Open WebUI Release Notes

Added

• 📑 Tabbed workspace. The Tabs button at the top of a chat now opens a workspace for files, multiple terminal sessions, artifacts, previews, voice calls and comments. Add tabs from the + menu, drag to reorder them, and create and save new files directly into the selected terminal. Keep the conversation and its working files together while coding, analyzing data or reviewing generated documents. Commit, Commit, Commit, Commit
• 🖥️ Open Terminal Desktop tab for computer use. Open the Desktop tab from the + menu to view and control the desktop provided by your connected Open Terminal, with mouse, keyboard, clipboard and audio support where available. With a model that can call its desktop tools, you can follow computer-use workflows in the same desktop and step in yourself: operate graphical apps, inspect generated documents or handle a step that needs manual input. Requires an Open Terminal connection with desktop support enabled. Commit, Commit, Commit, Commit
• 🌐 Browser tab for browser use and web app testing. Open websites and local development servers beside your chat, with navigation controls, multiple tabs and a mobile viewport. On a compatible Open Terminal connection, Chrome mode gives you and the model a shared browser session for browser automation: navigate sites, interact with forms and test the web apps the model builds. You can watch the work and interact with the page yourself; Proxy mode remains available for previews. Requires browser support on the selected terminal, and Chrome availability for browser-use tools. Commit, Commit, Commit
• ↔️ Full-width tabs. On larger screens, expand the tabbed workspace to fill the chat area, with the main conversation kept as its own tab. Switch between the chat, code, browser and desktop with more room to work, or return to the side-by-side layout; your layout choice is remembered. Commit, Commit
• 💻 Open WebUI Desktop 0.1.x. The separately installed app for macOS, Windows and Linux now focuses on setting up and running Open WebUI on your own computer, with optional llama.cpp local models. The 0.1.0–0.1.4 updates bring a slimmer interface, searchable settings, startup logs, optional automatic Desktop updates, start-to-tray controls and image copying and saving. They also improve screen sharing, knowledge folder uploads, Linux graphics and shortcuts, and NVIDIA/AMD local-model setup and updates. Use it for a managed local installation and local AI workflows. Desktop changelog, Download v0.1.4
• 🌿 Git in the side panel. When the selected terminal's folder is a Git repository, a Git panel in the tabbed side panel now lets you review diffs, stage, discard and commit changes, manage branches and worktrees, push and pull, browse history and work with GitHub pull requests, and open files can show their changes with Show diff. Commit, Commit, Commit, Commit, Commit
• ⚡ Live terminal updates. On terminals that support it, the Git panel, the list of open ports and the running processes and their output now update as soon as something changes instead of every few seconds. Commit, Commit
• 💭 Side chats. Typing "/side" or "/btw" in a chat, or choosing Side chat in the side panel, now opens a temporary side conversation using the chat so far as context. Ask a quick question or explore an alternative without adding the detour to the main conversation; the side chat disappears when you close its tab. Available to administrators and users given the new Allow Side Chat permission, which is off by default. Commit, Commit, Commit
• 💬 Comment threads. Administrators can now turn on Comments in Admin Settings > General or with "ENABLE_COMMENTS", which lets users leave comments with replies, reactions and mentions on the chats, notes, models, knowledge bases, prompts, skills and tools they can open, including on a selected passage of a chat message, which then stays highlighted in the reply, or of a note page, shown in a Comments tab in the chat's side panel, which "/comments" opens, and with comment counts in the workspace lists. Commit, Commit, Commit, Commit
• 🔔 Notification inbox. A new Inbox in the sidebar collects comments on your items, replies to your comments, mentions in comments and channels, replies in channels, failed automation runs and upcoming calendar events with an unread count, and administrators can turn it off in Admin Settings > General or with "ENABLE_NOTIFICATIONS". Commit, Commit, #19539
• 🧩 MCP Apps in chat. Tools from MCP servers that come with an interactive app now show that app right in the chat after they run, in a sandboxed frame that can only reach the sites the server declares, and every tool call the app wants to make waits for you to confirm it. Commit, Commit, #21040, #20915
• ✨ Generate title from top bar. The rename field at the top of an open chat now has the same sparkle button as the sidebar, which generates a title from the conversation and saves it right away. #33382
• 📐 Side panels on tablets. On screens from 768 pixels wide, such as tablets and narrow windows, channel threads and the pages list and chat in notes now open beside the content instead of over it, picking a terminal opens its files beside the chat as well, and the search dialog shows its preview there by default and remembers whether you turned it on or off at any window size. Commit, Commit
• 📊 More PowerPoint charts. The PowerPoint preview now draws pie, doughnut and horizontal bar charts as well as values below zero, and shows "Chart preview unavailable" for charts it cannot draw. Commit, #32884
• 🧊 3D model previews. GLB, glTF, STL, OBJ and PLY files in a terminal's file browser and in files shown in chat replies now open in a 3D viewer that you can rotate and zoom. Commit
• 🔘 Switch tools on and off. Tools in Workspace > Tools now have an on and off switch for everyone who can edit them, and a tool that is switched off can no longer be picked or run in any chat, including chats where it was already selected. Commit
• 🛠️ Tool creation from chat. Models with native function calling can now create a private Python tool in your workspace when you ask them to, for administrators and users allowed to create workspace tools, and it can be turned off per model under Tool Creation in the model editor's builtin tools. Commit
• 🤝 Multi-model sub-agents. The model editor now lets you choose other models for a model to delegate work to, enabling multi-agent workflows such as assigning research, coding and review to different models. The parent model chooses among the configured models the user can access; previously, sub-agents always used the same model as the parent. Commit
• 📏 Knowledge base file limits. Administrators can now cap how many files a knowledge base holds, how large each of its files may be and how many files go into it in one upload, for all knowledge bases in Admin Settings > Documents or with "KNOWLEDGE_MAX_FILE_COUNT", "KNOWLEDGE_MAX_FILE_SIZE" and "KNOWLEDGE_MAX_UPLOAD_COUNT", and a knowledge base's owner can set its own file count and size limits under Advanced when creating it or from Settings in its menu, while the global limits always apply. Commit, Commit, #33318, #24845
• 📄 File sizes in previews. Opened terminal files now show their size in the file toolbar, so you can check a document or generated output without leaving its preview. Commit
• 🗂️ Sort files by date added. The terminal file browser can now sort files by when they were added, next to name, size and date modified, on terminals that report creation times. Commit
• ↕️ Move blocks in notes. Every paragraph, heading and other block in a note now has a handle beside it that you can drag to move the block, or click to move it up or down. Commit
• 📋 Copy code in notes. Code blocks in notes now have a Copy button and use clearer syntax colors in light mode. Commit, Commit, #33455
• ⏸️ Approvals shown in sidebar. Chats in the sidebar now show a "Waiting for approval" marker while a tool call in them waits for you to allow or deny it. Commit, Commit
• 🏷️ Role prompt variable. System prompts, saved prompts and chat requests through the API can now use "{{USER_ROLE}}", which is replaced with the signed-in user's role, such as admin or user. #33441, #4765
• ♿ Accessibility improvements. Screen reader users now hear a name for every window, form field, setting and icon button, including Admin Settings, Valves, filters and channel message actions, and keyboard users can answer tool approvals, dismiss notifications, open model details in Admin Analytics, sort Analytics and group member tables, resize the sidebar, open notebook cells for editing, use multi-select lists in Valves, pick a status emoji, choose tag and voice suggestions, open the sources of a web search, use the menus in the Search window, stay inside the full-size image viewer and side drawers until they close them and reach every event on the calendar. Closing a window opened from a menu now returns focus to the menu button, Tab cancels shortcut recording, task-list checkboxes are named by their text, and unselected Analytics tabs have better contrast in Accessibility Mode. Commit, Commit, Commit, Commit
• 🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
• 🌐 Translation updates. Translations for Portuguese (Brazil), Latvian, Azerbaijani, Basque, Bengali, Bosnian, Bulgarian, Cebuano, Croatian, Czech, Danish, Dutch, Estonian, Faroese, Filipino, Galician, German, Greek, Hebrew, Hungarian, Indonesian, Irish, Japanese, Korean, Lithuanian, Malay, Norwegian Bokmål, Persian, Polish, Punjabi, Romanian, Russian, Serbian, Slovak, Slovenian, Spanish (Spain), Tamil, Turkish, Turkmen, Ukrainian and Vietnamese were enhanced and expanded.

Fixed

• 🛡️ Security Advisory: This release contains security fixes. We strongly recommend updating all deployments as soon as possible to have the latest security fixes in place. These fixes are not listed in this changelog; we will publish the security advisories for them immediately following CVE assignment. Advisories
• 🔃 New chats stay in sync. A chat started from the home page keeps syncing with the server again after it is created, so files removed from the chat's Controls no longer come back after a reload and the owner of a chat shared with Allow replies gets Regenerate on other people's replies again. #33377, #33376
• 📂 Temporary Chat on folder pages. Turning Temporary Chat on or off on a folder's page, with the button at the top or with "/temporary", now keeps you on the folder page, so the next chat is still saved in the folder and gets its system prompt, default model and knowledge. #33456, #33448
• 🧵 Thread reply focus. Choosing Reply in Thread on a channel message now puts the cursor in the thread's reply box, also when the thread panel is already open. #33467, #33466
• 🪟 Thread message actions visible. Hovering the top message in a channel thread now shows its whole actions toolbar instead of cutting off its top half at the edge of the panel. Commit, #33472
• 📞 Interrupting realtime calls. Interrupting the model while it speaks in a realtime voice call no longer ends the whole call when the reported playback position does not match the audio. Commit, #33550
• 📶 Temporary chats after reconnecting. A reply that is still being written in a temporary chat now keeps arriving after the connection drops and comes back, and a reply that could not finish shows "Connection lost. Please retry." instead of loading forever. Commit
• 🏠 New chat initialization. Opening or reloading the home page or a folder now selects the model and applies chat URL parameters again, instead of leaving the model empty and ignoring the link’s settings. Commit
• ✍️ Restored chat drafts. Saved draft text now returns to the message input after the new-chat editor mounts, instead of disappearing during initialization. Commit
• 🧩 Nested code previews. Preview now opens code blocks inside lists, quotes and details blocks, so embedded examples and generated artifacts can be inspected directly. Commit
• 🖼️ Image drops from photo apps. Images dropped into chats and channels are now recognized from their contents when the source omits the file type, including photos dragged from macOS Photos, instead of being treated as generic files. Commit
• 📏 Live context usage estimates. The context indicator now accounts for output arriving after the latest reported token usage and avoids counting assistant text twice when it also appears in structured output, making it easier to track context-window usage during long agent runs. Commit
• 🔌 Responses-backed API streaming. Clients using Open WebUI’s Chat Completions API now receive the expected streaming format even when the upstream model uses the Responses API, including text, reasoning, tool calls, token usage and completion reasons. Commit
• 😀 Channel reaction names. Hovering a reaction on a channel message now shows who reacted when those names are available, instead of showing only the count. Commit
• 📊 Analytics activity scrolling. The activity chart now tracks the element actually being scrolled, keeping its visible rows in sync when browsing longer activity lists. Commit
• 🔑 Saved OAuth provider settings. OAuth providers now load their saved connection settings when Open WebUI starts. Admin Settings also explains that changes to provider connections require restarting every Open WebUI instance. Commit

Changed

• ⚠️ Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.
• 🎛️ Controls in the model menu. The chat files, valves, system prompt and advanced parameters moved from the Controls panel at the top of the chat to Controls in the model controls menu next to the message input, and the button at the top now opens the tabbed side panel. Commit, Commit
• 🗺️ Overview in the chat menu. The chat Overview, the map of all messages and their branches, now opens as a full-screen window from Overview in the chat's menu instead of as a tab in Chat Controls. Commit
• 🔁 Higher tool-call limit. A single response with native function calling can now run up to 1024 rounds of tool calls before it stops with "Tool-call limit reached", up from 256, and setting "CHAT_RESPONSE_MAX_TOOL_CALL_ITERATIONS" to 256 keeps the old limit. #33384
• 🔓 No sub-agent limits by default. The sub-agent limits in Admin Settings and through "SUBAGENTS_MAX_CONCURRENT", "SUBAGENTS_MAX_ASYNC", "SUBAGENTS_MAX_ITERATIONS" and "SUBAGENTS_MAX_OUTPUT" now default to no limit, and leaving one empty means no limit, where they defaulted to 20 at once, 20 in the background, 30 tool loops each and 30000 characters of output. Commit
• 🧠 Context compaction and prompt caching. When the same model handles the conversation and its compaction summary, eligible requests now reuse the conversation’s prompt structure so the provider can use its prompt cache. This can reduce the cost of summarizing long conversations and agent workflows; other requests retain the separate summary path. Commit
• 💻 Desktop 0.1.x upgrade changes. Open WebUI Desktop no longer switches between remote servers, bundles Open Terminal, or provides the old Spotlight and global voice overlays. Existing remote-connection users should review Open WebUI Tether. The Open Terminal Desktop and Browser tabs described above use a separately configured Open Terminal connection. Desktop 0.1.0 release notes
• 📭 File processing alerts removed. Personal notifications in Settings > Notifications no longer offer "Retrieval Content process failed", so notification webhooks no longer receive an alert when a file fails to process. Commit

Original source

Added

• 🧭 Analytics session explorer. Administrators can now open a Sessions tab in Admin Analytics that lists each chat with its tokens, responses, errors and time span, filters them by search, model, token range or sub-agents, and shows a chat's saved replies and tool calls with their timing and outcome, as long as "ENABLE_ADMIN_CHAT_ACCESS" is on. Commit
• 📑 Pages in notes. Notes can now hold several pages and subpages, which you can add, rename, reorder, move under another page, download, link to and delete from the page tabs, and search results and the model now work with notes page by page. Commit
• 👀 Live presence in notes. A note now shows who else has it open, and clicking a person jumps to the page and spot they are working on. Commit
• ✏️ Rename from chat menu. The menu next to an open chat's title now has Rename, which turns the title at the top of the page into a text box, so a chat can be renamed without finding it in the sidebar first. #33177, #33176, #33246, #33339, #33338, Commit, Commit
• 🖼️ Generated images in terminals. When a terminal is selected in a chat, generated and edited images are now also saved to its working folder, so the model can keep working on them with the terminal's tools. Commit
• 🗃️ Models show chat files. Models can now show a file attached in the chat or stored in an attached knowledge base right in the reply with the built-in display_file tool, which until now only worked for terminal files. #32471, Commit, Commit
• 💾 Chat model choice saved. Changing the model in a chat is now saved with the chat right away, so the chat reopens with that model even when no message was sent after the change. Commit
• ⌨️ Unassign single shortcuts. Settings > Keyboard now shows a small x beside every assigned shortcut that unassigns only that one, so a shortcut such as Regenerate Response on Ctrl+R or Cmd+R can be switched off while all others keep working. #33185, #31463, Commit
• 🎚️ Slider for number Valves. Plugin authors can now show a number Valve or UserValve as a slider with a number box beside it, whose ends come from the field's minimum and maximum, so users see the allowed range while picking a value. #33179, #32045, Commit
• 📇 Provider details for models. Administrators editing a model now see a Provider details section with the input and output types, context window, maximum output and supported parameters that the provider reports for it. Commit
• 🧲 Embedding prefixes in settings. Administrators can now set the query and content prefixes that some embedding models need under Admin Settings > Documents, where they could only be set with the "RAG_EMBEDDING_QUERY_PREFIX" and "RAG_EMBEDDING_CONTENT_PREFIX" environment variables. Commit
• ⏱️ Terminal start timeout. Open WebUI now waits up to 60 seconds by default when it asks a terminal for its skills, AGENTS.md file or uploads, so a terminal that is still starting can answer, with "AIOHTTP_CLIENT_TIMEOUT_TERMINAL" to change the limit and a message naming the terminal when it still times out. Commit
• 🚨 Automation failure notifications. Automation run failed is now an event users can pick for their notification targets under Settings > Notifications, so the owner hears about every failed run with the automation's name and error. #33331, #33228, Commit
• ⚡ Faster knowledge base commands. Knowledge base commands such as ls, cat and grep and the knowledge base sync check now list files without loading every file's full text, so on large knowledge bases each call is up to ten times faster and uses far less memory. #33332, #33322, Commit
• 🔭 Faster chat search. Searching your chats, including from the Reference Chats menu and the model's chat search tool, no longer loads every matching chat in full, so results come back faster on large chat histories, and a result's message preview in the Reference Chats menu now loads when you hover it. Commit
• 📦 Batched document embedding. Large documents are now embedded and saved in batches of 1000 chunks by default, set with "RAG_EMBEDDING_BUFFER_SIZE", so processing a very large file holds far less in memory at once. Commit
• 🧾 Mistral OCR model choice. Administrators can now pick the Mistral OCR model and send extra request options through a Parameters field in Admin Settings > Documents or "MISTRAL_OCR_PARAMS", for example to stay on an older OCR model or to match what an Azure AI Foundry endpoint expects. #33333, #19707, Commit
• 📉 Negative relevance threshold. The Relevance Threshold in Admin Settings > Documents now takes negative values for rerankers that return raw scores below zero, where the field refused them and a negative "RAG_RELEVANCE_THRESHOLD" kept the page from saving while hybrid search was on. #33330, #29888, Commit
• 🎞️ Animated ComfyUI images. Images from ComfyUI's Save Animated WEBP and Save Animated PNG nodes now show up in the chat as the animated file, for both image generation and image editing. #33325, #33013, Commit
• 📡 Metrics skip health checks. OpenTelemetry metrics now leave out requests whose URL matches "OTEL_PYTHON_FASTAPI_EXCLUDED_URLS" or "OTEL_PYTHON_EXCLUDED_URLS", so health checks and probes no longer fill the request metrics, the same way traces already skip them. #33329, #31609, Commit
• 🗝️ Admins manage user API keys. Administrators can now rotate or delete a user's API key in the Edit User dialog, and a rotated key is shown once so it can be copied. #32774, Commit, Commit
• 👓 More hideable chat controls. Administrators can now also hide the selected tools, skills, filters, web search, image generation and code interpreter shown in the chat input, through Visible controls in Admin Settings > Interface or "UI_VISIBILITY". #32408, Commit
• ♿ Improved UI accessibility. Screen reader and keyboard users can now move through a chat message by message with each message's name as a heading, move through menus and submenus with the arrow keys, Home and End, reach a note's Generate title button and the options of a filter list opened with the mouse, leave the Compare revision editors with Escape and Tab, and hear names for every field of the calendar event window, the last column of the Users and Feedback tables and each day in the Settings > Usage heatmap, while the model picker outlines only one row, takes keyboard focus when opened in a window and leaves focus in that window when it closes, and focus outlines on tab rows are no longer cut off.
• 🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
• 🌐 Translation updates. Translations for Portuguese (Brazil), Catalan, Italian, Azerbaijani, Basque, Bengali, Bosnian, Bulgarian, Cebuano, Croatian, Czech, Danish, Dutch, Estonian, Faroese, Filipino, Galician, Georgian, German, Greek, Hebrew, Hindi, Hungarian, Indonesian, Irish, Japanese, Kabyle, Korean, Latvian, Lithuanian, Malay, Norwegian Bokmål, Persian, Polish, Punjabi, Romanian, Russian, Serbian, Slovak, Slovenian, Spanish (Spain), Swedish, Tamil, Thai, Tibetan, Turkish, Turkmen, Ukrainian, Urdu, Uyghur and Vietnamese were enhanced and expanded.

