PyPI · #4851 most downloaded on PyPI

open-webui

0.11.3842K downloads/moopen-webui/open-webui ↗New releases in your daily digest, changelog included.

Open WebUI

Last release 17 days ago
31 Aug 2026
Ships on a steady schedule
a new release about every 3 weeks
Nearly every release is documented
notes for 60 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
2 years old
165 releases · first in 2024

Release timeline

165 releases since 2024

202420252026

Releases

0.10.029 Jun 2026Security3 sources agree
We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed secti…
Added

🤝 Share folders with your team. You can now share a folder and the chats inside it with specific users, groups, or everyone, with read or write access; people you share with see shared folders in their sidebar and open the chats in a read-only view when they are not the owner, and administrators control who is allowed to share folders with a new "Folders Sharing" permission that is off by default. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit

🗜️ Automatic context compaction for long chats. Conversations that grow past a configurable token threshold can now be summarized automatically so they stay within a model's context window, with a notification shown while it happens; administrators can enable it, set the threshold, customize the summarization prompt, and lower the threshold per model. It is off by default. Commit, Commit, Commit, #19594

🖥️ Open WebUI Computer agent support. Open WebUI can now connect to Open WebUI Computer through its OpenAI-compatible gateway, letting chats run full agent sessions on your own machine with file, terminal, git, and web access. GitHub

🚀 Much faster hybrid search on large knowledge bases. Hybrid search now runs natively in the database on pgvector setups instead of loading an entire collection into memory, so querying large knowledge bases is dramatically faster. Commit, #20737

🗂️ External knowledge bases. Knowledge bases can now be backed by an external retrieval source through configurable external knowledge connections, so you can search an existing external system from chat instead of only Open WebUI's built-in store. Commit

🧠 Reworked memory system. Memory has been overhauled with distinct memory types — long-lived personal memories and per-conversation context — managed through a structured add, update, and delete flow, giving models a more reliable way to remember and apply what they've learned about you. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit

🧩 New plugin primitive: the Event function. Where pipe, filter, and action functions all run inside a conversation, the new Event function is the first primitive that hooks into the system itself: it runs your own Python in response to events emitted across the whole application — sign-ups, configuration changes, file uploads, role changes, deletions, startup and shutdown, and more. That makes a new class of behavior possible directly inside Open WebUI, from onboarding and access control to auditing, lifecycle automation, and external integrations. Comes with starter boilerplate in the function editor. Commit, Docs

🔔 New event system with webhooks. Open WebUI now emits events for a wide range of system activity — sign-ins, configuration changes, startup, and actions across chats, knowledge, files, and more. Administrators can send these as outbound webhooks, route them to specific users or groups, and manage which events go where from a new event settings admin page. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, #1240, #16426

🔐 Configure authentication from the admin panel. LDAP and OAuth/OIDC settings now have a dedicated Authentication settings page, so providers can be configured from the admin interface. Commit, #12945

🏷️ More custom header variables. Custom request headers now support "{{USER_MESSAGE_ID}}", "{{USER_MESSAGE_PARENT_ID}}", and "{{TASK}}", letting connected services tell apart real user messages from automated background requests like title, tag, and follow-up generation. Commit

📄 File details forwarded to external document extractors. External custom document-extraction servers now receive the file's ID, name, and content type, and these are also available as custom header variables, so extraction can be tailored per file. Commit, #26259

🎰 Last model pre-selected for new slots. When you add another model to a multi-model chat, the slot now defaults to the model you last picked instead of starting empty. #25974

⚡ Faster model overview. The admin model overview now loads its feedback history and tags through batched queries, so it opens noticeably faster on instances with many chats. Commit

🏎️ Lighter channel profile previews. Profile previews in channels now load a person's details only when you hover to open one, rather than fetching them for every message up front. Commit

↩️ Reset permissions to defaults. The group and default permission dialogs now include a button to restore all permissions back to their built-in defaults in one step. #25931

📥 Chat import permission. Administrators can now control whether users are allowed to import or clone chats, with a new "Allow Chat Import" permission. Commit, Commit, Commit, #25927

🔔 Per-group user webhook permission. Administrators can now control which users may set a personal notification webhook, with a new "User Webhooks" permission. #25923

✍️ Customizable autocomplete prompt. Administrators can now set a custom prompt template for autocomplete generation from the admin interface settings. Commit, #25879

🔑 Configurable secret key length. The auto-generated secret key length can now be set with a new environment variable, instead of always using a fixed length. Commit, #25906

🏟️ Arena evaluation models configurable via environment. Arena evaluation models can now be defined through an environment variable, which previously could not be set that way. Commit

✏️ Edit prompts from the menu. The prompts list now has an Edit option in each prompt's menu, taking you straight to its editor. #25789

📋 Clone automations. Automations now have a Clone option in their menu, so you can duplicate one as a starting point. #25790

🔁 Recurring calendar events. The calendar event editor now includes a repeat option, so events can recur on a schedule. #25865

🧷 Separate skills import and export permissions. Administrators can now control importing and exporting skills independently, with new skills import and export permissions. #25921

🏷️ Filter admin models by tag. The admin Models settings page now has a tag filter for narrowing the model list by base-model tags. Commit

📊 Sortable analytics chat list. The model chat list in analytics now has sortable column headers, so you can order it by title, last updated, or user. Commit, #26168

🔐 Argon2 password hashing option. Password hashing can now use Argon2 through a configurable algorithm setting, removing the 72-byte password length limit that came with the previous default. Commit, Commit, #25656

🔐 Optional encryption of valve values at rest. Tool and function valve values can now be encrypted at rest through a new opt-in setting, with existing stored values migrated automatically, so sensitive settings like API keys aren't kept in plaintext. Commit, #23721

🗄️ AWS RDS IAM database authentication. The database connection can now authenticate using AWS RDS IAM tokens through a new opt-in setting, instead of only a static password. Commit, #23580

🔓 Automatic auth for models with OAuth 2.1 tools. When a model uses tools that require OAuth 2.1, Open WebUI now initiates the authorization flow automatically instead of failing the request. Commit, #23325, #23272

🔤 Custom tokenizer for token-based text splitting. Token-based document splitting can now use a configurable Hugging Face tokenizer model, so chunking can match the tokenizer of the model you use. Commit, #24139

🔒 Restrict OAuth scopes requested from MCP servers. A new setting lets administrators limit which OAuth scopes Open WebUI requests when connecting to MCP servers. Commit, #25981, #25978

🧩 Filter Outlet Hook can now run on API requests and responses. A filter function's outlet hook now runs for direct API callers, including streaming responses, so response post-processing isn't limited to the web interface; this is controlled by a new setting and on by default. Commit, #25650

🖥️ Setting for terminal sidebar auto-open. A new interface setting controls whether the files sidebar opens automatically when you select a terminal. Commit, #25628

📌 Reorder pinned notes by dragging. Pinned notes in the sidebar can now be dragged to reorder them. #25677

🔎 Chat actions in search. The search dialog now offers a context menu on each result, so you can act on a chat directly from search. #25490

🔎 Snippets in chat search results. Searching your chats now shows a snippet of the matching content in each result, so you can tell results apart at a glance. Commit, Commit, Commit, #25178

📝 Formatted valve descriptions. Valve descriptions for tools and functions now render Markdown, so they can include formatting and links. Commit

🔽 Dropdown inputs for valve options. Valve and confirmation inputs can now present a set of options as a dropdown instead of free text, making fixed-choice settings easier to configure. Commit, #26278

🔌 Control the OAuth resource parameter for MCP connectors. MCP connectors can now be set to always send, never send, or automatically decide whether to include the OAuth resource parameter, so they work with providers that reject it. Commit

🔎 SERPHouse web search. SERPHouse can now be used as a web search provider. Commit, Commit, #26254

🔎 Microsoft Web IQ web search. Microsoft Web IQ can now be used as a web search provider, with a matching page-browse loader. #26178

⚠️ Optional web search confirmation. Administrators can now require users to confirm before a web search runs, with a banner and message making it clear when search is about to be used. Commit, #24942

🪪 Client User-Agent forwarded to model backends. The browser's User-Agent is now passed through to all model backends, so upstream services can see the originating client. #26333

🖐️ Drag items from the sidebar into chat. Folders, notes, and models — including pinned notes — can now be dragged from the sidebar into the chat input. #25771, Commit, #26384

🏷️ Tag suggestions in the model editor. The model editor now suggests existing tags as you type, making it easier to reuse a consistent set. Commit, #25703

🗣️ Voice suggestions in the model editor. The model editor now offers a dropdown of available text-to-speech voices, making it easier to pick one. Commit, #25706

🎛️ Unified model picker for workspace base model. Choosing a base model in the model editor now uses the searchable model selector instead of a plain field, making it easier to find and pick the right model. Commit, #24576

🔍 Searchable pickers in the model editor. Attaching actions, filters, tools, knowledge, and skills to a model now uses type-to-search pickers instead of long checkbox lists, making large libraries easier to manage. Commit

🖼️ iPhone images work with OpenAI image editing. Uploaded images are now normalized before being sent to OpenAI image editing, fixing edits that failed for certain iPhone photo formats, with a new admin toggle to control the behavior. Commit, Commit, #26252, #26249

🟢 Loaded-model indicator for llama.cpp. Models served through llama.cpp now report whether they're currently loaded in memory, including the sleeping state, so the loaded indicator works for them too. Commit

🧱 Structured model output rendered on the client. Reasoning, tool calls, and server-side tool steps such as web and file search are now rendered in the browser from the model's structured output instead of being flattened into the message text on the server, giving more accurate and editable rendering of these items. Commit, Commit

📜 Custom CA bundle for outbound connections. A new environment variable lets you point Open WebUI at a custom CA certificate bundle, and the per-connection SSL settings now accept a bundle path, so deployments behind a corporate or internal CA can keep certificate verification on instead of disabling it. Commit, Commit

