Saving the audio settings emptied the list of file types accepted for speech recognition, so transcription then turned away the recordings it had taken before. #30208

🚻 Group picker without permission. The picker for sharing a chat, a note or a knowledge base with a group was offered to accounts not allowed to share with groups, and is now hidden from them. #30189

🗜️ Per-field settings saves. Only the settings actually changed are now stored, rather than the whole object, so another tab's older copy no longer overwrites them and a default an administrator changes still reaches everyone, and pinning a model, reordering the list or picking a default from outside the settings window now saves the same way. Commit, #30183

⚠️ Failed settings feedback. Settings that could not be saved were shown as saved anyway until the page was reloaded, because the interface stored them locally without waiting on the server; a failure now raises an error and leaves the panel as it was. Commit

🔠 Menu text scaling. The entries in the menus that drop down across the interface now scale with the rest of it, rather than staying at a fixed size while the menu around them grew. #29493, #29488

🪞 Account menu highlighting. An account menu entry carrying a pin button beside it now lights up across the whole row in the shared colour, and a long label no longer pushes the pin out of the menu. Commit

🔲 Shift-click file selection. Shift-clicking a file in the terminal's file browser now adds that range to what is already selected, and clicking through a selected file removes its range. Commit, Commit, Commit

🛟 Attachment name collisions. Attaching a file to a message on an instance that puts attachments in a terminal's working directory replaced whatever file of that name was sitting there; the upload now takes the next free name, "report (1).pdf" beside "report.pdf", and the attachment shows the name it was saved under, though two uploads arriving at the same moment from different browsers can still land on the same name. Commit

📛 Failed upload feedback. A file that could not be written to the terminal now says so, rather than passing in silence while the browser refreshed as though it had arrived. Commit, Commit, Commit

☑️ Unchecked checkbox defaults. A prompt variable written as a checkbox with a default of false opened the form already ticked, as did False, "false", 0 and "0", because any non-empty default counted as ticked; it is now ticked only where the value really is true. #30037, #30036

🎯 Prefilled question timing. Opening a chat from a link holding a question sent it before the box had it, so a question naming a variable went off with the variable unfilled; the send now waits for the text to be in place and filled in. Commit, Commit

📜 Task list height. The list of steps a model works through ran as long as it needed and pushed the rest of the reply down the page; it now stops at a quarter of the window's height and scrolls within itself. Commit

⎋ Escape key targeting. The shortcut for closing a dialog always shut the settings window, whichever dialog was actually in front, so a dialog opened from within settings took both away at once; each dialog now answers the shortcut for itself, as it already did for the escape key. #29830, #29817

🎹 Message pair shortcut. The shortcut that adds an empty question and answer to a chat also sent whatever was typed in the message box, so the pair arrived alongside a message you had not meant to send yet. #30167

🥁 Collapsing the task list. Folding away the list of tasks under a reply also sent whatever you had typed in the message box. #30202

🕰️ Temporary chat links. A link carrying the temporary chat marker opened an ordinary chat, because the marker was written into the address but never read back when the page loaded, and such a link now opens the temporary chat it promises. Commit

⌨️ Recording a new shortcut. Pressing a key combination to record it as a shortcut also ran whatever that combination was already bound to, so setting one up did the thing you were trying to rebind. #30160

🔃 Stale tab reload. A tab still running the previous build met an error page after the server was updated instead of loading the new one, because every image built from Docker carried the same version stamp; the stamp now follows the build, and a stale tab reloads as it was meant to. #29832, #29831

📌 Channel code headers. The bar naming a piece of code in a channel thread or its pinned messages now sits flush at the top of the panel, clipped to the block, rather than floating over the code as it scrolls. #29836, #29835

📨 Duplicated proxy headers. A reply proxied from a terminal server or an OpenAI or Ollama connection no longer carries that server's own "Server" and "Date" headers, which had a reverse proxy in front logging a duplicate line for every one. #29841, #29824, #29843

🎣 Testing an image connection. The Verify button beside an image generation connection saved the whole image configuration first and then tested whichever engine was active rather than the connection beside it, and it now tests exactly that connection and changes nothing. Commit

🪝 Responses API tool strictness. A workspace tool, MCP server or OpenAPI server reaching a model on the Responses API was turned into a strict schema where it had never asked to be, so the model filled every optional field with empty strings, zeros and empty arrays, and search and filter tools were handed values where leaving them out was meant. #30046, #27750

🪃 Responses API tool calling. A forced tool choice sent to a connection on the Responses API went out in the wrong shape and was refused by providers that check it, and a tool call in a reply that was not streamed came back as empty text, so nothing reading the API ever saw it. #30095, #30085

⛓️ Missing tools in links. Opening a chat from a link whose "tools" or "tool-ids" parameter names a tool that no longer exists, or that the account cannot see, kept that id in the selection and sent it with the message; ids matching no tool the account has are now dropped and the rest of the link works as before. #29803

🚫 Model editor error messages. A workspace model that cannot be loaded for editing now says so, instead of sending you back with "You do not have permission to edit this model" whatever the real reason. #29694, #29629

👥 Directory updates that were dropped. A change your identity provider sent as an add or a remove, or without naming the attribute it was changing, was accepted and then quietly discarded, so a rename or a deactivation never reached the account; those now take effect. Commit

🗃️ Directory request validation. A provisioning request carrying the wrong kind of value, or an attribute Open WebUI does not support, now comes back as an error instead of passing in silence, and a sync that changes nothing no longer marks the account as touched. Commit

🔘 Model editor save button. Saving a workspace model whose model list could not be refreshed afterwards now reports the error and frees the Save button, rather than leaving it disabled and spinning though the model had been saved. Commit, Commit

🫱 Rating a reply again. Switching a reply's rating from one thumb to the other kept the score and the reason given the first time, and rating a reply whose feedback had since been deleted failed outright; both now record the rating you just gave. #30075, #30077

📶 Sorting feedback by user. The User column in the admin feedback history did nothing when clicked, and now sorts by who left the feedback. #30191

🪂 Closing the Edit User dialog. Changes typed into the admin Edit User dialog and then abandoned showed on the row in the user list until the page was reloaded, and closing the dialog now drops them. #30193

🪙 Model defaults save. Saving the model defaults in the admin settings put the selected, pinned and ordered models back as they stood when the page was opened, undoing anything changed in between. #30206

👤 A custom gender shown back. An account whose gender is a wording of its own came back to an empty dropdown in the account form, and the form now shows Custom with that wording beside it. #30215

🗓️ Clearing a calendar event. Emptying the repeat, the description or the location of a calendar event did not take and the old wording came back, and those fields can be cleared again. #30204

📕 Required prompt dropdowns. A prompt's form could be sent with a required dropdown left unchosen, and now asks you to pick something first. #30078

🎫 Account form required fields. The account form now refuses to save with a required field left empty, the way the admin user dialog does, and a date of birth is no longer demanded of accounts that never set one. #30296, #30295