Fixed

• 🛡️ Security Advisory: This release contains security fixes. We strongly recommend updating all deployments as soon as possible to have the latest security fixes in place. These fixes are not listed in this changelog; we will publish the security advisories for them immediately following CVE assignment. Advisories
• 🔎 Search dialog filters restored. The search dialog again understands and suggests the "tag:", "folder:", "pinned:", "shared:" and "archived:" filters, where adding one emptied the results and archived chats could not be found at all. #33181, #32518, Commit
• 📍 Search locations by type. The Location filter in the search window now lists only folders for Chats and only channels for Messages, and switching the content type clears a location that no longer fits, where such a pick returned an empty list. #33183, #33182, Commit
• 🧮 Inflated streamed token counts. Token counts for a reply are no longer inflated when the provider reports its usage again on every streamed chunk, where every report was added up, so the usage shown for the reply and in Admin Analytics now matches the provider's final count. #32052, #29064, #28528, Commit
• 📝 Note typing after Formatting. Typing in a note now works right after switching Formatting on or off in the note's menu, where the editor stopped taking input and saving until the page was reloaded. #33222, Commit
• 🎙️ Note recordings kept. A recording in a note now stays in the note when the connection drops while it is being transcribed, for example when a laptop goes to sleep. #33240, Commit
• 🀄 IME typing with Backspace. Pressing Backspace while composing text with a Japanese or other input method in the chat input no longer ends the composition or makes the text appear twice, which started in 0.12.4. #33245, #33223, Commit
• 🤖 Photos for sub-agents. Models can now hand a photo attached in the chat to a sub-agent, where the hand-off failed with "file_ids not attached or unavailable" and no sub-agent started. #33244, #33241, Commit
• 🪆 Sub-agent partial output kept. A foreground sub-agent that stops at the tool-call limit now hands the model its partial output along with the error, where everything it had written was lost, and the error now reads as a plain message in both foreground and background. #33269, #33267, Commit
• 🔗 MCP failures keep the chat. A tool call to an MCP server that cannot be reached, for example after a restart or a dropped connection, now fails on its own and the reply still finishes, where the whole chat stopped as if you had pressed stop. #33272, #33268, Commit
• 🔃 Cut-off replies stay finished. A reply cut off by a server restart no longer goes back to the loading dots when the connection comes back later. #33277, Commit
• 🐢 Slow chat loads. Opening a chat on a slow connection or switching chats quickly now shows the chat you opened, where a slower earlier load could replace it with an old copy and the next message forked the chat. #33180, Commit
• 👁️ Tool images with Vision off. Models with Vision turned off now get a short "[image]" note in place of each image a tool returns, where the reply failed with an error and every later message in that chat failed the same way. #33345, #32720, Commit
• ✋ Stop button on others' replies. In a chat shared with Allow replies, the Stop button no longer shows on someone else's running reply, where it showed but did nothing. #33343, Commit
• 🧷 Refused sharing changes undone. The Access dialog of a prompt, skill, tool, note or knowledge base now goes back to the saved sharing when the server refuses a change, where it kept showing the refused change as if it were saved, and the model editor now shows the server's message for such a refusal. #33209, #33208, Commit
• 🔌 Tool server Headers reset. Adding another connection in External Tool Servers now starts with empty Headers, where it kept the previous connection's Headers and saved them on the new one. #33201, #33200, Commit
• 🧰 OpenAPI tools listed. The Available Tools window in a chat now lists the tools of an OpenAPI tool server, where it said "No tools found". #33205, #33204, Commit
• 🎛️ Generation switches update. Saving Title, Follow-Up, Tags or Autocomplete Generation in Admin Settings > Interface now updates the matching switches in Settings > Interface and autocomplete in the chat input right away, where they kept the old setting until a reload. #33197, #33196, Commit
• 🗂️ Local knowledge filter. Picking Local in the source filter on Workspace > Knowledge now lists knowledge bases made with Create, where it showed "No knowledge found". #33199, #33198, Commit
• 🪣 Large S3 Vectors deletes. Removing a file or knowledge base with more than 500 chunks from S3 Vectors now works, where the delete request went over the service's limit of 500 keys and failed. Commit
• 🔢 Empty embedding batch size. Clearing the Embedding Batch Size in Admin Settings > Documents now saves the default of 1, where files uploaded afterwards failed to process. #33288, #33287, Commit
• 🔊 Read Aloud with Kokoro.js. Read Aloud now speaks with the chosen Kokoro voice when Kokoro.js (Browser) is picked in Settings > Audio, where it used the browser's built-in voice while the server's speech engine was Web API. #33211, #33210, Commit
• 🔉 Kokoro.js without a GPU. Kokoro.js (Browser) now runs on the CPU in browsers that offer WebGPU but have no GPU available, where its voices never finished loading and Read Aloud kept spinning without speaking. #33233, #33232, Commit
• 🎨 ComfyUI failures reported. A ComfyUI workflow that fails, for example when the GPU runs out of memory, now shows an error and tells the model the image could not be made, where it was reported as a successful generation with no images. #33237, #33236, Commit
• 🖌️ Responses API images shown. Images that a model creates through the Responses API, such as Gemini image models through OpenRouter, now show in the chat, where they were saved but not displayed. #33320, Commit
• 🛝 Playground Controls applied. Settings chosen under Controls in the Playground, such as Temperature and Seed, now reach Ollama models, where they were dropped and every run gave a different reply. #33286, #33285, Commit
• 📋 Shift paste in channels. Holding Shift while pasting long text into a channel message or thread reply now keeps it as text when Paste Large Text as File is on, as it already did in chats. #33190, #33189, Commit
• 🧵 Thread replies while loading. A thread reply or model answer that arrives while the thread is still loading now shows up in full, and a reply no longer shows twice. #33346, Commit, Commit
• 👥 Analytics model chats by group. A model's Chats tab in Admin Analytics now follows the User group filter, where it listed every user's chats with that model. #33207, #33206, Commit
• 🙈 Hidden files in folder counts. The item count under a folder in a chat's terminal file browser now leaves out hidden files while Show Hidden Files is off. #33213, #33212, Commit
• 📁 Expanded folders kept. Deleting, renaming or adding a file in a chat's Files tab now keeps expanded folders listed, where every expanded folder came up empty. #33195, #33194, Commit
• 📌 Pins kept in shared folders. A member's chat now keeps its pin when the owner of a shared folder moves it to another folder inside that folder, where it dropped out of the member's Pinned list. #33342, #33341, Commit
• 🌙 Overnight calendar events. A calendar event that ends after midnight, such as 8:00 PM to 1:00 AM, now keeps its end time on the next day, where saving dropped it and stored the event as ending at its start time. #33290, #33289, Commit
• 🗓️ Midnight calendar events. A calendar event that ends at midnight now shows only on its own day in Month view, where it also showed on the next day. #33292, #33291, Commit
• 🪝 Old webhook removable. A notification webhook carried over from before v0.11 now stays removed from Settings > Notifications, where it came right back after Remove. #33295, #33294, Commit
• 🔔 New default notification target. A notification target added after removing the last one now becomes the default, where it never did. #33284, #33283, Commit
• 🗣️ Translated search and Skills labels. Labels in the workspace search, the Skills list, the skill editor and the terminal file browser now follow the interface language, where several always showed in English. #33308, #33304, #33305, Commit
• 📜 Keyboard tab scrolling. Scrolling on the Settings > Keyboard tab no longer moves the whole Settings window. #33187, #33186, Commit

Changed

• 🔀 Model switch keeps your picks. Switching models in a chat now applies the new model's default tools, skills, filters and features while keeping the ones you turned on or off yourself, where every switch cleared your picks, and chats with several models now get the default tools and skills of every selected model. Commit, Commit
• 📣 Model mentions switch chats. Sending a message to a model picked with @ now switches the chat to that model, where the mention stayed above the input and the chat kept its own model. Commit
• 🔁 Regenerate uses current models. Regenerating a response in a chat with several models now uses the model currently picked for that column, where it reused the model that first wrote the response. Commit
• 📎 Note attachments in pages. Files attached to a note now sit inside the page where they were added, and the attached files of existing notes move to the end of the note's first page. Commit
• 📂 Folder moves keep chat dates. Moving a chat into or out of a folder now keeps its last activity date, so it stays sorted by when it was really last active, where it jumped to the top of the sidebar under Today. #33327, #30362, Commit
• 📮 Automation failure webhooks. Admin event webhooks set to System events only no longer receive automation run failures, which now go to webhooks set to specific users or groups that include the automation's owner. #33331, Commit
• 📃 Knowledge base API responses trimmed. Adding, updating or removing knowledge base files and renaming or sharing a knowledge base through the API now return only the affected files or an empty list, so these calls no longer slow down as the knowledge base grows, and the full list stays available from the paginated files endpoint. #33335, #31397, Commit