🖥️ More terminal server orchestrator controls. Admins connecting an orchestrator terminal server can now configure session lifecycle policies and refresh or reset running terminal sessions, including targeting only idle ones, from the connection settings. Commit

📁 Terminal file browser can stay within a root folder. The terminal file navigator now anchors to a defined root and home directory, so users can be kept within their workspace instead of browsing into system folders by accident. Commit

🧠 Memory toggle follows the server default. When a user hasn't set their own memory preference, it now follows the admin's global memory setting instead of defaulting to off. #25909

🧹 Unshare all shared chats at once. The Shared Chats dialog now has a button to stop sharing every shared chat in one action. #25848

📈 Richer analytics with a date picker. The analytics dashboard now lets you choose a date range and shows additional columns. #25922, #25919

🔢 Chat and file counts in their dialogs. The Chats and Files dialogs now show the total number of chats and files in their titles. #25872, #25873

⚡ Faster math rendering. Rendered math is now cached and reused, so messages with repeated or unchanged math expressions render more efficiently. #25847

⚡ Lighter Markdown setup. Markdown extension setup now runs once instead of on every render, avoiding repeated work and extension stacking. #25837

⚡ Snappier read-only code blocks. Read-only code blocks now skip language auto-detection, so they render faster. #25824

⚡ Non-blocking audio model loading. Loading speech models no longer blocks the server, keeping it responsive while they initialize. #25806

⚡ Faster URL safety checks. The safety check on fetched URLs now resolves addresses off the main loop, so it no longer blocks other work. #25825

⚡ Fewer queries for channel reactions and replies. Channel reactions and thread replies now load through batched queries, reducing database load on busy channels. #25831

⚡ Lighter streaming. Streaming responses now skip re-processing message content that hasn't changed, reducing work on every update. #26325, #26326

⚡ Smoother tool-call rendering. Displaying tool calls now parses their content iteratively, avoiding slowdowns on deeply nested data. #26146

⚡ Hidden tool-call details cost nothing. When tool-call arguments are collapsed, they are no longer rendered behind the scenes, noticeably speeding up chats with heavy tool use. Commit, #26147

⚡ Leaner knowledge-file reading for agents. The built-in tools that let a model read knowledge files now return output in bounded, paginated chunks with a default and a hard cap, instead of potentially returning an entire large file at once, sharply reducing token usage. Commit, #26139

⚡ Lighter, faster file search on large knowledge bases. Listing and searching files no longer returns each file's full extracted text by default, and content matching is now length-bounded, so these requests are far lighter and searching across very large knowledge bases is dramatically faster. Commit, Commit, Commit, #25774, #25741, #26145, #25867

⚡ Faster password hashing and bulk user import. Password hashing and verification no longer block the server, and importing users from a CSV is now processed in a single batch, keeping large imports and sign-ins responsive. Commit, #25804, #25805

⚡ Non-blocking model downloads. Downloading large Ollama models no longer blocks the server on file reads and checksums, keeping it responsive during big downloads. #25829

⚡ Non-blocking uploads and link fetches. Hashing uploaded files and fetching URLs now run off the main loop, so large uploads and link previews don't hold up other requests. #25822

⚡ More blocking work moved off the main loop. Additional blocking operations in audio, pipelines, and plugin handling now run in worker threads, keeping the server responsive under load. #26381

⚡ Unreachable backends don't stall model loading. Loading models and tool servers no longer blocks on backends that are down or slow to respond, so the model list stays responsive when one connection is unreachable. #26289

⚡ Batched streaming updates. Streaming responses now group small updates of the same type before sending them, reducing overhead during fast token streams and tool-call output. Commit, #26202

🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

🌐 Updated translations. Catalan, Brazilian Portuguese (pt-BR), Irish, German (de-DE), and Spanish (es-ES) translations were updated.

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section — some may be withheld for a short time to give administrators time to upgrade. Advisories

🔐 Knowledge base write access enforced on upload. Attaching an uploaded file to a knowledge base now requires the same write access as the rest of the knowledge API, so users without write access can no longer add files to a collection by referencing its ID. #26001

🗝️ API key permission enforced on all key endpoints. Viewing and deleting API keys now respects the API keys permission, matching the protection already applied to key creation. #25992

🔊 Text-to-speech permission enforced on the speech endpoint. The OpenAI speech proxy now honors the text-to-speech permission, so it can no longer be used by people who are not allowed to use that feature. #25993

🎲 Model access enforced on arena fallback. Reaching a model indirectly through an arena model on background and task requests now enforces that model's access rules, closing a path that could otherwise bypass them. #26046

⏰ Scheduled automations stop for deactivated accounts. Scheduled automations now re-check the owner's account status and permissions before each run, so they stop when an account is deactivated or has automations access revoked. #26047

🚧 Heavily encoded paths rejected behind the proxy. Request paths that remain encoded after repeated decoding are now rejected instead of forwarded, preventing a path traversal that could otherwise slip through. #26050

🌐 Image URL fetches hardened against DNS rebinding. Fetching user-supplied image URLs now re-checks the destination address at connection time, closing a path that could be used to reach internal addresses behind a public hostname. #25960

🛂 Web fetch blocklist matches on hostname. The web fetch filter now matches entries against the request's hostname on domain boundaries, so blocked hosts can no longer slip through with an added path and lookalike domains are no longer mistaken for allowed ones. #25949

🪪 MCP connectors request least-privilege scopes. MCP connectors that register dynamically over OAuth now request only the scopes for the specific resource rather than the authorization server's full catalog. #25958

🙈 Channel member lists no longer expose private data. Viewing a channel's members now returns only basic profile details, instead of also exposing other members' settings, linked-account data, and personal information. Commit

🛟 SCIM sync can't demote an admin. A SCIM provisioning sync that marks a user inactive can no longer strip an existing administrator's role, preventing an instance from being locked out of its own administration. #25948

👻 Collaborative notes reject unauthenticated presence events. The remaining real-time note-collaboration events now require an authenticated session, so presence and cursors can no longer be spoofed by someone who only knows a note's ID. #25946

⏱️ Login timing no longer reveals which accounts exist. Sign-in now takes the same amount of time whether or not an account exists, removing a timing difference that could be used to discover valid accounts. Commit, Commit

🔌 Terminal connections can't be redirected to another user. Terminal session identifiers are now safely encoded before being passed upstream, closing a way to tamper with the connection's user identity. #26042

📡 Real-time events only reach your own session. The server now verifies that a real-time event is delivered only to the requesting user's own active session, instead of trusting a client-supplied session identifier. #25763

🔓 Revoked sessions are rejected on real-time connections. Real-time and terminal WebSocket connections now honor token revocation and expiry, so a signed-out or expired session can no longer keep a live connection open. Commit, #25764, #25686

🕳️ Another DNS-rebinding gap closed in URL fetching. Fetching a URL's content now re-checks the destination address at connection time, closing another path that could reach internal addresses behind a public hostname. #25775

🗣️ Azure speech input is escaped. Voice and language values are now escaped when building Azure text-to-speech requests, preventing malformed or injected markup. #25776

⚙️ Interface settings update respects its permission. Saving interface settings now enforces the interface permission, so users without it can no longer change those settings through the API. #25996

🗄️ Unknown knowledge collections are denied by default. Retrieval now rejects unknown or unscoped collection names by default, closing a legacy path that could be used to reach collections outside the normal access checks. Commit

🙈 Error responses no longer leak internals. Server error responses now return sanitized messages instead of raw exception text, so internal details aren't exposed to signed-in users. Commit, Commit, Commit, Commit, #26375, #26374

📏 Upload size limit enforced on the server. The maximum upload size is now enforced server-side, so it can't be bypassed by a client that ignores the limit. Commit, Commit, #25869

🖼️ OAuth profile pictures are validated. Profile picture URLs from OAuth providers are now validated and their type checked when stored, preventing unsafe image sources. Commit, #24548

📦 Security updates to frontend dependencies. Several frontend dependencies were updated to patch known security vulnerabilities. #26281

🤝 Chat sharing respects the user-sharing permission. The share-chat dialog now hides the option to share with specific users from people who lack that permission, matching the access rules enforced elsewhere. #25915

📤 Chat export respects its permission everywhere. Every chat export menu now checks the export permission, so users without it can no longer export chats through one of the dropdown menus. #25914

📂 File write access requires real ownership. Editing or deleting a file through a knowledge base or workspace model now requires that the object's owner actually owns the file, so a read-only file can no longer gain write access by being referenced from an object you control. #26032

🖌️ Image edit endpoint enforces permission. The image-edit endpoint now checks the image-edit switch and the image-generation permission, matching image generation, so it can't be called by users who lack access. #26009

📁 Folder permission enforced on all folder actions. Every folder operation now checks the folders permission, so the setting is respected consistently instead of only when listing folders. Commit

🧩 Code Execution settings collapse when off. The Code Execution settings section now collapses when the toggle is disabled, keeping the settings page tidy. #25970

📅 German date format in Notes. Dates in the Notes view now display correctly for German, where they previously failed to render. #25985

🎙️ ElevenLabs speech keeps working when voices can't load. Text-to-speech through ElevenLabs no longer fails when the available-voice list can't be fetched, instead of rejecting every voice. Commit, #26075

🪟 Default Permissions modal resets on close. Closing the Default Permissions dialog without saving now discards unsaved edits instead of keeping them around the next time you open it. Commit

👯 Side-by-side chat with the same model. Running two panes with the same model no longer leaves one pane stuck waiting or showing the other pane's reply after a reload, since each pane's messages are now tracked separately. Commit, #25982

💾 Model edits no longer lost when changing access. Adjusting a model's access no longer auto-saves on its own and discards your other unsaved changes to that model. #26004

🔧 Parallel tool calls over the Anthropic-compatible API. External Anthropic-compatible clients calling Open WebUI's messages endpoint now receive tool calls reliably when a model issues several at once or returns them in its final message. Commit, #25963, #25964

