LibreChat Release Notes

Name: LibreChat
Brand: LibreChat

Follow LibreChat to add their release notes to your feed!

27 release notes curated from 28 sources by the Releasebot Team. Last updated: Jun 1, 2026

Get this feed:

May 31, 2026
Date parsed from source:
May 31, 2026

First seen by Releasebot:
Jun 1, 2026
LibreChat

LibreChat v0.8.6

LibreChat releases v0.8.6 with Agent Skills and subagents, richer artifact previews and editing, expanded observability and operational tooling, stronger MCP, auth, and admin hardening, plus new model and provider support for Claude, Gemini, and Bedrock.
The v0.8.6 release of LibreChat

What's Changed

🏞️ Highlights

Agent Skills & Subagents

Agent Skills package reusable instructions, references, scripts, assets, and permissions into portable capabilities that agents can invoke automatically or on request.

Subagents let agents delegate specialized work to other agents while preserving upload, user, and MCP context with recursion and graph limits.

Code Execution & Artifacts

Text, source-code, DOCX, CSV, XLSX, and PPTX artifacts can render inline or in the side panel with richer previews.

Artifact editing, Gemini PDF media blocks, model-spec icons, and persistent agent resource files received reliability fixes.

Observability & Operations

Added Prometheus metrics, backend OpenTelemetry tracing, SSE lifecycle tracing, HyperDX browser RUM, structured logging context, explicit readiness endpoints, file-log controls, and graceful HTTP shutdown.

MCP, Auth, and Admin Hardening

Improved MCP remote proxy support, OAuth audience handling, JWT expiry fallback, optional OpenID/MCP client-secret flows, multi-audience OpenID validation, trusted registration overrides, admin-panel SSO redirects, streamable HTTP limits, and MCP permission enforcement for agent tools.

Provider and Model Updates

Added Claude Opus 4.8 support, Gemini 3.5 Flash support, Gemini tool combinations, Gemma 4 thinking-level support, model-aware Google/Gemini max output tokens, Bedrock AWS profile/API key support, and Bedrock guardrail handling.

Reliability and UI Polish

Hardened retention semantics, user/config response sanitization, configured rich-text rendering, Redis/in-memory generation cleanup, all-data retention for agent files, MCP title rendering, sidebar/chat race handling, hover actions, shared links, generated file chips, and balance script config loading.

For detailed changes in the release candidate, see:

v0.8.6-rc1

Changes Since v0.8.6-rc1

✨ Features

🚧 feat: Support Guardrail Config Option streamProcessingMode by @dlew in #12815

📈 feat: Add Prometheus Metrics Endpoint + AWS Credential Providers by @danny-avila in #13111

🧾 feat: Add Structured Logging Context by @danny-avila in #13110

🛡️ feat: Bedrock Guardrail Config Environment Variable Resolution by @entropic489 in #11717

📡 feat: Add Backend OpenTelemetry Tracing by @danny-avila in #12909

🏷️ feat: Hide Model Spec Badge Rows by @danny-avila in #13124

👟 feat: Enable Eager Execution of Tool Calls by @danny-avila in #13192

🍪 feat: Add Session Cookie Secure Override by @danny-avila in #13189

🪂 feat: Graceful HTTP shutdown on SIGTERM/SIGINT by @pjhampton in #13211

🩺 feat: Add Explicit Readiness Endpoints by @danny-avila in #13212

🗂️ feat: Allow Disabling File Log Transports by @danny-avila in #13215

⚡ feat: Add Gemini 3.5 Flash Support by @danny-avila in #13231

🛣️ feat: Add MCP Remote Proxy Support by @danny-avila in #13076

⚖️ feat: Add Operational Prometheus Metrics by @danny-avila in #13265

🖲️ feat: Trace SSE Stream Lifecycle with OTel by @upman in #13266

📜 feat: Add Explicit new Skill Route from Agent Builder by @sand116 in #13119

🆔 feat: Built-in Build Metadata for Support Triage by @danny-avila in #12756

🛂 feat: Add AWS Profile Support for Bedrock Credentials by @iElsha in #10504

🪙 feat: Add AWS Bedrock API key support by @dustinhealy in #8690

🛰️ feat: Support Gemini Tool Combinations by @danny-avila in #13273

🧠 feat: Add Claude Opus 4.8 Support by @danny-avila in #13380

♊ feat: Model-Aware Max Output Tokens for Google/Gemini by @danny-avila in #13390

📡 feat: Add Configurable HyperDX Browser Real User Monitoring by @upman in #13287

🪪 feat: Accept Multiple OpenID JWT Audiences by @danny-avila in #13404

🪪 feat: MCP OAuth - Support audience parameter for Auth0/Cognito-style providers by @Freudator86 in #13402

💠 feat: Extend thinkingLevel Support to Gemma 4 Models by @King-of-Infinite-Space in #13088

🐛 Fixes

🧰 fix: Scope MCP Registry Initialization To Config Fingerprints by @danny-avila in #13115

🧹 fix: Reset Redis Reorder State After Last Unsubscribe by @sand116 in #13117

🏷️ fix: Harden Helm Chart Tag Parsing by @danny-avila in #13123

🛡️ fix: Sanitize Agent List Skill Scope by @danny-avila in #13122

🗝️ fix: Protect Model Spec Instructions by @danny-avila in #13125

🪵 fix: Restore Winston Format Factory Shape In Test Mocks by @JorgeCosta87 in #13139

🛡️ fix: Escape People Picker Search Regex by @danny-avila in #13169

🤝 fix: Honor OPENID_REUSE_TOKENS in Admin OAuth Exchange by @jangByeongHui in #13154

🪪 fix: Resolve Group-Scoped Config Overrides by @danny-avila in #13176

🧽 fix: Strip Admin OAuth Redirect Params by @danny-avila in #13181

🔍 fix: Prefer LibreChat Web Search over Anthropic's when Both Selected by @danny-avila in #13166

🗂️ fix: Scope Handoff Agent Context Docs by @danny-avila in #13167

🪪 fix: Scope Message Conversation Access by @danny-avila in #13183

🧭 fix: Reduce MCP Registry ACL Lookups by @danny-avila in #13195

⛴️ fix: Stop Double-Wrapping configYamlContent in Helm ConfigMap by @vdittgen in #13198

📡 fix: Handle Pre-Session 406 for Optional SSE MCP Stream by @pnancarrow in #13202

🧯 fix: Harden Data Retention Semantics by @danny-avila in #13049

🪪 fix: Add Admin Panel SSO URL Config by @danny-avila in #13220

🦣 fix: Response Size Limits for Streamable HTTP MCP Responses by @danny-avila in #13219

🏃 fix: Improve OpenID Lookup Planning by @danny-avila in #13229

🧩 fix: Support DocumentDB Prompt Group Lookup by @danny-avila in #13232

📡 fix: Respect Custom Endpoint Stream Usage Opt-In by @danny-avila in #13237

🍞 fix: don't show 'deleting file' toast on attached files by @dlew in #13239

🧵 fix: Preserve Streaming Messages During Stale Refetch by @danny-avila in #13247

🛡️ fix: Harden MCP OAuth Request Handling by @danny-avila in #13264

🪪 fix: Consolidate MCP OAuth Policy by @danny-avila in #13254

🪪 fix: Prevent MCP Server Name Collisions by @danny-avila in #13256

⌛ fix: Use JWT exp claim for MCP when OAuth token omits expires_in by @devanchohan in #13248

🪪 fix: Support OpenID PKCE Without Client Secret by @eleite93 in #12364

🪪 fix: Allow Optional client_secret for MCP OAuth by @aupuzikov in #12460

🛂 fix: Detect OAuth Errors From HTTP 400 Responses by @janluedemann-esome in #11961

🪬 fix: Skip MCP Tools When Required Custom User Vars Are Unset by @verifizieren in #13152

🪨 fix: Normalize Empty MCP Tool Descriptions to undefined for Bedrock Compat. by @serhiizghama in #13217

📡 fix: Tighten Streaming Message Cache Preservation by @danny-avila in #13271

🧷 fix: Harden MCP Proxy SSRF Checks by @danny-avila in #13274

🧱 fix: Validate Bedrock User Credentials by @danny-avila in #13277

🧷 fix: Pin MCP OAuth Client Secrets by @danny-avila in #13276

🏣 fix: Reject System Tenant In Auth Context by @danny-avila in #13278

🧾 fix: Validate Bedrock User Credentials by @danny-avila in #13279

🪟 fix: Apply Admin-Panel Config Overrides To YAML-Defined MCP Servers by @dustinhealy in #13173