🐑 Model clones keep their base. Cloning a model from the admin Models settings now carries the model it was built on, where the clone came out detached from it, and an arena model no longer offers Clone at all. #30080, #30079

🧤 Model sharing survives a save. Saving a model you cannot fully share no longer strips the access entries you cannot re-create, where an editor resending every stored entry had each one re-checked against what its author may grant, and a save from someone with narrow rights quietly took the model private for everyone else. Commit, #30093, #30087

📠 Prompt version saves. Saving a new version of a prompt without Set as Production leaves the live prompt exactly as it was, where the draft quietly took its place, and the editor now shows the production text the moment a version is set. #30231, #30230, #30233, #30232

💬 Model description round trips. A workspace model whose description is switched from the default back to custom saves again, where the switch read the field as empty and the description was dropped on save. #30249, #30247

🎚 Compaction threshold saves. The context compaction threshold set in general settings now reaches the model parameters, where the value never left the page. #30270, #30269

📢 Speech engine defaults. Switching the text to speech engine now applies that engine's own default voice and model, where the change kept the previous engine's settings in place. #30289, #30288

🗞 MinerU key in local mode. The document settings save again in local mode with the MinerU key left empty, where the form demanded a key it did not need. #30299, #30298

🫂 Group dialog reset. The new-group dialog opens empty after a group is created, where the next one came up holding the group just made. #30280, #30279

🧵 Thread reply notifications. Clicking the notification for a reply written inside a thread dropped you at the bottom of the channel with the thread still shut and the reply nowhere in sight; it now opens the thread the reply belongs to. #29856, #29855

🔽 Dropdown arrow spacing. The arrow in the dropdowns drawn no wider than their contents, among them the provider on a new connection, no longer overlaps the last characters of the longest choice. #29866, #29865

🧊 Lowercase header handling. Headers from an upstream that writes them in lower case, as anything served by uvicorn does, are now matched without regard to case, so "Content-Encoding" is stripped and clients stop failing to decompress a body the server had already decoded. #29843

🛑 Complete chat stop. Where a chat had more than one task in flight, stopping it, deleting it, or closing a note being worked on could stop the first and leave the rest running to the end, both because a task that had already finished ended the round early and because the list being worked through was rewritten underneath it as each one was cleared away; every task is now stopped in turn, so a reply that was calling tools stops calling them rather than running on to its own limit, though instances sharing their state through Redis were not affected. Commit, #29844, #29816

🖊️ Channel code blocks. Where a model answers in a channel with structured output, the code inside it was drawn as plain highlighted text rather than in the editor every other message uses, so it could not be edited in place and a diff in it could not be opened for editing; it now renders the same way as everywhere else. #29861

📐 Code block edits on collapse. An unsaved edit inside a code block stays on screen when the block is folded away and opened again, where collapsing it showed the saved text though the edit was still pending. #30284, #30283

🚨 Code run errors with output. A code run that ends with an error now shows the error alongside what it printed, where a run that printed anything at all showed its error nowhere. #30286, #30285

🔕 Reactions on read-only channels. The reaction picker no longer appears on a channel open to you as a viewer alone, matching the reply and menu options already hidden there. #30241, #30240

🎯 Knowledge search accuracy on PostgreSQL. A fresh install using PostgreSQL built its search index before a single piece of text existed to organise it around, so the index was never fit for the content that arrived afterwards and every search quietly returned the wrong passages; the index now waits until there is enough text to build on, and until then searches read everything exactly. An install already carrying such an index can restore it by rebuilding that one index. #30143, #30134

🗂 Knowledge file filter on first click. The File content filter in a knowledge base now narrows the listing the first time it is clicked, where the first click only armed the checkbox and everything stayed listed until it was clicked again. #30211, #30210

🔭 Knowledge base search recall. Where many knowledge bases are stored together, a search of one holding a small share of what is stored found only a small share of its matches, and the shortfall grew as the store did; the search now keeps looking until it has enough from the knowledge base you asked for, and "PGVECTOR_ITERATIVE_SCAN" switches that off or makes it strict. #30142, #30135

🪣 Searches that found nothing. A knowledge search that came back empty never handed its database connection back, so enough of them left knowledge search failing outright until the server was restarted; connections are returned now on PostgreSQL and on openGauss alike. #30142, #30133, #30144

🧽 Knowledge folder deletion. Deleting a folder without moving what was in it up a level dropped the files from the listing but left their text in the search index and the files themselves in storage, so a model went on retrieving and citing pages from a folder that was no longer there; the text is now removed with the folder, and a file no other knowledge base holds is deleted with it unless file retention is switched on. Commit

🦀 Regex searches over chat and knowledge files. A pattern search now runs in time proportional to the text whatever the pattern, where a nasty expression could stall the search for good, and the patterns it accepts follow RE2's rules, with no lookarounds or backreferences and character classes matching ASCII only. Commit

⏰ Automation schedule parsing. An automation whose rule puts the time in "DTSTART" is now read at that hour, rather than listed at midnight and opened at nine, which moved when it ran as soon as it was saved again. Commit

⏲️ Recurrence counts and start dates. A rule repeating a set number of times, ten or a hundred, is read as the limited repeat it is, where any count beginning with a one was treated as one-shot, and a rule carrying its start date on the same line as its repeat text now follows the start you picked, on schedules and calendar events alike. #29262

⌛ Stalled schedules and stuck tasks. A schedule whose rule takes too long to work out no longer holds up the round that evaluates it and is skipped with a warning, and background tasks shared through Redis now expire once their worker falls silent, after "REDIS_TASK_TTL" seconds. Commit

📣 Model mention chips. A mention whose ID carried anything beyond letters, digits and a little punctuation, such as the brackets in some workspace model IDs, stayed on screen as the raw "<@…>" text both in the box you type in and in the message once sent; any ID without a space in it is now drawn as a chip. #29864

😀 Multi-codepoint emoji. An emoji whose shortcode is several codepoints, the flags among them, is inserted whole, where only its first part reached the message. #30213, #30212

🔔 Custom webhook names. A webhook target named with a space or a slash is now tidied the way an automatic name always was, so it can still be edited, deleted, made the default or tested afterwards. #29947

🪛 Paginated MCP tool lists. A server that hands its tools back a page at a time had only the first page read, so the rest were never offered to a model; the whole list is now collected before the tools are built. Commit

💭 Anthropic thinking blocks. Open WebUI's own thinking blocks are no longer forwarded to an OpenAI-compatible backend, which since 0.11.0 made a strict server such as NVIDIA Dynamo refuse an Anthropic client's second turn; signed blocks still pass through. #29849, #29799

🗨️ Channel model terminals. A model with a terminal chosen in the workspace had that choice honoured in a chat but dropped where it answered in a channel or ran as a channel automation, so it worked without one; it now carries the same terminal everywhere, alongside the tools, filters and features it already carried. Commit