🗃️ Prompt caching preserved over the Anthropic-compatible API. Requests through the Anthropic-compatible API now keep their prompt-caching markers instead of having them stripped, so clients that rely on caching work as intended. Commit, #25998, #25964

🔁 Fewer redundant data loads. Several views no longer fire duplicate background fetches at once, avoiding occasional glitches from overlapping requests. #25943, #25942, #25934, #25935, #25838, Commit

🔎 Steadier search boxes across admin and workspace. Search fields for users, knowledge, prompts, tools, and similar lists now run only as you type and reset to the first page correctly, instead of occasionally re-searching on their own. Commit, #25938

📊 Admin feedback list loads again on PostgreSQL. The admin feedback list no longer fails to load on PostgreSQL setups, where it previously returned a server error. Commit, #25953

🗂️ Deleting nested folders checks chats correctly. Deleting a folder that contains subfolders now accounts for the chats inside those subfolders when applying the delete-permission check, instead of only the top-level folder's chats. Commit, #25920

🖱️ Dragging chats into folders is more reliable. Dragging a chat into a folder no longer throws an error in cases where the chat couldn't be resolved. #25928

🛠️ Workspace menu shows for the skills permission. Users who only have the skills permission now see the Workspace entry in their menu, which previously appeared only for other workspace permissions. #25925

🧠 Admins can always reach memories. Administrators can now use the memories endpoints regardless of the memories permission toggle, matching how admin access works for other features. #25924

🖼️ Image settings page survives a config load failure. The admin image settings page no longer crashes when its configuration fails to load, showing the page instead. #25933

🧵 Code blocks render in channel threads. Code blocks now display correctly in a channel's thread view, where duplicated message identifiers previously broke their rendering. Commit, #25917

🔵 No more false unread badges on chats. Chats no longer show an unread indicator after automatic changes like title generation or pinning, archiving, and moving them between folders, and newly created chats are marked read correctly so they don't appear unread after a refresh. #25912, #25782, #25108

📌 Pinned notes stay in sync. Pinning, unpinning, or deleting a note now updates the sidebar's pinned list consistently, instead of showing a stale pin state. #25918, #25640

📅 All-day calendar events keep their date. Saving an all-day calendar event no longer shifts it by a day for users in certain time zones. #25864

🧷 Damaged chat history recovers more reliably. When a chat's current position is missing or points at a malformed message, Open WebUI now repairs it from the latest valid message — on both the client and the server — instead of risking a broken history view. Commit, Commit, #26298, #26258, #26257

💾 Saving a chat no longer drops messages. Chat updates are now merged with the existing history on the server, with explicit tracking of deleted messages, instead of overwriting it, preventing message loss from concurrent or partial saves. Commit, Commit, Commit, #25657

📺 Channel message updates stay in their channel. Streaming updates to a channel message are now skipped if the message no longer exists or belongs to a different channel, preventing stray updates. Commit

📌 Pinned channel messages update for everyone. Pinning or unpinning a channel message now updates live for all members and works from thread views, instead of only changing for the person who pinned it. Commit

📄 Mistral OCR uploads work again. Document OCR through Mistral has been repaired after an upstream library change broke its file uploads. #25779

🗂️ Chroma collection detection fixed. Open WebUI now correctly detects existing Chroma collections, fixing a case where it always reported them as missing. #25780

📊 Vega-Lite charts render reliably. Vega-Lite charts in chat are now detected by their code block language tag, so they render correctly. #25843

🏷️ Long chat tag lists scroll. The tags section in the chat menu now scrolls instead of overflowing when a chat has many tags. #26031

⌨️ Enter key shows correctly on iOS. The Enter key symbol in the keyboard shortcuts list no longer renders as an emoji on iOS. #26173

🔗 Whitespace in names no longer breaks MCP connections. User name and info headers are now trimmed before being forwarded, fixing MCP connection failures when a display name contained leading or trailing whitespace. #26182, #26181

🈳 Search no longer fires mid-composition. Typing in search with an input method editor (such as Japanese, Chinese, or Korean) no longer triggers a search when you press Enter to confirm a composition. #26238, #26285, #26172

🧰 Valves icon stays visible. The icon for configuring valves no longer disappears, so user-configurable tool and function settings remain reachable. #26256

🎛️ Chat controls persist across navigation. Edits to chat controls are now kept when navigating between chats, and reverting a control to the chat's saved value persists correctly, instead of being lost. #26336, #25793

🔍 Chat search tool handles empty queries. The built-in chat search tool no longer crashes when called with an empty query. Commit, #26310

📑 More robust MinerU document processing. Document processing through MinerU now handles its ZIP results more safely, including very large outputs. Commit, #26263

⏰ Scheduled automations with session-auth tools work. Automations that use session-authenticated tools or terminals now authenticate correctly when running on a schedule, instead of failing. Commit, #26247, #26137

📝 Model system prompt preserved with knowledge. A model's system prompt is no longer dropped when knowledge retrieval runs with native tool calling. Commit, #26217

🔑 Expired sessions return you to sign-in. When a request fails because your session has expired, Open WebUI now redirects you to the sign-in page instead of leaving you on a broken view. Commit, #26237

🎯 Ejecting a workspace model unloads the right model. Unloading a workspace model now resolves to its underlying base model, so the correct model is freed from memory. Commit, #26269

🔄 Edited models refresh in the admin list. After editing a model in the admin settings, the models list now updates right away instead of needing a manual reload. Commit

🗂️ Workspace model bulk actions and search work across pages. Bulk actions on workspace models now apply across all of them, and search results paginate correctly. #26274

🧩 MCP resource results come through. Tool results that return resource content — including binary blobs and URI references — are no longer silently dropped, and image results are attached as files. #25260, #24038, Commit

🔗 Broader MCP server compatibility for OAuth. Open WebUI now discovers an MCP server's protected resource metadata even when the server doesn't advertise it, and recognizes more OAuth preflight variations, so more MCP servers connect. #25980, #25954, Commit, #26068

📤 Clearer upload error messages. Failed uploads now show a readable explanation instead of an opaque error stub. #25961

📋 Cloned prompts get a proper title. Cloning a prompt now adds the clone suffix to the correct field, so the duplicate is named as expected. #25800

📐 Long default group names don't overflow. A long default group name no longer overflows its row in the admin authentication settings. #25685

🖐️ Sidebar drags don't trigger uploads. Dragging a chat item in the sidebar no longer shows the file-upload overlay. #25675

🔁 Recovers from a stuck streaming response. If the signal that a response finished is missed — for example after a mobile app is backgrounded mid-stream — Open WebUI now recovers the chat instead of leaving it stuck in a streaming state. Commit, Commit, Commit, #26320, #26315

🧠 Model skills load on demand instead of filling the prompt. A model's attached skills are now presented to the model as a manifest it can load when needed, rather than having their full content inserted into the system prompt; skills you mention inline still get their content included directly. Commit, Commit, #25592, #25599

🗂️ Empty metadata no longer breaks Chroma indexing. Document metadata with empty values is now filtered out before indexing, fixing a case that could fail on Chroma. Commit, #26342, #26339

🔁 Updating a knowledge file won't break the knowledge base. When a file's content is updated, its new embeddings are now added before the old ones are removed, so a failed reindex leaves the knowledge base intact and usable instead of empty. Commit, #23789, #23787

🔤 Documents with special tokens index correctly. Measuring chunk sizes no longer fails when a document contains text that looks like a special token. #26210

📝 Note file attachments stay in sync. Updating the files attached to a note now keeps the editor and saved note in sync. Commit

📱 Better banner layout on mobile. Notification banners now lay out correctly on small screens. Commit, #24912

📂 Knowledge file listing includes attached files. Listing files through the knowledge tools now also shows files attached directly to a model, not only those inside a knowledge base, fixing cases where listing returned no results for a model with a single attached file. Commit, #26301

🏷️ Chat titles generate after long first responses. A new chat now gets its title even when the first response takes a long time, such as one with extensive reasoning or many tool calls, instead of staying "New Chat".
Note truncated.