🪡 fix: Prevent Hover Actions Flash While Streaming by @danny-avila in #13285

🧩 fix: Add REDIS_CLUSTER_SAFE_DELETE Flag for ElastiCache Serverless CROSSSLOT Errors by @serhiizghama in #13275

🧵 fix: Prevent Message Loading Race During Streaming by @danny-avila in #13295

⏭️ fix: Avoid False Resume Submission Stale Detection by @danny-avila in #13297

🧯 fix: Suppress Google Service Key Noise by @danny-avila in #13322

✂️ fix: Truncate Long MCP Server Titles In Builder Panel by @dustinhealy in #13321

📎 fix: Preserve Gemini PDF Media Blocks by @danny-avila in #13357

🛡️ fix: Harden Model Spec Icon Rendering by @danny-avila in #13356

🪡 fix: Artifact Edit Saves by @danny-avila in #13358

🛡️ fix: Cap Default Limit on Agent List Queries by @danny-avila in #13382

🪨 fix: Preserve Bedrock Guardrail Config by @danny-avila in #13381

⚓ fix: Skip Retention for Persistent Agent Resource Files by @maxesse in #13394

🧟 fix: Reap Hung In-Memory Generations for Redis Failsafe Parity by @danny-avila in #13396

🪃 fix: Retry MCP OAuth Token Refresh Without Scope on Server Rejection by @danny-avila in #13412

🖼️ fix: Preserve Model Spec Icon URLs by @danny-avila in #13370

🔑 fix: support 'userinfo' in OPENID_REQUIRED_ROLE_TOKEN_KIND by @pboers1988 in #13182

🪪 fix: Preserve Trusted Registration Provider Overrides by @danny-avila in #13307

💰 fix: Load app config in set-balance script to respect balance settings by @ucodia in #12669

📬 fix: Honor Admin-Panel allowedDomains Override at Registration by @nangelovv in #13204

🔒 fix: Strip post-login fields from unauthenticated /api/config response by @ChrisJr404 in #13102

🏟️ fix: Restrict MCP OAuth Audience in User-Managed Configs by @danny-avila in #13418

🛂 fix: Enforce MCP Permissions for Agent Tools by @danny-avila in #13174

🧼 fix: Sanitize User Response Fields by @danny-avila in #13421

🧼 fix: Harden Configured Rich Text Rendering by @danny-avila in #13423

🪪 fix: Use Shared IdP Avatar Processing by @danny-avila in #13422

🔧 Refactoring

📸 refactor: Refresh Shared Links With Latest Snapshot by @danny-avila in #13095

🗂️ refactor: Collapse Generated File Chips by @danny-avila in #13116

🛟 refactor: Gracefully Skip Unavailable Web Search Rerankers by @danny-avila in #13191

🗂️ refactor: Clarify Code Sandbox File Guidance by @danny-avila in #13236

🧬 refactor: Derive Latest Message From Cache by @danny-avila in #13294

⏱️ refactor: Optimistically Show New Chats In Sidebar by @danny-avila in #13298

🧠 refactor: Replay DeepSeek reasoning_content via OpenRouter by @danny-avila in #13368

📤 refactor: Align Mention Options With Model Selector by @danny-avila in #13397

🧠 refactor: Memoize MCP Permission Checks Per Request by @danny-avila in #13419

🗄️ refactor: Honor All-Data Retention for Agent Files by @danny-avila in #13424

🧪 Tests

🛟 test: Restore Playwright Smoke E2E by @danny-avila in #13020

📦 Dependencies, Chores & CI

🧹 chore: Type Agent MCP lean projection in ServerConfigsDB by @gaurav0107 in #13171

🛡️ chore: Harden CI Supply Chain Workflows by @danny-avila in #13090

🕵🏻 ci: Improve Flaky Subagents Test by @dustinhealy in #13185

📦 chore: npm audit fix, bump otel & @librechat/agents by @danny-avila in #13186

📦 chore: Bump @librechat/agents to v3.1.88 by @danny-avila in #13187

🧪 ci: Stabilize Virtualized Agent Grid Tests by @danny-avila in #13214

🧵 chore: Raise MCP SSE Line Default by @danny-avila in #13224

📦 chore: bump @librechat/agents, qs, langfuse by @danny-avila in #13299

🐢 ci: Raise test-packages-api timeout to 20 min by @danny-avila in #13326

🧮 chore: Update Gemma Context Token Defaults by @danny-avila in #13410

✂️ chore: Strip Session JWT Forwarding from Browser RUM by @danny-avila in #13414

📦 chore: Bump @hyperdx/browser to v0.24.0 by @danny-avila in #13416

🔧 chore: Drop duplicate getAppConfig import in set-balance.js by @danny-avila in #13417

🌍 Internationalization

🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #13107

🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #13128

🌍 i18n: Update translation.json with latest translations by @danny-avila in #13230

🌍 i18n: Update translation.json with latest translations by @danny-avila in #13283

🌍 i18n: Update translation.json with latest translations by @danny-avila in #13291

🌍 i18n: Update translation.json with latest translations by @danny-avila in #13325

New Contributors

@entropic489 made their first contribution in #11717

@sand116 made their first contribution in #13117

@JorgeCosta87 made their first contribution in #13139

@jangByeongHui made their first contribution in #13154

@pjhampton made their first contribution in #13211

@devanchohan made their first contribution in #13248

@eleite93 made their first contribution in #12364

@aupuzikov made their first contribution in #12460

@janluedemann-esome made their first contribution in #11961

@verifizieren made their first contribution in #13152

@serhiizghama made their first contribution in #13217

@iElsha made their first contribution in #10504

@Freudator86 made their first contribution in #13402

@pboers1988 made their first contribution in #13182

@King-of-Infinite-Space made their first contribution in #13088

@nangelovv made their first contribution in #13204

@ChrisJr404 made their first contribution in #13102

Full Changelog: https://github.com/danny-avila/LibreChat/compare/v0.8.6-rc1...v0.8.6
Original source
May 25, 2026
Date parsed from source:
May 25, 2026

First seen by Releasebot:
Jun 1, 2026
LibreChat

Config v1.3.12

LibreChat adds retention mode controls, per-server MCP proxy support, and model spec UI options.
Added interface.retentionMode

"temporary" keeps retention limited to temporary chats

"all" applies configured retention to all supported retained data, including persistent agent resource files

Added mcpServers..proxy

Allows sse and streamable-http MCP servers to use a per-server outbound proxy

Supports http://, https://, socks://, and socks5:// proxy URLs

Added modelSpecs.list[].hideBadgeRow

Allows a model spec to hide the tool badge row in the chat composer

Original source
All of your release notes in one feed

Join Releasebot and get updates from LibreChat and hundreds of other software products.

Create account
Get updates with:
Apr 9, 2026
Date parsed from source:
Apr 9, 2026

First seen by Releasebot:
Jun 1, 2026
LibreChat

🚀 LibreChat v0.8.5-rc1

LibreChat releases v0.8.5-rc1 with a new admin panel foundation, context compaction for long chats, a redesigned sidebar and tool call UI, refreshed prompts, and pinned model specs for quicker access, alongside broad performance, MCP, and security improvements.
The v0.8.5-rc1 release of LibreChat

What's Changed

🏞️ Highlights

Admin Panel Foundation

Per-principal (Roles & Groups) configuration overrides, Custom Roles & Groups, System Grants for admin-level access control

Admin panel, available for testing here

Context Compaction/Summarization

Long-running agent conversations are automatically summarized to stay within context limits. Includes configurable triggers, context pruning of large tool results, and a new top-level summarization config. See Config v1.3.8.

UI Redesign

Redesigned sidebar with unified icon strip layout, including all panels (agent builder, prompts, etc.)

Overhauled tool call UI with grouping/richer output rendering

Refreshed Prompts UI

Performance & MCP Improvements

Pinned Model Specs: Users can now pin favorite model specs for quick access.