🧺 Deleted channel messages leave no quotes. Deleting a channel message now clears the quote of it sitting on every reply and drops it from the reply box, where a reply kept showing the deleted message and could still be sent addressed to it. #30314, #30313

🔌 Terminal tools need a terminal. A model was offered the tools that read your terminal and type into it whether or not the chat had a terminal switched on and connected in your browser, so it could reach for one that was not there; those tools are now handed over only for the terminal the chat has open. Commit, Commit

🔤 Custom header encoding. The custom headers a connection sends are encoded once the values are filled in, so a person's name or group carrying anything beyond plain ASCII, a line break included, no longer breaks the request or reaches the other end as something else. Commit

🆎 Chromium spellcheck corrections. Picking a suggestion from the browser's own spelling menu in the message box did nothing, or put the misspelling straight back, because a highlight meant for the notes editor was being drawn over the selection and rebuilding the text underneath it, taking the browser's spelling marks with it; that highlight is now kept out of the message box and only drawn where the editor is not in use. #29952, #29944

🈁 IME composition while renaming. Confirming a chat rename with Enter or Escape part way through typing with an input method editor now finishes the composition without saving or cancelling the rename, where the key press acted at once. Commit

🐳 Dotless host addresses. With local web fetching turned on, an address pointing at a container name on the same network, "http://apprise:8000" and the like, is now accepted rather than refused as invalid. #29945, #28161

🪧 False skill mentions. Something written as "<$fh>" in a message, as Perl and other languages do, was taken for a mention of a skill and quietly removed before the model saw it, and drawn on screen as a chip; only mentions naming a skill that exists and is turned on are treated as mentions now. Commit

🎒 Skill settings survive saving. Saving a skill from its editor cleared the tags and translations it carried and switched it back on where it had been disabled, and all of that now survives the save. #30185

🫥 Webhook avatar forwarding. Turning "ENABLE_PROFILE_IMAGE_URL_FORWARDING" off stops browsers being sent on to outside picture addresses, and a channel webhook's picture was sent on regardless; it now serves the built-in picture like the rest, in the webhooks dialog as well as the message list, where the dialog had been sending every viewer's browser straight to the outside address. #29889, #29892

🪟 Statistics window origin. The window that shares chat statistics with the community accepted requests from any page that opened it and answered to anywhere; it now reads and replies only where the community site is at the other end. #29918

🖼️ Tool image rendering. Where a tool answered with an image tucked inside an object or a list rather than on its own, the image was written into the conversation as its raw text, a single screenshot costing hundreds of thousands of tokens and crowding out everything else; such an image is now taken out wherever it sits and attached to the reply, so the model is handed the picture and you see it. An older fault that let every second image through untouched goes with it, and in a saved chat such an image is now kept as a file and referred to rather than written into the conversation itself, so the chat stays small. #29665, #29208,
Note truncated.

0.11.231 Aug 2026Security2 sources agree

We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed secti…

Added

🖼️ Richer previews for terminal files. Word documents and slide decks produced in the terminal are now previewed as the finished document rather than an approximation, and every document preview gains a page strip down the side with numbered thumbnails you can click to jump straight to a page, and the notice warning that a preview might differ from the download is gone now that it does not. Commit, Commit, Commit, Commit, Commit
⚡ Less overhead on every message. Deployments without pipelines configured, which is the default, no longer pay setup work for them on each chat message and background task. #29146
🏎️ Lighter model list refreshes. On deployments running several workers, a refresh that finds the model list unchanged no longer has every worker rewrite the whole list to the shared cache, cutting the work and the traffic each refresh costs. #29264
🧵 Smoother busy websocket servers. Large Redis-backed websocket deployments now spend far less time sweeping old sessions, reading their own session data back from Redis, and checking every outgoing websocket message for file attachments Open WebUI does not send, so channel posts, collaboration updates, heartbeats, and live chat updates put less load on busy servers. #28835, #28180
🧰 A new request filter step. Filter authors can now use request to adjust the payload right before each model call, including follow-up calls after tool use, while existing inlet, stream, and outlet filters keep working as before. Commit, Commit
🤏 More room in file previews on touch screens. File previews on phones and tablets no longer show zoom buttons that sit over an already small preview, leaving pinch to zoom to do the job. #29176, #29152
👆 Resizing panels by touch. The divider beside the main sidebar or a side panel can now be dragged on a touchscreen or with a stylus, and a drag made with the mouse keeps following the pointer when it leaves the window. Commit, Commit, Commit
🔤 Choice of interface font. Interface settings now offer a font family field where you can name a font installed on your computer and watch it apply across the interface as you type, with an empty field returning to the standard font. Commit
♿ Wider accessibility mode coverage. Accessibility mode now lifts the contrast of more of the interface, including muted text, table text, icons, the colours elements change to on hover, and the highlight behind sidebar and menu items you point at, so low-contrast areas meet the level the accessibility guidelines ask for in both light and dark themes, and the close button on the folder dialog now announces itself to screen readers, as do document and slide previews, which can now be reached with the keyboard. Commit, Commit, #29160, Commit, Commit
🌐 Translation updates. Polish, Simplified Chinese, German, Irish, Catalan, and Portuguese (Brazil) translations were expanded, corrected, and brought up to date with newer interface text. #29029, #29043, #29108, #29151, #29184, #29179, #29247, #29217