0.9.61 Jun 2026Security3 sources agree

We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed secti…

Added

📦 Official knowledge base sync tool. A new companion tool from Open WebUI, oikb, keeps a knowledge base in sync with a local directory, GitHub repo, S3 bucket, Confluence space, or any of more than 40 other sources, uploading only new and changed files using the incremental sync support added in this release. oikb
📂 Smart directory sync for knowledge bases. Local directories can now be synced into a knowledge base in one action: file checksums are compared against what's already stored, and only added or modified files are uploaded while removed files and orphaned subdirectories are cleaned up, with the directory structure mirrored automatically and per-file progress shown throughout. #19190, #19394, Commit, Commit, Commit, Commit, Commit, Commit
🗂️ Knowledge base folders. Files inside a knowledge base can now be organized into nested folders, with breadcrumb navigation that makes it much easier to manage and find content in large collections. Commit, Commit, Commit, Commit, Commit, Commit
🧰 Filesystem tool for knowledge bases. A new built-in tool, enabled via the "ENABLE_KB_EXEC" environment variable, lets AI models browse and search knowledge base contents using familiar filesystem commands such as 'ls', 'cat', 'grep', 'find', 'head', 'tail', and 'sed', including pipes between them. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
✏️ File renaming in knowledge bases. Files inside a knowledge base can now be renamed directly from the workspace, with the new name reflected wherever the file is referenced. Commit
😀 Emoji picker in message input. A new emoji button in the rich text formatting toolbar lets you browse and insert emojis directly into your messages. #24704
🪄 Per-chat skills toggle. Skills can now be turned on or off for a conversation directly from the chat Integrations menu, the same way tools and capabilities already work, instead of only through the model preset. #25036, #25037
🔎 Access preview for users and groups. Administrators can now preview exactly which models, knowledge bases, and tools a given user or group can access, making it easier to audit and verify permission setups. Commit
📄 Configurable knowledge base file page size. Administrators can now request a larger page size when listing a knowledge base's files through the API, reducing the number of requests needed to retrieve large collections instead of paging through fixed increments of 30. #25148, Commit
🔃 Persistent processing indicator for knowledge files. Files still being processed in a knowledge base now keep showing a processing indicator across page reloads, so you can tell what's still ingesting after navigating away and back. #25031, Commit
📑 MinerU file type configuration. Administrators can now configure which file types are processed by the MinerU document loader, via the new "MINERU_FILE_EXTENSIONS" setting, extending it beyond PDF to formats like DOCX, PPTX, and XLSX. Commit
📃 Legacy Word document support. Older ".doc" Word files can now have their text extracted by the default document extraction engine, in addition to the modern ".docx" format. Commit
📁 Create subfolders from the folder header. Chat folders can now have subfolders created directly from the folder header in the chat view, not just from the sidebar. Commit
⚡ Faster initial page loads. The configuration endpoint that loads on every page visit no longer runs an unnecessary user-count query, making the initial application load lighter on the database, especially on instances with many users. Commit
🚀 Faster tool-enabled chat completions. Chat completions that use multiple tools now start faster because the tools they reference are fetched from the database in a single batch query instead of one query per tool. #24808, Commit
🏎️ More responsive web search under load. Web search through SearXNG, Google PSE, Brave, Serper, and Serpstack now uses non-blocking network calls, so the server stays responsive to other users while a search is in flight, and concurrent multi-query searches complete faster. Commit
🐎 Lighter Ollama backend connections. Requests to Ollama backends now reuse a shared connection pool instead of opening a fresh session each time, reducing TCP and TLS handshake overhead for installs that poll Ollama frequently or have multiple backends configured. Commit
💽 Fewer redundant model-list writes. On multi-instance deployments backed by Redis, the model list is no longer rewritten when it hasn't changed, cutting a major source of redundant writes. #25469, #25474, Commit
📉 Faster websocket disconnect cleanup. Disconnecting from a collaborative session no longer triggers a scan across the entire Redis keyspace, using a per-session index instead, which keeps disconnects cheap on large deployments. #25466, Commit
📝 Frontmatter auto-fill for tools, functions, and skills. Opening a tool, function, or skill editor now auto-fills the name, id, and description fields from the file's frontmatter, saving you from re-entering metadata already declared in the source. #24649, Commit
🪪 More user placeholders in custom headers. Custom-header templates for direct connections and tool servers now support "{{USER_EMAIL}}" and "{{USER_ROLE}}" alongside the existing user and session placeholders. Commit
⏱️ Configurable MCP connection timeout. The timeout for the initial handshake with an MCP tool server is now configurable via the new "MCP_INITIALIZE_TIMEOUT" setting, so servers that are slow to start or expose many tools can finish connecting instead of timing out. #25011, Commit
📐 Profile image size limit. Administrators can now cap the size of inline profile images via the new "PROFILE_IMAGE_MAX_DATA_URI_SIZE" setting, bounding how much database and cache space inline avatars and model icons can consume. #25468, #25476
🎫 Wildcard OAuth role mapping. Administrators can now set "*" in the allowed OAuth roles to grant the user role to any authenticated OAuth user, instead of having to enumerate every accepted role. #25062, Commit
📊 Paginated feedback history. The feedback and evaluation history list is now paginated, keeping it responsive for instances that have accumulated large numbers of feedback entries. Commit
🔘 Bulk enable or disable automations. Automations can now be enabled or disabled in bulk from an actions menu on the automations page, instead of toggling each one individually. Commit
➡️ Optional auto-redirect to single sign-on. Administrators can now enable "OAUTH_AUTO_REDIRECT" so that, on deployments with a single sign-on provider and no other login methods, users are sent straight to the provider instead of seeing a login page first. #25067, Commit
☁️ Azure AI Foundry v1 with Entra ID. Open WebUI now supports Azure AI Foundry's OpenAI v1 endpoint together with Microsoft Entra ID authentication, so these connections work without manual workarounds. #24761, #24985, Commit
🌎 Linkup web search provider. Administrators can now select Linkup as the web search provider from the admin settings, with options to configure the API key and search depth. #24752, Commit
🧊 Valkey vector database support. Valkey can now be used as the vector database backend, configurable through new "VALKEY_URL" and related settings including index type, distance metric, and HNSW tuning. #24769, Commit
🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
🌐 Translation updates. Translations for Spanish (Spain), Swedish, German, Korean, Catalan, Russian, Irish, Simplified Chinese, Traditional Chinese, Finnish, Polish, Turkish, and Malay were enhanced and expanded.