Original source

Added
🎯 Load selected skills on demand. Administrators can turn on "Load selected skills on demand" under Admin Settings > General or set "ENABLE_SKILL_LAZY_LOADING", so skills selected in the chat or attached to a model are only listed for the model to load when it needs them instead of sending their full instructions with every message, while skills mentioned in the message still load right away, and it is off by default and needs the built-in Skills tool. Commit
📍 Compaction shown in chats. A "Context compacted" line now marks the message where older messages were summarized, opens to show the summary and also appears inside a reply when compaction ran between its tool calls, Chat Controls > Overview tags that message, and compaction progress and errors now show in the chat instead of as pop-up notices. Commit, Commit, Commit, Commit, #31324
🗜️ Compaction in more chats. Context compaction now also runs in temporary chats and in short chats that are already over the threshold, such as one question with a reply full of tool output, so the follow-up and any regenerate or edit of it no longer fail with a context length error. #32794, Commit, #32781, Commit, #32600
🕶️ Hide controls for users. Administrators can now hide single controls from users under Visible controls in Admin Settings > Interface or with "UI_VISIBILITY", such as model capabilities, default features and built-in tools in the model editor, Capture, Compare text, Attach Webpage, Attach Files, Attach Notes, Attach Knowledge and Reference Chats in the + menu, the /status, /model and /settings commands, the usage info, Fork, Merge Responses, Preview, Artifacts, Archive and Tags in chats, Set as default and Keep in Sidebar for models and settings such as the Usage tab and the speech engines, while hidden controls keep their values and the features behind them stay usable, hiding Archive also hides Unarchive, and administrators still see every control. Commit, #32830
🫙 Unavailable options hidden. Options that cannot take effect are now hidden, such as Capture in the + menu without a Vision model, Attach Notes for users without the Notes permission, the Valves pickers in Chat Controls for disabled tools and functions, the Context Compaction Threshold while context compaction is off, the title, follow-up and tag generation switches in Settings > Interface while the admin has turned them off, Compress Images in Channels for users who cannot use channels, the Web Search in Chat setting while web search is not available to the user, the Voice section of Settings > Interface for users who cannot make calls, group and default permission toggles for features the admin has turned off, the Terminal capability and default terminal in the model editor while no terminal server or direct integration is available, the New Temporary Chat and Delete Chat shortcuts for users who may not use them, the Web Search, Image Generation, Code Interpreter and Memory capabilities and Default Features in the model editor while that feature is off for the instance, built-in tools in the model editor that the model's capabilities rule out or whose feature is off, the engine settings in Admin Settings > Web Search and Admin Settings > Images while web search or image generation is off, the Web Search Query Generation switch in Admin Settings > Interface while web search is off, the Regenerate Menu and terminal settings in Settings > Interface while they cannot apply, "/skills:create" for models that cannot create skills, the Call button while speech-to-text is unavailable, the Audio settings tab for users allowed no speech or calls, the multi-factor authentication section while MFA does not apply to the user and the openwebui.com author link on a new chat while community sharing is off, while saved values are kept for when they apply again. #32969, #32967, #32959, Commit, Commit, Commit, #32962, #32973, #32976, #32977, #32980, #32961, Commit, Commit, Commit, Commit, Commit, Commit, #32972, Commit, #32975, Commit, #32983, Commit, #32966, Commit, #32978, Commit, #32963, Commit, #32965, Commit, #32984, Commit, #32985, Commit, #32986, Commit, #32974, Commit, #32981, Commit, #32971, Commit, #32970, Commit, #32964, Commit, #32830
🔏 Access button respects sharing. The Access button and menu entry of models, prompts, tools, knowledge, skills and notes and the Access button in folder settings are now hidden from users without the matching sharing permission, who had nothing they could change in its dialog. #32979, Commit, #32830
🖇️ Attach entries without uploads. When files cannot be attached, because of a missing permission or a selected model without File Upload, the greyed Attach Knowledge, Reference Chats and Attach Notes entries in the + menu no longer open and the # and @ lists leave out what cannot be attached, including pasted links for users without the web upload permission, so a picked item no longer vanishes from the input without a message. #32968, Commit, #32830
⏱️ Exact last active time. Hovering the last active time in the admin user list and in a group's member list now shows the exact date and time. Commit
🗨️ New chat from folders. A folder's menu in the sidebar now has a New Chat item that starts a chat in that folder. Commit
🪪 Profile cards across the workspace. Hovering an owner's name in the workspace lists of models, knowledge, prompts, skills and tools and in admin Functions now opens their profile card instead of an email tooltip, with their profile picture next to the name, profile pictures in access settings, version history and the Analytics user list open the card too and the Notes list shows each owner's profile picture. Commit, Commit, Commit, Commit, Commit, Commit
🔢 Turn count in chat previews. The preview shown when hovering a chat in the sidebar now shows how many user and assistant turns its current branch has. Commit
🎚️ Chat Controls saved per setting. A change in a chat's Controls, such as its system prompt or a parameter, now saves only that setting, so a copy of the chat open in another tab or on another device no longer wipes it with older settings. Commit, #32755
🪃 Questions survive reconnects. When the page reloads or loses its connection while Ask User, a tool approval, an MCP server's input request or a function's confirmation or input dialog waits for you, the question now comes back once you reopen that chat within a minute, so the request no longer waits without an answer. Commit
✍️ Note edits by text. The model can now edit a note by finding and replacing exact text instead of only by character offsets, picking one match or all of them and getting the positions and surrounding text back when a match is ambiguous. Commit, #32752
🔍 Compare view stays aligned. Matching rows in the two panes of the Compare view now stay lined up and in place while scrolling, resizing or editing, and a colored bar now marks changed lines also while whitespace or emphasis markers are ignored. Commit, Commit, Commit, Commit
🖱️ Clickable setting labels. Clicking the label of a setting across user and admin settings, including advanced parameters and connections, now toggles its switch, focuses its field or presses its button, and the label highlights while the row is hovered or focused, so the right control is easier to find. Commit, Commit, Commit, #32768, #32900
☑️ Select several sidebar chats. Shift-clicking a chat in the sidebar starts a selection that more clicks or a shift-click range extend, and the selected chats can then be archived or, with the delete permission, deleted together, while Escape clears the selection. Commit, #32543
🫲 Swipe open Chat Controls. On a phone, swiping left across a chat now pulls in the Chat Controls panel, which follows your finger like the sidebar does and closes again with a swipe to the right. Commit
🗃️ Bulk file management. Manage Files in Settings > Data Controls can now download a single file and lets you select several files or all files matching a search to delete them or download them together as one zip archive, with progress and a stop button. Commit
📥 Accurate upload status. A file uploaded to a knowledge base now only shows as done once it is indexed and linked to the knowledge base, so it no longer shows as done and then goes missing from the list until a reload. Commit, #32803
⏳ Knowledge files show Processing. A file added to a knowledge base now switches from Uploading to Processing once it reaches the server, and the list keeps itself up to date until the file is ready, so it no longer says Uploading until you reopen the knowledge base. #32982, Commit
🧮 Knowledge uploads listed at once. Files selected or dropped together into a knowledge base now all appear as Uploading right away in upload order, so each one no longer waits to appear until the file before it has finished processing. #32992, Commit
📈 Analytics by tokens. The Admin Analytics dashboard now ranks models and users by tokens by default with a switch back to messages, and its usage chart adds volume and activity views, a single model view, a comparison with the previous period, a choice of time steps and Year to date and Last 12 months ranges. Commit, Commit, Commit, Commit, Commit, Commit
🗂️ File browser grid view. The terminal file browser can now switch between a list and a grid view from its menu, folders show how many items they hold, and on larger screens hovering a file shows a preview, up to 1 MB for text files and 20 MB for images, audio, video and documents. Commit, Commit, Commit
📁 File browser folder menu. A folder's menu in the terminal file browser now has New File and New Folder items that create the file or folder inside that folder. Commit, Commit
📬 First-message terminal uploads. With Chat Uploads set to Filesystem on a Per chat terminal, a file attached to the first message of a new chat now waits and uploads into that chat's own terminal when the message is sent, so it no longer lands in the shared workspace. Commit, #30245
🪧 Folder descriptions. Folders can now have a description in their settings, shown under the folder title on the folder's page. Commit, Commit
🚚 Organize chats in shared folders. The owner of a shared folder can now rename chats other people started in it and drag them to another folder within the same shared folder. Commit
🛰️ MCP protocol 2026-07-28. MCP connections now also work with servers that speak the stateless 2026-07-28 protocol version, while older servers still connect through the earlier handshake. #33087, Commit, #29778
📧 LDAP default email domain. Administrators can now set a default email domain in the LDAP settings or with "LDAP_DEFAULT_EMAIL_DOMAIN", so LDAP users without a mail attribute sign in with their username at that domain as their email address and into any existing account with that address, which is why the domain should be one you control. Commit, #33001
🔐 OAuth connections over the API. Connections set to OAuth authentication now also send the user's OAuth token when the user calls the API with an API key or bearer token, like tool servers already did. #32826, Commit, #32820
🫣 Hidden base models for groups. Administrators can now turn on the Hidden Models permission under Models Access in the user and group permissions, or set "USER_PERMISSIONS_WORKSPACE_MODELS_HIDDEN", so those users can pick hidden models as the base model of a workspace model while the hidden models stay out of their model picker. Commit, #29806, #29639
🧾 Model usage in audit logs. With audit logging on and "/chat" removed from "AUDIT_EXCLUDED_PATHS", where it is excluded by default, each chat reply and tool call round now writes its own audit log entry with the model and the input, output and total tokens the provider reported, linked to the request that started it. Commit, #30098
📨 Voice call user headers. With "ENABLE_FORWARD_USER_INFO_HEADERS" on, Realtime voice calls now also send the user info headers, or the signed user JWT when configured, to the realtime provider, like chat requests do. #32733, Commit
🏎️ Faster action buttons. An action button now only saves the chat again when the action changed a message, so actions on large chats finish sooner. Commit, #32658, Commit
👪 Faster group saves. Saving, deleting or changing the members or permissions of a group now finishes in well under a second with thousands of users online, where it took several seconds and reloaded the open chat of everyone online. #32883, Commit, #32882, Commit
🧳 Faster folder changes. Renaming, sharing, moving or deleting a folder and deleting all chats now finish quickly with thousands of users online, where each took several seconds and reloaded the open chat of everyone online. #32888, Commit
📣 Faster channel posts. Posting a message in a channel with many members online now returns in a fraction of a second, where it waited for every online member's login to be checked again first. #32889, Commit
📊 Faster analytics dashboard. The Admin Analytics dashboard now gets its totals, model and user lists and daily charts from fewer and lighter database queries, so it opens faster on instances with many messages. Commit
♻️ Prompt cache survives restarts. Tools from tool servers, Open Terminal included, now reach the model in the same form after every restart, so the provider's prompt cache keeps working and long chats are no longer processed again from scratch. #33000, Commit
👁️ PDF image OCR stays light. With PDF Extract Images (OCR) on, reading text from images in PDFs now uses one processor thread per upload by default, so uploads no longer start a thread pool the size of the server's cores that could slow the whole server down, and administrators can pass their own RapidOCR settings with "RAPIDOCR_PARAMS". Commit, #32844
♿ Improved UI accessibility. Screen reader users now hear the Send button, the sidebar's user menu button by the name it shows, Playground's role button by the word it shows, the model editor's Description, Tools, Skills, Filters and Actions rows by what they show, a sidebar folder's options button, the sidebar button on Calendar, Notes, Channels and Home on phones, the on/off switches on Skills, Functions and Automations rows, the suggested prompts on a new chat as buttons, Archived Chats as a table, the sort order on the column headers of Archived Chats and the Evaluations leaderboard, chat input pills and menus, copy, export, merge and artifact buttons, clear search and Cancel buttons, the note editor's Undo, Redo, Record and Note Menu buttons, Playground's System Instructions button and model selects, the code box in the tool and function editors, switches, icon buttons, selects and number inputs in Admin Settings, the Create knowledge base, Create Prompt and Clone Prompt dialogs and the close button of 22 dialogs by name, together with a source's number, the number on a channel's member count button, the choice a Visibility button shows, a resizable panel's width, how long ago each sidebar chat was updated, the info button under a reply with its usage figures, a model's description, notifications such as copy confirmations (copying a prompt in Workspace included), when a reply starts and finishes, call mode's Listening and Thinking status, menu buttons as menus with their open state, the selected search content type, how many archived chats a search found, how many models match a search in the model picker, the Settings window by name, the sidebar folder toggle by name with its open state, the chosen option in Select dropdowns, the search window's list by its visible caption, a heading on each Workspace page, the sidebar section titles and chat date groups as headings, the sidebar's models, folders and chats as lists, the Settings tabs as Personal and Admin tab lists that point to their panels, the items of the input, integrations, user and chat menus as menu items, the Keyboard tab's shortcut categories as headings with a list under each, the chat input as a text field, the sidebar logo link as New Chat, the onboarding logo by the instance name with other branding images hidden as decoration, the model logos on a new chat by model name (hidden when only one model is selected), the model the arrow keys are on in the model picker, the model name and the Suggested label on a new chat as headings, the suggestion list by name and the chat title as the page heading, and no longer hear an open or closed state on the area around the sidebar button in Channels on phones; keyboard users get the model picker's More and Eject buttons that show on focus, filter lists that move focus to their options when opened, tooltips that show on focus and close with Escape, Escape in the model picker's More menu or filter list that closes only that list, focus that returns to the model picker button when the picker closes with Accessibility Mode on, an outline on the model picker row the arrow keys are on, focus that moves to the other sidebar button when the sidebar opens or closes, arrow keys that move through the input, integrations, user, chat and Terminal menus, a Terminal menu that opens on its first terminal, a Tab key that reaches the note editor's Record and Note Menu buttons, Evaluations leaderboard columns they can sort and models they can open from it, focus that stays on a Workspace section link after choosing it, focus that stays in the Archived Chats list after unarchiving a chat, focus on the recording bar when dictation starts and a Skip to main content link that now moves focus to the page content; notification text in the light theme and the chat dates in Archived Chats now meet the 4.5:1 contrast minimum; buttons in the collapsed sidebar, on sidebar folders, on Prompts, Skills, Functions and Automations rows, on Workspace and Notes list rows, on attached files and in the Integrations menu are no longer nested inside other buttons; the Archived Chats and Keyboard lists stay usable at 400% zoom; and with Accessibility Mode on, pinch zoom works on phones, the active Workspace section is underlined, code editor placeholders, the model editor's JSON Preview row and Calendar's days from other months and today's date meet the contrast minimum, and the More and Eject buttons and Set as default in the model picker, the version link and See what's new in Settings > About, the sidebar's Chat Menu button, the Note Menu and Delete buttons in Notes, the More button on file rows, the Create button's menu arrow, Calendar's previous and next month buttons and the name, ID and command fields in the model and prompt editors are at least 24 pixels in size.
🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
🌐 Translation updates. Translations for Korean, Cebuano, Thai, German, Japanese, Vietnamese, Urdu, Bengali, Hungarian, Tibetan, Turkmen, Lithuanian, Danish, Basque, Irish, Slovenian, Estonian, Croatian, Faroese, Georgian, Portuguese (Brazil), Spanish (Spain), Hindi, Finnish, Kabyle, Galician, Uyghur, Slovak, Norwegian Bokmål, Serbian, Ukrainian, Polish, Turkish, Bosnian, Dutch, Czech, Bulgarian, Hebrew, Punjabi, Swedish, Romanian, Persian, Greek, Malay, Latvian, Azerbaijani, Indonesian, Tamil, Filipino and Russian were enhanced and expanded.
Fixed
🛡️ Security Advisory: This release contains security fixes. We strongly recommend updating all deployments as soon as possible to have the latest security fixes in place. These fixes are not listed in this changelog; we will publish the security advisories for them immediately following CVE assignment. Advisories
📤 Chat export permission respected. The Export item of a folder in the sidebar, the Export option in Archived Chats and the Copy option in the chat menu are now hidden from users without the Allow Chat Export permission, like the export options of single chats. #32703, Commit, #32702, #32684, Commit, #32683, #32960, Commit
🎛️ Pipe Valves permission respected. The Valves button of a pipe model in the chat input is now hidden from users without the Allow Chat Valves permission. #32772, Commit, #32771
👥 One model without Multiple Models. A new chat now starts with a single model for users without the Multiple Models permission, where a default or a link with several models kept them all selected. #32668, Commit, #32667
🖊️ Chat Edit permission respected. The Edit button of a user's own messages is now hidden from users without the Allow Chat Edit permission, where only the Edit button of replies was hidden. #32841, Commit, #32832
📅 Calendar page respects access. Opening the Calendar page with Calendar turned off or without the Calendar permission now returns to the home page, where it showed an empty calendar and an error. #32837, Commit, #32834
🔒 Live access after archiving. People who see a chat through a shared folder now stop receiving its live updates when the owner archives it or archives all chats, and people with a share link stop when the owner unshares all chats, as they already did when a single chat was unshared or deleted. #32887, Commit
🧵 Thread replies deleted too. Deleting a channel message now also deletes its thread replies, which stayed behind and could still be found in search. #32666, Commit, #32665
🔗 Shared chat pages load once. Chats opened under /s/, through a share link or by an administrator viewing another user's chat, no longer reload over and over and jump back to the bottom, which since 0.12.3 made scrolling up impossible. #32725, Commit, #32657
🧹 Deleting the open chat. Deleting the chat you are viewing from the sidebar now opens an empty new chat, where the deleted chat's messages stayed on screen and the next message failed, in Safari with "The string did not match the expected pattern." #33069, Commit, #33068
🪡 More Concise and Add Details. Choosing More Concise or Add Details or typing a suggestion under a reply now rewrites that reply, where the model got the instruction without the reply and answered it on its own, for example with "OK, I'll keep answers shorter". #33084, Commit, #33083
📱 Sign-in page on small screens. The sign-in page can now be scrolled when it is taller than the screen, such as on phones with the keyboard open, where parts of the form could be out of reach. Commit
🖼️ Note menu image uploads. Images picked with Upload files in a note's menu now appear in the note, where they were saved with the note's files but never inserted. #32793, Commit, #32792
📜 Prompt history on unchanged saves. Saving a prompt without changes no longer adds an identical version to its history. #32709, Commit, #32708
🎨 Images after tool approval. Images the model generates after you answer its question or approve or reject a tool call now appear in the reply, where they were created but never shown and the model kept retrying with more hidden images. #32680, Commit, #32678
🧬 Embeddings with Prefix ID. The embeddings API now works with models from a connection that has a Prefix ID, where the provider rejected the prefixed model name as unknown. #32724, Commit, #32715
📞 Realtime calls answer once. A Realtime call no longer answers the same sentence twice when a short pause splits it into two turns. #32773, Commit, #32764
⬅️ Right-to-left question cards. Question cards from Ask User now follow the Chat Direction setting, so Hebrew and Arabic questions and answers are laid out right to left. #32784, Commit, #32778
🛠️ Same-named tool functions. When two attached tools have a function with the same name, the model can now call both, where only the first one could be called. #32670, Commit, #32669
🧷 Tool server array parameters. An array query parameter now reaches an OpenAPI tool server as repeated values instead of one text value that looks like a Python list. #32677, Commit, #32676
📖 Reading files in pages. The model's file reading tools now return every part of a file or knowledge base file read in pages with line numbers on, where some text between pages was skipped, and asking for only an end line now reads from the first line up to it, where the model got the same opening part back and kept retrying. #33155, Commit, #33099, #33154, Commit, #33100
📚 Multi-folder knowledge drops. Dropping several folders on a knowledge base now uploads all of them, where only the first one was uploaded. #32653, Commit, #32652
🙈 Base models after publishing. Hiding, toggling or editing a base model right after making it public in Admin Settings > Models is now saved. #32655, Commit, #32654
🧩 Restored skill-only drafts. A draft that holds only a skill, brought back to the chat input, now sends only that skill, where the names of every skill were sent. #32690, Commit, #32689
🐍 Python code block results. Running a plotting block again now shows only the new plot, and a block whose last value is a date, decimal number or other object shows that value instead of "Maximum call stack size exceeded". #32686, Commit, #32685, #32682, Commit, #32681
🪟 Preview of an earlier artifact. Preview on an earlier code block now opens that block's artifact when the artifacts pane was closed, where it opened the newest one. #32688, Commit, #32687
📎 Attachments in the chat input. An attached webpage now stays when file upload is not allowed, and a file's Entire Document switch shows that file's own setting after another attachment is removed. #32701, Commit, #32700, #32699, Commit, #32698
🕸️ Web pages on fresh installs. Attached web pages and other HTML text extraction return their text again on fresh installs, where a broken update of a library underneath made them come back empty. #33103, Commit
🔎 Shared Chats search paging. A search in Shared Chats or in an admin's view of a user's chats now loads more than the first 60 results. #32675, Commit, #32674
📂 Open folder stays open. Deleting another folder in the sidebar no longer closes the folder page you have open. #32697, Commit, #32696
📝 Note pins and counts. The Notes list now shows Pin for a note unpinned from the sidebar, and readers of a note shared as read only see its word and character counts instead of zero. #32707, Commit, #32706, #32711, Commit, #32710
🪞 Notes open once. A note that two people open at the same time, such as one imported from a Markdown or text file and not edited since, no longer shows and saves its text twice, also with several workers. #33004, Commit, #33002, Commit, #32824
🔊 Voice from Settings > Audio. Read Aloud and voice mode now use the voice picked in Settings > Audio, which in Firefox fell back to the default voice. #32705, Commit, #32704
🔈 Read Aloud stops on failure. Read Aloud now stops requesting the remaining sentences once one fails, so an unavailable speech provider shows a single error instead of one for every sentence. #33028, Commit, #33023
🗄️ Archived chats survive folders. Archive All Chats now takes the chats out of their folders, so deleting a folder afterwards no longer deletes those archived chats for good. #32647, Commit, #32646
🔌 No hangs after closed pages. Closing a page while it was still loading, such as a chat export or a file's processing status, no longer loses database connections on SQLite, where later requests could hang or fail with 503 once enough were lost. #32617, Commit, #32609, #32741
🧱 Frontend build on Windows. Running npm run build or npm run dev on Windows works again, where the encryption module check added in 0.12.3 failed on Windows paths and line endings, and the build now runs with a 12 GB memory limit like the Docker build. #32735, Commit, #32656
🪄 Function input dialogs answered. Confirming or cancelling a function's input or confirmation dialog now reaches the function when a script event arrived while the dialog was open, where the function kept waiting for an answer. #32744, Commit, #32742
❓ Clearer Ask User error. When a model sends the Ask User questions as something other than a list, such as a JSON string, it now gets an error saying they must be an array of question objects instead of "ask_user requires 1-3 questions", which made models repeat the same call. #32727, Commit, #32662
🛑 Stop sequences with percent. A stop sequence containing % no longer stops every message from sending. #32649, Commit, #32648
🗜️ Channel image compression by default. With image compression on, images in channels are now compressed when Compress Images in Channels is left at its default, where they were sent uncompressed. #32693, Commit, #32692
🎙️ Microphone off when leaving. Leaving a chat while dictating now turns the microphone off. #32640, Commit, #32638, #32639
✏️ Chat titles of only spaces. Renaming a chat to only spaces now keeps its title and shows an error instead of saving a blank title. #32770, Commit, #32769
💬 Prompts from / in channels. Picking a prompt from the / menu in a channel now inserts the prompt text instead of a command chip. #32713, Commit, #32712
🔤 No stray formatting spaces. Chat messages no longer show an extra space at the start of each paragraph and before italic, bold, struck-through or linked text, which appeared in 0.12.3 and left a gap after an em dash. #32743, Commit, #32739
🔁 FastMCP list results sent once. List results from tools on servers built with the standalone FastMCP package now reach the model once instead of twice, as text and as structured data. #32726, Commit, #32719
🪢 MCP tools with alternative inputs. MCP tools that describe their input as alternatives, such as a page by ID or by path, now receive the arguments the model sends, where they were called with none and the server rejected the call. #32903, Commit, #32898
🩺 Readable MCP tool errors. When an MCP tool returns an error, the model now gets the server's error text as written instead of an unreadable dump of the whole result, so it can correct the call where it tended to retry the same broken one. #32942, Commit, #32918
📞 Ended Realtime calls named correctly. When the voice provider ends a Realtime call, the call now shows "Voice provider connection closed" instead of sometimes showing "Voice connection failed". #32730, Commit, #32729
🧭 Scrolling while a reply streams. On slow or busy devices a streaming reply now keeps the view at the bottom as its content grows, where it stopped following partway through, and scrolling up while it streams is no longer pulled back down. Commit, #32728
⚡ Early updates in new chats. The first reply of a new chat no longer stays empty with the Stop button showing when its error or content arrives before the page knows the new chat, a message added while a chat is still loading no longer stays missing until a reload, and a message queued during the first reply of a new chat is sent once that reply finishes. Commit, Commit, #32550, #32761
🧠 Reasoning replay with Azure. Reasoning models on Azure OpenAI through the Responses API no longer fail with an "Unknown parameter" error on the request after they think and then call a tool. Commit, #32805
📋 Drafts with variables kept. Reloading the page with a chat input draft that contains {{ }} placeholders, or editing a queued message that contains them, now keeps the text as it was, where it asked for input variables and dropped the text. Commit, #32650
🔑 OAuth 2.1 static MCP secrets. MCP connections using OAuth 2.1 (Static) now send the client secret through HTTP Basic authentication when the server does not take it as a form field, where servers such as X Ads that list the public client method first got no secret and rejected the sign-in. #32818, Commit, #32813
🌍 Web Search settings save. Admins can now save Web Search settings such as the web loader while web search is turned off, where empty search engine fields blocked saving. #32840, Commit, #32831
🖌️ Images settings save. Admins can now save Images settings while Image Generation or Image Edit is turned off, where a missing API key or URL for that feature's engine, such as the OpenAI key on a fresh install, blocked every change on the page. #32949, Commit, #32835
🌄 WebP image editing. Editing a WebP image with Image Edit now works in the Docker image, where the image reached the provider without an image type and was rejected. #32902, Commit, #32899
🍴 No fork in temporary chats. The Fork chat option is now hidden in temporary chats and the /fork command answers that there is no chat to fork, where forking failed with an error. #32839, Commit, #32833
🚀 First message after loading. A message sent right after the page loads is no longer wiped by the new chat setup still running, where it disappeared and its reply stayed empty until a reload. #32829, Commit, #32819
📑 MinerU key in local mode. Document extraction with MinerU in local mode now sends the configured API key to MinerU 4.x servers that require one, where every document failed. #32838, Commit, #32836
🚫 Model import reports taken IDs. Importing models on the Workspace Models page now stops with an error at a model whose ID belongs to another user's model the importer cannot edit or, for non-admins, to a connection model, where that model was skipped without a message. #32866, Commit
🎞️ Left-aligned PowerPoint titles. The PowerPoint preview now keeps titles and subtitles that the file aligns left on the left, where it centered them. #32876, Commit, #32873
🫥 Multi-model hover previews. Sidebar hover previews of a chat with replies from several models now show one reply at full width, where every reply was squeezed into the card. Commit, #32858
🐚 Launcher help in zsh. The examples in the Docker Compose launcher help now quote options with square brackets, so they also work when pasted into zsh. #32881, Commit, #32878
🌡️ Context gauge uses model threshold. The context usage gauge now measures against the compaction threshold set on the model or in the default model parameters, the same one compaction uses, where it ignored a lower threshold on the model and showed a chat as far from compaction. Commit, #32821
🏷️ Tooltips show text as written. Tooltips now show names, paths and descriptions that contain angle brackets as written, where they came out mangled or partly missing. #32953, Commit
📇 Knowledge file text edits. The Preview of a text file in a knowledge base now shows its indexed text and refreshes after you save an edit, where it kept showing the original upload, and saving empty content is now refused. Commit
📡 Websockets after Redis reconnects. With the Redis websocket manager and "retry_on_timeout" in "WEBSOCKET_REDIS_OPTIONS", an instance now accepts new browser connections again once Redis is back after its connection dropped, where since 0.12.3 every new connection could hang until the instance was restarted. #33009, Commit, #33008
🥞 One model More menu open. Clicking the More button of another model in the model picker, or clicking another model, now closes the More menu that was open, where the menus stayed open and piled up over the picker. #33020, Commit, #33019
Changed
🔧 Direct Integrations off disables connections. While Direct Integrations is off, as it is by default, the tool servers and Open Terminal connections that users and admins saved in their Integrations settings are no longer used in chats, where turning it off only hid the settings tab, so instances that never turned it on lose those connections until an admin turns on Direct Integrations in Admin Settings > Connections or sets "ENABLE_DIRECT_INTEGRATIONS". #32996, Commit
🔀 Sharing changed only in Access. Saving a model, prompt, tool, skill, knowledge base, note, channel or calendar no longer changes who it is shared with, which is now changed only in the item's Access settings, saved right away in the model editor, channel settings and external knowledge sources, or through the access endpoints that channels and calendars now also have. Commit, Commit
🐳 Python 3.12 Docker image. The Docker image now runs Python 3.12 on Debian 13 instead of Python 3.11 on Debian 12, so custom functions, tools and packages installed with pip inside the container need versions that support Python 3.12. #32861, Commit
🤝 Sharing permissions enforced everywhere. Sharing permissions such as Models Sharing, Knowledge Sharing and Folders Sharing now also apply to sharing through the API, and a change in an item's Access settings that a user is not allowed to make is now refused with an error instead of being quietly left out. Commit
🗄️ Manage Files shows only yours. Manage Files in Settings > Data Controls now lists only your own files, also for administrators, who saw every user's files there while "BYPASS_ADMIN_ACCESS_CONTROL" was on, as it is by default. Commit
🕹️ Model controls for all users. Anyone with access to a model can now pick its model control options, such as a Thinking level, and parameters saved to an account are no longer filtered by the Allow Chat Controls and Allow Chat Params permissions, which now only hide the Chat Controls and Advanced Parameters panels. #32860, Commit, #32626
🚦 Stricter MCP timeouts and redirects. "MCP_INITIALIZE_TIMEOUT", 10 seconds by default, now also limits listing tools and reading resources on MCP servers, so slow servers may need a higher value, and MCP connections now only follow redirects that stay on the same address. #33087, Commit
⌨️ Shift quick actions removed. Holding Shift over a sidebar chat no longer shows the quick Archive and Delete buttons, since Shift-click now selects chats, which are then archived or deleted together, and deleting asks for confirmation first. Commit, #32543
✉️ No emails on hover. Hovering an owner in the workspace lists and admin Functions, or a person in access settings, no longer shows their email address, since the profile card that replaces the tooltip does not include it. Commit, Commit, Commit

Original source

Added

• 🔐 End-to-end encrypted chats. Direct messages and private group channels can now hold a temporary end-to-end encrypted chat: a member picks Encrypted Chat in the channel menu, the other members see "Encrypted chat in progress" with a Join link, messages of up to 16 KiB are encrypted in the browser with MLS and only passed through the server without being saved, participants can verify each other by comparing codes and see when others are typing, and the chat is cleared when you leave or reload and ends when channel membership or access changes. Administrators turn it on under Admin Settings > General > Encrypted channels or with "ENABLE_ENCRYPTED_CHANNELS" and grant it with the new Encrypted Channels permission, off by default or set with "USER_PERMISSIONS_FEATURES_ENCRYPTED_CHANNELS", and it needs websocket connections with websocket server logging off and HTTPS in production. Commit, Commit, Commit, Commit
• 📡 Much lighter streaming with Redis. With Redis, a streaming reply is now stored under its own key and new text is appended to it instead of rewriting the whole reply into a shared hash on every update, and replies started on older instances are still read during an upgrade; with room channels on, each instance now only subscribes to the rooms of people connected to it, so Redis no longer sends it live updates for chats it does not serve. Commit Commit #32478
• 🔍 Compare view options and undo. The Compare revision view has a Comparison options menu to ignore whitespace, ignore emphasis markers or only show changes with the unchanged lines folded away, an Undo button that steps back through your edits in both panes in order, and changed lines that are now lined up by their matching text. Commit, Commit, Commit, Commit
• 📝 Richer Markdown file previews. Markdown files opened in the terminal file browser now render with the same renderer as chat replies, including math, footnotes, highlighted code blocks, alerts and Mermaid diagrams, as well as HTML blocks mixed with Markdown, laid out as a compact document, and task list checkboxes in an editable file can be ticked to save the change to the file. Commit Commit Commit #32514
• 👀 Live collaborators in shared chats. The top bar of a chat now shows the pictures of the other people who have the same chat open at that moment, up to three and a count for the rest, with a Collaborators list that opens their profile cards. Commit, Commit, Commit
• ✏️ Edit and regenerate in shared chats with replies. In a chat from a shared folder that allows replies, people who may edit messages can now edit a prompt to start a new branch and regenerate any reply, not only replies to their own messages, and others viewing the chat stay on the branch they had selected. Commit, Commit
• 🗄️ Folder access in the folder editor. Sharing a folder now happens through an Access button in the Edit Folder dialog instead of a Share item in the folder menu, the sharing mode can be set before anyone is added, and subfolders note that access granted to parent folders also applies to them. Commit, Commit
• 🔎 Workspace search. The search window now searches your chats, chats in folders shared with you, chats shared with you, channel and direct messages and notes in one place, with filters for content type, a folder or channel, and whether something was created by you or shared with you, highlighted matches, a preview of each result with Ctrl/Cmd + Enter, Copy link, and channel results that open the thread scrolled to the matching message. Commit, Commit, Commit
• 💭 Comments in document previews. Word, Excel, PowerPoint and PDF files opened in the terminal file browser now show their comments and replies, marked where they belong in the document and opened by hovering or tapping a marker, and older .xls spreadsheets can now be previewed too. Commit
• 🧹 Clear Input Selections shortcut. Clearing the model override, selected tools and filters and the web search, image generation and code interpreter toggles from the chat input is now a shortcut you can change in Settings > Shortcuts, still Escape by default. Commit
• 🙋 Ask about a file from the file browser. Selecting text in a file open in the terminal file browser now shows an "Ask or edit…" box that sends your request to the model with the file attached and the selection quoted, so it can answer or edit that file in the same terminal; unsaved edits can be saved before sending, and requests sent while a reply is running wait in the queue. Commit
• ☁️ Google Drive access limited to picked files. The Google Drive picker now asks only for access to the files a user picks instead of read access to their whole Drive, so self-hosted installs no longer need Google's restricted-scope verification and users no longer see the "Google hasn't verified this app" warning. #32531 Commit #29537
• 📜 Full text of long status lines. Status lines above a reply, such as a token usage summary sent by a function, can now be clicked to show their full text, and with several status lines the history shows every entry in full. #32532 Commit #30056
• 📏 Skill read limits. Administrators can set how many characters of a skill the model reads at once and how long the preview of longer instructions is, under Admin Settings > General with "Skill Read Limit" and "Skill Preview Length" or the "SKILL_CONTENT_MAX_CHARS" and "SKILL_PREVIEW_MAX_CHARS" environment variables, which default to 20000 and 5000. Commit
• 🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
• 🌐 Translation updates. Translations for Portuguese (Brazil), Chinese (Traditional), Arabic, Bengali, Hebrew, Georgian, Punjabi, Slovak, Serbian, Urdu, Uzbek and Vietnamese were enhanced and expanded. #32440, #32482, #32501