✨ Features

🧩 Redesign Tool Call UI with Contextual Icons, Smart Grouping, and Rich Output Rendering by @berry-13 in #12163

🎛️ DB-Backed Per-Principal Configuration Override System by @danny-avila in #12354

🧵 ALS Context Middleware and Config Cache Invalidation by @danny-avila in #12407

👥 Admin Groups API Endpoints by @dustinhealy in #12387

🪪 Admin Roles API Endpoints by @dustinhealy in #12400

🏢 Scoped App Config in Auth Login Flows by @danny-avila in #12434

🏗️ 3-Tier MCP Server Architecture with Config-Source Lazy Init by @danny-avila in #12435

🏗️ bulkWrite Isolation, Pre-Auth Context, Strict-Mode Fixes by @danny-avila in #12445

⛩️ Admin Grants API Endpoints by @dustinhealy in #12438

📄 Model-Aware Bedrock Document Size Validation by @danny-avila in #12467

🔐 Admin Auth Support for SAML and Social OAuth Providers by @danny-avila in #12472

👨‍👨‍👦‍👦 Admin Users API Endpoints by @dustinhealy in #12446

📌 Add Pin Support for Model Specs by @berry-13 in #11219

🐛 Fixes

🔑 Type-Safe User Context Forwarding for Non-OAuth Tool Discovery by @crossagent in #12348

🐛 Resolve MeiliSearch Startup Sync Failure from Model Loading Order by @adityaarunsinghal in #12397

🗝️ Resolve User-Provided API Key in Agents API Flow by @ESJavadex in #12390

📸 Snapshot Options to Prevent Mid-Await Client Disposal Crash by @danny-avila in #12398

🏁 Invalidate Message Cache on Stream 404 Instead of Showing Error by @danny-avila in #12411

🔑 Robust MCP OAuth Detection in Tool-Call Flow by @danny-avila in #12418

🪝 Safe Hook Fallbacks for Tool-Call Components in Search Route by @danny-avila in #12423

🛡️ Add Origin Binding to Admin OAuth Exchange Codes by @danny-avila in #12469

💰 Lazy-Initialize Balance Record at Check Time for Admin Panel Overrides by @danny-avila in #12474

🖼️ Message Icon Flickering from Context-Triggered Re-renders by @danny-avila in #12489

🛡️ Restrict System Grants to Role Principals by @dustinhealy in #12491

🗂️ Allow Empty-Overrides Scope Creation in Admin Config by @danny-avila in #12492

🔏 Strip Unnecessary Fields Across Write Paths in Conversation & Message Methods by @danny-avila in #12498

🔒 Exclude Unnecessary Fields from Conversation $unset by @danny-avila in #12501

🔑 Auth-Aware Startup Config Caching for Fresh Sessions by @danny-avila in #12505

🔁 Pass recursionLimit to OpenAI-Compatible Agents API Endpoint by @danny-avila in #12510

🏖️ Sandpack ExternalResources for Static HTML Artifact Previews by @danny-avila in #12509

🎯 MCP Tool Misclassification from Action Delimiter Collision by @danny-avila in #12512

📎 Route Unrecognized File Types via supportedMimeTypes Config by @danny-avila in #12508

🪆 Allow Nested addParams in Config Schema by @danny-avila in #12526

🔐 Strip code_challenge from Admin OAuth Requests Before Passport by @danny-avila in #12534

🔍 Only Show Searchbar if Enabled by @dlew in #12424

🔨 Custom Role Permissions by @dustinhealy in #12528

📝 Properly Restore Draft Text When Switching Conversations by @dlew in #12384

🗣️ Prevent @librechat/client useLocalize from Overwriting Host App Language State by @shtayeb in #12515

🔎 Specify Explicit Primary Key for Meilisearch Document Operations by @danny-avila in #12542

♻️ Reuse Existing MCP OAuth Client Registrations to Prevent client_id Mismatch by @DenisPalnitsky in #11925

🚫 Hide Delete Account Button When ALLOW_ACCOUNT_DELETION Is Disabled by @danny-avila in #12568

🎯 Use Resolved Provider for Agent Token Lookup on Custom Endpoints by @danny-avila in #12574

🔐 Add Middleware to Admin OAuth Callback Routes by @dustinhealy in #12579

🧬 Merge Custom Endpoints by Name Instead of Replacing Entire Array by @danny-avila in #12586

🧮 Atomize Redis Event Sequence Counters for Multi-Replica Deployments by @danny-avila in #12578

📂 Enable Hidden File Upload for GitNexus Index Artifact by @danny-avila in #12597

📂 Respect supportedMimeTypes Config in File Picker Accept Filter by @danny-avila in #12596

📩 Restore Primary Action Button Visibility in Light Mode by @UnicronBE in #12591

🔧 Refactoring

🎨 Redesign Sidebar with Unified Icon Strip Layout by @berry-13 in #12013

🔄 Migrate to react-resizable-panels v4 with Artifacts Header Polish by @danny-avila in #12356

📁 Prompts UI by @berry-13 in #11570

📐 Resolve Stale Active Sidebar Panel and Favorites Row Height by @danny-avila in #12366

⚡ Fast-Fail MCP Tool Discovery on 401 for Non-OAuth Servers by @danny-avila in #12395

⚡ Use In-Memory Cache for App MCP Configs to Avoid Redis SCAN by @danny-avila in #12410

🌊 Local Snapshot for Aggregate Key Cache to Avoid Redundant Redis GETs by @danny-avila in #12422

🪢 Eliminate Unnecessary Re-renders During Message Streaming by @danny-avila in #12454

🧹 Tighten Config Schema Typing and Remove Deprecated Fields by @danny-avila in #12452

🏗️ Remove Redundant Caching, Migrate Config Services to TypeScript by @danny-avila in #12466

🚫 Remove Interface Config from Override Processing by @danny-avila in #12473

⚖️ Split Config Route into Unauthenticated and Authenticated Paths by @danny-avila in #12490

🗜️ Eliminate Unstable React Keys During SSE Lifecycle by @danny-avila in #12536

⚡ Short-Circuit Config Override Resolution by @danny-avila in #12553

🧑‍🎨 Prompts/Sidebar Styles for Improved UI Consistency by @berry-13 in #12426

⏱️ User Job Tracking TTL and Proactive Cleanup to Redis Job Store by @danny-avila in #12595

⚙️ Other Changes

📬 Add Forwarded Headers to Nginx SSL Proxy Template by @christopher-b in #12379

📝 Add UTM Tracking Parameters to Railway Deployment Links by @berry-13 in #12228

📝 Update Deployment Link for Railway in README and README.zh.md by @berry-13 in #12449

🔬 Add TypeScript Type Checks to Backend Workflow and Fix All Type Errors by @danny-avila in #12451

🧹 Remove Deprecated Gemini 2.0 Models & Fix Mistral-Large-3 Context Window by @danny-avila in #12453

🧹 Clean Up Config Fields by @danny-avila in #12537

🗒️ Update LICENSE.md Year: 2025 -> 2026 by @neuralnotesyt-netizen in #12554

📊 Add GitNexus CI/CD and Deployment Configuration by @danny-avila in #12577

🔒 Bump MongoDB from 8.0.17 to 8.0.20 in Docker Compose Files by @danny-avila in #12399

📦 Bump Dependabot Packages by @danny-avila in #12487

📦 Bump axios to exact v1.13.6, @librechat/agents to v3.1.63, @aws-sdk/client-bedrock-runtime to v3.1013.0 by @danny-avila in #12488

📦 Bump mongodb-memory-server to v11.0.1, mermaid to v11.14.0, npm audit by @danny-avila in #12543

📦 npm audit by @danny-avila in #12570

📦 Bump nodemailer to v8.0.5 by @danny-avila in #12587

📦 Bump axios, @librechat/agents by @danny-avila in #12598

🌍 Internationalization

🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #12458, #12571, #12583, #12588

New Contributors

@crossagent made their first contribution in #12348

@christopher-b made their first contribution in #12379

@adityaarunsinghal made their first contribution in #12397

@ESJavadex made their first contribution in #12390

@neuralnotesyt-netizen made their first contribution in #12554

@UnicronBE made their first contribution in #12591

Full Changelog: https://github.com/danny-avila/LibreChat/compare/v0.8.4...v0.8.5-rc1
Original source
Apr 8, 2026
Date parsed from source:
Apr 8, 2026

First seen by Releasebot:
Jun 1, 2026
LibreChat

⚙️ Config v1.3.8

LibreChat adds centralized top-level summarization, with global triggers, context pruning, model settings, and inline SummaryContentPart support. It also tightens configuration validation, removes obsolete fields, and narrows endpoint, MCP, and storage options.
Added top-level summarization configuration

New centralized summarization replaces the per-endpoint summarize and summaryModel fields

Configure summarization triggers, context pruning, and model settings globally

Supports SummaryContentPart for inline conversation summaries

Added maxToolResultChars to shared endpoint settings

Limits the maximum character count of tool call results sent to the model

Available on all endpoints including via the all key

Removed endpointsMenu and sidePanel from interface configuration

These fields are no longer configurable via librechat.yaml due to recent UI improvements

Removed no-op fields

summarize, summaryModel, and customOrder removed from custom endpoint configuration

plugins, summarize, summaryModel, and customOrder removed from Azure OpenAI configuration