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section — some may be withheld for a short time to give administrators time to upgrade. Advisories
🛡️ Tool server permission enforcement. The per-user permission for inline tool servers is now enforced on chat-completion requests, so users without that permission can no longer bypass the admin setting by supplying tool servers directly in their requests. Commit
🔒 Knowledge base access check in search tool. The built-in knowledge search tool now verifies that the caller can access a knowledge base before searching it by id, preventing users from reading the contents of knowledge bases they have not been granted access to. #25113
🗄️ Cross-user access to retrieval collections. Resolving the documents used for retrieval now verifies the caller's access to each referenced file and rejects client-supplied collection names, preventing a crafted request from pulling another user's files or vector collections into its context. Commit
🔣 Collection name validation. Vector collection names are now rejected unless they contain only safe characters, preventing malformed names from reaching the vector store or breaking out of a database query expression. #24982
🚫 Unscoped retrieval collections denied by default. Retrieval requests for collection names that don't correspond to a known file, memory, web-search, or knowledge base are now denied for non-admins by default, with a new "ENABLE_RETRIEVAL_UNSCOPED_COLLECTIONS" setting to restore the previous behavior if needed. Commit
📜 Prompt history authorization. Comparing, deleting, and restoring prompt versions now verify the history entry belongs to the prompt you're authorized for, preventing access to or modification of another prompt's version history. #25056
🚦 Code interpreter permission on the legacy path. The legacy code-execution path now enforces the same permission and capability checks as the current one, so users without the code interpreter permission can no longer trigger code execution through it. #24724
🧱 API key endpoint restriction bypass. The endpoint allow-list that limits which paths an API key may reach is now matched against the routed request path directly, preventing a crafted request from slipping past the restriction. #25123
🚧 System prompt bypass via request parameter. The flag that skips a model's configured system prompt can no longer be set by external clients through a request parameter, so admin-configured system prompts can't be bypassed from the API. #25156
🚪 Terminal proxy path traversal. The terminal proxy now fully decodes request paths before validating them, blocking multi-encoded payloads that could otherwise escape the intended path. #25157
🪤 Cache file path traversal. The cache file server now requires an exact directory boundary match, closing a gap where a sibling directory whose name began with the cache directory's name could be used to serve files from outside it. #25086
🔀 Ollama backend selection access check. Requests can no longer target an arbitrary Ollama backend by index; a caller-supplied backend selector is now verified against the backends that actually serve the requested model. Commit
🔓 Cross-user file exfiltration via image URLs. When a chat message references a file by id in an "image_url" field, the server now resolves that file only for its owner, an administrator, or a user with an explicit read grant, preventing other authenticated users from extracting a file's contents by routing it through the model. #24625, Commit
📌 Chat file attachment access checks. Attaching files to a chat now links only files the caller can read, preventing a user from associating another user's file with their chat to access its contents. #25054
🧾 Model knowledge file ownership checks. Creating or updating a model now verifies that any knowledge files attached to it are files the editor can access, preventing another user's files from being attached to a model. #25055, Commit
📅 Calendar event move authorization. Updating a calendar event to move it into a different calendar now requires write access on the destination calendar, preventing users from injecting events into calendars they cannot write to. #24764
📣 Channel chat access control. Generating a response in a channel context now verifies the caller's access to that channel and scopes the included messages, preventing access to channels or messages the user isn't permitted to see. #24725
🕸️ Web loader SSRF gating with Playwright. When the Playwright-based web loader is in use, page navigations and redirects are now validated the same way as the default loader, closing a gap where the Playwright path could reach internal or otherwise blocked URLs. #24756
🛂 DNS rebinding protection for URL fetches. The IP address validated for an outbound URL fetch is now the same one used for the actual connection, closing a DNS rebinding window where an attacker-controlled hostname could resolve to a public IP during the safety check and then to a private IP when the connection was opened. #24759
🪞 OAuth profile picture redirect handling. The OAuth profile picture fetch now follows redirects only when administrators have explicitly allowed it, closing a window where a redirect from an externally validated URL could be used to reach internal addresses. #24809
🧼 Model profile image script injection. Model profile images are now validated on save and only served inline when they are a known-safe image type, preventing a crafted SVG profile image from running scripts in other users' browsers, while existing legacy images that fail validation are cleared gracefully instead of breaking the model list. #25060, #25173
🧯 Diagram rendering script injection. Mermaid diagrams rendered in chat are now sanitized before display, preventing a crafted diagram from running scripts in the viewer's browser. #25219
🔐 Shared-chat file write protection. Access to a file through a shared chat now only grants read access, so users who can read a shared chat can no longer modify or delete files attached to it. #24755
🔏 Cross-origin embed prompt control. When Open WebUI is embedded in an iframe on a different origin, the embedding page can now only drive the chat input or submit prompts if the user has explicitly opted in via the "iframe Sandbox Allow Same Origin" setting, preventing untrusted host pages from triggering confirmation dialogs or controlling the chat. #24767, Commit
🗂️ Chat folder ownership checks. Creating a chat or updating a chat's folder now verifies the referenced folder belongs to the current user, preventing chats from being associated with folders owned by other people. #24588
🧩 Chat recovery from corrupted history. Chats whose internal message graph was left in a malformed state by a failed regeneration now open and load correctly, with missing roles, parent references, and current-message pointers reconstructed automatically instead of breaking the chat. #24424, #24157, #20474, #24799, Commit
📨 Imported chats with folders appear correctly. Importing grouped chats no longer leaves them invisible when a referenced folder is missing; such chats now appear in the chat list instead of being silently orphaned. #24910, Commit
🎟️ MCP tool server sessions stay connected. OAuth-authenticated MCP tool server sessions are no longer mistakenly refreshed and deleted by the single sign-on session handler, so those connections stay active. #24618, Commit
🤝 MCP OAuth scope discovery. The OAuth flow for MCP tool servers now reads the scopes a server advertises through its Protected Resource Metadata, so connecting to servers that declare their own scopes succeeds. #24730, #24690
🔍 Web search reliability. Web search again fetches page content reliably with the default web loader engine, a new "USER_AGENT" environment variable lets administrators set a real browser user-agent so fetches aren't blocked by Cloudflare, Wikipedia, and other bot-detection systems, and the startup script no longer fails to launch when these new environment variables are unset. #24560, #24793, #24683, Commit
🔥 Firecrawl web search results. Web search using Firecrawl now returns results correctly regardless of which response format the Firecrawl version uses. #24712
🦅 Kagi web search. Web search using Kagi works again after its API endpoint and request method were updated to match Kagi's current API. #25015
🔢 Bracketed numbers in code blocks. Numbers in square brackets such as "[0]" inside code blocks are no longer stripped out as if they were source citations, so code displays and copies correctly. #24948, Commit
🔌 API chat completions reliability. Direct calls to the chat completions API no longer fail with an internal error when no chat session identifier is supplied. #24553, #25235, Commit, Commit
🖼️ ComfyUI image generation and editing. Generating and editing images via a ComfyUI backend now works again, including when ComfyUI is hosted on a private or internal network where URL validation was previously blocking the admin-configured endpoint. #24565, Commit, Commit
🖌️ Image generation with non-standard response headers. Image generation now works with backends that return valid JSON without a standard content-type header, instead of rejecting the response. #24838
🐘 Knowledge search on large documents. Searching knowledge bases on PostgreSQL no longer fails when scanning across documents with very large extracted text content. #24670, Commit
💬 Chat title generation. Automatically generated chat titles now use the model currently selected in the dropdown for the active chat and fall back to the model from the active message branch otherwise, and a clear message is shown if no model is available instead of an unhelpful error. #24604, #24745, Commit, Commit
🧮 Message search and analytics consistency. Edits, deletions, and branch changes made in a chat are now reflected in message search results and analytics counts instead of leaving stale entries behind. #25205, Commit
🩹 Graceful handling of in-chat task failures. When web search query generation, image prompt generation, or a tool call fails or references a missing tool, the chat now falls back or surfaces a clear error instead of breaking partway through the response. #25038, #25144, Commit
🎛️ Filter changes to message output. Filter functions that modify a message's structured output after generation now have those changes saved and displayed, instead of being discarded when only the output, not the text content, was changed. #24884
⏩ Titles and tags reflect filtered output. Outlet filters now run before automatic title, tag, and follow-up generation, so those are based on the final filtered message instead of the unfiltered version. #24717
💾 Action-replaced message content persists. Message content replaced by an action function through its event emitter is now kept when the chat is saved, instead of reverting to the original after a page reload. #24585, #25485
🏷️ Skill mentions in messages. Mentioning a skill in a message now keeps the skill's name as readable text instead of removing it, and selecting a skill without typing anything no longer causes an error on providers that reject empty messages. #24929, Commit
🧹 Usage timer cleanup on send failure. The background usage-stats timer started during message generation is now always cleared, even when sending a message fails, preventing leaked timers from accumulating over a session. #25478
🗑️ Background tasks stop when a chat is removed. Deleting or archiving a chat now cancels any in-flight generation or title and tag tasks for it, instead of leaving orphaned background work running. #25050, Commit
⌨️ Responsive knowledge file search. Searching for knowledge files in the chat picker and model knowledge selector now matches on file names by default instead of scanning the full extracted text of every document on each keystroke, keeping the search responsive on large deployments, with content search available as an explicit opt-in. #25082, #25119, Commit
📥 Document processing with empty embeddings. Saving documents to the vector database no longer crashes when an embedding step returns no vectors, allowing the process to continue instead of failing the whole upload. #25166
🔤 Non-UTF-8 text and CSV uploads. Text and CSV files saved in legacy encodings, including Latin-1, Windows-1252, and Chinese encodings such as GB18030, are now detected and loaded correctly instead of being rejected as binary or failing with an empty-content error. #25172, #24973, Commit, Commit
🧽 Null bytes in nested data no longer break saves. Data containing null bytes nested inside structured fields is now sanitized correctly before being written, preventing database errors that the previous check failed to catch. #25018, Commit
🧠 Clear error when no embedding model is configured. Using knowledge or retrieval features without a loaded embedding model now returns a clear setup error explaining what to configure, instead of failing with a cryptic crash. Commit
🧲 Memory search quality. Memory searches now apply the configured embedding query prefix, so retrieval works correctly with embedding models that require one for queries. #24921, Commit
📚 Knowledge tool context overflow. The built-in tool that lists a model's knowledge no longer dumps every file in every knowledge base into the model's context; it now returns summaries by default and paginates file listings only for a requested knowledge base. #25105, Commit
⏳ Terminal session stability. The terminal proxy no longer hangs when one direction of the connection closes before the other, so terminal sessions shut down cleanly instead of stalling. #25464, #25479
🧷 Tool call continuity with strict providers. Chats that contain incomplete tool calls or orphaned tool results no longer fail to continue when sent to providers that strictly validate tool pairings, such as Anthropic and AWS Bedrock Converse. #24758, #24940, #24798, Commit
🛑 Stream termination for pipe functions. Streamed responses from pipe functions now always send the standard end-of-stream marker, so chat clients and external integrations reliably detect when a response is complete instead of waiting on streams that already finished. #24763
🔊 Non-blocking text-to-speech transcoding. Converting text-to-speech audio to MP3 no longer blocks the server's event loop, so other requests stay responsive even while a TTS response is being transcoded. #24876
🎚️ Default text-to-speech voice. Text-to-speech requests now honor the voice specified in the request and fall back to the configured default only when none is given, instead of always using the admin default or failing. #15143, #25035, Commit, Commit
🪝 Reliable knowledge base file linking. Files uploaded to a knowledge collection are now linked on the server as part of the upload itself, so they remain attached to the collection even if you navigate away or close the page before processing finishes. #24807, Commit
☁️ Azure connections on custom hostnames. Connections marked as the Azure provider now use the Azure code path even when the endpoint does not contain "azure" in its hostname, fixing custom Azure deployments served from non-standard domains. #24882, Commit
🗓️ Clearing calendar event fields. Removing the description or location from a calendar event now saves correctly instead of silently keeping the previous value. #25026, Commit, Commit
💭 Advanced parameter settings. Custom reasoning tags and custom model parameters are now saved correctly instead of being dropped, and the presence penalty and repeat penalty no longer save the frequency penalty's value instead of their own. #25183, #25200, #25204
📏 Long username display. Long usernames no longer overflow their containers in the admin user list, user modals, and sidebar. #25185
🎯 All skills selectable in the model editor. The model editor's skills selector now lists every skill you have access to, with a search box for large lists, instead of showing only the first 30 with no way to reach the rest. #24873, Commit
🔔 Accurate knowledge upload feedback. Dragging files into a knowledge base no longer shows an upload notification before the upload has actually been processed. #25484
♿ High-contrast timestamp readability. The user message timestamp now uses the correct colors in high-contrast mode instead of inverted ones, keeping it readable. #25461
♿ Keyboard and screen reader access to menus. The integrations, more-options, and user menus are now real buttons with labels and keyboard support, so they can be opened with the keyboard and announced by screen readers. Commit
🖱️ Focus-loss handling in editors. Workspace and admin editors for models, tools, functions, and skills again respond correctly when the browser window loses focus, after the wrong event name was being listened for. #25459
🛟 Resilience to corrupted local storage. Corrupted data in the browser's local storage no longer crashes the interface; affected settings and dismissed-banner state now fall back to safe defaults. #25481
📶 Quieter reconnection notifications. Brief connection interruptions, such as backgrounding a mobile tab, no longer flash a "connection lost" warning, and the "reconnected" message only appears if a disconnect was actually shown. Commit
🍎 Safari PDF handling. PDF processing now works in Safari, which doesn't support the stream iteration the previous code relied on. #25151, #25473
🎙️ Voice mode mute shortcut listing. The keyboard shortcut for muting voice mode now appears in the keyboard shortcuts help modal. #25193
📎 Document attachments in channel model replies. Tagging a model in a channel thread now forwards uploaded non-image documents such as PDFs and DOCX files into the model's context, so document summarization and comparison workflows that already worked in direct chat now work in channels too. #24896, #24898, Commit
🙈 Hidden models in channel mentions. Models marked as hidden no longer appear in the channel message-input model mention selector, matching how hidden models are excluded elsewhere in the interface. #24892
🧵 Channel thread and pinned message stability. Opening a channel thread or the pinned messages view no longer fails to render when a message or its data is missing. #25209
📺 YouTube short link transcripts. Pasting a "youtu.be" short link into a chat now loads the video transcript correctly instead of failing with an empty-content error. #24856, Commit
🙉 Hidden models in default-model and automation pickers. The admin pickers for default models and default pinned models, and the automation model dropdown, now filter out hidden models, consistent with how hidden models are treated elsewhere. #24869, Commit, Commit
🔊 Speech-to-text SSL setting honored. Speech-to-text requests now respect the "AIOHTTP_CLIENT_SESSION_SSL" setting, so administrators using self-signed certificates or custom SSL configurations can use STT engines that were previously failing TLS verification. #24568, #24857, Commit, Commit
🔗 Placeholders in MCP connection headers. Custom header templates configured on MCP server connections now have their "{{USER_ID}}", "{{USER_NAME}}", "{{USER_EMAIL}}", "{{USER_ROLE}}", "{{CHAT_ID}}", and "{{MESSAGE_ID}}" placeholders interpolated at request time, matching how custom headers already work for direct connections and tool servers. #24822
🪟 Bing search CLI smoke test. Running the Bing web-search module from the command line for a quick connectivity check no longer raises an error about missing arguments. #24765, #24768
🩺 Database health check recovery. After a transient database connection error, the health check endpoint now recovers automatically instead of staying permanently broken on the affected worker. Commit
🥾 Startup on non-Unicode consoles. Open WebUI no longer crashes at startup when the console can't encode the banner's box-drawing characters, such as on Windows or with redirected or headless output, falling back to a plain-text banner instead. #24965, #25482
🆕 First admin signup after a reset. Creating the first administrator account is no longer blocked by a previously stored signup setting, so a fresh or reset instance can always be bootstrapped. #24821
🪵 JSON exception logging. With JSON log formatting enabled, exceptions are now recorded correctly with a structured type, message, and stacktrace instead of being dropped, and a logging failure can no longer crash the application. #25135, Commit
🧭 Workspace skills permission. Users granted only the "workspace.skills" permission can now see the workspace entry in the sidebar and are correctly routed to the skills page from the workspace index. #24729
🔁 Resilient database migrations. Database migrations now skip tables, indexes, and columns that already exist and add missing primary keys to legacy tables, so upgrades succeed even when parts of the schema were manually or partially created beforehand. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, #24722