Fixed

• 🧾 API key header requests in the audit log. Requests authenticated with an API key in the x-api-key header, as Anthropic SDKs send it, or in a header set with "CUSTOM_API_KEY_HEADER" now appear in the audit log under the key's owner, and failed attempts with a wrong key are logged without a user, where these requests were missing from the audit log. #32443, Commit
• 📚 Knowledge sharing kept on rename. A collaborator with write access who edits a shared knowledge base's name or description no longer turns off sharing they could not set themselves, such as Public. #32450, Commit, #32449
• 🤝 Prompt and tool sharing kept on save. A collaborator with write access who saves a shared prompt or tool no longer makes it private for everyone; sharing they could not set themselves is now kept. #32493, Commit, #32492
• 📄 PDF export of long notes and chats. Long notes and chats now download as PDF, where Firefox failed with "Canvas exceeds max size" and Chrome saved a black PDF. #32459, Commit, #18334, #26373, #19583
• ⏩ Continue Response with several models. Continue Response now continues the reply it was clicked under, where in a chat with several models it could extend another model's reply. #32456, Commit, #32455
• 🏷️ Tags of imported chats. Imported chats now show their tags and the tags appear in tag suggestions, where tags missing from the account were not created on import. #32454, Commit, #32453
• 🔖 Tags of archived chats. Searching the sidebar for a tag whose chats are all archived no longer deletes the tag, which lost its original name when the chats were unarchived. #32452, Commit, #32451
• ⌨️ Input methods in channels. Pressing Enter to confirm a word while typing with an input method, such as for Japanese, Chinese or Korean, no longer sends and clears a channel message before the word is in. Commit
• 🖱️ Scroll error after leaving a chat. Scrolling a chat right before opening Notes no longer logs a TypeError in the browser console. #32458, Commit, #32457
• 📐 Steady first turn in new chats. The latest message and reply in a new chat now keep their real height when the chat gets saved and the message list reloads, so the view no longer jumps on the first turn. Commit
• 💬 Sending in channels. Your own channel message now stays in place when the server confirms it instead of being redrawn, and the channel scrolls to your new message as you send it, where it could jump or keep the old scroll position. Commit
• 📂 Terminal folder in new chats. In a new chat, files you attach are uploaded to the folder open in the terminal file browser and the file browser stays in that folder once the chat is created, where uploads could go to the default folder and the browser jumped back to it. Commit
• 📁 Shared folder settings and access. Editing a shared folder's models, system prompt or files no longer resets its sharing mode, and a subfolder in a folder shared with write access stays writable when it is also shared directly with read access. Commit, Commit
• 🔑 OAuth token refresh with client_secret_basic. When "OAUTH_TOKEN_ENDPOINT_AUTH_METHOD" is client_secret_basic, token refresh now sends the client credentials in the Basic header like sign-in does, where providers that accept only Basic rejected the refresh and Open WebUI deleted the user's OAuth tokens, breaking model connections and tool servers that use them until the next sign-in. #32507, Commit, #32506
• 🛠️ OAuth tools after sign-in. An OAuth MCP tool now stays turned on after its sign-in redirect when the model has default tools, and links with ?tools= turn the listed tools on. #32488, Commit, #32476
• 🔤 Admin default font kept. Saving Settings > Interface no longer stores the administrator's default font and image compression size as your own settings, so later changes to those defaults still reach you. #32497, Commit, #32496
• 🔊 Read aloud with slow speech. Read aloud no longer stops after the first sentence when the speech engine takes longer to produce the next one than the current one takes to play. #32484, Commit, #32446
• 🖼️ Inline HTML previews on Per chat terminals. Inline HTML previews in replies now find the file in the chat's own terminal workspace when the Open Terminal chat context is Per chat, where they showed "File not found". #32485, Commit, #32477
• 🧵 Replies in channel threads. A reply started in one channel thread no longer carries over to the next thread you open, where messages could quote a message from the other thread. #32490, Commit, #32489
• 📑 Scanned PDF previews. Previewing a scanned PDF without a text layer in the knowledge base viewer no longer scrolls the page up and pushes the header and toolbar out of reach. #32487, Commit, #32481
• ↩️ Right-to-left lists. Bullets, numbers and task checkboxes of Markdown lists now sit on the correct side for right-to-left text in replies and file previews. Commit, #32444
• 🔁 Regenerate in cloned shared chats. Regenerate now works in a chat you cloned or forked from someone else's share, where it failed with "You can only regenerate your own messages". #32508, Commit, #32505
• 🗑️ Delete hidden for repliers in shared chats. People replying in a shared chat no longer see a Delete button the server refuses, which made a deleted reply come back on reload; Delete shows to the chat's owner and to administrators when "ENABLE_ADMIN_CHAT_ACCESS" is on. #32480, Commit, #32479
• 🎛️ Model default features can be turned off. A model can now switch off a Default Feature, such as Code Interpreter, that the administrator turned on in Model Defaults, where it came back on when reopened and in new chats. #32500, Commit, #32498
• 🧰 Built-in tools turned back on stay on. A built-in tool such as Memory that is off in Model Defaults now stays on after a model turns it back on and is saved. #32504, Commit, #32503
• 🏠 Refresh with Landing Page Mode set to Chat. Refreshing a new chat when Landing Page Mode is Chat no longer hides the message field and opens the model menu in the top left corner. #32510, Commit, #32509
• 🗜️ Compaction during tool runs keeps sources out. Context compaction during a long series of tool calls now summarizes your own message without the knowledge and file content added to it, and that content is given back to the model afterwards. Commit, #32491
• 🧩 Built-in tools with a custom tools parameter. A model with a custom parameter named tools, such as one that turns on a provider's native web search, now keeps its built-in tools, attached tools and file context, and its custom tools are sent alongside them. #32530 Commit #32528
• 🔌 Tool servers back after an outage. With Redis, tools from OpenAPI tool servers now come back once the servers are reachable again, where an empty list cached while every server was down kept them missing until a restart or a save in the tool server settings. #32533 Commit #29573
• 📥 PDF links read as documents. PDFs from sites that block unknown clients, such as Wikimedia, and arXiv links like arxiv.org/pdf/1706.03762 now go to document extraction, where the model got the raw PDF bytes. #32523 Commit #32524 Commit

Changed

• 🎯 Model skills now load their full instructions. With the Skills builtin tool on, skills attached to a model in the model editor, which every new chat pre-selects, and skills picked from the chat input menu now send their full instructions with each message, where they were only listed by name and description for the model to load with view_skill; deployments that attached skills to models only to make them available should remove them from the model to avoid the extra prompt length, since every skill the user can read is listed for the model anyway. Commit
• 📮 Redis permissions for room channels. With "WEBSOCKET_REDIS_ROOM_CHANNELS" on, the Redis user now needs the PUBLISH, SUBSCRIBE, UNSUBSCRIBE and PING permissions and access to the "&socketio" and "&socketio#*" channels, while PSUBSCRIBE is no longer used; a missing permission is logged with how to fix it. Commit

Original source

Added

• 📑 MinerU 4.x servers. The MinerU document engine now works with self-hosted MinerU 4.x servers, where every document failed with a 404 because 4.x removed the old parsing interface; 3.x servers work as before, 4.x servers take a tier (flash, basic, standard or advanced) and enable_ocr in the MinerU parameters while language and model_version stay 3.x only, and images that 4.x returns inside the document text are left out of the indexed content. #32422, Commit, #31516
• 🤝 Keep both changes when comparing. The Compare revision view now has a Keep both button that puts the original and the proposed text of the selected change into the proposed revision, original first, so you no longer have to pick one side. Commit
• 📚 Open attached knowledge from its preview. Clicking the name in the preview of an attached knowledge collection now opens that collection in the workspace, and file and link names are real links that open in a new tab. Commit
• 🏷️ Model ID in custom headers. Custom headers on connections and tool servers can now use {{MODEL_ID}}, which holds the ID of the model handling the chat request, the workspace model's own ID for a workspace model and each model's own ID in a multi-model chat, so downstream services can route or log usage per model. #32426, Commit, #30006
• 🧾 Requested model in the audit log. Audit log entries for chat and completion requests, including the OpenAI, Ollama and Anthropic compatible endpoints, now carry a model_id field with the model the client asked for at every AUDIT_LOG_LEVEL, where the model only appeared in the request body and went missing when MAX_BODY_LOG_SIZE cut a long prompt; other requests log it as null. #32429, Commit, #30097
• 🔐 Custom TLS certificate for Milvus. Open WebUI can now connect to a Milvus server with a self-signed or company-issued TLS certificate by pointing the new "MILVUS_SERVER_PEM_PATH" environment variable at the certificate file, in normal and multi-tenancy mode. #32427, Commit, #31632
• 🧭 call_tool for Tool Search. With Tool Search on, the model now gets a new call_tool tool and runs a tool it found with search_tools through it, passing the tool's name and its arguments, instead of calling the deferred tool directly by a name that is not in the request's tool list, which strict providers rejected; approvals and other tool behavior stay the same. Commit, #32243
• 🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

Fixed

• 🔏 Channel message metadata kept server side. Channel messages posted or edited through the API no longer take their metadata from the request, so a user can no longer make a message appear to come from a channel webhook or a model. #32421, Commit
• 👮 SCIM cannot delete admins. An identity provider can no longer delete administrator accounts, including the first admin, through a SCIM delete request, which now answers with 403 and leaves the account in place, so a sync that prunes unassigned users can no longer leave the instance without an administrator; admins are removed in the admin panel. #32415, Commit, #27662
• 🗝️ Collection names checked as stored. Retrieval access checks now compare collection names the way vector stores resolve them, ignoring letter case and treating hyphens and underscores alike, so a name written differently can no longer pass the check as something other than the collection that is then read. #32435, Commit
• 📱 Voice on Android Chrome. Voice calls and dictation on Android Chrome no longer go silent or hang on Listening after about ten uses until the page is reloaded, since the microphone level display now releases its audio output after each turn. #32417, Commit, #29969
• 🖥️ Per chat terminal file actions. With the Open Terminal chat context set to Per chat, opening HTML files, running notebooks, saving edited files, creating new files, deleting several selected files and downloading a folder or selection as a zip now use the chat's own workspace, where HTML files showed "File not found" and saved files never appeared in the chat. #32418, Commit, #29965
• 🧮 Memory reindex rate limits. Reindexing memories, from the admin Reindex Knowledge and Memory Vectors button, a user resetting their memory vectors or the automatic reindex after an embedding model change, now follows the Embedding Concurrent Requests limit and batch size, where it sent one request per memory at once and rate-limited providers failed most of them with 429 errors. #32420, Commit, #32212
• ⏰ Automation run results. An automation run is now recorded as successful only after its reply finishes, and a reply that fails or is cancelled is recorded as an error that links to the chat, where runs counted as successful as soon as the reply started. Commit
• 📜 Long polling kept out of the audit log. With websocket support turned off, every socket.io long polling request is no longer written to the audit log as its own entry, which flooded it and could not be filtered with AUDIT_EXCLUDED_PATHS, so the audit log looks the same with either transport. #32425, Commit, #31871
• 📎 Sources of approved tools. With tool approval set to ask, a knowledge or file tool the user approved now saves and shows its sources below the reply, where they were lost after approval. #32439, Commit, #32436
• 🗂️ Sidebar hover previews. Moving the pointer from one sidebar folder to the next no longer leaves the first folder's preview open or keeps the next one from opening, and folder and chat previews now also open when the pointer rests on the padding around a name. #32438, Commit, #32437

Changed

• 🔖 Valkey connections tagged as Open WebUI. Open WebUI's Valkey vector store connections now report their library name as GlidePySync(open-webui), so operators of a shared Valkey or ElastiCache can tell its traffic apart; this needs valkey-glide-sync 2.5.2 or newer, so installs that use VECTOR_DB=valkey with an older manually installed version must upgrade it, or startup fails. #32428, Commit, #31654

Original source

Added

• 🧱 External apps in channels. Administrators can now turn on Apps in Admin Settings > General, or with "ENABLE_APPS", and connect external apps in the new Apps tab of Admin Settings by their HTTPS address, reviewing the permissions each app asks for, such as reading its mentions, reading channel messages or posting messages, and choosing who may use it; channel managers then add an app to a channel with Add Members in the channel info, where it is listed with the members and its own profile picture, and mentioning it with @ lets it answer in the channel with replies that can be shown only to the person who asked, show cards with a title, fields and a thumbnail, offer buttons or links, follow up with a later message for longer tasks or provide a Markdown file to download. Apps on a private network address can be reached over plain HTTP once their address is listed in "APP_ALLOWED_PRIVATE_ORIGINS". Open WebUI keeps a live connection to each app, Admin Settings > Apps shows whether it is connected, and a failed connection names the cause, such as a rejected API key, a wrong public key or an unreachable address. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
• 🎭 Avatars in Standard voice calls. A model's avatar now also appears in voice calls that use the Standard call mode, moves with the spoken reply and can play the model's gestures when the model uses native function calling, where avatars and gestures only worked in Realtime calls; the Voice avatar setting in the model editor is now shown even when Realtime is off. Commit
• 🪪 Profile cards from profile pictures. Clicking the picture of the person who wrote a message in a shared chat, of a shared chat's owner in the sidebar or of a direct message partner in the sidebar now opens their profile card. Commit
• 🗂️ Open sidebar folders in a new tab. Folders in the sidebar can now be opened in a new tab with a middle click or Ctrl or Cmd click, and their link can be copied from the browser's context menu. Commit, #29750
• 🔀 Compare and merge a revision. The skill file editor, the prompt editor and the system prompt in the model editor have a Compare revision button, and the chat input has Compare text in its + menu and a /compare command, each opening a side-by-side view where you paste a proposed revision, for example one written by a model, step through each change, copy changes in either direction and apply the result to your draft, the skill file editor also gets a Copy button for the open file, and comparing two files in the terminal file browser, with Select for Compare and Compare with Selected, now opens the same view. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
• 🔕 Mute channels. The menu of a channel or direct message now has a Notifications setting where Mentions only mutes it, so it no longer shows an unread count or notifies you unless someone @mentions you. Commit
• 📤 Export a skill as a .skill file. The skill menu has Export .skill, which downloads one skill with all its files as a single .skill archive, and .skill files can be imported like ZIP files, from disk or a link. Commit
• 📣 Typed mentions in channels. Writing @ name or #channel in a channel message without picking from the list now turns it into a real mention when the name matches a member, model, app or channel, and mentions pasted from another message keep pointing at the same person. Commit, Commit
• 👥 Who wrote in a shared chat. Chats in shared folders now show the pictures of everyone who wrote in them, up to three and a count for the rest, each opening that person's profile card. Commit
• 🗂 Folder previews on hover. Hovering a folder in the sidebar shows a card with its default model, its knowledge and its chat counts, with a button to edit the folder. Commit
• 🎠 Turn and zoom the voice avatar. In voice calls and in the model editor preview, the voice avatar can now be turned by dragging, panned with a right drag, Shift drag or two fingers, zoomed with the mouse wheel or a pinch and reset with a double click. #32378
• 🔍 Faster one-word chat search. Searching your chats for a single word is now about 40% faster, as each chat is checked once instead of twice. #32268, #32266
• 👯 Message pairs for every model. Generate Message Pair, Ctrl+Shift+Enter, now adds a placeholder reply for each selected model side by side, where only the first model got one, and the side-by-side view stays after a reload. #32309
• 🔆 Screen on during calls. The screen now stays on during Realtime voice calls as well as Standard ones and is allowed to turn off again once the call ends, where Realtime calls let it go dark and Standard calls kept it on after closing the call. Commit, #32251
• ☁️ Azure OpenAI Realtime calls. Realtime voice calls can now use Azure OpenAI: in the Voice calls section of Audio settings, administrators pick Azure OpenAI as the Provider, enter the Azure endpoint and the deployment name and sign in with an API key or with Microsoft Entra ID, and clearer errors now point to wrong credentials or a wrong URL or deployment, with the "AUDIO_REALTIME_PROVIDER" and "AUDIO_REALTIME_AUTH_TYPE" environment variables for the new settings. Commit, #32343
• 📊 Input and output tokens in analytics. The Analytics dashboard now shows model usage and user activity in one table with a Models and Users switch, and both lists show input, output and total tokens as separate columns that can each be sorted, where they showed a single Tokens column. Commit, Commit
• 🎚️ Realtime input parameters. Administrators can now add extra settings for the audio input of Realtime voice calls as JSON under Input Parameters in the Voice calls section of Audio settings, such as noise reduction, or with the "AUDIO_REALTIME_INPUT_PARAMS" environment variable. Commit
• 🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
• 🌐 Translation updates. Translations for Portuguese (Brazil), Italian, Czech, Romanian, Dutch, Ukrainian, Polish, Thai, Spanish, Malay, Persian, Korean, Arabic, Japanese, Indonesian, Russian, Vietnamese, Turkish, Hindi, German, Greek, Hungarian, Hebrew, Bulgarian, Swedish, Estonian, Norwegian Bokmål, Lithuanian, Croatian, Slovak, Bosnian, Danish, Slovenian, Galician, Latvian, Tibetan, Serbian, Bengali, Cebuano, Azerbaijani, Basque, Irish, Georgian, Kabyle, Punjabi, Faroese, Tamil, Uyghur, Urdu, Filipino and Turkmen were enhanced and expanded.