Use the new top-level summarization configuration instead

Tightened type validation across configuration schemas

titleMessageRole on custom endpoints now restricted to "system", "user", or "assistant"

headers values on custom and assistants endpoints now must be strings

additionalHeaders values on Azure OpenAI groups now must be strings

addParams uses recursive validation with web_search boolean support

paramDefinitions now uses a fully typed schema

engineSTT restricted to "openai" or "azureOpenAI"

engineTTS restricted to "openai", "azureOpenAI", "elevenlabs", or "localai"

playbackRate now validated with range 0.25–4.0

scraperTimeout and firecrawlOptions.timeout now require non-negative integers

memory.model_parameters values restricted to string, number, or boolean

Tightened MCP server configuration validation

timeout and initTimeout now require non-negative integers

sseReadTimeout now requires a positive integer

stderr now validated as "pipe", "ignore", "inherit", or a non-negative integer file descriptor

Connection type fields now have explicit defaults ("stdio", "sse", "websocket")

endpoints.all no longer accepts baseURL

The all key now uses a narrowed schema that omits baseURL

endpoints.agents no longer accepts baseURL

Updated fileStrategy and fileStrategies to use a narrowed storage-only enum

Valid values: "local", "firebase", "s3", "azure_blob"

Original source
Mar 9, 2026
Date parsed from source:
Mar 9, 2026

First seen by Releasebot:
Jun 1, 2026
LibreChat

⚙️ Config v1.3.6

LibreChat updates default model lists, adds OpenAI gpt-5.4 variants and gpt-5 vision support, removes deprecated Google models, improves model matching, and makes public shared links disabled by default for better security while fixing remoteAgents config responses.
Updated default model lists

Added gpt-5.4, gpt-5.4-thinking, and gpt-5.4-pro to OpenAI default models

Added gpt-5 to vision-capable models

Removed deprecated PaLM2/Codey models from Google default models

Improved model pattern matching to use longest-or-exact-key match, preventing cross-provider substring collisions

Changed ALLOW_SHARED_LINKS_PUBLIC default to false

Public shared links are now disabled by default for improved security

Set ALLOW_SHARED_LINKS_PUBLIC=true to restore previous behavior

Fixed remoteAgents field being omitted from config responses

The remoteAgents interface configuration is now correctly included in the startup config

Original source
Mar 4, 2026
Date parsed from source:
Mar 4, 2026

First seen by Releasebot:
Jun 1, 2026
LibreChat

⚙️ Config v1.3.5

LibreChat adds local OCR document parsing, Gemini thinking level and Bedrock reasoning controls, Bedrock document uploads, updated Google model defaults, refreshed date variables, and OpenRouter reasoning updates.
Added document_parser OCR strategy for local text extraction

Extracts text from PDF, DOCX, XLS/XLSX, and OpenDocument files without external OCR services

Uses pdfjs-dist, mammoth, and SheetJS locally — no API key needed

Runs automatically for agent file uploads even without any ocr configuration, and as a fallback when a configured OCR strategy fails

Can also be set explicitly via ocr.strategy: "document_parser" in your librechat.yaml

See OCR Configuration for details

Added thinkingLevel parameter for Gemini 3+ models

Controls the thinking effort level: "minimal", "low", "medium", or "high"

Exposed as a slider in the Google endpoint settings UI

Applies to Gemini 3+ models only (Gemini 2.5 models continue to use thinkingBudget)

Added reasoning_effort parameter for Bedrock models

Configures reasoning effort for supported Bedrock models (ZAI, MoonshotAI)

Options: "low", "medium", "high"

Exposed as a slider in Bedrock endpoint settings UI

See AWS Bedrock Configuration for details

Added Bedrock document upload support

Users can now upload documents (PDF, DOCX, etc.) when using Bedrock endpoints

Updated default model lists

Added gemini-3.1-pro-preview, gemini-3.1-pro-preview-customtools, gemini-3-pro-preview, and gemini-3-flash-preview to Google default models

Changed date template variable format

{{current_date}} now uses named weekday (e.g., 2026-03-04 (Monday)) instead of numeric index

{{current_datetime}} now includes timezone offset (e.g., 2026-03-04 14:30:00 -05:00 (Monday))

Updated OpenRouter reasoning configuration

Reasoning parameters are now sent as a unified reasoning object to match OpenRouter's updated API

Original source
Feb 18, 2026
Date parsed from source:
Feb 18, 2026

First seen by Releasebot:
Jun 1, 2026
LibreChat

⚙️ Config v1.3.4

LibreChat adds new interface controls for creating prompts, agents, and remote agents, expands Bedrock and Moonshot support, and introduces deferred_tools and programmatic_tools for agents. It also updates default models, removes deprecated settings, and adds new model spec options.
Added create field to interface.prompts and interface.agents configuration

Controls whether users can create new prompts/agents (default: true)

Complements existing use, share, and public permission fields

Boolean values still supported for backward compatibility

See Interface Configuration for details

Added interface.remoteAgents configuration for remote agent access control

Added use setting to enable/disable remote agent usage (default: false)

Added create setting to control whether users can create remote agents (default: false)

Added share setting to control whether users can share remote agents (default: false)

Added public setting to enable public sharing of remote agents (default: false)

See Interface Configuration for details

Added models and inferenceProfiles to endpoints.bedrock configuration

models : Specify custom model IDs available for Bedrock

inferenceProfiles : Map inference profile IDs to display names for cross-region inference

See AWS Bedrock Configuration for details

Added Moonshot as a known endpoint

New moonshot known endpoint for Moonshot AI integration with icon support

See Moonshot Configuration for details

Added deferred_tools and programmatic_tools agent capabilities

deferred_tools : Enables lazy/event-driven loading of MCP tools, reducing context window usage (enabled by default)

programmatic_tools : Enables programmatic tool calling for MCP tools via code execution sandbox (disabled by default, requires latest Code Interpreter API)

See Agents Configuration for details

Removed deprecated forcePrompt setting

Removed from Azure endpoint and custom endpoint configurations

Setting was deprecated and no longer functional

Updated default model lists

Added claude-sonnet-4-6 and claude-opus-4-6 to Anthropic and Bedrock default models

Added moonshotai.kimi and moonshotai.kimi-k2.5 to Bedrock default models

Added Bedrock parameter support for MoonshotAI, Z.AI, and OpenAI GPT-OSS models

Removed deprecated Claude models: claude-3-opus, claude-3-sonnet, claude-3-haiku, claude-2.x, claude-1.x, and claude-instant variants

Added artifacts field to modelSpecs list entries

Enables the Artifacts capability for a model spec

Set to true to enable with default mode, or a mode string (e.g., "default") for a specific mode

See Model Specs Configuration for details

Added effort parameter for Anthropic Adaptive Thinking in modelSpecs presets

Controls the thinking effort level for supported Anthropic models (e.g., Claude Opus 4.6)

Options: "low", "medium", "high", "max", or unset (model decides)

Supported by anthropic and bedrock (Anthropic models) endpoints

See Model Specs Configuration for details

Original source
Jan 28, 2026
Date parsed from source:
Jan 28, 2026

First seen by Releasebot:
Jun 1, 2026
LibreChat

⚙️ Config v1.3.3

LibreChat adds expanded configuration for prompts, agents, MCP servers, and Bedrock, with new sharing controls, stronger SSRF protection, guardrail support, richer model spec options, and default prompt caching for supported Claude and Nova models.
Restructured interface.prompts and interface.agents from boolean to object structure

Added use field to control whether users can use prompts/agents (default: true)

Added share field to control whether users can share prompts/agents (default: false)

Added public field to enable public sharing of prompts/agents (default: false)

Boolean values still supported for backward compatibility (treated as use setting)

See Interface Configuration for details

Added public field to interface.mcpServers configuration

Controls whether users can share MCP servers publicly (default: false)

See Interface Configuration for details

Enhanced SSRF protection for actions.allowedDomains and mcpSettings.allowedDomains

When not configured: SSRF targets are blocked by default, all other domains are allowed

When configured: Only listed domains are allowed

Blocked targets include: localhost, private IPs, link-local IPs, .internal /.local TLDs, and common service names

Supports protocol and port restrictions (e.g., 'https://api.example.com:8443')

See Actions Configuration and MCP Settings for details

Added guardrailConfig to endpoints.bedrock for AWS Bedrock Guardrails support

Configure guardrailIdentifier with your guardrail ID

Set guardrailVersion to specify the version

Optional trace field for debugging ("enabled", "enabled_full", or "disabled")

See AWS Bedrock Configuration for details

Added new fields to MCP server configurations

Added title field for custom display name in the UI

Added description field for server description

Added apiKey authentication for SSE/HTTP transports with source, authorization_type, and custom_header options