Changed

⚠️ Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.
⚙️ Tool-call iteration cap renamed and raised. The environment variable that limits how many tool calls a single chat response may make is now "CHAT_RESPONSE_MAX_TOOL_CALL_ITERATIONS", with its default raised from 30 to 256 and a new "-1" value for unlimited; the previous "CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES" name continues to work as a fallback, and chats that hit the cap now show a clear error in-chat instead of stopping silently. #24918, Commit
🔐 Reduced public "/api/config" exposure. The "/api/config" response no longer includes several feature flags ("enable_api_keys", "enable_password_change_form", "enable_version_update_check", "enable_public_active_users_count", "enable_easter_eggs") for unauthenticated callers, reducing information disclosure to anonymous visitors. Commit, Commit
🔑 "WEBUI_SECRET_KEY" is now a hard requirement even for unsupported deployments. Deployments that start the backend in an explicitly unsupported way (such as invoking uvicorn directly) without setting "WEBUI_SECRET_KEY" will now refuse to start instead of falling back to an empty key; the supported start methods (start.sh, start_windows.bat, and "open-webui serve") still set or auto-generate it automatically, so standard deployments are unaffected. Direct Uvicorn startup is not supported. #25218

Open source →

0.9.510 May 20263 sources agree

🛡️ Redirect-based SSRF protection. All outbound HTTP requests now block 3xx redirects by default via a new AIOHTTP_CLIENT_ALLOW_REDIRECTS environment

Added

🛡️ Redirect-based SSRF protection. All outbound HTTP requests now block 3xx redirects by default via a new AIOHTTP_CLIENT_ALLOW_REDIRECTS environment variable, preventing redirect-based SSRF where a public URL silently redirects to internal addresses (RFC 1918, loopback, cloud-metadata endpoints). Affected call sites include web fetch, image loading, OAuth discovery, tool server execution, and code interpreter login. #24491
🛡️ Iframe content security policy. Administrators can now configure a Content-Security-Policy for all srcdoc iframes (Artifacts, tool embeds, file previews, citation modals) via the IFRAME_CSP environment variable, restricting what LLM-generated or user-uploaded HTML can load and execute inside previews. Commit
🎛️ Granular markdown rendering controls. Users can now independently disable Markdown rendering for user messages and assistant responses from Interface settings, preventing unintended formatting when pasting text that contains Markdown-sensitive characters. Commit
🔧 Terminal proxy response headers. Administrators can now inject custom response headers into terminal proxy responses via the TERMINAL_PROXY_HEADERS environment variable (JSON object), enabling deployment-specific security headers like sandbox policies for proxied content. Commit
🔌 Channel streaming and tool support. Mentioning a model in a Channel now streams responses in real time and supports the full chat completion pipeline, including native and default function calling, built-in tools (web search, image generation), user tools, MCP tools, filters, and RAG knowledge injection — the same capabilities available in standard chats.

Fixed

📝 Notes create and open reliability. Creating new notes and opening existing notes no longer fails with a TypeError caused by is_pinned being passed to the SQLAlchemy model on create, and passed twice to NoteResponse on read. #24484, #24486
🔐 Skill public sharing permission enforcement. Creating or updating skills now filters access grants through the sharing.public_skills permission, preventing non-admin users from making skills publicly accessible without the required permission. #24494
🔐 Calendar public sharing permission enforcement. Creating or updating calendars now filters access grants through a new sharing.public_calendars permission, preventing users from making calendars publicly readable or writable without explicit admin-granted sharing permission. #24493
🔐 Feedback user attribution spoofing. Submitting evaluation feedback can no longer forge the user_id field through mass-assignment, preventing authenticated users from attributing ratings to other users and corrupting Elo leaderboard rankings and admin feedback exports. #24508
🛡️ Image URL redirect-based SSRF. Chat messages containing image URLs no longer follow 3xx redirects to internal addresses during base64 conversion, closing the most reachable redirect-based SSRF variant that required no special permissions or feature flags. #24524
🛡️ Collection write access on file processing. The process_file and process_files_batch retrieval endpoints now enforce collection write-access checks before embedding content, preventing authenticated users from injecting file content into another user's knowledge-base collection. #24524
🔐 Tool source code update authorization. Updating a tool's Python source code now requires workspace.tools or workspace.tools_import permission, preventing users with only a write-access grant from overwriting executable tool code while still allowing metadata edits. #24513
🔐 Channel message ownership enforcement. Updating or deleting messages in group and DM channels now requires message ownership, preventing channel members from tampering with or silently removing other members' messages. #24506
🔐 Channel pin write permission. Pinning and unpinning messages on standard channels now requires write permission instead of read permission, preventing read-only users from modifying pinned content. #24521
🛡️ Image generation URL validation. Generated image URLs are now validated through validate_url() before fetching, aligning the defense-in-depth posture with sibling image-loading paths. #24518
🔐 Model params exposure for read-only users. The per-model API endpoint now strips the params dict (including system prompts) from responses to callers without write access, preventing read-only users from viewing admin-curated model configuration. #24525
🛡️ URL parser SSRF bypass. URL validation now rejects backslash, tab, CR, and LF characters that cause urllib and requests/aiohttp to disagree on the target host, closing a parser-confusion SSRF bypass. #24534
🛡️ Profile image MIME-type allowlist. Serving profile images from data URIs now enforces a strict MIME-type allowlist (PNG, JPEG, GIF, WEBP by default, configurable via PROFILE_IMAGE_ALLOWED_MIME_TYPES) and sets X-Content-Type-Options: nosniff, preventing stored-XSS through SVG or other executable content types. Commit
🔐 File ownership in folder and knowledge attachments. Attaching files to folders or knowledge bases now verifies per-file read access, and folder file lists in chat middleware are filtered to entries the caller can read, preventing unauthorized file content from being injected into RAG context. Commit
🔐 Shared chat access for owners and admins. Chat owners can now view and clone their own shared chats without requiring an explicit access grant, and administrators can manage shared chat access controls on any chat. Commit, Commit
🧵 Legacy chat history self-healing. Loading legacy conversations now automatically detects broken parent-link graphs in migrated message records, merges missing messages from the embedded JSON history, and backfills them to the normalized table so future loads use the fast path without data loss. Commit
🎛️ Filter selector reactivity. Model filter checkboxes now derive state reactively from the current filter list and selected IDs instead of capturing a one-time snapshot at mount, so checkboxes update correctly when model contexts or filter configurations change at runtime. Commit
🌐 Portuguese (Brazil) translation updates. Translations for newly added UI items were added along with a consistency pass across existing entries. #24503

Changed

🧹 Removed unauthenticated retrieval status endpoint. The unauthenticated GET /api/v1/retrieval/ status endpoint has been removed as dead code — retrieval configuration is already available through authenticated admin endpoints. #24497
📋 PR template issue requirement. Pull requests now require a linked Issue or Discussion reference, ensuring better traceability for all contributions. PRs without a linked issue or discussion may be closed without review.

Open source →

0.9.39 May 20263 sources agree

🔇 Voice Mode mute control. Voice Mode now includes a dedicated mute toggle with an "M" shortcut and auto-unmute after assistant playback, so you can p