Fixed

• 🔓 Skill editor and more over plain HTTP. When Open WebUI is opened over plain HTTP at a network address, the skill editor, adding options to model controls, adding gestures to a voice avatar, Realtime voice calls and the Playground chat now work, where they failed with "crypto.randomUUID is not a function" and the skill editor stayed disabled. Commit, Commit, #32238
• 📑 Page titles for external knowledge citations. Citations from external knowledge bases such as Qdrant, Milvus or pgvector whose source is a web address now show the page title in the source list below the answer, matching the numbered markers in the text, where the full address was shown. #32232, #32231
• 🧭 Redis Sentinel master names with capital letters. With Redis Sentinel, a master name with capital letters in "REDIS_URL", such as myMaster, the default of the OT-Container-Kit redis-operator, now works, where it was lowercased and every Redis call failed with "No master found". #32234, #31918
• 🔐 Redis Sentinels with a password. Redis Sentinels protected with a password now work, as the credentials in "REDIS_URL" and "WEBSOCKET_REDIS_URL" are also used for the Sentinels, where every Redis call failed with "No master found"; Sentinel credentials set in "WEBSOCKET_REDIS_OPTIONS" still take precedence. #32241, #32240
• 🔗 External knowledge citation links. Clicking the title or Content link of a citation from an external knowledge base such as Qdrant, Milvus or pgvector now opens the cited web page, or shows the title as plain text when the source is not a web address, where it led to a not found error. #32233, #32231
• 🧰 Tools picked in new chats. Tools picked from the Integrations menu, the Web Search toggle and a picked skill in a new chat now stay on after switching to another chat and back or reloading, where the chat fell back to the model's default tools and broke prompt caching. #32235, #32084
• 📅 Recurring automations run once. Automations set with the Daily, Weekly or Monthly picker now run at the exact minute chosen in your own timezone, where they could run twice for one occurrence, and users behind the server's timezone could have their first run moved to the next day. #32264, #32263
• 📵 No voice calls in shared chats. The Voice mode button no longer shows in a shared chat you can reply in, and a call that was open closes when you switch to one. Commit
• 🙆 VRM 0.x avatar rest pose. Voice avatars made in the older VRM 0.x format now rest with their arms down and breathe and sway the right way, where their arms were raised and their idle motion was mirrored. #32270, #32269
• 🕶️ Follow-ups in temporary chats. Follow-up suggestions in temporary chats are now based on the reply just written, where they were generated without it. Commit
• 🔁 No reconnect loop after sign-in. A tab where you signed in without reloading the page now reconnects signed in after a connection drop, such as sleep, a network change or a server restart, where since 0.12.0 it reconnected several times per second until the page was reloaded and put heavy load on the server. #32341, #32338
• 📎 Note uploads no longer stuck. A file uploaded to a note while another file or edit was saved now finishes and stays attached after a reload, where it kept spinning and was saved without its file. #32328, #32327
• 🪟 Side-by-side replies after Regenerate. Adding a second model and pressing Regenerate now keeps both replies side by side after a reload, where the second reply showed as another version of the first. #32326, #32325
• 👎 Rating reason and comment kept. The reason and comment saved in the rating form are no longer wiped a few seconds later when the generated tags arrive, both on the reply and in Admin Panel > Evaluations > Feedback. #32334, #32333
• 🐙 GitHub skill imports with symlinks. Importing a skill from a GitHub link now works when the repository has symlinks outside the skill folder, such as a CLAUDE.md link at the root, where it failed with "Archives cannot contain links or special files". #32313, #32312
• 🗒️ Production versions with notes. Setting an older model version as production now works when the model has a note attached as knowledge, where it failed with "Referenced knowledge is unavailable". #32317, #32316
• 📂 Open knowledge file stays open. Deleting a folder in a knowledge base no longer closes the file open in the viewer unless the delete removed that file. #32319, #32318
• 💾 Save hidden on others' messages. In a chat shared with Allow replies, editing a message someone else wrote no longer shows a Save button that silently reverted the text; Send and Save As Copy stay. #32321, #32320
• 👁️ Re-enabled models stay on. In Admin Settings > Models, turning a model back on or showing it again now stays after a reload and the model appears in the chat model picker, where for a model never edited before the second change looked saved but was lost. #32354, #32353, #32368, #32365
• 💲 Dollar signs in Ask and Explain. Ask and Explain on selected text now keep dollar signs such as "$5" or "$&" in the selected text and in your question, where they were dropped or replaced with other text. #32356, #32355
• ▶️ Code blocks show their last value. Running a code block in the browser whose last line returns a number, list or other value, such as square(7), now shows that value, where it stayed on Running for a minute and ended with "Execution Time Limit Exceeded". #32360, #32359
• 🔔 Reminders for moved calendar events. A calendar event moved to a new time after its reminder went out now reminds you again before the new start, where it never reminded again. #32358, #32357
• 🌩️ MCP OAuth behind Cloudflare. Connecting an OAuth MCP tool server such as Canva now works when the provider's sign-in page is behind Cloudflare bot protection, where it failed with "OAuth client registration is still invalid after re-registration". #32364, #32363
• 🗃️ File list for pipes and tools without attachments. Pipes and tools now get an empty file list on messages without attachments, where they got None and plugins that loop over the files failed. #32380, #32379
• 🈯 Model editor language switching. Switching the Editing language in the model editor from one translated language to another now shows that language's name and description, where the fields kept the text of the language shown before. #32224, #32223
• 🗣️ Kokoro voice in calls. Voice calls now speak replies with the Kokoro.js (Browser) voice chosen in your settings when the administrator has no server speech engine set, where the browser's own voice was used instead. Commit
• 🧩 Rich UI embed console errors. Rich UI tool embeds no longer log a security error in the browser console on every load when iframe Sandbox Allow Same Origin is off or the embed comes from another site; the embed works as before. #32226, #32222
• 🔎 Clearer Top K descriptions. The Top K and Top K Reranker descriptions in Admin Settings > Documents now say that Top K Reranker is the number of chunks the reranker passes to the model and that with hybrid search Top K is the number of candidates sent to the reranker, where the old text led admins to give the model far fewer chunks than intended. #32225, #32221
• 🔌 MCP connection errors in the logs. When an MCP server fails to connect during a chat, the reason, such as a refused connection or a 401 from the server, is now logged as an error, where it was only logged at debug level and never reached the logs of a default install. #32229, #32213
• 🗑️ Deleting one language's custom translation. In Admin Settings > General > Translations, Delete now removes only the translation for the language shown and keeps the row while other languages still have text, where it removed the row with its translations for every language. Commit
• 💬 Translated model prompt suggestions. Editing the prompt suggestions of a model that uses the default suggestions in another language now starts from the administrator's default suggestions for that language, where the list was empty. Commit
• 🏷️ Titles for voice call chats. Chats started with a Realtime voice call now get a generated title and tags as soon as the chat is created, following the Automatic title and tag settings, where they stayed named "New Chat". Commit, #32258
• 🪝 Webhooks for group and direct messages. Members of group channels and direct messages now get their channel message webhook notifications, where only regular channels sent them, and muting such a channel stops them except for messages that mention the member. #32404, Commit, #32403
• 📄 Files from saved temporary chats. After a temporary chat is saved, the model no longer tries to open a file attached in it and gets "File not found", since such a file was never stored and its text is already in the prompt. Commit, #32351
• 🔑 SSO sign in for SCIM users. Users created through SCIM can sign in with SSO again, where they got "401 Invalid authentication request" since 0.12.0 because no sign-in record was created for them; a database migration adds the missing record for existing accounts without giving them a usable password, SCIM email changes now also update the sign-in email and deleting a user through SCIM removes the sign-in record as well. Commit, #32347
• ✂️ Deleting a message mid-chat. Deleting a message in the middle of a chat no longer makes the model forget every earlier message while the chat still shows them. #32332, Commit, #32331
• 🪧 Ask and Explain popup cut off. The Ask and Explain popup is no longer cut off when you select text near the end of a reply and stays next to the selection while you scroll. #32330, Commit, #32329
• 🌬️ Background noise in Realtime calls. Wind or background noise no longer cuts off the model mid-sentence in Realtime voice calls, since its spoken reply now only pauses until speech is confirmed and resumes after noise, and noise that is not understood as speech is also removed from the voice model's conversation so it no longer confuses later answers. Commit, #32248, #32250
• 🧠 Memory in automations. Automations now get the memory tools when the user has memory turned on, following the user's setting, the default interface settings or the memory setting for everyone, where they were left out. Commit, #32337
• 🗜️ Compaction during long tool runs. Context compaction now also runs during a long series of tool calls based on the token usage the provider reports, and the compacted summary is kept with the reply so the next message continues from it, where long tool runs could hit the model's context limit. Commit, #32306

Changed

• ⚠️ Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.
• 💡 Follow-ups as next messages. The default follow-up prompt now suggests the messages you would most likely send next, in your own tone and latest language, as requests or questions, without repeating finished work, with the strongest suggestion first, and reads only the chat's first message and the last four, each cut to 1,000 characters, so long chats stay quick, where it asked for questions only over the last six messages; instances with a custom follow-up prompt are not affected. Commit, Commit
• 📖 Large skills load as a preview. With the Skills builtin tools on, a skill whose SKILL.md is longer than 20,000 characters now reaches the model as a 5,000 character opening preview, and the model reads on from where the preview ends with read_skill_file, which now returns up to 20,000 characters per call instead of 100,000, and the new grep_skill_files tool lets the model search a skill's files for a word or pattern, keeping long skills from filling the context. Commit, Commit, Commit

Original source

Added

☎️ Realtime voice calls. Administrators can now switch Call mode in the Voice calls section of Audio settings from Standard to Realtime, so Voice mode talks through an OpenAI Realtime voice model (gpt-realtime-2.1-mini with the Marin voice by default) that handles small talk itself and hands real questions and tasks to the chat's selected model, with its conversation history and tools, before speaking the answer while the full reply appears in the chat. Approvals and questions from tools still have to be answered in the chat, calls need the Allow Call permission and end after an hour, models can set their own Realtime Voice in the model editor, and the settings can also be given with the "AUDIO_REALTIME_ENABLED", "AUDIO_REALTIME_OPENAI_API_BASE_URL", "AUDIO_REALTIME_OPENAI_API_KEY", "AUDIO_REALTIME_MODEL", "AUDIO_REALTIME_VOICE", "AUDIO_REALTIME_TRANSCRIPTION_MODEL" and "REALTIME_CALL_PROMPT_TEMPLATE" environment variables. Commit, Commit, #5894

🕺 Animated avatars in Realtime voice calls. A model can now show a 3D character instead of the voice orb during Realtime calls: in the model editor, upload a rigged VRM avatar of up to 25 MiB, preview it, optionally give it VRMA clips of up to 10 MiB for its idle, listening and speaking states, and add up to 16 named gestures with a description, which the voice model plays on its own when the conversation fits or when asked, such as a wave or a clap, while the avatar's mouth follows the spoken answer. Commit, Commit

🔏 Two-factor sign-in. Administrators can require an authenticator app for every user under Admin Settings > Authentication, or with "ENABLE_MFA", so users set one up from a QR code on their next sign-in, get ten single-use recovery codes, and can later replace their authenticator or create new recovery codes in their account settings; OAuth and trusted-header sign-ins can be let through without it with "MFA_ALLOW_OAUTH_BYPASS" and "MFA_ALLOW_TRUSTED_HEADER_BYPASS", and the "open-webui mfa reset" command gives a user who lost their authenticator a one-time recovery token. Commit

👫 Replying in shared chats. When sharing a chat with people or groups, or sharing a folder, the new Sharing mode setting can be switched from Clone only to Allow replies, so everyone it is shared with can keep writing in the same conversation instead of cloning it. Each message shows the name and profile picture of who sent it, with other people's messages on the left in bubble view, replies stream live to everyone with the chat open, a line above the input shows who is typing, people can only edit, rate, regenerate or stop their own messages, and the owner's own chat settings, title and tags stay untouched by others. Commit, Commit, Commit

🕹️ Model controls. Anyone who can edit a model can now add named controls to it in the model editor, such as a Thinking control whose Low, Medium and High options each set the reasoning effort, where every option can carry its own custom parameters and one can be marked as the default, shown either as a menu or as a slider that runs from the first option to the last; people with the Allow Chat Controls and Allow Chat Params permissions then pick an option from a knobs button next to the model selector in the chat input, their choice is remembered for that model, and the names of controls and options can be translated for each language in the editor. Controls cannot be set on pipe, direct connection or arena models and are not applied to automation runs. Commit, Commit, Commit, Commit, Commit, #31972

🧠 Compaction during long tool runs. With context compaction on and native function calling, a reply that runs many tool calls in a row is now compacted between tool rounds once its context passes the token threshold, keeping each tool call together with its results and giving the summary the tool names and arguments, where compaction only ran before the reply started and a long tool run could grow past the model's context. Commit, #27599

🧳 Multi-file skills with version history. Workspace skills can now hold supporting files such as scripts, references and templates next to SKILL.md, managed in a file tree in the skill editor, and every save keeps a version you can page through, compare with the current one, make the live version again or delete. Skills import from a ZIP folder, a JSON file or a single SKILL.md with a preview first, and export as ZIP or JSON. Models can read a skill's supporting files and create skills or edit their files on their own, so for anyone allowed to create workspace skills "/skills:create" now saves the new skill straight to the workspace without needing a terminal. Commit, Commit, Commit

🗄️ Knowledge bases as a file browser. A knowledge base now opens with its folders and files on the left and the selected file next to them, where you can switch between a preview of the original file and the text the model searches, edit that text in place or download the file, with search, filters and sorting above the list and a question before unsaved edits are dropped. Commit, Commit, Commit, Commit, Commit

🎛️ Redesigned model editor. The model editor has a new layout: the background image now fills a banner at the top with the model's picture, name and ID set over it and buttons to add, change or remove it on hover, a long system prompt opens folded to a short preview with Show more, and Capabilities, Default Features, Builtin Tools, Knowledge, Tools, Skills, Filters, Actions, Prompts, Voice and Terminal each fold into one row that summarizes what is set, such as "Web Search, Image Generation +2", "3 of 9 enabled" or "Custom · 4", and opens into switches with descriptions or a searchable picker with Enable all, Clear and a Manage link. Advanced Params shows how many parameters are changed, every setting name explains itself in a tooltip, Save & Update with the change note stays at the bottom of the editor, default features now sit with Capabilities and only list the capabilities that are on, default filters are switched on per filter inside the Filters picker, Knowledge has its own picker with Upload Files, empty lists point to the workspace where items are added, and the admin Model Defaults panel uses the same rows. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit

⏮️ Model version history. Every save of a workspace model now keeps a version you can page through in the model editor, make the live version again or delete, and a version whose knowledge, tools, functions or terminal are gone or no longer yours to use is refused instead of being switched on half working. Commit, Commit

🔙 Tool and function version history. Every save of a tool or function now keeps a version you can page through in its editor, make the live version again or delete, so a change can be tried and rolled back without creating a copy and setting it up again. #29496, Commit

🆚 Compare prompt versions. The prompt editor's history now compares any earlier version with the current one in a diff view and can start editing from an old version as a new one, and asks before unsaved changes are dropped. Commit, Commit

🗜️ Tool Search for large tool sets. Administrators can now turn on Tool Search, marked experimental, in Admin Settings > Interface, so tools with long definitions are left out of the request and only listed by name and a short description, and the model looks up the full definition with a search_tools tool when it needs one, which keeps the prompt small and the prompt cache intact when many tools or MCP servers are enabled; the Deferral Threshold sets the definition length in characters above which a tool is held back, Always Loaded Tools takes names or patterns such as github_* that are always sent, and Defer Built-in Tools decides whether built-in tools are held back too. It applies with native function calling and can be set with "ENABLE_TOOL_SEARCH", "TOOL_SEARCH_DEFER_THRESHOLD", "TOOL_SEARCH_ALWAYS_LOADED" and "TOOL_SEARCH_DEFER_BUILTIN_TOOLS". Commit

🌳 Nested groups. Administrators can now give a group a parent group, so members of the inner group also get everything shared with the parent groups above it and their permissions, the group editor shows the inherited permissions and lists direct and inherited members separately, deleting a group moves its subgroups up to its parent, and open browsers pick up changed group access right away without reloading. Commit

🥇 Default models per group. Administrators can now set default models for a group in its settings, which its members get for new chats instead of the global default, with the most deeply nested group winning when several apply and a user's own default models still taking priority. Commit

🔱 Fork shared chats. Shared chat links and chats you can only read, such as ones in a folder shared with you, now have a fork action on each finished reply, which makes your own copy of the conversation up to that message; a fork from a share link holds only what was shared, and a fork of someone else's chat leaves out their folder, pin and chat variables. Commit, Commit, Commit

🪝 Import skills from a URL. Administrators can now pick Import from URL in the Skills workspace import menu to load skills from a GitHub repository, a GitHub folder or SKILL.md link, or a direct link to a ZIP, JSON or Markdown skill file, which open in the import preview to pick from; downloads are checked against internal addresses on every redirect and capped at 200 MiB. Commit, Commit

🛍️ Skills on the community site. With Community Sharing on, the Skills workspace now has a Discover a skill link to the skills on openwebui.com, the skill menu has Share for people allowed to export skills, which sends the skill with all its files to openwebui.com, and a skill opened from openwebui.com loads straight into the new skill editor for people allowed to import skills. Commit, Commit

🔐 Access from the list. The menu of each item in the Models, Knowledge, Prompts, Skills, Tools and Notes lists now has an Access entry, so who can use an item can be changed without opening it. Commit, Commit, Commit

▪️ Livelier typing cursor while a reply streams. The cursor shown at the end of a streaming reply now pulses faster and fades further, so an ongoing reply is easier to spot. Commit

👻 Unavailable models in the admin Models list. The Models list in Admin Settings now opens on a new Available view that leaves out base models no longer offered by any connection, and an Unavailable view lists those leftovers, while each model's menu now offers Delete for a leftover or workspace model and Reset for an available base model to bring its saved settings back to the defaults. Commit, Commit, #31389, #32048, #26812

📡 Lighter multi-instance streaming. Deployments that share websocket traffic through Redis use less CPU while streaming, because each server now skips live updates for rooms it has no one in; set "WEBSOCKET_REDIS_ROOM_CHANNELS" to false to restore the previous delivery. #28818, #28173

📑 Word and PowerPoint files from code. The code interpreter can now create Word documents and PowerPoint decks that open in Office, using libraries bundled with Open WebUI so it also works without internet access. #30382, #30361

🧲 Reordering filtered model lists. Models on the admin models page can now be dragged into place while a search, view or tag filter is active, with every model hidden by the filter keeping its position. #30390, #29634

🖨️ Images in note PDFs. Downloading a note as a PDF now includes the images pasted into it, where the PDF held only the title and text. #30975, #30974

🕵️ Tavily search depth. Administrators can now choose how deep Tavily web searches go, from ultra-fast to advanced, in the Tavily settings of the web search page or through "TAVILY_SEARCH_DEPTH", separately from the existing extract depth. #31308, #29891

🏎️ Native hybrid search on Milvus. Hybrid search on Milvus 2.5 and newer, with one collection per knowledge base or with multitenancy, now runs inside Milvus with its built-in BM25 full-text search next to the vectors in the same collection, where every search loaded every chunk of the collection into Open WebUI and scored it there, making hybrid search on Milvus much faster and lighter on memory; the BM25 weight setting works the same way it does on pgvector. #31645, #31660, #26243

🪙 Input and output tokens in analytics. Hovering, focusing or clicking the token total on the admin Analytics dashboard now shows how many of those tokens were input and how many were output. Commit, #31646

🚀 Faster JSON handling across the app. JSON is now read and written with orjson by default, speeding up request and response bodies, streamed provider responses and live socket updates, which now encode about 17 times and decode about 3 times faster. #31616

🎚️ Separate switches for Tools, Functions and tool servers. Administrators can now turn off workspace Tools, Functions or external tool servers on their own with "ENABLE_TOOLS", "ENABLE_FUNCTIONS" and "ENABLE_TOOL_SERVERS", so in-process plugins can be switched off while OpenAPI, MCP and Open Terminal servers keep working, or the other way round. Commit, #31509

📬 Message queue in channels. Messages sent in a channel or thread while an earlier one is still sending or a file is still uploading now wait in a queue above the message box, where each can be sent right away, edited or removed, and they go out in order once their files are ready, where a message sent during an upload went out with a broken attachment. Commit, #31587

📄 Copy button in the model JSON Preview. The JSON Preview in the model editor now has a Copy button that copies the model's JSON to the clipboard exactly as the preview shows it, including edits that have not been saved yet. Commit, Commit, #31955

💡 Model ID suggestions for connections. After verifying a connection in the add or edit connection dialog, the model ID field suggests the models the server reports, leaving out ones already added. Commit

🆔 MCP Connection ID filled in from the name. When adding an MCP tool server, the ID field is now labeled Connection ID and filled in from the server name, so it no longer has to be typed before saving or registering an OAuth client, and importing a connection keeps its ID. Commit

🔩 MCP tools listed in the chat tools dialog. Expanding an MCP tool server in the tools dialog of the chat input now loads and lists its tools with their descriptions and a tool count, offers Reconnect when the server needs you to sign in again, and only shows the tool servers selected for the chat. Commit

🪣 S3 file storage on the slim image. The slim image can now keep files in an S3 bucket with "STORAGE_PROVIDER" set to s3, where it only supported local storage; Google Cloud and Azure storage still need the standard image. Commit

🚪 Sign out all devices for a user. Administrators can now sign a user out of every device from the user edit dialog, while the user's API keys keep working. Commit

📻 OpenAI Realtime models for text-to-speech. Administrators can now pick OpenAI Realtime as the text-to-speech engine in Audio settings, which uses the gpt-realtime-2.1 or gpt-realtime-2.1-mini model with voices such as Marin and Cedar only to turn text into a finished audio clip rather than for a live voice conversation, and the instructions that keep it reading text aloud word for word can be replaced under Prompt Template or with the "REALTIME_TTS_PROMPT_TEMPLATE" environment variable. Commit, Commit

🎒 Skills built-in tool per model. The Builtin Tools section of a model now has a Skills switch, on by default, so a model can be kept from finding and loading skills on its own while skills a user picks for a chat still apply. Commit

🪞 Cloning chats you can only read. A chat you open read only, such as one in a folder shared with you, now shows a Clone Chat button that copies it into your own chats from the message you are viewing, for anyone allowed to import chats. Commit

🏁 Finish reason for outlet filters. Outlet filters now get the reason the model stopped, such as reaching the token limit or stopping to call a tool, on the finished reply of OpenAI-compatible and Ollama models, so they no longer have to read every streamed chunk to find out, and Ollama replies cut off by the token limit now report length instead of stop. #32079

🔖 Build shown next to the version. The version in Settings shows "dev" and the commit for development builds and the commit for other non-release builds, and update checks and the update notification now only run on release builds. Commit

📂 Folder default model set in the folder settings. A folder's default model for new chats is now chosen in the folder's settings, and switching the model inside a chat in that folder no longer changes the folder's default. Commit, Commit

🏷️ Workspace model list links. In the workspace model list, clicking a model's name now opens its editor and a small arrow next to it opens the model in a new chat, the enable switch goes back if saving fails, and deleting with Shift held now asks for confirmation. Commit

🪫 Unreachable MCP servers shown as a status. When an MCP server attached to a chat cannot be reached, the reply now shows a "Failed to connect to MCP server" status line and carries on without that server's tools, instead of marking the reply with an error. Commit

🐚 Prompt cache friendly terminal settings. Open Terminal connections now have a Working Directory Context switch to leave the current folder out of the tool instructions, and a User Shell Tools option set to Always Include keeps the tools for your shell in the request while the shell is closed, so opening folders, reloading the page or losing the shell no longer change the start of the request and break the provider's prompt cache. Commit, #32026, #31590

🌙 Local time and last seen on profile cards. The profile card that opens on a person's name in channels or on an @mention now shows their local time and when they were last active, and it reloads each time it opens so the status stays current. Commit

🛸 Exa as the web loader. Administrators can now pick Exa as the Web Loader Engine in Web Search settings, so pages from web search and attached links are fetched through Exa, reusing the Exa API key when Exa is also the search engine. Commit

💡 Custom parameter suggestions. Custom parameter fields now suggest common parameter names such as reasoning_effort, service_tier, num_ctx or response_format as you type, along with typical values for many of them, and a new row starts empty instead of with a placeholder name. Commit

📇 Faster knowledge pages on PostgreSQL. Opening a knowledge base on PostgreSQL no longer scans the whole file table to find files still being processed, which with many large files could take seconds per page load and slow the database for everyone; a new index covers that lookup and is created by a migration. Commit, #30003

🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

🌐 Translation updates. Translations for German, Italian, Turkish, Persian, Indonesian, Catalan, French, Malay, Simplified Chinese, Hindi, Japanese, Romanian, Czech, Slovenian, Croatian, Slovak, Dutch, Hungarian, Tamil, Spanish, Vietnamese, Norwegian Bokmål, Hebrew, Greek, Lithuanian, Korean, Canadian French, Swedish, Portuguese (Portugal), Brazilian Portuguese, Thai, Estonian, Russian, Bosnian, Ukrainian, Basque, Bulgarian, Azerbaijani, Danish, Irish, Finnish, Bengali, Latvian, Traditional Chinese, Polish, Georgian and Galician were enhanced and expanded.