Added oauth.skip_code_challenge_check for providers like AWS Cognito that support S256 but don't advertise it

See MCP Servers Configuration for details

Added groupIcon property for model specs custom groups

Specify built-in icon keys (e.g., "openAI", "groq") or custom URLs

Only the first spec with a groupIcon in each group is used

See Model Specs Configuration for details

Added xhigh (extra high) reasoning effort option for OpenAI models

New option for reasoning_effort parameter: "xhigh"

See Model Specs - Preset Fields for details

Bedrock promptCache parameter now defaults to true for Claude and Nova models

Automatically enables prompt caching for supported Bedrock models

Can be explicitly disabled by setting promptCache: false

See Model Specs - promptCache for details

Original source
Jan 7, 2026
Date parsed from source:
Jan 7, 2026

First seen by Releasebot:
Jun 1, 2026
LibreChat

LibreChat v0.8.2-rc2

LibreChat ships v0.8.2-rc2 with new AI and MCP capabilities, broader model and file support, stronger security and accessibility, plus major UI polish and bug fixes for smoother chat, streaming, and admin workflows.
The v0.8.2-rc2 release of LibreChat

What's Changed

✨ Features

💾 Add Memory Configuration Options for CI unit tests by @chrisdoyle in #10567

🍌 Gemini Image Generation Tool (Nano Banana) by @usnavy13 in #10676

🤖 Anthropic Vertex AI Support by @usnavy13 in #10780

🪧 Add Custom Group Icon Support for Model Specs by @Odrec in #10782

🌊 Resumable LLM Streams with Horizontal Scaling by @danny-avila in #10926

🏃 Keep Modals Open on Escape in Dropdown Menus by @dustinhealy in #10975

⛓️‍💥 More Accessible Login Page Links by @dustinhealy in #10997

🔒 Add MCP server domain restrictions for remote transports by @atefbellaaj-at-slalom in #11013

⚡ Add Keyv memory cache read-through for MCPServersRegistry by @atefbellaaj-at-slalom in #11030

🥂 High Contrast Toasts by @dustinhealy in #11035

🎞️ OpenRouter Audio/Video File Upload Support by @papasaidfine in #11070

🏞️ Modifiable OpenAI Image Gen Model Environment Variable by @dustinhealy in #11082

🪙 Update GPT-5.1 and GPT-5.2 Token Pricing by @danny-avila in #11101

🛜 Enable Network Requests in Offline Mode by @danny-avila in #11107

📊 Render Inline Mermaid Diagrams by @danny-avila in #11112

📋 Add Floating Copy Button to Code Blocks by @danny-avila in #11113

🪟 Make Chat Header Transparent by @lemonTree43 in #11122

✨ Add Claude conversation importer with thinking support by @RisingOrange in #11124

🚧 Add Bedrock Guardrails Support by @nealedj in #11141

📊 Enhance Inline Mermaid UX by @lemonTree43 in #11170

🧠 'Extra High' Reasoning Effort OpenAI Parameter by @danny-avila in #11171

🧩 Standardize empty states, improve MCP icon upload accessibility, and refine UI layout by @berry-13 in #11195

💾 Custom Endpoint Support for Memory LLM Config by @dustinhealy in #11214

🪐 Cross-replica support in GenerationJobManager for Redis mode by @danny-avila in #11233

🐛 Fixes

📂 Extend MIME Type Support for Developer Code Files by @Gerald-M in #10908

🚧 OriginalDialog Modal Tooltip and Dropdown Menu Regressions from #10952, #11008) by @dustinhealy in #10975

🪵 Standardize Logging Directory with Environment-Aware Resolution by @danny-avila in #11000

🔄 Resolve Infinite Refresh Loop on OpenID Provider/Database Switch by @danny-avila in #11002

💬 Increase Z-index of OriginalDialog for Proper Layering by @alessiopelliccione in #11008

👁️ Return Focus on My Files Modal Close by @dustinhealy in #11032

🖲️ Convert Create and Edit Prompt Buttons to Links by @dustinhealy in #11056

♻️ use DOMAIN_CLIENT for MCP OAuth Redirects by @SpectralOne in #11057

🎫 OAuth Token Endpoint Auth. Method Handling for FastMCP 2.14+ Compatibility by @owengo in #11067

🧈 Smoother Control Panel Tab Expansion Animations by @dustinhealy in #11077

📤 Show Proper Upload Options for Azure and Agent Endpoints by @dustinhealy in #11081

🔗 Share Links Respect Custom Base Path by @Nk-rodrigues in #11087

✍️ Validation for Conversation Title Updates by @danny-avila in #11099

🐛 ChatGPT import creating fragmented conversation tree by @RisingOrange in #11123

🧜‍♀️ Mermaid Dialog UI Improvements by @danny-avila in #11125

🧠 Messages View Height Expansion from #11142 & improve Thinking/Code-Block UX by @danny-avila in #11142

🔒 Better SSRF protection for Actions by @danny-avila in #11143

🔧 Agent File Upload Permission Checks by @danny-avila in #11144

🔒 Access Control on Agent Permission Queries by @danny-avila in #11145

🎨 Use presentation background for header buttons by @lemonTree43 in #11147

🔧 Incorrect count query in meilisearch sync by @ablizorukov in #11157

🧰 Allow UI-based MCP Management without Configured Servers by @danny-avila in #11158

🪜 Layering Conflicts and UX Polish by @danny-avila in #11177

🏺 Restore Archive Functionality with Dedicated Endpoint by @danny-avila in #11183

🔒 Restrict MCP Stdio Transport via API by @danny-avila in #11184

🐋 NODE_MAX_OLD_SPACE_SIZE arg not being applied in Dockerfile.multi file's client build stage by @shtayeb in #11200

📎 Allow Message Attachments for Users with Viewer Permission on Agents by @danny-avila in #11210

🧵 Remove Empty String values from Gemini API Payload by @danny-avila in #11213

🎯 Actions Allowed Domains Handling by @danny-avila in #11215

🏞️ Image Preview Refactor with Accessibility Enhancements by @danny-avila in #11217

🌙 Agent Builder MCP Tool Removal Button Text Contrast by @dustinhealy in #11223

🔥 Firebase Support for Nano Banana Tool by @lurkerCha in #11228

🔒 SSRF Protection and Domain Handling in MCP Server Config by @danny-avila in #11234

🔧 Sorting and Pagination logic for Conversations by @danny-avila in #11242

🔧 Clean empty strings from model_parameters for Agents/OpenAI by @danny-avila in #11248

📦 Dependencies & Chores

📦 Bump @librechat/agents to v3.0.51 by @danny-avila in #10994

📦 Bump @librechat/agents to v3.0.52 by @danny-avila in #11003

📦 bump MCP SDK to v1.25.1 and fix packages/api ghost dependencies by @danny-avila in #11128

🐋 Pin MongoDB image version in Default Docker Files by @danny-avila in #11151

📦 Bump Packages & Fix Recursion in @librechat/api build by @danny-avila in #11166

📦 bump MCP SDK to v1.25.2 by @danny-avila in #11247

🔧 Refactoring

⏳ Exclude Temporary Conversations and Messages from Meilisearch Indexing by @dlew in #10872

🧰 Default TTL for Cached Tools by @danny-avila in #11033

⏸ Improve UX for Parallel Streams (Multi-Convo) by @danny-avila in #11096

🧮 Replace Eval with Safe Math Expression Parser by @danny-avila in #11098

🪄 UI Polish and Admin Dialog Unification by @berry-13 in #11108

🔌 MCP UI with Improved Accessibility and Reusable Components by @berry-13 in #11118

📡 SSE Connection Settings and Error Handling by @danny-avila in #11129

🔊 Audio Chunk Handling for STT by @danny-avila in #11140

🔧 Display name logic in Parallel Responses by @danny-avila in #11149

🔧 batching documents on meili index reset by @ablizorukov in #11165

🚦 Concurrent Request Limiter for Resumable Streams by @danny-avila in #11167

🫱🏼‍🫲🏽 Improve Agent Handoffs by @danny-avila in #11172

🔀 Conditional Mapping Support for Multi-Convo (Parallel) Messages by @danny-avila in #11180

🧜 Focus Rendering for Mermaid Diagram by @danny-avila in #11181

🍪 Move OpenID Tokens from Cookies to Server-Side Sessions by @danny-avila in #11236

🎨 UI/UX

🧠 Expanded Thinking footer, Banner links, and Copy Thoughts accessibility by @berry-13 in #11142