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories
💥 Replies stop breaking mid-chat. A conversation no longer fails in the browser and stops showing the assistant reply until you reload, and chats already saved in that state display and can be edited again. #29250, #29244
⌨️ Preview shortcuts stay in the preview. Arrow keys now page a document or slide preview only while that preview has focus, instead of paging it from anywhere on the page and taking the arrow keys away from whatever you were typing in. Commit, Commit
🧊 Streaming no longer stalls on reasoning models. A reply from a reasoning model now streams through to the end instead of showing its first few words and then freezing until generation finishes. #29053, #29035
💭 Thinking stays in Thoughts. After a model uses a tool, its reasoning for the next step now appears in the collapsed Thoughts section instead of being written into the reply as ordinary text. #29052, #29040
🧠 Large tool calls stream faster through Anthropic-compatible clients. When a streamed tool call sends a large block of arguments, Open WebUI now waits until that block can actually be complete before checking it, instead of doing the same expensive check again on every tiny piece. #28858
🛑 Stop works across instances. Stopping a response now takes effect on deployments that spread people across several instances backed by a Redis cluster, instead of the reply continuing to the end regardless. #29165, #19840
🎯 Fewer needless chat reloads. A conversation holding an older unfinished reply no longer reloads itself each time some other response in it finishes, reloading only for the reply the update actually concerns. Commit
📖 Banners with underlined text. A banner containing underlined text now displays instead of failing to render. #29118, #29115
🧰 Pinned models start with their own tools. Starting a chat from a pinned model in the sidebar now applies that model's tools and skills instead of carrying over the ones from the model you used last. #29058, #29050
❓ Rejected ask_user calls no longer kill the reply. If a model asks the user a question in a way Open WebUI refuses, the model now receives that error and can continue or retry, instead of leaving the chat stopped with no answer. #29252, #29077
🚫 Disabled models no longer vanish. Turning a model off in the admin Models list now keeps it in view so you can turn it back on, instead of it disappearing with no way to recover it. #29037, #29036
✂️ Message text kept intact. Text containing angle brackets and a dollar sign is no longer mistaken for a skill mention and silently removed before your message reaches the model. #29051, #29041
📆 Moved calendar events stay visible. Changing an event's date no longer makes it disappear from the calendar, and events already stuck in that state show up again. #29085, #29067
🔁 Repeats follow the event. A repeating event now works out its occurrences from its own date and time, where a repeat rule carrying a start date of its own could place them on the wrong weekday or at the wrong hour. Commit
🔟 Repeating automations keep their count. An automation set to run a fixed number of times is no longer shown as running once and quietly rewritten to a single run the next time you open and save it. #29261, #29263
🗓️ Schedules survive a save. An automation carrying a start date now shows its real schedule in the list and keeps its weekly or monthly setting when saved, instead of showing raw rule text and falling back to daily. #29263
🧩 Custom automation schedules stay custom. Reopening an automation with a custom repeat rule no longer loses the custom rule from the editor. #29260
🔢 Accurate admin user counts. The counts on the admin Users tabs now follow your search and reset when you switch tabs, instead of showing stale or unfiltered numbers. #29080, #29079
🧷 Sidebar folders stop acting stale. A folder that has been removed from the sidebar is now removed from the internal sidebar registry too, so later sidebar actions do not target a folder that is no longer on screen. #29121
📱 Readable model list on small screens. The model identifier and timestamp in the workspace model list no longer overlap the model name on narrow displays. #29084, #29083
🧱 Long setting values stop crushing labels. Settings rows now let long controls shrink inside the available space instead of squeezing the label beside them. #29229
🧭 Model defaults panels stay usable. The model capabilities and prompt suggestion sections in admin settings now scroll inside their panels instead of growing past the available space. #29235
📲 Dropdowns stay on screen. A dropdown near the edge of a narrow screen now shifts inward to stay fully visible instead of opening past the edge with its option labels cut off. #29226, #29225
🌗 Dropdown lists follow the theme. The list a dropdown opens now takes its light or dark colouring from the rest of the interface instead of the system default. Commit
🎛️ Valves dialog stays in bounds. A valve whose selected options form a long line no longer stretches its input past the edge of the dialog and over the page behind it. #29203, #29202
🧹 Shared chats search resets. Reopening the shared chats dialog now starts with an empty search box and the full list, rather than a leftover search term above unfiltered results. #29082, #29081
🔎 Case-insensitive search beyond English. Searching and filtering by tag now ignore letter case for accented and non-Latin text on installations backed by SQLite, where only unaccented English letters were matched whatever their case. Commit
🏷️ Labels with colons and example URLs translate correctly. Interface text such as Warning:, http://localhost:8000, and https://mineru.net/api/v4 now appears correctly instead of being misread by the translation system. #29161, #29154
🔑 Precise account matching on SQLite. Signing in through an identity provider now matches your account on its exact identifier, so accounts whose identifier is an unusually long or zero-padded number are no longer at risk of being confused with another. Commit
🗃️ Knowledge list loads reliably. The Knowledge page in the workspace now fills in its list on opening instead of occasionally staying empty. Commit
🎟️ Tool servers without a key. A tool server connection saved without a key is no longer sent an empty authorization header, which some servers refused outright. Commit
🐍 Code interpreter starts on Windows. The built-in code interpreter now serves its script and WebAssembly files with the browser-safe file types Windows hosts sometimes overwrite, so Pyodide can load instead of failing before code runs. #29139, #29133

Changed

⏱️ Daily limit on repeats. A calendar event can no longer be set to repeat more often than once a day, and saving one that repeats more often is now refused with a message explaining the limit. Commit
🏷️ High Contrast Mode is now Accessibility Mode. The interface setting previously called 'High Contrast Mode' is now called 'Accessibility Mode', with the same switch in the same place. Commit