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories

🚷 Revoked access ends live updates. Removing someone's access to a shared channel or a note, or deleting it, now also stops the live messages and edits their open sessions were still receiving from it. Commit

📄 Docling file names. A document sent to a Docling server for extraction now carries only its file name, where it previously revealed the full path the file is stored under on the server. #30357, #30352

🔒 Share links of deleted folders. Deleting a folder together with its chats now also removes those chats' share links, where the shared conversations stayed reachable through them. #31306, #31305

🙈 Admin chat access setting enforced everywhere. With "ENABLE_ADMIN_CHAT_ACCESS" turned off, administrators can no longer read, change, share, clone, delete, message into or attach other users' chats through direct API requests, where only opening them was refused. #31416, #31413

👥 Direct message members. The person who started a direct message can no longer add or remove people through the API, where someone added this way could read the whole earlier conversation and the original pair ended up in a second, empty direct message. #31575, #31570

📡 Channels permission for live messages and automations. Users without the Channels permission no longer receive live channel messages, and an automation that posts into a channel no longer runs once its creator has lost that permission. #31578, #31577

🫥 Temporary chats leave no sub-agent chats. Temporary chats no longer offer the model sub-agents or timers, whose conversations were saved on the server although a temporary chat should leave nothing behind. #31573, #31567

🧾 Passwords kept out of the audit log. With request auditing on, every field whose name ends in "password" is now masked in both logged requests and logged responses, including admin settings such as YaCy, Jupyter and the LDAP Application DN Password, and passwords containing a double quote, where only fields named exactly "password" in requests were masked and only up to the first quote. #31622, #31659

👁️ Cloning shared chats checks access first. Cloning a shared chat now checks access to the share before its content is read, the same order the shared chat view uses. #30388

📁 Files attached to folders. Files attached to a folder when it is created, or newly added by someone editing a shared folder, are now checked against that person's own access, so a folder can no longer be used to reach files they cannot open. #30442

🚪 Removed channel members stop receiving messages. Removing someone from a group channel now also disconnects their open sessions from it, so they stop receiving its live messages right away. #30446

🗝️ Stronger generated secret key. The secret key Open WebUI generates when "WEBUI_SECRET_KEY" is not set now comes from a cryptographically secure random source. #30441

🐌 Wildcard searches on SQLite. Searches on SQLite can no longer tie up the server with a search term full of wildcards, which could make matching take exponentially long. #30393

🌀 Message cleanup for background tasks. Cleaning details blocks and images out of messages before titles, tags and follow-ups are generated can no longer stall on crafted message content. #30394

🗃️ Live document saves limited to notes. Live collaborative edits are now only saved for note documents, the only documents that have a save handler. #30395

🛑 Sub-agent results after a role change. A chat now only continues with a finished sub-agent's result while its owner still has an active role, the same check timers already make, so a deactivated or pending account no longer keeps generating replies. #31451

🔗 Only safe file links open. File attachment links and file links in code execution results now open only web, mail, phone and relative links, the same check links in chat messages go through. #31491

🎛️ Tool approval mode no longer restored from drafts. Restoring a saved message draft no longer switches the chat's tool approval mode, which could save settings and approve tools without asking. Commit

🧱 Safety checks for generated image downloads. When an image generation backend returns a link instead of the image, the download now goes through the same safety checks as other external image downloads, while links on the configured ComfyUI address stay trusted. #31623

🎫 Login check when loading the app settings. Loading the app's settings now uses the same login check as every other request, so a session that is no longer valid only gets the logged-out settings. #31621

📝 Notes permission for live note editing. Opening a note for live collaborative editing now requires the Notes permission, like the rest of the Notes feature. #31552

📆 Calendar tools check calendar access. Editing or deleting a calendar event through the chat tools now checks access to the event's calendar the same way the calendar API does. #31537

📞 Voice mode permission applies to call links. Opening a chat with "?call=true" in the URL now respects the "Allow Call" permission and the same checks as the Voice mode button, so it no longer starts a voice call for users without that permission, with several models selected or with the Web API speech-to-text engine. #31826, #31825

🔒 Password changes sign out everywhere without Redis. Changing a password, by the user or an administrator, now signs that account out on every device even on installations without Redis, where existing sessions stayed valid until they expired. Commit

⛓️ Live connections end with the session. A browser's live connection is now checked every 30 seconds and closed once its sign-in has been revoked or has expired, where it kept receiving updates. Commit

🤐 Sign-in requests kept out of the audit log. With request auditing on, the bodies of authentication and OAuth requests and their responses, such as sign-in, password changes and API key creation, are no longer written to the audit log. Commit

🛂 Forwarded headers trust for open-webui serve. Starting Open WebUI with "open-webui serve" or "open-webui dev" now honors "FORWARDED_ALLOW_IPS", where it trusted forwarded headers from every connection regardless of the setting. Commit

🤖 Automation and sub-agent access ends with the account's sessions. Signing an account out of every device, for example by changing its password, now also cuts off its running automations and sub-agents, whose access stayed valid for up to an hour. Commit

🪪 Token exchange group mapping. With OAuth group mapping on, signing in through token exchange now assigns groups from the token's own groups claim when the provider's user info leaves it out, as it already did for roles. Commit

🤝 Sharing a shared folder. Only a folder's owner or an administrator can now change who a folder is shared with, where anyone with write access to it could also share it with other people or groups. Commit

🕵️ Shared chats keep the owner's settings private. Opening a chat shared with you, by link or through a shared folder, no longer hands you the owner's chat settings such as the system prompt and other parameters, chosen tools, filters and tool servers, filled-in chat variables or message details, and cloning a shared chat no longer copies the owner's chat variables or files the clone under the owner's folder. Commit

🛃 Administrators read other users' chats without writing to them. With "ENABLE_ADMIN_CHAT_ACCESS" on, administrators can now only read other users' chats, where they could also send messages into them, stop their replies or answer their tool approvals through direct API requests even though the chat page only showed them read only. Commit

🗒️ Notes switch applies to the notes API. Turning Notes off with "ENABLE_NOTES" or in Admin Settings now also refuses every notes API request, where it only hid notes in the interface and anyone with the notes permission could still create, read, change and delete notes through the API. Commit, #31414

🎣 Links no longer act on your behalf without asking. Opening Open WebUI from a link, including from another website or a hidden frame, can no longer act in your name unseen: a prompt given with "?q=" is only filled into the message box instead of being sent, loading web pages or videos with "load-url" or "youtube" and starting a voice call with "call=true" or "voice=true" now ask for confirmation first, and links that create a note with a title and content now ask before creating it. Commit, Commit

🕶️ Enforced temporary chats hold on every route. Users with Enforce Temporary Chat can no longer save chats by calling the chat API directly or through import, clone and fork, where only the web interface stopped them; admins are not affected and existing chats still open. Commit, #31633

👑 First admin keeps its protection. On Postgres, an account created in the same second as the first admin, as happens when a script sets up an instance, can no longer be taken for the primary admin, which let other admins demote or delete the real first admin and made that account impossible to edit, lock or delete. #32157

✋ Tool approval in temporary chats. With tool approval set to ask, tools called in a temporary chat now wait for an Allow or Deny dialog, where they ran without asking although the menu showed approval as on. Commit, #29249

🪣 Limits for collaborative note editing. Live collaborative editing now keeps a size budget per document and a limit on open documents per connection and stores only well-formed updates, so a client can no longer make the server hold unbounded editing data. #31603

🗣️ Interface language detection. Browsers reporting a bare or regional language code, such as German, Dutch or Polish in Firefox and Japanese or Latin American Spanish in Chrome, get the matching translation again, where 0.11.4 fell back to English. #30377

🔑 OAuth sessions survive parallel requests. Chatting through a connection that forwards your single sign-on token no longer logs your OAuth session out when two requests renew an expiring token at once against a provider that rotates refresh tokens, including requests handled by different workers or replicas sharing Redis, which previously cost every following request its token until you signed in again. #30426, #30450, #30416

🧱 Blocked OAuth groups not created. With automatic group creation on, groups matching "OAUTH_BLOCKED_GROUPS" are no longer created at sign-in, where a provider sending a user's full directory membership could fill the groups list with thousands of empty groups. #31316, #29558

⏰ Automations on Windows with PostgreSQL. Automations can be created, edited and run again on Windows servers using PostgreSQL, where 0.11.4 rejected every schedule with an error and the scheduler failed on each tick. #30424, #30400

🤖 Automations keep their model's tools. The first automation run after a restart now uses its model's tools, MCP servers, default features and filters, where it previously ran without them and a channel automation showed the model ID instead of its name. #30379, #27694

🕰️ Last run after Run now. Running an automation with Run now now updates its last run time on the automation page and in the Automations list right away, where they kept showing "Last run Never" or the last scheduled run. #31583, #31580

⏲️ Failed timers show their error. A timer that fails before the model starts answering, for example because its model was removed, now shows the error in its reply, where the chat kept a blank reply that looked stuck. #31483, #31481

💻 Skills from personal terminals. Skills and the AGENTS.md instructions file from a terminal you added in your own settings are now read through your browser, so they reach the model even when only your browser can reach that terminal, such as one running on your own machine. Commit, #30410

🪆 Sub-agents get personal tools. Sub-agents and chats resuming after a tool approval now get the same personal tool servers, such as Open Terminal, as the main model, where they received none of them. #31424, #29893

🪃 Background replies show up live. When a background sub-agent finishes or a timer goes off, its result and the model's follow-up reply now appear in the open chat right away, where they only showed after a page reload. #31576, #31566

🌿 One branch with background sub-agents. When a background sub-agent finishes while the answer that started it is still being written, its report now follows that answer, where the chat switched to another branch that hid the latest question and answer and the model replied without seeing them. #31557, #31507

✅ Approving several tool calls at once. With tool approval set to ask, every tool the model calls in one turn now gets its own approval card in turn, where only the first did and the others stayed on "Executing..." forever. #31315, #29293

🔁 Approved tool results kept. With tool approval set to ask, the result of an approved tool call now stays in the chat once the reply finishes, so the model still sees it in later turns and a second tool call no longer sends the first back to waiting for approval and runs it again. #31502

🗣️ System prompt after a tool approval. With tool approval set to ask, the request sent after approving a tool call now carries the system prompt and, in a compacted chat, the conversation summary instead of the whole history, taking the prompt from the chat Controls, then your personal settings, then the admin default; a system prompt sent only in an API request is still not kept. #31501, #31499

🎯 Skills from the / menu. A skill picked from the / menu in the chat input is now applied to the reply the same way as one picked from the $ menu, where it was inserted as a mention and never loaded. #31429, #29978

♻️ Skill toggles reach the chat. Turning a skill on or off in the workspace now updates the skill menu in chat right away, where the old list stayed until a page reload. #30966, #30965

🪟 Terminal instructions on Windows hosts. The AGENTS.md file in the home folder of a terminal running on Windows now reaches the model, where it was skipped because the Windows home path was not recognized. #31342, #31340

⚙️ Settings labels on reload. Settings labels no longer turn into raw keys such as "settings.admin.connections.title" from the second page load on. #30354, #30348

🧠 Ollama system prompt after tool calls. With native function calling on an Ollama model, the model's system prompt now stays in place after a tool result, so the final answer follows the model's instructions again. #30375, #30161

🧰 Chats recover from broken tool history. A chat where a tool call was saved without its result, or a result without its call, no longer fails on every following message with Anthropic and Bedrock models, because such unmatched pieces are now left out of what is sent to the model. #31431, #28937

📌 Attached files after context compaction. With native function calling, files attached to a message now stay tied to that message after older messages are compacted and after a tool approval, where the model could be handed an older file's reference or none at all for a new upload. Commit, #31411

🧯 Responses API errors kept. Errors from providers on connections set to the Responses API now appear in the chat and are still there after a reload, where some never showed at all and others vanished and left an empty reply. #31439, #31433

🔡 Missing space after thinking. Reasoning model answers no longer lose a space right after the thinking block, where "The answer is 4." could be shown and saved as "The answeris 4.". #31438, #31435

🏁 Stray end of solution marker. Replies from models that wrap their answer in solution markers no longer show the closing marker, and text written after it appears as a normal part of the reply. #31436, #31434

🔭 Thinking indicator after tool calls. A group of collapsed steps in a reply now shows "Exploring" with a spinner while the model is still thinking inside it, such as after a tool call, where it already read "Explored" and the chat looked stuck. Commit, #29531

📏 Output limit for Ollama through the API. A "max_tokens" value sent through the API to an Ollama model now limits the reply length and overrides the value saved in the model's advanced parameters, where Ollama ignored it and replies ran to full length. #31437, #31432

🦙 Ollama connection headers and sign-in everywhere. An Ollama connection's custom headers, authentication type and cookie forwarding now apply to every request, including checking the connection, loading, uploading, downloading and unloading models and the Manage Ollama dialog, so Ollama servers behind gateways such as Cloudflare Access work throughout and no key is sent when the authentication type is None, which also applies to unloading models from llama.cpp connections. Commit, #29868, #31489, #31487, #31490

📸 MCP tool images reach the model. An image returned by an MCP tool, such as a camera snapshot, is now handed to the model as well as shown in the tool call, so the model can answer about what it shows. #30358, #30327

🔐 MCP OAuth scopes. MCP tool servers using OAuth with dynamic client registration, such as Atlassian and Notion, now receive the scopes they need so tool calls work after connecting, and connections set up earlier recover them without registering again. #30384, #29967

💽 Leaner storage of MCP media. Images and audio returned by MCP tools are no longer saved a second time inside the database, which kept growing it with every such result. #30419, #30411

⌛ MCP tool call timeout. MCP tool calls now stop after the time set in "AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER", or "AIOHTTP_CLIENT_TIMEOUT" when that is unset, and the model sees the timeout as a tool error, where a hung MCP server kept the chat waiting until the connection was closed. #31641, #31640

🔔 Webhook chat links. The link in "chat finished" and "chat failed" webhook notifications opens the chat again, where the missing "/c/" part of the address led to a 404 page. #31572, #31565

🎙️ Voice calls recover from speech failures. When the text-to-speech provider fails during a voice call, the call now shows the provider's error once and goes back to listening, where it previously hung in "speaking" with no sound until tapped. #30372, #30052

🎧 Read Aloud on iPhone and iPad. Replies read aloud automatically and voice calls now play sound on iOS and iPadOS, and a failed playback returns the speaker button to idle with an error message, where it previously stayed stuck in "speaking". #30373, #30262

🎤 Voice mode stops when leaving the chat. Leaving a chat with voice mode active, for example to open the workspace or notes, now turns the microphone off, where it previously kept listening and sending what you said as prompts. #30417, #30405

🔇 Mute shortcut during voice calls. Pressing M during a voice call mutes the microphone after every turn again, where it previously typed an "m" into the chat box. #30421, #30406

📁 Folder clicks keep a chat's tools. Clicking a folder name in the sidebar while a chat is open no longer swaps that chat's tools and skills for those of the folder's default model. #30376, #30226

🗂️ Blank folder names rejected. Renaming or creating a folder with a name made only of spaces now shows "Folder name cannot be empty." instead of saving a blank name that made the folder and its chats disappear from the sidebar after a refresh. #31380, #31379

📝 Cleared chat system prompt. Clearing a chat's own system prompt now falls back to your personal system prompt, where the chat was previously sent no system prompt at all. #30333

🧩 Default features when comparing models. Adding a second model to a chat keeps web search, image generation and code interpreter on when every selected model has them as default features, and the web search toggle now always matches what is actually sent. #30383, #30310

🌊 Per-chat streaming setting. A chat's own Stream Chat Response setting in Controls now takes effect, where it was ignored whenever the account-wide setting was set. #31362, #31361

📬 Send queue recovers. Deleting or editing a queued message held back by a failed attachment now lets the rest of the queue send, where the chat's queue previously stayed stuck until the chat was reopened. #30447, #28880

⏩ Send now on queued messages. Clicking Send now on one queued message sends only that message, where it could send the whole queue at once and leave two replies mixed together in the chat until a reload. Commit, #30027

💲 Clipboard variable keeps dollar signs. The clipboard variable in prompts now pastes text exactly as copied, where a pair of dollar signs turned into one and broke shell commands and math formulas. #31364, #31363

🏅 Copied replies start unrated. A reply saved as a copy no longer carries over the original's rating, so rating the copy no longer overwrites the original's feedback. #30962, #30961

🎭 Artifacts pane after deleting a message. Deleting the message holding the newest artifact while the artifacts pane shows it now moves the pane to the last remaining artifact, where it kept showing the deleted one with wrong version numbers. #30435, #30287

⭐ Default model kept on settings save. Saving the Interface settings no longer replaces your chosen default model with the administrator's default or cuts a multi-model default down to its first model. #30953, #30952

👆 Clicking outside menus. Clicking outside the model selector or another open menu now only closes it, where the click also went through to whatever was underneath, such as a suggested prompt. Commit, #29878

🔌 Deleting a direct connection sticks. Deleting one of your own direct connections in Settings is now saved right away, where it came back after a reload unless you also pressed Save. #31384, #31383

🧹 Add Connection form reset. Adding several connections in a row no longer silently saves the advanced settings of the first one, such as its headers, provider and API type, with the next. #30958, #30957

⌨️ Ctrl+Enter to Send in channels. With "Ctrl+Enter to Send" turned on, Enter in a channel or thread reply now starts a new line and Ctrl+Enter sends, where Enter always sent the message. #31319, #31318

📱 Composer buttons at larger UI scale. On phones with UI Scale at 1.2x or more, the + and Integrations buttons in the message input stay visible and tappable, with the model name shortened to make room. #30374, #29989

📥 Imported chats marked as read. Imported and cloned chats no longer show as unread in the sidebar or count toward folder unread badges. #30754, #30750

🪧 Chat title with title generation off. With title generation turned off, a new chat now shows its first message as the title in the header and browser tab right away, where it showed "New Chat" until a reload and a note's chat panel showed the whole model reply as its title; a title that arrives before the new chat has finished opening is no longer dropped either. #31355, #31348, Commit, #31492

🏷️ Tags after bulk chat actions. Unarchiving all chats now brings their tags back, and deleting all chats removes tags no longer used by any chat from the suggestions. #30453, #30452