🌍 Internationalization

🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #10995, #11034, #11051, #11103, #11114, #11127, #11130, #11146, #11150, #11173, #11218

New Contributors

@Gerald-M made their first contribution in #10908

@Nk-rodrigues made their first contribution in #11087

@RisingOrange made their first contribution in #11123

@SpectralOne made their first contribution in #11057

@ablizorukov made their first contribution in #11157

@alessiopelliccione made their first contribution in #11008

@chrisdoyle made their first contribution in #10567

@lurkerCha made their first contribution in #11228

@nealedj made their first contribution in #11141

@papasaidfine made their first contribution in #11070

@shtayeb made their first contribution in #11200

Full Changelog: https://github.com/danny-avila/LibreChat/compare/v0.8.2-rc1...v0.8.2-rc2
Original source
May 13, 2026
Date parsed from source:
May 13, 2026

First seen by Releasebot:
May 23, 2026
LibreChat

🚀 LibreChat v0.8.6-rc1

LibreChat releases v0.8.6-rc1 with major new Agent Skills and Subagents, richer code execution and file artifact previews, CloudFront and S3 delivery support, and broader security, auth, MCP, provider, and model improvements.
The v0.8.6-rc1 release of LibreChat

What's Changed

🏞️ Highlights

Agent Skills

Agent Skills let you package reusable agent behavior into SKILL.md bundles: instructions, reference files, scripts, assets, and tool permissions can travel together as a capability an agent can invoke automatically, on request, or always-on.

Skills can be imported, size-limited, shared through ACLs, and scoped per agent, making it easier to build repeatable workflows without baking every instruction into the agent prompt.

Subagents

Subagents let agents call other agents as tools, so a primary agent can delegate specialized work, run independent passes in parallel, or even call a configured copy of itself for fan-out style problem solving.

Subagent runs preserve the surrounding upload, user, and MCP context while enforcing recursion and graph limits, which keeps multi-agent execution powerful without making it unbounded.

Code Execution & Artifacts

Text, source-code, DOCX, CSV, XLSX, and PPTX artifacts can render inline or in the side panel with richer previews.

Nested artifact paths, Unicode filenames, file metadata encoding, and generated-code context filtering received several hardening passes.

CloudFront + S3 File Delivery

New CloudFront file strategy support includes signed cookies, signed downloads, strict signed-access enforcement, region-aware storage keys, and cookie refresh on auth refresh.

Security, Auth, and MCP Hardening

MCP OAuth, OpenID/OIDC, SSRF checks, artifact routing, permission caching, avatar fetching, and HTML rendering were tightened across the stack.

Providers, Search, and Model Support

Tavily search/scraping, OpenRouter prompt-cache configuration, Vertex AI multi-region endpoints, Anthropic tool-argument streaming, and GPT-5.5 token definitions are now supported.

✨ Features

feat: agent skills by @danny-avila in #12625

📄 Auto-render Text-Based Code Execution Artifacts Inline by @danny-avila in #12829

🪢 Enable Tool-Output References for Bash Tool by @danny-avila in #12830

🪟 Render Code-Execution Text Artifacts as Side-Panel Artifacts by @danny-avila in #12832

🪟 Render Source-Code Artifacts in the Side Panel by @danny-avila in #12854

🚫 Add Support for none Reranker Type in Web Search Config by @dlew in #12765

💭 Require Explicit Auto-agent Enablement for Memories by @danny-avila in #12886

🪟 Add allowedAddresses Exemption List For SSRF-Guarded Targets by @danny-avila in #12933

🔍 Add Tavily as Search and Scraper Provider by @yashwanth-alapati in #12581

🔐 OIDC Bearer Token Authentication for Remote Agent API by @SpectralOne in #12450

📄 Rich File Artifact Previews for DOCX, CSV, XLSX, PPTX by @danny-avila in #12934

🌩️ CloudFront CDN File Strategy by @AtefBellaaj in #12193

🧵 Enable Anthropic Tool Argument Streaming by @danny-avila in #12962

🚀 Decouple File Attachment Persistence from Preview Rendering by @danny-avila in #12957

🧮 Add GPT-5.5 Token Definitions by @danny-avila in #12973

🧭 Add Message Navigation Strip & Redesign Scroll-to-Bottom by @berry-13 in #12657

🔐 Add Signed CloudFront File Downloads by @danny-avila in #12970

🌥️ Add Optional Region-aware S3/CloudFront Storage Keys by @danny-avila in #12987

🔄 Cross-Origin Admin OAuth Refresh by @dustinhealy in #13007

🧭 Add OpenRouter Prompt Cache Setting by @danny-avila in #13029

🔐 Mint Code API Auth Tokens by @danny-avila in #13028

🌐 Support Vertex AI Multi-Region Endpoints by @danny-avila in #13044

📦 Configure Skill Import Size Limit by @danny-avila in #13073

🎭 Support OpenID Audience On Refresh Grants by @danny-avila in #13077

🌩️ Strict CloudFront signed cookie enforcement via requireSignedAccess by @upman in #13078

🐛 Fixes

🔐 Restore Tenant Context in MCP OAuth Callback by @dustinhealy in #12782

🗨️ Restore ModelSpec Preset Greeting (and iconURL Fallback) by @danny-avila in #12809

🛡️ Prevent silent crash from unhandled MCP OAuth reconnect rejections by @danny-avila in #12812

🌱 Inject Code-Tool Files Into Graph Sessions on First Call (+ read_file Sandbox Fallback) by @danny-avila in #12831

🚫 Reject Binary Files in read_file Sandbox Fallback (No More Mojibake) by @danny-avila in #12851

🔧 Replace Literal NUL Bytes in handlers.spec Test Fixture + Normalize CRLF by @danny-avila in #12852

📂 Preserve Nested Folder Paths for Code-Execution Artifacts by @danny-avila in #12848

🛂 Skip Inherited / Mark Skill Files Read-Only in Code-Env Pipeline by @danny-avila in #12866

💎 Stop Double-Counting Cache Tokens for Gemini/OpenAI in Usage Spend by @danny-avila in #12868

🛡️ Filter user_provided Sentinel in Tool Credential Loading by @Falenos in #12840

🧹 Graceful MCP OAuth Revoke Cleanup When Tokens Are Missing by @gaurav0107 in #12825

🔌 Prevent Repeated Idle Check Triggers for Users With Failed MCP Connections by @darthhexx in #12853

🧜‍♂️ Preserve Mermaid foreignObject HTML in Sanitized SVG by @ethanlaj in #12819

🩹 Treat responseCode === 0 as Transport Failure, Not Server Error by @derhelge in #12834

📂 Preserve Nested Skill Paths in Code-Env Uploads by @danny-avila in #12877

🩹 Polish code-execution attachment UX by @danny-avila in #12870

🔌 Follow 307/308 redirects in MCP streamable HTTP transport by @ontl in #12850

📥 Resolve Imported-Conversation Default Model From Runtime modelsConfig by @danny-avila in #12885

🩹 Sync ControlCombobox popover width with trigger after layout changes by @ethanlaj in #12887

🛡️ Handle MCP Tool Cache Lookup Failures by @danny-avila in #12910

📌 Stabilize Agent Prompt Cache Prefix by @danny-avila in #12907

🧭 Migrate Anthropic Long Context by @danny-avila in #12911

🧹 Clear MCP OAuth Tokens On Revoke by @danny-avila in #12913

🛡️ Harden GitNexus Index Workflow by @danny-avila in #12935

🧷 Pin GitNexus Native Dependency by @danny-avila in #12937

🛡️ Harden MCP Redirect SSRF Checks by @danny-avila in #12931

🧯 Harden Code Env Filepath Uploads by @danny-avila in #12936

🔐 Avoid Logging Password On Login Validation Error by @danny-avila in #12926

🪪 Validate Avatar URL Before Fetch by @danny-avila in #12928

🚦 Make URL Auto-Submit Configurable by @danny-avila in #12929

🧼 Sanitize HTML In Admin Banner And MCP Config Dialog by @danny-avila in #12927

🐛 Propagate User Identity to Subagent MCP Tool Calls by @danny-avila in #12950

🔐 Forward per-file entity_id through code-env priming by @danny-avila in #12958

🧬 Subagent MCP requestBody Propagation (bump @librechat/agents to 3.1.78 + cleanup) by @danny-avila in #12959

🛰️ Honor Anthropic Vertex Configuration by @danny-avila in #12972

🌐 Preserve Unicode Filenames by @danny-avila in #12977

⏳ Preserve Temporary Chat Retention Config by @danny-avila in #12985

🛂 Harden Agent File Preview Access by @danny-avila in #12981

🌐 Percent-encode X-File-Metadata header for Unicode filenames by @usnavy13 in #12983