Open source →

0.11.125 Aug 2026Security2 sources agree

We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed secti…

Added

🚦 Human in the loop tool approval. Where an administrator has turned it on, you can switch a conversation from letting tools run freely to being asked first, so a model that wants to use a tool stops and waits for you to allow or deny it, one call at a time in a saved conversation, by button or by keyboard shortcut, with your choice remembered for this conversation and for future ones, switching back to running freely releasing anything already waiting, and automations, channel replies, and temporary chats unaffected. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🙋‍♂️ Models that can ask you a question. A new built-in tool lets a model pause and put up to three multiple-choice questions to you before continuing, with room to type your own answer instead, and the question survives a reload in a saved conversation, so you can come back and answer it later rather than losing the conversation. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🖇 Agents can now display terminal files directly. A model can now show a file it made in a terminal directly in its reply, with a preview and a download button, instead of describing a path that led nowhere when clicked, and a new interface setting chooses whether these open in the reply or in the files pane. Commit, Commit, Commit, #27650
📶 Streaming rebuilt from the ground up. A reply now streams as small pieces of new text instead of resending the whole message so far with every update, so the data sent over a reply grows with its length rather than with its length squared, which on a server with many people chatting at once means far less processor time spent encoding, passing, and decoding those updates, far less load and memory on the shared cache that carries them between instances, and far less work in your browser, which no longer takes in the whole reply again and redraws the parts of it that have not changed on every update, cutting the data sent and the server work spent appending to a message by up to 1000x on a very long reply, and a reply still in progress is now kept aside on the server, so reopening the conversation after a refresh picks it up where it is rather than showing a blank message, on deployments backed by Redis. Commit, Commit, Commit, Commit
🪵 Much faster throughout. Hundreds of places across the application no longer assemble detailed log text that is switched off and thrown away unread, so sending messages, uploading and indexing files, running searches, signing in, and loading admin pages all get that time back, with the largest gains on busy servers, in long conversations, and on chats that draw from a large knowledge base. #27834, #27837
🚀 Faster model list lookups. Title generation, tag suggestions, autocomplete, and other background steps of a chat turn now fetch the model list in one go, which keeps other people's responses flowing on busy Redis-backed instances with many models. #27821
🛰️ Cheaper log export. Deployments that export their logs to a telemetry collector, with "ENABLE_OTEL" and "ENABLE_OTEL_LOGS" both set, now prepare each exported line once instead of twice, which matters more than it used to now that log text is only assembled when something will actually read it. #27840
📇 Faster permission checks on large instances. Working out which groups you belong to is now a direct lookup rather than a scan of every membership on the server, so chats and the admin user list stay quick as an organization grows. #27822
⚙️ Much faster JSON handling. Saving and opening chats, reading settings, returning results from built-in tools, streaming replies, signing in and signing up, working out your permissions, and reading stored chunk details during knowledge base searches on Valkey and Oracle vector storage are all handled much faster across the application when the "ENABLE_ORJSON" option is turned on. Commit, #28396, #27841, #27807, #27805, #27813
📤 Much faster outbound requests. Conversations and embedding batches sent to Ollama and Anthropic models are packaged for delivery much faster, which is most noticeable in long chats when the "ENABLE_ORJSON" option is turned on. #27811, #27810
🐍 Much faster code interpreter output. Printed output and generated images from code run in chat appear much faster when the "ENABLE_ORJSON" option is turned on. #27812
🪶 Lighter page loads. Several small requests the interface makes on every page load, along with a few administrative ones, no longer set up database access they never used, which took several times longer than the rest of the request put together. #28178
♻️ One less read per message. Sending a message no longer loads the whole conversation from the database twice over, which mattered most in long chats where that record is largest. #28809
🏁 Faster skills on large instances. Opening the skills list, or sending a message that uses one, no longer checks every skill on the instance one at a time, so both are far quicker where many skills exist and most of them are not yours. #28798
🩻 Faster tools on large instances. Listing or exporting tools no longer checks every tool on the instance one at a time, so the integrations menu and the tools workspace open faster where many exist. Commit
🧊 Faster file access checks. Checking whether you may reach a file no longer walks every workspace model you can see looking for it, so opening a folder of files, downloading one, or retrieving from one is much quicker on instances with many models. #28802
🧱 Faster folder listings. Listing your folders now works out your group memberships once for the whole listing rather than again for every item in every folder. #28810
🧼 Less work per update in a long chat. Each update saved while a reply streams no longer re-examines the entire conversation, only the part being added, so the cost of an update stops growing with the length of the chat. #28820
🗃 Cheaper attaching of sources and files to a reply. Adding a source, file, or embedded item to a reply now reads just that one field rather than rebuilding the whole conversation to find it, which on a two hundred message chat is around 3.1 ms per item down to 0.65 ms, and no longer grows with the length of the conversation. Commit, Commit
🚏 Faster workspace model lookups. Working out which workspace models you may edit no longer loads every model on the instance and discards most of them, which also speeds up exporting models and the file access checks that relied on it. #28795
📮 Faster handing off a streaming reply. Passing a reply in progress between instances now writes it once rather than converting it back and forth and scanning it for characters that only matter elsewhere, which on a large non-English conversation took most of the time spent on each write. #28833
🥵 Constant load on an idle instance. An instance sitting idle no longer works through every chat you have once a second looking for timers that are due, which on a large history kept about a quarter of a processor core busy doing nothing and could exhaust memory until the application was killed. #27663, #27622, #27745
📍 Sidebar folders fetched once. Refreshing the sidebar now asks for your folders once rather than three times, on page load and on every action that refreshes it. #28662, #28661
💤 Far fewer writes just from being signed in. Recording that someone is online now writes at most once a minute for each person rather than on every single request, where an open tab alone caused two write transactions a minute before anyone touched anything. #28177, #28165
🛰 Less overhead on every request. The layers each request passes through before it is handled are now one instead of five, which also removes a quarter of that cost from every piece of a streamed reply on instances that set security headers. Commit, #28171
🎏 Turning off compression of live updates. A new "UVICORN_WS_PER_MESSAGE_DEFLATE" setting stops the server compressing every live update it sends, which costs processor time on each one for almost no saving now that a reply streams as small pieces; compression stays on unless it is turned off. #28613
🌡 Faster chat list and unread counts. Opening the sidebar, and the unread markers on folders, no longer read through your whole chat history to produce a short list, which on an instance with 15000 chats took 2 to 4 seconds. #27663, #27622, #27745