🔗 Share link access after relinking. Deleting a shared chat's link and creating a new one without closing the Share dialog now shows the new link's own access, where the dialog kept showing the old link's setting such as Public. #31037, #31029

🗨️ Share dialog wording. The Share dialog now says a new link stays private until you choose who can view it, where it claimed anyone with the URL could view the chat. #31420, #31417

🖱️ First click in dialogs opened from menus. Menus such as the sidebar chat menu, the chat header menu, folder and note menus, the knowledge Add Content menu and the Actions menus now close when an item is picked, so the first click in the dialog it opens works, where buttons such as Copy Link and Confirm had to be clicked twice. #31488, Commit, #31486, #31496, #31493

🧰 Model menu actions in the model selector. Picking Edit, Keep in Sidebar, Copy Link or Delete from the menu next to a model in the model selector works again, where the selector closed and the action never ran, and Edit and Delete now close the selector so the first click in the window they open is not lost. #31503

⌨️ Enter after a smiley. Pressing Enter now sends a message that ends in a smiley such as ":)" or in a word starting with ":", "/" or "#", where it did nothing because an empty suggestion list still held on to the key. #31506, #31504

🧪 Code Interpreter when switching chats. Opening another chat from the sidebar now turns Code Interpreter off like web search and image generation, where it stayed on and was saved into the next chat's draft; a chat's own draft and a model's default features still decide. #31500, #31472

🔎 Hybrid search on large Chroma collections. Hybrid search over a knowledge base of more than about 32,000 chunks stored in Chroma now returns results, where it previously failed with "Error querying knowledge base". #30368, #30351

🧭 Qdrant strict mode. File uploads and hybrid search now work on Qdrant with strict mode enabled, where every upload after the first failed with "Limit exceeded" and hybrid search found nothing, and hybrid search now falls back to normal vector search whenever a collection cannot be read. #31461, #31460, #31459

🎨 Generated image formats. Generated images that come back as JPEG or WebP are now saved, downloaded and served as what they are, where they were always labelled as PNG. #30359, #29948

✏️ Shared knowledge file edits. Users with write access to a shared knowledge base can now save edits to its files, where the editor reported success but the old content stayed in place. #30448, #30319

💯 Relevance scores on knowledge tool citations. Citations from knowledge and chat file searches made by the model through native function calling now show their relevance percentage, as the same sources already did with classic retrieval. #31307, #29776

🔤 Korean and Japanese text files. Korean and Japanese text files in legacy encodings such as EUC-KR and Shift-JIS are now read correctly for chats and knowledge bases, where they were stored as garbled Chinese characters. #31356, #31352

🧵 Backslashes in HTML uploads. Uploaded HTML files now keep their backslashes as written, where a path such as "C:\new\table" gained line breaks and one containing "C:\Users" failed to upload. #31450, #31440

🐍 Code mentioning matplotlib. Python code that only mentions matplotlib in a comment, a string or an availability check now runs, and the code editor's Python formatter works on code that imports it. #30381, #29894

🖼️ ComfyUI Save Image (Advanced). Images from ComfyUI workflows that end in the "Save Image (Advanced)" node, such as the Qwen Image Edit template, now appear in the chat for both generation and editing. #30420, #30404

🕸️ Unreachable links named. Attaching or adding a link that cannot be fetched, such as one whose server refuses the connection or returns an error page, now reports "Could not read content from" the link instead of a vague processing or knowledge base error. #31351, #31354, #31347

🧾 Document loader headers checked on save. Invalid headers for the external document loader now show an error on save whichever extraction engine is selected, where they silently kept the documents settings from saving. #30434, #30294

🌍 Attach Webpage user agent. Attaching a webpage now sends the configured "USER_AGENT" from the first request, so sites such as Wikipedia that block the default agent no longer fail with 403 Forbidden. #30385, #29617

☁️ Long non-Latin S3 file names. Files stored on S3 with long names in scripts such as Cyrillic are now read correctly, so their content reaches the model instead of failing with "File name too long". #30418, #30409

📈 Leaderboard chart for slashed model IDs. The leaderboard activity chart now shows data for models whose ID contains a slash, such as Hugging Face models served through Ollama. #30456, #30455

👥 Admin user chat list after deletion. Deleting a chat from a user's chat list in the admin panel no longer leaves the list empty. #30604, #30601

📇 User CSV import blank line. Importing users from a CSV file that ends with a line break no longer reports the empty last line as an invalid row. #31374, #31373

🛠️ Refused authentication settings. When the server refuses a value on the admin authentication page, such as a JWT expiration without a time unit, the page now shows the value actually stored instead of the refused one. #30433, #30293

🏟️ Arena models after editing. Editing an arena model in the admin models page, for example to set its tools, no longer removes its access settings and model pool, where non-admin users lost the arena model and its chats ignored the configured models. #31309, #29564

📅 Calendar event end moves with its date. Changing a calendar event's date now moves its end along with it, where the end kept its old date and events could span several days or lose their duration. #31303, #31302

🔂 Repeating events that started earlier. A repeating calendar event that is still running when the visible dates begin, such as a weekly event from 23:00 to 01:00, now shows on the following day, where only the same event without a repeat did. #31606, #31605

📋 Copy buttons in account settings. Copying your token or API key in the account settings no longer also saves the account form and any unsaved profile changes along with it. #30956, #30955

🚫 Read-only prompt controls. Prompts you can only read now show their edit, share, delete and enable controls in the workspace as unavailable, where they looked usable but could not be changed. Commit, #30219

🔃 Model sync API on SQLite. Syncing models through the API on a default SQLite setup now saves changes to existing models, where the request stalled and returned an empty list with "database is locked" in the log. #31349, #31346

🐘 Non-ASCII search on PostgreSQL. Searching automations by a word from their prompt and filtering models or prompts by a tag now find non-ASCII words such as Chinese on Post