⏱️ Align Auto-Refill Next Date by @danny-avila in #12980

🧭 Navigate Signed CDN Downloads by @danny-avila in #12998

🪪 Preserve OIDC Logout ID Token Hint by @danny-avila in #12999

🧭 Preserve Resend Files for Subagents by @danny-avila in #13030

🛟 Persist Vertex Gemini 3 thoughtSignatures across DB round-trips by @danny-avila in #13026

🛟 Summarization Provider misses vertexai + case-mismatched custom endpoints by @danny-avila in #13025

🗂️ Remove Generated Code Files From Prompt Context by @danny-avila in #13037

🛟 Allow Empty modelSpecs.list to Unstick Admin-Panel Saves by @dustinhealy in #13036

📜 Scope Read File Prompt For Code Agents by @danny-avila in #13040

🦘 Skip OpenAI Model Fetch For User-Provided Keys by @danny-avila in #13038

☁️ Enable Azure Agent Provider Uploads by @danny-avila in #13045

🛡️ Gate Bash PTC Capabilities by @danny-avila in #13053

🛰️ Validate Vertex Endpoint Overrides by @danny-avila in #13054

🛂 Restrict OpenID JWT Bearer Reuse by @danny-avila in #13052

🧯 Bound Permission Superset Cache Inputs by @danny-avila in #13065

🧮 Count Rejected Skill Import Bytes by @danny-avila in #13063

🧬 Bound Subagent Expansion by @danny-avila in #13064

🗝️ Enforce Skill Share Role Permission by @danny-avila in #13062

🪙 Pass appConfig to getBalanceConfig in set-balance script by @Odrec in #13070

🛡️ Harden Artifact Routing Lookups by @danny-avila in #13069

🧵 Preserve Upload Context Across Multipart Routes by @danny-avila in #13072

🍪 Refresh CloudFront Cookies On Auth Refresh by @danny-avila in #13083

🛡️ Harden OpenID Session Token Reuse by @danny-avila in #13086

🔧 Refactoring

🧬 Align LibreChat With Agents LangChain Upgrade by @danny-avila in #12922

🛂 Avoid Default Tavily Safe Search by @danny-avila in #12939

🛡️ Restrict User Tavily Endpoint URLs by @danny-avila in #12946

⚡ Bound Concurrent Office-HTML Rendering for Code Artifacts by @danny-avila in #12951

🗃️ Keep Code Artifacts Manual-Open by @danny-avila in #12961

⌨️ Clarify Bash Command Drafting State by @danny-avila in #12963

🪟 Improve Subagent Dialog Prompt Rendering by @danny-avila in #12982

🛡️ Scope allowedAddresses By Port by @danny-avila in #13022

🧰 Use Bash PTC for Agent Tools by @danny-avila in #13042

🧬 Align OpenRouter Reasoning Payloads by @danny-avila in #13039

🪪 Require Remote OIDC Audience by @danny-avila in #13066

🏷️ Rename Code Interpreter Labels To Run Code by @danny-avila in #13071

🍪 Refresh CloudFront Media Cookies by @danny-avila in #13091

🖥️ UI & Styling

🖥️ Render Bash PTC Calls With Bash UI by @danny-avila in #13046

📦 Dependencies, Chores & CI

📦 Update TypeScript Config for TS v7 by @danny-avila in #12794

🛡️ Bump @xmldom/xmldom to 0.8.13 via Root Override by @danny-avila in #12795

📦 Update @librechat/agents to v3.1.74 by @danny-avila in #12869

🛡️ Bump @librechat/agents to v3.1.79 by @danny-avila in #13000

📦 npm audit fixes and Mongoose 8.23 TypeScript follow-ups by @danny-avila in #12996

⛴️ Use Bitnami Legacy MongoDB Image in Helm Chart by @vdittgen in #13032

📦 Bump @babel/preset-env to v7.29.5 by @danny-avila in #13034

🛡️ Harden Docker Dev Image Builds by @danny-avila in #13041

📜 Improve Skill Handling Logs by @danny-avila in #13057

🪵 Log Subagent Limit Hits by @danny-avila in #13068

📦 Bump @librechat/agents to v3.1.85 and mermaid to v11.15.0 by @danny-avila in #13079

🐳 Build Docker Client Package With Data Provider Dist by @danny-avila in #13097

📦 Bump @librechat/agents to v3.1.86, npm audit, build fix by @danny-avila in #13105

✨ v0.8.6-rc1 by @danny-avila in #13094

📚 Documentation

📚 Add Skills, Subagents, and CloudFront References by @danny-avila in #13096

🌍 Internationalization

🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #12916, #12964, #13058, #13080

New Contributors

@Falenos made their first contribution in #12840

@gaurav0107 made their first contribution in #12825

@ontl made their first contribution in #12850

@yashwanth-alapati made their first contribution in #12581

@vdittgen made their first contribution in #13032

Full Changelog: https://github.com/danny-avila/LibreChat/compare/v0.8.5...v0.8.6-rc1
Original source
May 12, 2026
Date parsed from source:
May 12, 2026

First seen by Releasebot:
May 23, 2026
LibreChat

⚙️ Config v1.3.11

LibreChat adds CloudFront file storage support, signed URL and cookie access, and new Skills and Subagents capabilities for more flexible agent behavior and bundled file storage.
Added CloudFront file storage configuration

Adds "cloudfront" as a file storage strategy for stable S3-backed CDN URLs

Adds the root-level cloudfront object for distribution domain, signed-cookie mode, signed download URL expiry, cache invalidation, and region-aware object paths

Supports signed cookies for inline image/avatar access and signed CloudFront URLs for authorized downloads

See CloudFront with S3 and CloudFront Object Structure

Added Skills and Subagents to the documented default agent capabilities

skills enables manual $ invocation, model-invoked skills, always-apply skills, and agent skill allowlists

subagents enables isolated child agent runs from the parent agent

See Skills and Subagents

Added skills to granular file storage strategies

Allows skill-bundled files to use a dedicated storage backend

Original source
May 8, 2026
Date parsed from source:
May 8, 2026

First seen by Releasebot:
May 23, 2026
LibreChat

⚙️ Config v1.3.10

LibreChat tightens allowedAddresses security by requiring an explicit port for actions, MCP settings, and endpoints. It preserves private-IP scoping, clarifies allowedDomains precedence, and blocks bare hosts, invalid ports, CIDRs, and public IP literals.
Changed allowedAddresses entries to require an explicit port

Applies to actions.allowedAddresses, mcpSettings.allowedAddresses, and endpoints.allowedAddresses

Entries must use host:port, private.ip:port, or [ipv6]:port

Bare hosts and IPs such as localhost, 127.0.0.1, and host.docker.internal are rejected

This scopes each SSRF exemption to one intended private service instead of every port on the same host

Preserved private-IP scoping for allowedAddresses

URLs, paths, CIDR ranges, whitespace, invalid ports, and public IP literals remain invalid

Hostname entries still trust whatever private IP that hostname resolves to on the listed port

Clarified how allowedAddresses interacts with allowedDomains

allowedAddresses is used when allowedDomains is not configured

When allowedDomains is configured, it acts as the authoritative strict whitelist

Original source
Apr 21, 2026
Date parsed from source:
Apr 21, 2026

First seen by Releasebot:
May 23, 2026
LibreChat

⚙️ Config v1.3.9

LibreChat improves model and schema support with fixes for summarization triggers, new Anthropic thinkingDisplay controls, expanded effort levels, default Claude Opus 4.7 listings, and a text/x-markdown MIME alias for smoother file handling.
Fixed summarization.trigger schema to match documented and runtime-supported types

Previously only accepted token_count (which silently never fired at runtime)

Now correctly accepts token_ratio, remaining_tokens, and messages_to_refine via a discriminated union

token_ratio value constrained to 0–1, other types require positive integers

Added thinkingDisplay parameter for Anthropic models

Controls whether reasoning content is returned in responses for Claude Opus 4.7+ (which omits thinking by default)

Options: "auto" (default), "summarized", "omitted"

Available on anthropic and bedrock (Anthropic models) endpoints

Added xhigh to Anthropic effort levels

effort field now accepts "", "low", "medium", "high", "xhigh", "max"

Added Claude Opus 4.7 to default model lists

claude-opus-4-7 for Anthropic

anthropic.claude-opus-4-7 for Bedrock

Added text/x-markdown MIME type alias

Maps to text/markdown for consistent file handling

Original source
Apr 21, 2026
Date parsed from source:
Apr 21, 2026

First seen by Releasebot:
May 23, 2026
LibreChat

LibreChat v0.8.5

LibreChat releases v0.8.5 with a major admin panel foundation, context compaction and summarization, Claude Opus 4.7 support, a refreshed UI, and performance and MCP improvements for smoother chats and better control.
The v0.8.5 release of LibreChat

What's Changed

🏞️ Highlights

Admin Panel Foundation

Per-principal (Roles & Groups) configuration overrides, Custom Roles & Groups, System Grants for admin-level access control

Admin panel, available for testing here

Context Compaction/Summarization

Long-running agent conversations are automatically summarized to stay within context limits. Includes configurable triggers, context pruning of large tool results, and a new top-level summarization config. See Config v1.3.8.