🥁 Long replies no longer slow as they grow. A long reply is no longer re-examined from the beginning for reasoning and code blocks on every piece that arrives, so the work stops growing with the length of the reply, which on a long reply is around 190x less time spent on it. #28861
💽 Faster saving of long chats. A chat is now written to the database in one go rather than one message at a time, so saving a long conversation is much quicker and puts far less strain on the database, and saving one where nothing has changed writes nothing at all. #28806
📦 Faster loading of shared folders. Folders shared with you now load in a couple of queries rather than one for each folder and each owner, so the list appears sooner for anyone with many of them. #28804
⚡ Uninterrupted chat during knowledge search. Responses now keep streaming for everyone on the server while knowledge base searches run, instead of pausing until each search finishes. #27824
🔍 Smarter chat search. Searching your chats now finds conversations containing all of your words in any order rather than only the exact phrase you typed, with exact matches still listed first, and the preview snippet points at whichever word it found. Commit
⌨️ Model switching from the message box. Typing "/model" now tells you which model you are on, switching to another by name with "/model" followed by its id, or opening the model picker straight from the slash menu without reaching for the mouse. Commit, Commit
📎 Sending while attachments upload. Sending a message before its files have finished uploading now queues it and sends it automatically once they are ready, instead of refusing with an error, and each queued message shows the progress of its attachments. Commit, Commit, #28381, #28380
📖 Opening a document at the right page. A model showing you a PDF, Word document, or slide deck from a terminal can now open it at a particular page or slide, so a reply that cites something on page 76 can put that page in front of you. Commit, Commit, Commit
💼 Attachments that go straight to a terminal. A terminal connection can now be set to receive files attached in chat into its own working directory rather than into the conversation, which also means files can be attached while using a model that cannot read them itself. Commit, Commit, Commit, Commit
🔦 Searching files in the terminal browser. The file browser now has a search box that finds files by name and by what is inside them, and opening a result takes you to the matching line. Commit
🌲 Browsing files as a tree. The terminal file browser now expands folders in place rather than only navigating into them, remembers what you had open, offers a right-click menu, can show hidden files, sorts by size, expands a folder you hover over while dragging something onto it, and moves a whole selection in one go when you drop it. Commit, Commit
🧰 Managing models on more servers. Administrators can now download, load, and unload models on llama.cpp and LM Studio connections from the manage models dialog, remove them on llama.cpp, and start a download straight from the model picker's search box, alongside the Ollama support that was already there. Commit, Commit, Commit, Commit, #28766
📢 Automations that post to a channel. An automation can now be pointed at a channel instead of a chat, so its scheduled run appears as a message there for everyone to see, chosen from a new destination picker that also covers folders. Commit
🙋 Mentioning people in a channel. Typing an at sign in a channel now lists that channel's own members first, before everyone else on the server, so the people you are likely to mean are at the top. Commit, Commit, #28883
🔗 Attaching any link. Pasting a link into a chat or a knowledge base now works out what is behind it, downloading a document or image as a real attachment rather than treating everything as a web page to be read as text. Commit
🔎 Searching tools and skills in chat. The integrations menu now has a search box for tools and for skills, so a long list can be narrowed by name instead of scrolled through. #26709, Commit, #28807, #28812
🧭 More from the message box. The slash menu now offers settings and, in a new chat, a toggle for temporary chat, alongside the commands that were already there. Commit
🚨 Being told when a file fails to process. A file that cannot be processed for a knowledge base now raises a notification naming the file and what went wrong, and keeps that reason on the file, instead of quietly being marked as failed. #27666, #6311, Commit
🔬 Zoom controls on previewed images. An image opened in the file browser now has zoom in, zoom out, and a reset button showing the current zoom, and pinching, scrolling, and holding a modifier key while scrolling now zoom and pan as they do elsewhere. Commit, Commit, Commit, Commit
🗂️ Recognisable file icons. The terminal file browser now marks each file with an icon for its type, so code, images, archives, documents, and configuration files can be told apart at a glance instead of sharing one generic page icon. Commit, Commit, Commit
📽️ Truer PowerPoint previews. Slide previews now render tables, charts, connectors, gradients, theme colours, bullets, fonts, and text alignment far closer to the original, and the viewer lets you move between slides with the arrow keys or the scroll wheel while the thumbnail strip follows along. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
📄 Faithful Word document previews. Word documents now open as proper pages with headers, footers, footnotes, and embedded images intact, and can be zoomed, rather than being flattened into plain formatted text. Commit, Commit
🗝 Deleting your API key. An API key can now be revoked outright from your account settings, where the only way to retire one was to replace it with a new one. #28874, Commit
🎛️ Settings for the task model. Administrators can now set the generation parameters used for background work such as titles, tags, follow-ups, search queries, and conversation summaries, either from the admin panel or through "TASK_MODEL_PARAMS", instead of those requests always using a fixed token limit that could cut a summary short. #27604, Commit, Commit
🎚️ Default interface settings for everyone. Administrators can now set system-wide defaults for the interface options in Settings, either from the admin panel or through "DEFAULT_INTERFACE_SETTINGS", with each person's own choices still taking precedence and anything left untouched shown as inherited and kept in step with later changes to the defaults. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🔠 Interface scaling throughout. The UI Scale setting and your browser's own text size now resize the whole interface consistently, including the sidebar, menus, dialogs, and file browser, rather than leaving parts of it fixed. Commit, Commit, Commit, Commit
🏷️ Named writing blocks. When a model wraps a draft such as an email in a writing block, the block is now titled with its subject and shows the recipient beside it, rather than every block reading simply as Writing. #28280, #28198
🤝 Files for delegated tasks. A task handed to a sub-agent can now carry the attachments it needs, so an image or document from your conversation reaches the sub-agent instead of arriving as a file reference it cannot open and may answer about anyway. Commit, #28213
📟 Terminal availability and scope. Administrators can now decide for each managed terminal whether it appears in chats and in automations at all, and whether everyone shares a single workspace or each chat or automation gets its own, with per chat terminals waiting until the conversation has been saved. Commit
🔒 Read-only files in the terminal browser. Files and folders you are not allowed to change are now labelled read-only, with uploading, editing, renaming, moving, and deleting turned off for them rather than failing at the moment you try. Commit
🔐 Terminals that use your own login. Managed terminals configured for session authentication now authenticate the terminal connection with your own token, where it previously sent no credentials at all. Commit
🎟 Setting up a tool server that uses OAuth. Adding one is now easier to get right: the connection dialog can authorize the account from the dialog itself, the check button tests the sign-in details rather than reporting a connection failure that was never going to succeed without them, and it is now labelled for what it does rather than suggesting it verifies the whole connection. Commit, #28552