Added

🔇 Voice Mode mute control. Voice Mode now includes a dedicated mute toggle with an "M" shortcut and auto-unmute after assistant playback, so you can prevent accidental interruptions from background noise without leaving the call overlay. Commit, #23832
🚀 Faster prompt list loading. Prompt and prompt-tag pages now load much faster for non-admin users, even with large prompt libraries, because accessible prompts are filtered efficiently in a single database query. #24288, #24258
⚡ Faster chat history loading. Chat history maps now load from normalized message records when available, reducing overhead for large conversations while preserving fallback behavior for legacy chats. Commit, #23159
🗑️ Delete from conversation menu. You can now delete the current conversation directly from the chat menu with a confirmation step, so cleanup is faster without searching through the full chat list. Commit, #24329
⬆️ Scroll to Top shortcut. Long conversations now include a Scroll to Top action in the chat menu when you are away from the top, making it much faster to jump back to the beginning of a chat. Commit, #24133
📅 Calendar creation flow. Users can now create calendars from a dedicated modal and a quick-add action in the calendar sidebar, making calendar setup faster from the calendar workspace. Commit, Commit
🧭 Unified model unload controls. Administrators can now unload running models from the model selector across supported providers, with loaded-state indicators shown for Ollama and llama.cpp models. Commit
⚡ Health check responsiveness. Health and readiness probes now avoid blocking database calls and skip sync session commit handling on probe paths, improving responsiveness and reducing false unready transitions during database pressure. #24380, #24384
🎛️ Playground controls panel. The Playground now includes a dedicated Controls toggle so you can adjust parameters like temperature and related settings per chat run without changing model-level defaults. Commit, #24103
🎙️ STT file extension controls. Administrators can now configure which audio file extensions are accepted for speech-to-text uploads, helping enforce safer and more predictable upload policies. Commit
📷 Remembered call camera selection. Voice call overlay now remembers your last selected camera and restores it automatically when available, so you do not need to reselect it every time you start voice mode. Commit, #24416
👥 User group prompt variable. System and template prompts now support the "{{USER_GROUPS}}" variable, which expands to the user’s group memberships so prompts can adapt to role- or access-based context automatically. Commit, #24462
🔐 Public chat sharing permission control. Administrators can now control whether users are allowed to create publicly shareable chats through a dedicated permission setting. Commit
🔐 Profile image forwarding control. Administrators can now disable external profile image URL forwarding with the "ENABLE_PROFILE_IMAGE_URL_FORWARDING" setting to prevent browser metadata leaks to third-party servers. #24420
🏷️ Dynamic header template variables. Administrators can now use chat, message, and user template variables in custom connection and tool server headers so each request can carry per-conversation context automatically. Commit, #24164
🛂 MCP OAuth server URL setting. Static OAuth tool server setups can now define a separate OAuth server URL, making discovery and client registration work when authentication endpoints are hosted separately from the tool server URL. Commit, #24164, #24216
⚡ Faster memory query performance. Per-user memory lookups and deletions now run much faster at scale because the memory user filter is indexed for existing and new installations. Commit, #23836
🚀 Smarter function dependency installs. Function dependencies are now skipped when they were already preinstalled and unchanged, reducing first-load delays and repeated package installation churn after startup. Commit, #24166
🔎 Brave LLM Context web search. Administrators can now choose Brave LLM Context as a web search provider to retrieve richer grounded passages with a configurable context token budget. Commit, #24120
🗂️ Open Terminal date sorting. Open Terminal now includes sort controls for name and date, with directory-first ordering and modified-time visibility to make file browsing faster. Commit, #24425
🎤 Voice mode prompt toggle. Administrators can now explicitly enable or disable the Voice Mode custom prompt behavior from Interface settings, giving finer control over how voice replies are guided. Commit
🧮 LaTeX copy shortcut. You can now click rendered LaTeX expressions to copy the raw formula to your clipboard, making it easier to reuse equations outside chat. Commit, #24244
✨ Smoother rich text editing. The message composer now defers formatting toolbar refresh work to the next animation frame, reducing typing jank while formatting controls stay accurate. Commit, #24013
🖼️ Arena model profile images. Arena models can now reliably display configured profile images instead of falling back to the default icon. Commit, #24412
🔄 Replaceable tool embed updates. Pipes and Tools can now overwrite previously emitted rich-UI embeds in-place by passing a replace flag on the embeds event, enabling live dashboards and progress panels that update without stacking duplicate entries.
✏️ Assistant response editing and continuation. You can now edit and restructure assistant output items — including reasoning blocks, tool calls, and text content — from a dedicated editor view, and continue generating from the edited state so the model receives full prior context.
🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
🌐 Translation updates. Translations for Chinese, Catalan, Filipino, and Korean were enhanced and expanded.

Fixed

🧵 Background code execution reliability. Code execution no longer hangs indefinitely when you switch conversations or browser tabs during a run, and disconnected or inactive sessions now fail with a clear timeout error instead of endless processing. Commit, #24089
🎙️ Voice recording MIME fallback support. Voice recording now tries a broader set of browser-supported audio formats and resets halted audio playback cleanly, improving microphone capture reliability in browsers where recording previously failed to start. Commit, #24162
🧠 Direct-connection task generation reliability. Title, tags, follow-up, emoji, query, and related task-generation endpoints now work correctly when chats use direct-connection models instead of failing with model-not-found errors. Commit, Commit, #24092
🔧 Parameterized URL tool readiness. New chats now wait for model defaults to finish applying before auto-submit, preventing early requests that can miss configured external tools. Commit, #24176
🚦 MCP cleanup response reliability. Successful native MCP tool calls no longer get replaced by a 500 "No response returned" error during cleanup, so valid chat responses are now returned consistently. #24105
🧵 Active task state recovery. Chat input no longer stays blocked by unrelated background tasks after a response is already complete, and interrupted assistant replies are now marked done more reliably. Commit, #23264
📌 Per-user note pinning behavior. Pinned notes are now tracked per user instead of with a shared note-level flag, so one person’s pin changes no longer affect everyone else. Commit
🧱 Custom header value coercion. Custom header values are now converted to text before requests are sent, preventing request failures when non-text values are configured. Commit, #24164
🔗 HTTP share link copy fallback. Copy Link now works reliably on HTTP deployments by using a selection-based fallback when secure clipboard APIs are unavailable. Commit, #24135
🧵 Regeneration loading lock recovery. Chats no longer get stuck in a permanent loading state after failed regenerations because invalid message-tree references are repaired before rendering. Commit, #24424
📸 Complete chat image capture. Downloaded chat snapshots now include all messages more reliably through visibility overrides and layout timing improvements during capture. Commit, Commit, #24088
🗓️ Calendar deletion lock handling. Calendar deletion now avoids SQLite write-lock contention by revoking calendar access grants in a separate transaction after calendar and event removal. Commit
🧩 Filter and internal tool coexistence. Internal tools now remain available when filters add provider-native tools, so filter-added tools no longer replace the built-in tool set during request processing. Commit, #24237
🛠️ OpenAPI tool spec compatibility. OpenAPI tool integrations now handle null or non-operation path entries more safely and parse path-level parameters consistently, preventing crashes and improving tool execution reliability across imperfect OpenAPI specs. Commit, Commit, #24376
🧰 OpenAPI tool schema parsing. OpenAPI tool imports now ignore non-method path item fields and correctly resolve nested composition schemas, preventing invalid tool parsing for compatible specs. Commit, #23254
🌍 Web search proxy compatibility. DuckDuckGo search now respects configured proxy environments more reliably, and trust-env behavior defaults to enabled so proxied web loading does not fail unexpectedly. Commit, #23810
🧾 Final markdown render flush. Streaming markdown now forces an immediate final parse when generation completes, preventing stale or partially rendered final output. Commit, #24088
🛡️ Webhook avatar URL validation. Channel webhook profile image URLs are now validated before saving, preventing invalid or unsafe avatar URLs from being accepted. #24370
📝 System prompt editor scroll stability. Editing large system prompts no longer jumps the page back to the top, so you can continue editing long model prompts without losing your place. Commit, #23999
🔎 Knowledge content search matching. Knowledge file search now matches both file titles and file content, so relevant files are easier to find even when the keyword is not in the filename. Commit, #24297
⚡ Faster prompt tag loading. Prompt tag filters now load much faster for non-admin users by fetching only accessible tags directly, avoiding per-prompt permission checks and unnecessary prompt data loading. #24287, #24258
🧾 Citation overflow badge readability. Citation overflow badges now keep multi-digit counts readable in a single compact bubble, preventing wrapped or cramped display when many sources are attached. Commit, #24391
🌐 Yandex result parsing guard. Yandex web search no longer fails when some XML fields are missing in individual results, so valid search responses continue to return usable sources instead of dropping to no results. Commit, #24243
🎧 Safer voice transcription uploads. Empty or failed voice conversions are now rejected with a clear error instead of continuing as malformed audio, reducing failed transcription attempts from corrupted or near-empty recordings. Commit
🎚️ Safer chunked STT processing. Chunked transcription now limits worker concurrency when no external STT engine is configured, reducing failed transcription behavior caused by overly parallel local processing. Commit
📈 Imported chat analytics coverage. Imported ChatGPT conversations now carry proper model and timestamp metadata and reliably write imported messages into analytics-backed storage, so imported chats are reflected correctly in Admin Analytics totals and model usage views. Commit, #24263
📎 Knowledge collection persistence. Knowledge collections selected with the chat input selector now remain attached after reloads and chat switches, so attached context no longer disappears between sessions. Commit, #24142
🧹 Embedding model name trimming. Embedding model names entered in Documents settings now automatically trim surrounding whitespace, preventing silent embedding failures caused by accidental trailing spaces. Commit, #24090
🔊 PCM TTS playback compatibility. Text-to-speech audio returned as PCM is now converted to MP3 before delivery, so speech playback works correctly with providers that return raw PCM audio. Commit, #24143
🪟 Windows PostgreSQL startup compatibility. Windows pip installs using PostgreSQL now start reliably with psycopg async by using a compatible event loop policy instead of the default Proactor loop. Commit, #24152
⏱️ MCP OAuth timeout control. OAuth token exchanges for MCP tool server connections now respect the configurable client timeout setting, reducing callback failures with slower providers. Commit, #24138
📄 PDF text search restoration. PDF previews now include a proper text layer so browser text selection and find-in-page search work again instead of rendering only image-like pages. Commit, #24149
🔑 Android password autofill support. Password inputs now expose the expected field name metadata, improving password manager autofill reliability on Android login pages. Commit, #24137
🎤 Non-blocking STT processing. Speech-to-text transcription no longer blocks the server event loop during both live transcription and uploaded audio file processing, so other users can continue using chats and live connections under concurrent load. #24338, #24379, #24169
🌐 SearXNG language parameter handling. Web searches now send clean multi-language values without trailing separators, so SearXNG requests no longer fail when multiple languages are selected. Commit, #24198
📂 File modal open-link behavior. Clicking a file name in the file details modal now opens the correct file content in a new tab for uploaded file items instead of failing to open. #24125
📎 Chat attachment display recovery. Files attached by chat tools now appear reliably in assistant responses, including non-image file attachments that were previously hidden. Commit, #24332
🧱 Channel embed rendering guard. Channel message embeds now appear only for model-generated messages and are suppressed in reply previews, preventing unintended embed expansion in regular user posts. Commit
🛡️ Safer image URL handling. Untrusted external image URLs are now blocked in profile and rich-text image rendering paths, preventing unintended client-side requests to attacker-controlled domains. #24420
🛡️ Sanitized spreadsheet HTML previews. Spreadsheet previews now sanitize generated HTML before rendering, reducing the risk of unsafe content being executed when opening office files in chat and file modals. #24468
🧰 Multi-worker tool update consistency. Updated tool code now refreshes correctly across workers without requiring a full service restart, so chats no longer run stale tool versions after edits. Commit, #24400, #24433
🧩 Default model metadata env parsing. The "DEFAULT_MODEL_METADATA" environment setting is now parsed and applied correctly, including when persistent config is disabled, so configured model capability defaults are no longer ignored at startup. Commit, #24319
🔄 Config import and Redis consistency. Imported settings now remain effective after import because configuration values are immediately synchronized to Redis, preventing stale cached values from overriding imported permissions and settings. Commit, Commit, #24346
🔔 LDAP signup webhook parity. New accounts created through LDAP now trigger the same signup webhook notifications as password and OAuth signups, so downstream provisioning and audit automations receive consistent events. Commit, #24377
🦆 DDGS auto-backend compatibility. Web search now handles DDGS automatic backend selection correctly and safely falls back on empty or rate-limited responses, preventing search failures in newer DDGS versions. Commit, #24188
🤖 Automation update tool reliability. Updating existing automations in chat now works correctly instead of failing with a missing method error. Commit, #24405
📅 Calendar event permission checks. Calendar event update and delete actions now handle ownership and access checks more reliably, returning clean access-denied results when appropriate. Commit
🛡️ Safer cached file delivery. Cached files that are not recognized as image, audio, or video now download as attachments instead of rendering inline, reducing the risk of unsafe browser content handling. Commit
📊 Streaming token analytics accuracy. Admin Analytics now records and aggregates token usage correctly for streaming chats across Responses API and OpenAI-compatible providers, including fallback handling for provider usage formats that use prompt and completion token keys. Commit, Commit, #24217, #24294, #24241
🔗 Admin shared chat links. Admin users can now open and clone shared chat links reliably without 401 errors because shared links are now resolved by share ID first, with safe fallback behavior for direct chat ID access. Commit, #24311, #24096
💾 Chat settings persistence. System prompts and other chat-level settings now persist correctly after creating a new chat and reloading, preventing prompt loss in affected conversations. Commit, #24193, #24270
💾 Chat control autosave persistence. Changes to chat controls like system prompt, parameters, and attached files are now autosaved on existing chats, so edits are no longer lost when you refresh or navigate away before sending a message. Commit, #23897
☁️ OneDrive option visibility. OneDrive personal and business upload options now appear only when their respective client IDs are configured, preventing unavailable options from showing in attachment menus. Commit, #24411
🧠 Reasoning content leakage prevention. Tool-call round-trip messages no longer wrap reasoning text in <think> tags inside the content field, preventing raw markup from leaking into chat output for models whose templates don't strip think tags (e.g. Gemma 4). #23844
🖥️ Terminal sidebar auto-open guard. The terminal sidebar no longer auto-opens on chat load when OpenTerminal is disabled, because stale terminal IDs saved on models or in localStorage are now validated against available terminal servers before use.
🔁 Single-confirmation connection deletion. Deleting OpenAI, Ollama, tool server, and terminal server connections now shows exactly one confirmation dialog instead of two, because redundant outer confirmation wrappers were removed from all connection components.
🧵 Reliable background task cleanup. The chat task lifecycle now deregisters completed tasks before checking for remaining siblings, eliminating the off-by-one timing issue that could leave the stop button stuck or dismiss the sidebar activity spinner too early.