Claude Opus 4.7 Support

Full model support with configurable reasoning visibility (thinkingDisplay). See Config v1.3.9.

UI Redesign

Redesigned sidebar with unified icon strip layout, including all panels (agent builder, prompts, etc.)

Overhauled tool call UI with grouping/richer output rendering

Refreshed Prompts UI

Sidebar icon toggle & new chat history switch

Performance & MCP Improvements

In-memory caching, Redis event sequence atomization, lazy MCP init

OAuth client registration fixes and stale client recovery

Pinned Model Specs: Users can now pin favorite model specs for quick access

Changes Since v0.8.5-rc1

✨ Features

🪪 Optimized Entra ID Group Sync with Auto-Creation by @Airamhh in #12606

🗂️ Sidebar Icon Toggle & New Chat History Switch by @danny-avila in #12642

🦉 Claude Opus 4.7 Model Support by @danny-avila in #12698

🫧 Claude Opus 4.7 Reasoning Visibility by @danny-avila in #12701

📅 Support text/calendar (iCalendar) in Code Outputs by @upman in #12758

🐛 Fixes

📑 Alias Mimetype text/x-markdown to text/markdown by @dlew in #12608

🔬 Scope Web Search Results to Own Turn by @danny-avila in #12631

🔀 Resolve Action Tools by Exact Name to Prevent Multi-Action Domain Collision by @lrreverence in #12594

🔑 Clear Stale Client Registration on invalid_client During OAuth Token Refresh by @danny-avila in #12643

🎯 Preserve Selected Artifact When Clicking Artifact Button by @starchow in #12601

🔍 Anthropic Web Search Multi-Turn Issue and Attachment Results by @danny-avila in #12651

🖼️ Hide Duplicate Image Placeholder During Image Generation by @danny-avila in #12654

🧊 In-Memory Endpoint Token Config Cache Isolation by @danny-avila in #12673

🔉 Normalize audio MIME types in STT format validation by @danny-avila in #12674

💎 Handle usage_metadata in Title Transaction for Gemini Models by @kojinseok-del in #12386

🤝 Normalize Empty Handoff Fields to Restore Default Fallback by @xxsLuna in #12707

🪐 Replace $bitsAllSet ACL Queries for Azure Cosmos DB Compatibility by @danny-avila in #12736

📝 Preserve Raw Markdown Formatting on Upload as Text by @danny-avila in #12734

📐 Align Summarization Trigger Schema with Documented and Runtime-Supported Types by @danny-avila in #12735

🔊 Preserve Log Metadata on Console for Warn/Error Levels by @danny-avila in #12737

🤝 Load Handoff Agents for Agents API by @danny-avila in #12740

🗺️ Resolve Custom-Endpoint Providers for Summarization by @danny-avila in #12739

🔒 Validate MCP OAuth Protected Resource Metadata binding by @danny-avila in #12755

🔐 Prefer WWW-Authenticate resource_metadata Hint for MCP OAuth by @danny-avila in #12763

🔏 Prevent Browser Autofill From Silently Dropping MCP CustomUserVars on Save by @jschmetzer in #12770

🧹 Clean Up Orphaned Agent File Stubs After Deletion by @danny-avila in #12781

🔧 Refactoring

🧩 Agent Side Panel Layout and Consistency Fixes by @danny-avila in #12676

🔼 Improve UX for Command Popovers by @danny-avila in #12677

📦 Dependencies & Chores

📝 Add RAG_API_URL to .env.example by @ivan09069 in #12665

📦 npm audit & bump @librechat/agents to v3.1.67 by @danny-avila in #12710

📦 Update @librechat/agents to v3.1.68 by @danny-avila in #12752

🌍 Internationalization

🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #12646, #12711

New Contributors

@lrreverence made their first contribution in #12594

@starchow made their first contribution in #12601

@ivan09069 made their first contribution in #12665

@kojinseok-del made their first contribution in #12386

@xxsLuna made their first contribution in #12707

@upman made their first contribution in #12758

@jschmetzer made their first contribution in #12770

Full Changelog: https://github.com/danny-avila/LibreChat/compare/v0.8.5-rc1...v0.8.5
Original source
Mar 20, 2026
Date parsed from source:
Mar 20, 2026

First seen by Releasebot:
May 23, 2026
LibreChat

LibreChat v0.8.4

LibreChat ships a security and stability focused release with 30+ security fixes, MCP reliability improvements, a new native ODT document parser, support for unauthenticated SMTP relays, better accessibility, and faster tokenization and artifact rendering.
The v0.8.4 release of LibreChat

This release of LibreChat is primarily focused on security and stability improvements.

Security Hardening

30+ security fixes: Strongly recommended update for all deployments.

MCP Improvements

Reconnection storm prevention with circuit breaker and backoff, OAuth race condition fixes, fail-closed domain validation, better STDIO UX with customUserVars.

Replaced tiktoken with ai-tokenizer

Lighter, faster tokenization dependency.

Artifact Rendering

Replaced React Markdown renderer with static HTML for more reliable artifact display.

Accessibility

Screen reader improvements for conversation headings and date groups.

Features

📖 Add Native ODT Document Parser Support by @pol9061 in #12303

📡 Support Unauthenticated SMTP Relays by @mfish911 in #12322

Fixes

🎭 Set Explicit Permission Defaults for USER Role in roleDefaults by @danny-avila in #12308

🧯 Remove Revoked Agents from User Favorites by @danny-avila in #12296

🖼️ Correct ToolMessage Response Format for Agent-Mode Image Tools by @danny-avila in #12310

🔌 Isolate Code-Server HTTP Agents to Prevent Socket Pool Contamination by @danny-avila in #12311

🛂 Reject OpenID Email Fallback When Stored openidId Mismatches Token Sub by @danny-avila in #12312

🛡️ Prevent loop in ChatGPT import on Cyclic Parent Graphs by @danny-avila in #12313

🪦 ACL-Safe User Account Deletion for Agents, Prompts, and MCP Servers by @danny-avila in #12314

🚦 ERR_ERL_INVALID_IP_ADDRESS and IPv6 Key Collisions in IP Rate Limiters by @bprussell in #12319

💣 Harden against falsified ZIP metadata in ODT parsing by @danny-avila in #12320

🪂 Automatic logout_hint Fallback for Oversized OpenID Token URLs by @Airamhh in #12326

♾️ Permanent Ban Cache and Expired Ban Cleanup Defects by @JooyoungChoi14 in #12324

🪤 Avoid express-rate-limit v8 ERR_ERL_KEY_GEN_IPV6 False Positive by @danny-avila in #12333

⛓️‍💥 Replace React Markdown Artifact Renderer with Static HTML by @danny-avila in #12337

🛂 Gate MCP Queries Behind USE Permission to Prevent 403 Spam by @danny-avila in #12345

Refactoring

🫧 Clear Drafts and Surface Error on Expired SSE Stream by @danny-avila in #12309

🩺 Surface Descriptive OCR Error Messages to Client by @danny-avila in #12344

Accessibility

🗣️ Add Screen Reader Context to Conversation Date Group Headings by @danny-avila in #12340

🗣️ Distinguish Conversation Headings for Screen Readers by @danny-avila in #12341

Dependencies & Chores

📦 Bump @dicebear dependencies to v9.4.1 by @danny-avila in #12315

🐳 Upgrade Alpine packages in Dockerfiles by @danny-avila in #12316

📦 Update fast-xml-parser to v5.5.7 by @danny-avila in #12317

🧹 Resolve correct memory directory in .gitignore by @ethanlaj in #12330

Internationalization

🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #12338

New Contributors

@pol9061 made their first contribution in #12303

@bprussell made their first contribution in #12319

@JooyoungChoi14 made their first contribution in #12324

@mfish911 made their first contribution in #12322

@JasonYeYuhe made their first contribution in #12323

Full Changelog: https://github.com/danny-avila/LibreChat/compare/v0.8.3...v0.8.4
Original source