🪤 Control over what embedded pages may do. Two new interface settings decide whether pages shown inside a chat, such as an artifact or an HTML preview, may run scripts and start downloads. Commit, #28924, Commit
🗄 Keeping files removed from a knowledge base. A new "ENABLE_KNOWLEDGE_FILE_RETENTION" setting keeps the stored file and its search data when a file is taken out of a knowledge base, rather than deleting them. Commit
🧾 CSV shape in retrieval. Turning on "ENABLE_RAG_CSV_SUMMARY" adds a short line naming the row count, data row count, column count, and column names of a CSV file to what the model sees, giving it the shape of the table alongside its contents. Commit
🔭 OpenSERP in the search settings. OpenSERP can now be picked as the web search engine in the admin panel, with a field for its address, rather than only being configurable through the environment. #27594, #27592
🪧 Profile changes from single sign-on. A name, email address, or picture updated from an identity provider at sign-in now raises an event naming what changed, and the rest of the session uses the updated record rather than a stale copy. Commit
📯 Group changes from single sign-on. Group memberships added or removed when someone signs in through an identity provider, and groups created automatically along the way, now raise the same events as the equivalent change made by an administrator or over directory sync. #27657
🔔 Sign-in and sign-out events for single sign-on. Signing in through an identity provider now raises the same login event that signing in with a password does, and signing out says which provider the session came from, so a function can set up or tidy up an account in another system when someone arrives or leaves. #27619, #27613
🪛 Naming background worker threads. A new "THREAD_POOL_THREAD_NAME_PREFIX" setting labels the threads that background work runs in, so they can be told apart when reading a profile or a thread dump. Commit
📙 OpenDocument files in a temporary chat. A text document, spreadsheet, or presentation from an office suite that uses the OpenDocument format now has its text read out in the browser when attached to a temporary chat, where the model was handed the raw archive and answered that it could not read the file. Commit, #28906
🌍 Pointing Tavily somewhere else. A new "TAVILY_API_BASE_URL" setting sends Tavily searches and page fetches to a different address, for instances that reach the internet only through a gateway of their own or that use a compatible service. Commit, #28701
🪟 Honest OAuth settings. When single sign-on settings come from the environment rather than being saved in the application, the admin panel now shows them as read-only with a note naming the setting that controls this, instead of accepting edits that were silently discarded on the next restart. #28276
📏 Widening the chat controls pane. The controls pane can now be dragged as wide as you like, where it stopped at a fixed limit regardless of screen size. Commit
📱 Smoother sidebar on mobile. The sidebar now follows your finger as you swipe it open or closed, responds to a quick flick, dims the page behind it as it moves, and gives every chat row a menu button you can reach without a hover you cannot perform on a touchscreen. Commit, Commit, Commit, Commit, Commit, Commit, Commit
🚪 Sidebar that stays put. Opening and closing the sidebar is now a smooth transition that keeps your chat list loaded, instead of rebuilding the list each time. Commit, Commit, Commit, Commit, Commit
👁️ Turning off chat previews. A new setting under Settings and Interface lets you switch off the preview card that appears when you hover a chat in the sidebar, useful for a quieter sidebar, for sharing your screen, or on a slow connection. #27632, #27639
☑️ Checkboxes beside their labels. In the model editor and the admin model defaults, each capability, feature, and tool checkbox now sits directly in front of its own label instead of at the far edge of its column, where it could look like it belonged to the next one, and the label itself can be clicked to toggle it. #27788, #27771, Commit, Commit
✍️ Typing cursor while responding. A blinking cursor now marks where the reply is being written, from the moment you send your message until generation finishes, in place of the previous loading placeholder. Commit
✒️ Underlined text. Underlined text now appears underlined in a reply instead of showing the markup around it, and underlining is kept when you edit in a rich text box rather than being dropped. Commit, #26904
📥 Adding group members from a file. Administrators can now add many people to a group at once by uploading a CSV of names and email addresses, with a template to download and a message naming any row whose address does not match an account. Commit
📑 Apache Tika 4 support. Administrators extracting document text with Tika can now choose which server version they run, from Admin Settings under Documents or through "TIKA_SERVER_VERSION", where only Tika 3 was understood before. Commit, #28939
💓 Tunable heartbeat for live updates. A new "WEBSOCKET_HEARTBEAT_INTERVAL" setting controls how often each open tab checks in with the server, where it was fixed at 30 seconds, so a large deployment can cut background traffic that no one asked for. Commit, #28166
⌛ Expiring abandoned reply state. A new "REDIS_RESPONSE_STREAM_TTL" setting expires the saved state of a reply that never finished, so a server killed mid-answer no longer leaves that data behind for good. Commit
🖨️ File and image detail parts on API requests. A request sent to the OpenAI-compatible endpoint carrying an image detail level or a file part in its message content now forwards both to providers that use the Responses API, where they were dropped, while documents attached inside Open WebUI are unaffected because those still go through knowledge retrieval. Commit
🧺 Leaner stored document metadata. Bulky extraction details such as page layouts, tables and detected languages are no longer kept alongside a document in the vector store, and a new "RAG_METADATA_MAX_VALUE_CHARS" setting drops any remaining oversized value, falling back to the configured upload size limit so a document that expands enormously while being read cannot exhaust a server's memory. Commit, Commit, #29025
💨 No filter work on installs without filters. A completed message on an install with no filter functions and no pipeline filters, which is the default, no longer rebuilds the whole conversation and ships it to the browser as an event nothing acts on. Commit
📂 Opening a file in a knowledge base. A file listed in a knowledge base can now be opened and read straight from that list, where the name was shown but nothing happened when it was clicked. Commit, #28086
🧵 Cheaper saving of a reply as it streams. The resume snapshot taken on every piece of a streamed reply no longer rebuilds the whole answer each time, so the cost of a save stops growing with the length of the reply. #28821
📀 Less repeated work setting up built-in tools. Every chat request no longer rebuilds a fresh copy of each built-in tool's definition from scratch, which was paid once per tool on every message. #28860
🕹️ Control over what a terminal port preview may reach. A new interface setting decides whether a previewed port runs with access to same-origin browser APIs, so you can lock a preview out of them on installs where previews serve content you do not fully trust. Commit
♿ Improved UI accessibility. A closed sidebar is no longer reachable by keyboard or announced by screen readers, the tool call blocks in a response can now be expanded with the keyboard, the buttons that normally appear on hover, such as message actions, file removal, and chat menus, now appear when you reach them with the keyboard as well, whatever you have tabbed to is marked with a clear outline throughout the application, and the rows in the integrations menu now tell a screen reader whether each tool or feature is switched on. Commit, Commit, Commit, Commit, Commit, Commit, #27667, #17150
🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
🌐 Translation updates. Faroese was added, and translations for Slovenian, Hungarian, Finnish, Korean, Portuguese (Brazil), Catalan, and French were enhanced and expanded.