Changed

⚠️ Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.
🚪 Signout request method. The signout endpoint now requires POST instead of GET, so custom clients and integrations must update logout calls accordingly. #24420

Open source →

0.9.224 Apr 2026Security3 sources agree

🔑 Brotli dependency update. Brotli has been updated to address CVE-2025-6176 .

Added

🧠 PaddleOCR-vl document extraction. Administrators can now use PaddleOCR-vl as a content extraction engine for document processing, with configurable API URL and token settings in document retrieval configuration. #23945
🔥 Firecrawl v2 API. Firecrawl web loading now uses the v2 API directly with proper retry logic, exponential backoff on rate limits, and configurable timeout handling, improving reliability for both cloud and self-hosted Firecrawl setups. #23934
⏰ Calendar event reminder customization. Calendar events now support a configurable reminder_minutes parameter, allowing models to set custom reminder durations instead of the default 10-minute notification.
🔑 Custom API key header. Administrators can now configure a custom header name for API key authentication via the CUSTOM_API_KEY_HEADER environment variable, enabling compatibility with reverse proxies that use the Authorization header for their own authentication.
🔌 OAuth session disconnection. Users can now disconnect OAuth sessions for specific providers (e.g., MCP connections) through a new API endpoint, enabling cleaner re-authentication workflows.
📚 Source overflow indicator. The Sources button now shows a +N badge when more than three sources are available, so hidden sources are clearly indicated in chat responses. #23918
⚡ Model list performance. Model list API responses now strip base64 profile image data from paginated results, and model tags are fetched via a dedicated efficient query instead of loading all models. This significantly reduces payload sizes and improves workspace Models page responsiveness.
⚡ Model avatar cache reuse. Default model profile images now redirect to a shared static path instead of reading files from disk per-request, reducing repeated I/O and improving loading efficiency when multiple models use the fallback icon. #24015
🚀 Faster splash image loading. Splash screen images are now prioritized earlier during page load with preload links, improving first-load LCP behavior and reducing delayed image discovery. #24011
🧵 Streaming markdown performance stability. Streaming responses now stay more memory-efficient by preventing repeated cleanup callback registration during markdown updates. #24048
📊 Telemetry gauge reliability. OpenTelemetry user gauge callbacks now use synchronous database queries directly, eliminating cross-thread async bridging issues that could cause silent failures in metric collection.
🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
🌐 Translation updates. Translations for Finnish, Korean, Portuguese (Brazil), and Dutch were enhanced and expanded.

Fixed

🔧 MCP task cancellation stability. Interrupted MCP tool calls no longer cause CPU spikes or runaway cleanup behavior. MCP client disconnection now runs in the same asyncio task as connection, respecting cancel scope constraints, and chat-active events are properly shielded during cancellation.
🧠 Persistent chat skill injection. Skills mentioned in persisted chats now inject into the system prompt reliably. Skill ID extraction from <$skillId|label> message tags is now handled server-side, and tags are stripped before messages reach the model.
🗄️ Async database driver migration. The async database backend now uses psycopg (v3) instead of asyncpg, eliminating brittle SSL parameter translation and supporting native libpq connection strings including sslmode, options, and target_session_attrs without any stripping or conversion.
🐳 Docker ARM64 reliability. Docker images built for arm64 via QEMU cross-compilation no longer produce 0-byte corrupted Python dependencies. UV_LINK_MODE=copy is now set in the Dockerfile to force reliable file installation.
🛠️ Throttle request handling. Request handling no longer fails when user activity status updates are throttled with a non-zero interval. #23979
✍️ Rich text extension conflicts. Rich text editing no longer triggers duplicate extension conflicts for lists and code blocks, improving editor stability. #24009
🔇 Fetch URL null content guard. The fetch_url built-in tool now safely handles None content returned by web loaders instead of crashing with a TypeError.
🌐 OAuth discovery fallback. OAuth protected resource discovery now falls back to well-known RFC 9728 URIs when the WWW-Authenticate header doesn't contain a resource_metadata link, improving compatibility with more MCP server implementations.
🔐 Session token resolution. Session user endpoints now gracefully handle missing Authorization headers by falling back to cookie and request state tokens, preventing errors when used behind forward-auth proxies.
🚫 Direct API error responses. Chat completion requests without a WebSocket channel (direct API calls) now return proper HTTP error responses instead of silently returning null on failure.
📡 Cancelled response stream cleanup. Cancelled chat generation now explicitly closes the upstream response body iterator, preventing orphaned async generators from spinning in anyio internals.
🔒 Model profile image path safety. Model profile image endpoints now validate and sanitize static asset redirect paths, preventing path traversal through encoded dots or malicious URL patterns.
📊 RAG template validation UI. The Documents settings page now displays a warning when RAG templates contain multiple [context] or {{CONTEXT}} placeholders, helping administrators avoid accidental redundant context injection.
🧩 Automation model detection. The create_automation tool now correctly detects the current model ID even when model_id is not yet set in metadata, falling back to the model dict.
🔄 MCP resource content handling. MCP tool results with the resource content type are now correctly detected and their resource.text payload is extracted, instead of being silently ignored.
🔄 Ollama and OpenAI metadata forwarding. Ollama and OpenAI proxy routes now forward request metadata to downstream handlers, ensuring consistent context propagation.
🧹 Browser-native message virtualization. The custom JavaScript-based message culling system (spacers, height caching, scroll listeners) was replaced with CSS content-visibility: auto, letting the browser natively skip rendering of off-screen messages without destroying component trees. This eliminates scroll jump artifacts and mount/destroy thrashing while preserving memory efficiency in long conversations.
📻 Redis notification compatibility. Redis pub/sub now handles missing or incompatible client_name support more gracefully, preventing connection errors with certain Redis configurations.

Changed

⚙️ psycopg v3 async driver. The async database driver has been migrated from asyncpg to psycopg (v3). This is a transparent change for most deployments, but custom connection strings with asyncpg-specific parameters may need adjustment.
🔑 Brotli dependency update. Brotli has been updated to address CVE-2025-6176.
🖥️ Windows startup script. The Windows startup batch script has been updated for improved compatibility.

Open source →