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories
🛂 Knowledge search reaching past what you may read. Searching knowledge bases now applies the list of collections you are allowed to open, where that restriction was handed to the vector store and silently discarded, so results could include material from knowledge bases you have no access to. Commit
💣 Documents that unpack far beyond their size. A Word, Excel, PowerPoint, OpenDocument or EPUB file that expands to far more than it stores is now rejected before it is read, where one could previously be used to exhaust a server's memory. Commit
✂️ Long replies cut off partway. A single oversized piece of a streamed reply, such as a long reasoning trace or a turn carrying many tool calls, no longer ends the answer early with a misleading error about byte counts, which affected every default installation. #28114, #25664
🚧 Web address checks that could be skipped. The fetchable-address test and the operator's web fetch filter list now run on every outgoing request, where a proxied or already-open connection could bypass them and a filter entry written as an address range silently matched nothing at all. #27823
🧑‍💻 Code execution reachable through a tag in a reply. On installs using native function calling, the older path that runs code found inside a tag in the model's reply is no longer active alongside the built-in tool, so code execution happens only through an explicit tool call. #29024
⌚ Recurrence rules that could tie up the server. How often an automation repeats is now taken from the rule the scheduler actually parsed rather than from the text of the rule, so a crafted rule can no longer disagree with what gets scheduled and walk the server through an unbounded run of occurrences, and a rule carrying a time zone on its start date now schedules instead of erroring. Commit
🗝️ Changing a password now ends other sessions. Changing your password, or an administrator resetting it for you, now stops every device that was already signed in, where they had stayed signed in on the old password until their session expired on its own, up to four weeks by default; the device making the change is signed out too and asked to sign in again, and this requires Redis, without which nothing can be revoked and a warning is now logged saying so. #28725, #28647
🧬 Workspace models shadowing a real one. Someone without administrator rights can no longer create, import, or edit a workspace model so that it takes over the identity of a model served by a connected provider, where doing so would have changed what everyone else got when they picked that model. Commit
🌳 Folders disappearing when moved into themselves. Moving a folder inside one of its own subfolders is now refused, where it was accepted and made that folder and everything in it vanish from the sidebar with no way to bring it back, while leaving the server walking the loop endlessly and querying the database as it went, which could exhaust a worker and its memory; any folder already in that state is returned to the top level. #28748
🧨 Searching a knowledge base with a costly pattern. A search pattern written so that it expands enormously before it even runs is now refused, where it could tie up the server; ordinary patterns are unaffected. Commit, #28284
💧 Attaching a very large file from a link. A file fetched from a link is now written to disk as it arrives and stops at the configured size limit, where the whole thing was held in memory first with no limit applied, so a large enough file could exhaust the server; a download that fails partway no longer leaves the partial file behind. #28945
⛓ Deleting one knowledge base removing a shared connection. Deleting an external knowledge base now leaves its connection in place while other knowledge bases still use it, and only an administrator removing the last one clears it, where any user deleting theirs took the connection away from everyone. #28113
📡 Intermittent connection failures. Requests to model providers and to services on the same network no longer fail intermittently with name lookup errors, often surfacing as a misleading model not found message, because addresses are resolved through the system again by default, with the faster resolver still available through "AIOHTTP_CLIENT_ASYNC_DNS_RESOLVER". #28242, #28013, #28215
🗯️ Losing the conversation with memory on. With the memory tool enabled, the model can see the earlier messages in your conversation again, instead of answering the second message as though the first had never been sent. #28400
👻 Vanishing responses. Replies from Responses-API providers that report an empty output at the end of a stream no longer disappear the moment generation finishes, leaving an empty message in their place. #27800, #27789
📥 Queued messages disappearing. Messages waiting to be sent are put back in the queue if sending them fails, rather than vanishing without being sent. Commit
🧵 Replies cut short mid-stream. A reply no longer breaks off part way through when a provider sends the pieces of its response in an unexpected order, which had left the answer truncated and skipped the filters that run once a message finishes. #28312
🧷 Replies not carried into the next turn. With providers that skip parts of the streaming sequence, the finished reply is now taken from the completed message, so it stays available as context for your next question and the citations that arrived with it are no longer dropped. #28310
🌊 Replies arriving in oversized pieces. Very large streamed pieces no longer break the response on default settings, where the reader that splits them safely only ran when a chunk size limit was configured. Commit
🩹 Signing in after a long-delayed upgrade. Accounts on instances that were upgraded from a version older than 0.6.41 to 0.9.6 or newer can sign in again, where an upgrade step had written their single sign-on identity in a form the application could not read afterwards, and a repair step corrects the affected accounts on startup. #28107, #28101, Commit
🔑 Signing in with some identity providers. Logging in through a provider that adds its own vendor-specific information to the header of the sign-in token now completes, rather than failing at the final step with a message claiming the email or password was wrong. #28065, #28062
🔌 Role changes taking effect at once. Changing someone's role now ends their live sessions no matter how the change was made, whether by a directory sync, an identity provider, a trusted header, or deleting the account, so permissions from their old role cannot linger, and their browser reconnects on its own. Commit
🛑 Memory permission being respected. Taking away someone's memory permission now also stops their stored memories being added to the context of their conversations, which one path had continued doing regardless. #27668
🔍 Listing a single connection's models. Asking for the models or version of one particular connection is now restricted to administrators, and a request naming a specific backend is checked against the models that backend actually serves even where the access control bypass is turned on. Commit
⚖️ Sharing defaults matching what was configured. On instances upgraded from older versions, public sharing of tools and notes no longer shows as switched on in the admin panel, and saving any unrelated permission no longer grants everyone a capability that was never enabled. #27716, #27715
🗂️ Folder permissions when starting a chat. Starting a conversation filed into a folder now checks that you are allowed to write to that folder, a check the message sending path had been skipping, and every place a chat can be filed now treats ownership, shared access, and unknown folders the same way. #28366
🪧 Clearer attachment failures. A link that cannot be read now says so and names the link, and a YouTube video whose transcript is refused explains why and points at the proxy setting that exists for it, instead of both being reported as a knowledge base error. #28362, #28361
🔎 Chat search finding recent messages. Searching your chats now looks inside the messages of current conversations on default installations, where it had only been reading an older storage format and missing their content entirely. Commit
🧭 Your place in a compacted chat. Opening a conversation whose history has been compacted now takes you to its most recent message instead of leaving you parked on the summary, and updates to an existing message no longer move your place in the conversation. Commit
🖥️ Chats with a personal terminal. Sending a message with a terminal you added yourself under Settings selected no longer fails with a terminal unavailable error, which had blocked those chats since 0.11.0. #27621, Commit, Commit
📆 Default date for new events. Creating a calendar event now starts on today's date rather than tomorrow's when you open the form in the evening, or yesterday's when you open it early in the morning. #27779, #27778
🗓️ Recurring event times. Repeating calendar events now show at the time you set them for instead of being worked out in the server's time zone and shifted by the gap between the two. #27774, Commit
🧩 Chats during model list refreshes. On direct connections, background work such as title and tag generation no longer fails or runs against a mix of old and new model entries while the model list is being refreshed. #27821
🎛️ Chat Controls staying put. Hovering a chat in the sidebar whose preview contains an artifact no longer forces the Chat Controls pane open and fills it with that artifact, over the chat you currently have open. #27773, #27772
📨 Reliable streaming with unusual characters. Responses containing any of three rare invisible line break characters no longer arrive split or broken when the "ENABLE_ORJSON" option is turned on. #27819
🧮 JSON options honoured again. Options passed to the shared JSON helper are no longer silently ignored when the "ENABLE_ORJSON" option is turned on, falling back to the standard encoder that supports them. Commit
🚫 Duplicate models in lists. Adding a model that is already on a connection's allowed list is now rejected instead of quietly adding it a second time, the arena picker no longer offers models you have already chosen, and existing duplicates are cleaned up the next time the list is saved. #28251, #28249
📁 Dragging chats into shared folders. A shared folder you can write to now highlights and accepts a dropped chat, while one you only have read access to no longer offers itself as a drop target for an action that could only fail. Commit, #28261
⏰ Listing automations through chat. Asking a model to list your automations without naming a folder now returns every automation you have, instead of only the ones that sit outside a folder. Commit
🧠 Faster follow-ups with memory enabled. The memories handed to the model now appear in a stable order from one message to the next, so servers that reuse their work between turns no longer reprocess the whole conversation each time you reply. #28292, Commit, Commit
🎯 Custom model parameters combining. Setting a custom parameter on a model no longer silently discards every custom parameter defined in the global defaults, and a value sent directly in an API request is no longer overwritten by the model's saved settings. Commit, #28241
👥 Sharing with people already added. The access picker no longer offers people and groups that already have access, and the Users heading no longer appears above an empty list. Commit, #28253
🔧 Full tool parameter descriptions. A tool whose parameter description runs over several lines now passes the whole description to the model instead of only its first line. Commit
📝 Notes saved in an unexpected shape. A note whose content was stored as structured data rather than text no longer breaks the notes page for everything else, and opens with that content shown as a formatted code block. Commit, #28222
💬 Direct messages after an account is deleted. A direct message conversation no longer counts a deleted account among its members, and opening a direct message with someone finds the existing conversation instead of starting a second one alongside it. Commit, #28257
🫥 Deactivating a model. Turning a model off no longer removes the wrong entry from the model list, or fails the list outright and leaves the model picker empty for everyone until the model is turned back on. Commit, #28202
💭 Readable errors on chat actions. When moving, renaming, or otherwise changing a chat fails, the message explaining why now appears in place of an unhelpful object placeholder. #28260, #28259
🪪 Authorship in shared chats. A chat shared with you now shows the name and picture of whoever wrote it, in the message list and in the overview panel, rather than crediting the messages to you. #28274, #28273
🖇️ Adding terminals over plain connections. Saving a terminal connection now works when the interface is served without HTTPS, where the dialog would sit there doing nothing because the browser withholds the tool used to generate its identifier. Commit, #28148
🗃️ openGauss vector storage. Deployments using openGauss for vector storage no longer fail the moment they touch it. #27838
🎚️ ColBERT reranker startup. Loading a ColBERT reranker now names the model in the log rather than printin

Note truncated.

Open source →