Original source

Added
📉 Far smaller slim image. A slim build now comes down at around 175 MB, near enough 89% smaller than the last release, the local models, the packages around them and the tools that installed them all gone from it; what that changes about the way an instance behaves is set out under Changed below and in the documentation. Commit, Commit
📦 Smaller standard image. The image no longer carries a second copy of Python, two sets of fonts nothing ever loaded, packages nothing imports, or the tool that installed them, taking about 170 MB off a standard build. #29731, #29723, #29725, #29726, #29728, Commit, Commit, Commit, Commit
🧑‍💻 Skills from a terminal. Skills a connected terminal server offers now sit beside workspace skills everywhere skills are picked — the "$" and "/" menus, the integrations menu and the skills panel, each marked Terminal — and are used the same way: picking one puts its instructions, its folder and the files it ships with in front of the model, and a model that was only told a skill exists can open it itself. They follow whichever terminal is selected and clear when that changes. Commit
📔 Terminal instructions file. A model working with a terminal is now handed the AGENTS.md sitting in that terminal's home directory, read afresh at the start of every turn, so the instructions you keep beside your work reach the model without being pasted in. Commit, Commit
📇 Automatic skill discovery. Every skill you can reach is now listed to the model by name and description, and the full text of one is loaded only when it decides to use it; before, a skill you had not selected in the message box was invisible to it, and this applies to models with built-in tools on. Commit
🌄 Model background images. A workspace model can now carry a background image, uploaded in its editor and drawn behind the chat whenever that model is selected, sitting below a folder's own background and above your personal one, and it travels with the model through export and import. Commit
📓 Skill creation from a chat. Typing "/skills:create" in a chat that already has content, with a terminal selected, turns the workflow you just went through into a reusable skill written to ".agents/skills" under that terminal's root working directory rather than whatever folder the shell happens to sit in, and authored to Open WebUI's skill standards. Commit, Commit, Commit, Commit, Commit
🖥️ Terminal tabs per command. The terminal pane now carries a tab for each command a model is running alongside your own shell, so you can watch them as they go, move between them and take the shell yourself, each tab opening with the command that produced it. Opening the pane puts you in a tab, starting your shell where nothing else is running, and closing the last tab folds the pane away again. Commit, Commit, Commit, Commit
📂 Folder uploads to terminals. The file browser beside a terminal takes a folder now, dropped onto it or picked from the Upload Folder entry in its menus, and rebuilds what is inside it as it goes, subfolders and all, where before a drop uploaded only the files sitting loose at the top. Commit, Commit, Commit
⚖️ Side-by-side file comparison. Picking two files in the file browser lights up a Compare button that lays them side by side or one above the other, numbering the lines, marking what was added and removed down to the part of the line that changed, counting both, and letting you swap which is which or leave whitespace out of it, a choice it remembers; a terminal too old to offer the comparison says so rather than failing quietly. Commit, Commit
🌐 Suggested prompts in your language. A fresh install now offers its suggested starter prompts in the language the interface is set to, rather than the same four in English for everyone, and the model defaults panel carries a way back to those defaults once its own suggestions have been edited. Commit, Commit
📏 Exa result length cap. Web search through Exa can be held to a number of characters per result, set beside its key in the admin web search settings or as "EXA_MAX_CONTENT_LENGTH". Commit
🇪🇺 European web search option. Staan can now be picked as the web search provider, giving deployments that need search inside the EU an option they do not have to host themselves, configured from the admin web search settings or through "STAAN_API_KEY", "STAAN_MARKET" and "STAAN_MAX_SNIPPETS". #30138, #26006, #30303, #30301
🗣️ Per-language names and descriptions. A model, tool, skill, function, banner or arena entry can now hold its name, description, starter prompts and valve labels once per language, written in a searchable table in its own editor or brought in as a JSON file, which is refused where a translation drops one of the placeholders the original fills in. The interface shows the wording for the language it is set to, and falls back to the plain text where that language has none. Commit, Commit, Commit, Commit
✏️ Interface text you can reword. An administrator can now replace the interface's own wording language by language from a panel in the admin settings, with a replacement refused where it drops one of the placeholders the original fills in. Commit
🔓 Turning off the sign-in form. The box asking for an email address and a password can now be taken off the sign-in page from the authentication settings, where until now it could only be set before the server started, leaving single sign-on or a directory to sign people in. Commit
🏷️ Custom file metadata. Metadata attached to an uploaded file now travels with the pieces that file is split into and arrives with the retrieved sources, the oversized and internal fields left out, and an operator can name in "RAG_SOURCE_METADATA_KEYS" which of those fields the model itself gets to see alongside the text. #29499, #29486, Commit, #29502, #29696
🗑️ Quick delete shortcut. Holding Shift over a note in the list or grid, or over a row on the automations page, turns its trailing controls into a delete button, removing the entry in one click rather than the three the menu and its confirmation ask for. #29635, #29633, #29640, #29637
🔀 Diffs are drawn as diffs. A diff or patch block in a reply is now laid out as one, with the file and hunk headings, the old and new line numbers, and the added and removed lines picked out down to the part of the line that changed, and a button to switch to the plain text and back. Commit
✒️ A formatting switch for notes. A note you can edit carries a Formatting switch in its menu: turned off, Markdown you type or paste stays as the characters you wrote, a paste keeps its plain text, and a web address is left as text, while formatting already in the note is untouched. Commit
🎛️ Admin model list filters. The models page in the admin settings can now be narrowed to the base models a connection offers or to the ones built in the workspace, alongside the filters for enabled, disabled, visible and hidden. Commit
🔍 Settings search by name. The search box in settings now matches each setting's own name and description rather than a keyword list kept per page, in whichever language you are using and regardless of accents, it leaves out anything your permissions do not let you change, and opening a result no longer clears what you typed. Commit, Commit, Commit
🆘 A model for every chat. Opening a conversation whose model has since been retired no longer leaves it stranded with nothing selected; it falls back to your default model, then the configured default, then the first one available, and a chat that still has a live model keeps it. #29757
⚡ Non-blocking search. Searching the text of chats and knowledge, and the grep a model runs over a knowledge base, now run beside the rest of the server rather than in front of it, so a long search no longer keeps other requests waiting. #29621, Commit
✴️ Lighter shared note editing. Notes written by several people at once no longer echo every keystroke back to the server once per watcher; the traffic between editors falls by half with two of them and keeps falling as more join, so shared notes stay smooth as the room grows. #28185
🔢 Sorted knowledge listings. The "ls", "tree" and "find" commands a model runs over a knowledge base now sort by name and take "-t", "-S" and "-r" for newest first, largest first and reversed. #29840
🪪 Authentication type header. A request to an OpenAI or Ollama connection now carries "X-OpenWebUI-Auth-Type", saying whether the person behind it signed in through the browser or called with an API key; its name is set with "FORWARD_USER_INFO_HEADER_AUTH_TYPE" and "{{AUTH_TYPE}}" works in custom headers. Commit
💡 Follow-up ghost text. Once a reply has finished, the first of the follow-up questions it suggests now sits greyed inside the empty message box as well as under the reply: Tab writes it out, and typing anything of your own clears it away. Commit
🪵 Model refusal logging. A request turned away with "Model not found" now writes a warning naming the account, the model and why it was refused, while the message the caller sees stays as vague as before. Commit
🤲 Cheaper chat requests behind Redis. Where several servers share their websocket traffic through Redis, a chat request no longer pulls the whole shared model list from Redis to ask about a couple of models; each worker keeps its own copy and refetches only when the list actually changed, so the cost stops growing with the number of models configured. #28176, #28167
💽 Long conversations stream cheaper. Writing or reading a single message no longer loads, checks and rewrites the entire conversation to change a few hundred bytes, so streaming into a long chat stops getting more expensive as it grows, and the whole round trip a message event costs falls to a fraction on conversations of thousands of messages. #28184, #28169
🧱 In-place streaming appends. Streamed replies can be assembled with CPython's in-place string append, turned on with "ENABLE_CHAT_RESPONSE_STREAM_INPLACE_APPEND" and left off by default while it is rolled out gradually. Commit, Commit, #30066
📘 Direct connection guidance. The connections and integrations pages in the personal settings now say plainly that a direct connection leans on your browser session to keep requests running, which suits testing and temporary use rather than everyday work. Commit, Commit
🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
🌐 Translation updates. Translations for Japanese, Traditional Chinese, Korean, Finnish, Russian, Ukrainian, German, Spanish, Portuguese (Brazil), Arabic, Arabic (Bahrain), Azerbaijani, Bulgarian, Bengali, Tibetan, Bosnian, Catalan, Cebuano, Czech, Danish, Basque, Croatian, Dutch, Italian, Turkish, Simplified Chinese, Bosnian, Catalan, Danish, Estonian, Finnish, Galician, Croatian, Kabyle, Norwegian Bokmål, Portuguese (Portugal), Romanian and Turkmen were enhanced and expanded.
Fixed
🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories
🔑 Tokens stay out of logs. A failure part way through signing in with an identity provider no longer writes the credentials it was handed into the application log, recording the provider and the error it reported instead. #29709
🔐 Sign-in role mapping. Roles sent by an identity provider were in some setups not applied, leaving an account at the default role, and a sign-in whose roles cannot be read is now refused rather than let through. Commit
🚫 Blocked sign-in groups saved. Comma-separated group names typed into the blocked groups field now take effect once saved, where the save stored the text as written and the sign-in check then read it as nothing; a group name carrying a comma of its own survives a save too. Commit
🚪 Signing out ends the session. Signing out or having every token revoked left any live connection that account already had in place, and those are now cut at the same moment; a token already revoked can no longer be replayed to cut someone else's newer session. Commit
🛡 Diagrams and SVG stay on this origin. Mermaid diagrams and SVG previews, attached or uploaded, no longer follow references pointing at another origin, a picture, style or configuration line among them, and a diagram that reaches outside is refused with an error; a file whose drawing leans on an external sprite now shows that part blank. #30271
📲 Terminal sessions follow access changes. A terminal connection now re-checks your access to it every ten seconds for as long as it stays open, so removing someone's permission or deactivating their account ends their live terminal on the next check, on every worker and not only the one they signed in through. Commit, Commit
🔒 Connection model listing access. The endpoints that list the models on a single Ollama or OpenAI connection could be reached by a signed-in account of any role, and now check the caller's role. #29619
🔏 Knowledge file access. A file's access through a knowledge base now follows its actual attachment alone, rather than also a collection name left behind on the file record. #29937
🌳 Knowledge directories stay inside their base. A directory id supplied to the knowledge file routes is now refused where it belongs to a different knowledge base, where a caller-supplied id could reach into a directory tree outside the one being addressed. Commit, #29887
🍪 Cookie forwarding scope. A connection authenticating as the signed-in person is handed this instance's browser cookies only where its new Forward cookies switch is on, which an instance relying on it has to turn on after upgrading. Commit, Commit, Commit
🗝️ Revocation list fallback. Where the revocation list is kept in Redis and Redis cannot be reached, a token is now accepted rather than the request failing, so signing out may not take effect until Redis is back. Commit, Commit
🗒 Home page chat drafts. A message typed into a chat started from the home page now comes back after a reload, text, uploads and all, where the draft was stored under a key the page never read again. #29762, #29760
🏞️ S3-hosted chat images. A chat image whose host echoes a Content-Encoding nothing asked for, an S3 or MinIO object uploaded with that metadata among them, no longer breaks the reply it sits in; it is sent as its link the way an unreachable image already was. #29623
🪆 Branch descent guard. Stepping between reply branches walked a chat's children without tracking where it had already been, so a history that pointed back at itself spun forever and locked the tab, and a child id with no message behind it threw; every one of the eleven places that walk now shares a single guarded helper. #30070
🗒️ Note save on exit. A note's title and its attachments save a moment after they change, and leaving the note inside that moment dropped the save, so the notes list kept showing the old title until the page was reloaded; the pending save now finishes before the next page opens. #29745, #29744
📷 Attachments sent without text. Sending an image or a file with nothing typed to a model that has skills attached replaced the empty message with the list of skill names, so the model answered with its own catalogue instead of looking at what you sent. #30045, #30040
🖍️ SVG attachments read as text. An SVG attached to a chat went up as a picture and came back rejected by every model that tried to decode it, and is now read as its source text instead, which needs a model that accepts file uploads. #30102, #30100
🩹 Notes survive a small edit. Asked to add a section or change a few lines, a model would send the whole note back and lose the rest of it with nothing to undo, because the editing tool never said when to edit a range instead; it now spells out the range rules the handler already enforced. #30048
📋 Note paste placement. A plain paste replaced more of the note than was selected, and a paste into a code block broke out of the block instead of going inside it; both now land exactly where they were dropped. Commit
🧿 Insert into note on read-only notes. The Insert into note action no longer appears on a note you may only read, which offered it where it could not land. #30223, #30174
🤝 Note sharing survives a save. Saving a note you had been given access to took that sharing away, so the note went private and everyone else lost it. #30175
🌍 Collaborative link handling. In a note two people are writing at once, a plain web address arriving from the other editor was turned into a link on your screen but not on theirs; it is now left as written. Commit
📑 Tika 4 document formatting. Where document extraction runs against a Tika server on version 4, the text now comes back as Markdown rather than a flat run of characters, so headings, lists and tables survive into what the model reads. Commit
⏳ Session expiry accuracy. A session with an identity provider now expires with the token it actually calls with, rather than whichever of its two tokens ran out first, which renewed it early and dropped it whenever that failed. Commit
🧩 Tool steps in finished replies. A reply that called tools showed each step as it ran, then lost them the moment the reply completed, because the provider's closing message replaced everything on screen rather than joining it; the closing message is now merged into what is already there, and a tool call is no longer mistaken for its own result. Commit, Commit
🧭 Streamed replies follow along. A reply arriving over the response events now keeps the view at the bottom as it is written, as replies on the older path already did, unless you have scrolled up yourself. Commit, Commit
🚿 Tool results arrive when the tools are done. The results of a model's tool calls now reach the reply as soon as the round that produced them finishes, instead of being held back with the rest of the streaming until the throttle let them through, and a channel reply or a continuation no longer carries the picture data a tool handed the model. Commit
🧗 Tagged blocks while streaming. A reply using reasoning, solution or code interpreter tags briefly showed the raw tag text in the message as it arrived, because the chunk carrying it reached the browser before the cleaned output did; the cleaned output is now sent the moment a tag is taken out, and the code an interpreter block writes fills that block rather than the message body. Commit
📗 Excel in the code interpreter. Reading or writing a spreadsheet in code the browser runs failed outright because the library that handles them never reached the browser, and it is now shipped alongside the rest. #30140, #30130
📀 Bundled charts and formatting. Drawing a chart with seaborn in code the browser runs fetched the library over the internet at that moment rather than taking it from what ships, and the code editor's Format button failed outright for anyone who is not an administrator; both now work from what comes with the application, offline included. #30148, #30145
🙋 Typed answer submission. In the card a model puts up to ask you a question, choosing one of its options on the last question sends your answers straight away, but typing your own into the Other box left Submit answers greyed out with no way to send it, and it now turns on as soon as that box has text. #29494, #29311
🥇 A truthful Recommended badge. The card a model puts up to ask you a question marks its first option Recommended, but nothing told the model that, so the badge fell on whichever option happened to be listed first; models are now asked to put the option they recommend there. #30196, #30195
🎚️ Partial settings permissions. An account barred from changing the interface settings can now save its system prompt, notifications, audio, keyboard shortcuts and pinned models, which were refused along with them. Commit
🎧 Speech file types kept. Saving the audio settings emptied the list of file types accepted for speech recognition, so transcription then turned away the recordings it had taken before. #30208
🚻 Group picker without permission. The picker for sharing a chat, a note or a knowledge base with a group was offered to accounts not allowed to share with groups, and is now hidden from them. #30189
🗜️ Per-field settings saves. Only the settings actually changed are now stored, rather than the whole object, so another tab's older copy no longer overwrites them and a default an administrator changes still reaches everyone, and pinning a model, reordering the list or picking a default from outside the settings window now saves the same way. Commit, #30183
⚠️ Failed settings feedback. Settings that could not be saved were shown as saved anyway until the page was reloaded, because the interface stored them locally without waiting on the server; a failure now raises an error and leaves the panel as it was. Commit
🔠 Menu text scaling. The entries in the menus that drop down across the interface now scale with the rest of it, rather than staying at a fixed size while the menu around them grew. #29493, #29488
🪞 Account menu highlighting. An account menu entry carrying a pin button beside it now lights up across the whole row in the shared colour, and a long label no longer pushes the pin out of the menu. Commit
🔲 Shift-click file selection. Shift-clicking a file in the terminal's file browser now adds that range to what is already selected, and clicking through a selected file removes its range. Commit, Commit, Commit
🛟 Attachment name collisions. Attaching a file to a message on an instance that puts attachments in a terminal's working directory replaced whatever file of that name was sitting there; the upload now takes the next free name, "report (1).pdf" beside "report.pdf", and the attachment shows the name it was saved under, though two uploads arriving at the same moment from different browsers can still land on the same name. Commit
📛 Failed upload feedback. A file that could not be written to the terminal now says so, rather than passing in silence while the browser refreshed as though it had arrived. Commit, Commit, Commit
☑️ Unchecked checkbox defaults. A prompt variable written as a checkbox with a default of false opened the form already ticked, as did False, "false", 0 and "0", because any non-empty default counted as ticked; it is now ticked only where the value really is true. #30037, #30036
🎯 Prefilled question timing. Opening a chat from a link holding a question sent it before the box had it, so a question naming a variable went off with the variable unfilled; the send now waits for the text to be in place and filled in. Commit, Commit
📜 Task list height. The list of steps a model works through ran as long as it needed and pushed the rest of the reply down the page; it now stops at a quarter of the window's height and scrolls within itself. Commit
⎋ Escape key targeting. The shortcut for closing a dialog always shut the settings window, whichever dialog was actually in front, so a dialog opened from within settings took both away at once; each dialog now answers the shortcut for itself, as it already did for the escape key. #29830, #29817
🎹 Message pair shortcut. The shortcut that adds an empty question and answer to a chat also sent whatever was typed in the message box, so the pair arrived alongside a message you had not meant to send yet. #30167
🥁 Collapsing the task list. Folding away the list of tasks under a reply also sent whatever you had typed in the message box. #30202
🕰️ Temporary chat links. A link carrying the temporary chat marker opened an ordinary chat, because the marker was written into the address but never read back when the page loaded, and such a link now opens the temporary chat it promises. Commit
⌨️ Recording a new shortcut. Pressing a key combination to record it as a shortcut also ran whatever that combination was already bound to, so setting one up did the thing you were trying to rebind. #30160
🔃 Stale tab reload. A tab still running the previous build met an error page after the server was updated instead of loading the new one, because every image built from Docker carried the same version stamp; the stamp now follows the build, and a stale tab reloads as it was meant to. #29832, #29831
📌 Channel code headers. The bar naming a piece of code in a channel thread or its pinned messages now sits flush at the top of the panel, clipped to the block, rather than floating over the code as it scrolls. #29836, #29835
📨 Duplicated proxy headers. A reply proxied from a terminal server or an OpenAI or Ollama connection no longer carries that server's own "Server" and "Date" headers, which had a reverse proxy in front logging a duplicate line for every one. #29841, #29824, #29843
🎣 Testing an image connection. The Verify button beside an image generation connection saved the whole image configuration first and then tested whichever engine was active rather than the connection beside it, and it now tests exactly that connection and changes nothing. Commit
🪝 Responses API tool strictness. A workspace tool, MCP server or OpenAPI server reaching a model on the Responses API was turned into a strict schema where it had never asked to be, so the model filled every optional field with empty strings, zeros and empty arrays, and search and filter tools were handed values where leaving them out was meant. #30046, #27750
🪃 Responses API tool calling. A forced tool choice sent to a connection on the Responses API went out in the wrong shape and was refused by providers that check it, and a tool call in a reply that was not streamed came back as empty text, so nothing reading the API ever saw it. #30095, #30085
⛓️ Missing tools in links. Opening a chat from a link whose "tools" or "tool-ids" parameter names a tool that no longer exists, or that the account cannot see, kept that id in the selection and sent it with the message; ids matching no tool the account has are now dropped and the rest of the link works as before. #29803
🚫 Model editor error messages. A workspace model that cannot be loaded for editing now says so, instead of sending you back with "You do not have permission to edit this model" whatever the real reason. #29694, #29629
👥 Directory updates that were dropped. A change your identity provider sent as an add or a remove, or without naming the attribute it was changing, was accepted and then quietly discarded, so a rename or a deactivation never reached the account; those now take effect. Commit
🗃️ Directory request validation. A provisioning request carrying the wrong kind of value, or an attribute Open WebUI does not support, now comes back as an error instead of passing in silence, and a sync that changes nothing no longer marks the account as touched. Commit
🔘 Model editor save button. Saving a workspace model whose model list could not be refreshed afterwards now reports the error and frees the Save button, rather than leaving it disabled and spinning though the model had been saved. Commit, Commit
🫱 Rating a reply again. Switching a reply's rating from one thumb to the other kept the score and the reason given the first time, and rating a reply whose feedback had since been deleted failed outright; both now record the rating you just gave. #30075, #30077
📶 Sorting feedback by user. The User column in the admin feedback history did nothing when clicked, and now sorts by who left the feedback. #30191
🪂 Closing the Edit User dialog. Changes typed into the admin Edit User dialog and then abandoned showed on the row in the user list until the page was reloaded, and closing the dialog now drops them. #30193
🪙 Model defaults save. Saving the model defaults in the admin settings put the selected, pinned and ordered models back as they stood when the page was opened, undoing anything changed in between. #30206
👤 A custom gender shown back. An account whose gender is a wording of its own came back to an empty dropdown in the account form, and the form now shows Custom with that wording beside it. #30215
🗓️ Clearing a calendar event. Emptying the repeat, the description or the location of a calendar event did not take and the old wording came back, and those fields can be cleared again. #30204
📕 Required prompt dropdowns. A prompt's form could be sent with a required dropdown left unchosen, and now asks you to pick something first. #30078
🎫 Account form required fields. The account form now refuses to save with a required field left empty, the way the admin user dialog does, and a date of birth is no longer demanded of accounts that never set one. #30296, #30295
🐑 Model clones keep their base. Cloning a model from the admin Models settings now carries the model it was built on, where the clone came out detached from it, and an arena model no longer offers Clone at all. #30080, #30079
🧤 Model sharing survives a save. Saving a model you cannot fully share no longer strips the access entries you cannot re-create, where an editor resending every stored entry had each one re-checked against what its author may grant, and a save from someone with narrow rights quietly took the model private for everyone else. Commit, #30093, #30087
📠 Prompt version saves. Saving a new version of a prompt without Set as Production leaves the live prompt exactly as it was, where the draft quietly took its place, and the editor now shows the production text the moment a version is set. #30231, #30230, #30233, #30232
💬 Model description round trips. A workspace model whose description is switched from the default back to custom saves again, where the switch read the field as empty and the description was dropped on save. #30249, #30247
🎚 Compaction threshold saves. The context compaction threshold set in general settings now reaches the model parameters, where the value never left the page. #30270, #30269
📢 Speech engine defaults. Switching the text to speech engine now applies that engine's own default voice and model, where the change kept the previous engine's settings in place. #30289, #30288
🗞 MinerU key in local mode. The document settings save again in local mode with the MinerU key left empty, where the form demanded a key it did not need. #30299, #30298
🫂 Group dialog reset. The new-group dialog opens empty after a group is created, where the next one came up holding the group just made. #30280, #30279
🧵 Thread reply notifications. Clicking the notification for a reply written inside a thread dropped you at the bottom of the channel with the thread still shut and the reply nowhere in sight; it now opens the thread the reply belongs to. #29856, #29855
🔽 Dropdown arrow spacing. The arrow in the dropdowns drawn no wider than their contents, among them the provider on a new connection, no longer overlaps the last characters of the longest choice. #29866, #29865
🧊 Lowercase header handling. Headers from an upstream that writes them in lower case, as anything served by uvicorn does, are now matched without regard to case, so "Content-Encoding" is stripped and clients stop failing to decompress a body the server had already decoded. #29843
🛑 Complete chat stop. Where a chat had more than one task in flight, stopping it, deleting it, or closing a note being worked on could stop the first and leave the rest running to the end, both because a task that had already finished ended the round early and because the list being worked through was rewritten underneath it as each one was cleared away; every task is now stopped in turn, so a reply that was calling tools stops calling them rather than running on to its own limit, though instances sharing their state through Redis were not affected. Commit, #29844, #29816
🖊️ Channel code blocks. Where a model answers in a channel with structured output, the code inside it was drawn as plain highlighted text rather than in the editor every other message uses, so it could not be edited in place and a diff in it could not be opened for editing; it now renders the same way as everywhere else. #29861
📐 Code block edits on collapse. An unsaved edit inside a code block stays on screen when the block is folded away and opened again, where collapsing it showed the saved text though the edit was still pending. #30284, #30283
🚨 Code run errors with output. A code run that ends with an error now shows the error alongside what it printed, where a run that printed anything at all showed its error nowhere. #30286, #30285
🔕 Reactions on read-only channels. The reaction picker no longer appears on a channel open to you as a viewer alone, matching the reply and menu options already hidden there. #30241, #30240
🎯 Knowledge search accuracy on PostgreSQL. A fresh install using PostgreSQL built its search index before a single piece of text existed to organise it around, so the index was never fit for the content that arrived afterwards and every search quietly returned the wrong passages; the index now waits until there is enough text to build on, and until then searches read everything exactly. An install already carrying such an index can restore it by rebuilding that one index. #30143, #30134
🗂 Knowledge file filter on first click. The File content filter in a knowledge base now narrows the listing the first time it is clicked, where the first click only armed the checkbox and everything stayed listed until it was clicked again. #30211, #30210
🔭 Knowledge base search recall. Where many knowledge bases are stored together, a search of one holding a small share of what is stored found only a small share of its matches, and the shortfall grew as the store did; the search now keeps looking until it has enough from the knowledge base you asked for, and "PGVECTOR_ITERATIVE_SCAN" switches that off or makes it strict. #30142, #30135
🪣 Searches that found nothing. A knowledge search that came back empty never handed its database connection back, so enough of them left knowledge search failing outright until the server was restarted; connections are returned now on PostgreSQL and on openGauss alike. #30142, #30133, #30144
🧽 Knowledge folder deletion. Deleting a folder without moving what was in it up a level dropped the files from the listing but left their text in the search index and the files themselves in storage, so a model went on retrieving and citing pages from a folder that was no longer there; the text is now removed with the folder, and a file no other knowledge base holds is deleted with it unless file retention is switched on. Commit
🦀 Regex searches over chat and knowledge files. A pattern search now runs in time proportional to the text whatever the pattern, where a nasty expression could stall the search for good, and the patterns it accepts follow RE2's rules, with no lookarounds or backreferences and character classes matching ASCII only. Commit
⏰ Automation schedule parsing. An automation whose rule puts the time in "DTSTART" is now read at that hour, rather than listed at midnight and opened at nine, which moved when it ran as soon as it was saved again. Commit
⏲️ Recurrence counts and start dates. A rule repeating a set number of times, ten or a hundred, is read as the limited repeat it is, where any count beginning with a one was treated as one-shot, and a rule carrying its start date on the same line as its repeat text now follows the start you picked, on schedules and calendar events alike. #29262
⌛ Stalled schedules and stuck tasks. A schedule whose rule takes too long to work out no longer holds up the round that evaluates it and is skipped with a warning, and background tasks shared through Redis now expire once their worker falls silent, after "REDIS_TASK_TTL" seconds. Commit
📣 Model mention chips. A mention whose ID carried anything beyond letters, digits and a little punctuation, such as the brackets in some workspace model IDs, stayed on screen as the raw "<@…>" text both in the box you type in and in the message once sent; any ID without a space in it is now drawn as a chip. #29864
😀 Multi-codepoint emoji. An emoji whose shortcode is several codepoints, the flags among them, is inserted whole, where only its first part reached the message. #30213, #30212
🔔 Custom webhook names. A webhook target named with a space or a slash is now tidied the way an automatic name always was, so it can still be edited, deleted, made the default or tested afterwards. #29947
🪛 Paginated MCP tool lists. A server that hands its tools back a page at a time had only the first page read, so the rest were never offered to a model; the whole list is now collected before the tools are built. Commit
💭 Anthropic thinking blocks. Open WebUI's own thinking blocks are no longer forwarded to an OpenAI-compatible backend, which since 0.11.0 made a strict server such as NVIDIA Dynamo refuse an Anthropic client's second turn; signed blocks still pass through. #29849, #29799
🗨️ Channel model terminals. A model with a terminal chosen in the workspace had that choice honoured in a chat but dropped where it answered in a channel or ran as a channel automation, so it worked without one; it now carries the same terminal everywhere, alongside the tools, filters and features it already carried. Commit
🧺 Deleted channel messages leave no quotes. Deleting a channel message now clears the quote of it sitting on every reply and drops it from the reply box, where a reply kept showing the deleted message and could still be sent addressed to it. #30314, #30313
🔌 Terminal tools need a terminal. A model was offered the tools that read your terminal and type into it whether or not the chat had a terminal switched on and connected in your browser, so it could reach for one that was not there; those tools are now handed over only for the terminal the chat has open. Commit, Commit
🔤 Custom header encoding. The custom headers a connection sends are encoded once the values are filled in, so a person's name or group carrying anything beyond plain ASCII, a line break included, no longer breaks the request or reaches the other end as something else. Commit
🆎 Chromium spellcheck corrections. Picking a suggestion from the browser's own spelling menu in the message box did nothing, or put the misspelling straight back, because a highlight meant for the notes editor was being drawn over the selection and rebuilding the text underneath it, taking the browser's spelling marks with it; that highlight is now kept out of the message box and only drawn where the editor is not in use. #29952, #29944
🈁 IME composition while renaming. Confirming a chat rename with Enter or Escape part way through typing with an input method editor now finishes the composition without saving or cancelling the rename, where the key press acted at once. Commit
🐳 Dotless host addresses. With local web fetching turned on, an address pointing at a container name on the same network, "http://apprise:8000" and the like, is now accepted rather than refused as invalid. #29945, #28161
🪧 False skill mentions. Something written as "<$fh>" in a message, as Perl and other languages do, was taken for a mention of a skill and quietly removed before the model saw it, and drawn on screen as a chip; only mentions naming a skill that exists and is turned on are treated as mentions now. Commit
🎒 Skill settings survive saving. Saving a skill from its editor cleared the tags and translations it carried and switched it back on where it had been disabled, and all of that now survives the save. #30185
🫥 Webhook avatar forwarding. Turning "ENABLE_PROFILE_IMAGE_URL_FORWARDING" off stops browsers being sent on to outside picture addresses, and a channel webhook's picture was sent on regardless; it now serves the built-in picture like the rest, in the webhooks dialog as well as the message list, where the dialog had been sending every viewer's browser straight to the outside address. #29889, #29892
🪟 Statistics window origin. The window that shares chat statistics with the community accepted requests from any page that opened it and answered to anywhere; it now reads and replies only where the community site is at the other end. #29918
🖼️ Tool image rendering. Where a tool answered with an image tucked inside an object or a list rather than on its own, the image was written into the conversation as its raw text, a single screenshot costing hundreds of thousands of tokens and crowding out everything else; such an image is now taken out wherever it sits and attached to the reply, so the model is handed the picture and you see it. An older fault that let every second image through untouched goes with it, and in a saved chat such an image is now kept as a file and referred to rather than written into the conversation itself, so the chat stays small. #29665, #29208, Commit
⏱️ Stopped reply state. Pressing stop saved the reply as finished while the parts inside it were still marked as running, so a block went on reading "Thinking..." or "Executing..." and came back that way after every reload; those parts are now closed off as the reply is stopped, and an open tab settles at once rather than only after a reload, while a tool call still waiting for your approval keeps its prompt. #29495, #29281
🩺 Knowledge sync errors. A knowledge base sync that fails now names the file it happened on and what the browser said, rather than reporting nothing beyond "Error accessing directory". #29507
🚧 Terminal proxy restrictions. Requests passed through to a terminal server are now refused where they aim at that server's administrative endpoints, are not followed on to somewhere else, and are turned away where the path carries characters a parser would rewrite. Commit
⛔ Malformed tool calls. Where a model asked for a tool with arguments that were not an object at all, a bare list or string, the reply stopped there; the model is now told what was wrong with the call and can try again. Commit
📡 Broken stream reporting. Where something failed part way through streaming an answer out of "/api/chat/completions", the stream simply stopped, leaving a client waiting on an answer that would never finish; it now closes with an error and a proper end of stream. Commit
🧷 Chat unblocked after an error. A reply that failed, on a content filter or an exhausted quota, left the chat turning away everything you typed after it and stopped the message queue. Only the failed reply now ends, so the chat carries on and the other replies in a multi-model answer keep writing. Commit
🫙 Empty failed replies in history. An assistant turn that ended in an error with nothing written is no longer handed back to the model as part of the conversation when you send your next message. Commit
📭 Empty page uploads. Adding a web address to a knowledge base that came back without any text failed with a bare "Error uploading file" and, where the upload itself was refused, left the row sitting in the list; the reason now reaches you as it was given, and the row is taken away. Commit
🎞️ Tool embed scope. The frames a tool call can ask to have shown, which run scripts of their own, were drawn wherever a message was rendered, a channel among them; they are now drawn only in the replies of the chat you are in, and never in a channel. #29985
🚰 Rejected picture addresses. A model entry carrying a picture address the server refuses no longer leaves that address in memory, where anyone signed in could pile them up. #29971
🖌 Editing a stored image. Asking a model to edit an image this instance already holds now works whatever host its address names, where a container name, a default port or a self-composed host made the edit fail with a generic loading error. #29691, #29220
🧪 Memory replies carry less. The memory tool no longer hands the model each memory's stored metadata, and a memory now records the model's id rather than the whole model entry. Commit
🔇 Memory fully off. With memory switched off, stored memories are no longer folded into a reply's context and the memory tools are no longer offered to the model, where both went on reaching it behind the switch. #30228, #30227
🧠 Memory review behind the switch. The background review that drafts new memories from a conversation no longer runs when memories are switched off or the account is barred from them, where it went on spending a task-model call every interval turn and failing at the write. #30309
🏗️ Terminal server save button. Saving a terminal server now waits for the save to finish before the dialog closes and cannot be set off twice by a second click. Commit
🗺️ Terminal file panel paths. The file panel beside a terminal now opens the file a model just wrote even when it is named with a relative path, where the panel could not match the name, jumped to the root and dragged the session's working directory with it. #30282, #30051
🍴 Forked chat folder. Forking a chat put the copy in the original's folder even where you cannot write to that folder; it is now created outside any folder unless you can. #30069
🪢 Dropping a folder in place. Dragging a folder onto the folder it already sits in failed with "Folder already exists", and is now taken for the no-op it is. #30169
🗝️ Read-only folders read-only everywhere. A folder shared with you as a viewer no longer shows its edit controls on the empty-chat page, where they appeared and a save went through or failed depending on rights the page never checked. Commit
🚿 Deleting a folder, keeping chats. Removing a folder while keeping the chats inside it was refused for an account not allowed to delete chats, even though nothing was being deleted, and it now goes through. #30163
🏷️ Tag cleanup after deletion. An administrator deleting someone else's chat tidied unused tags out of their own account rather than the owner's, leaving the owner with tags nothing points at. #30171
🌱 Forking past an unfinished reply. A chat that held an interrupted reply anywhere in it refused every fork from then on and never recovered; forking now waits only on a reply actually being generated, and a turn paused for tool approval still forks with its prompt showing. #30131, #30128
💾 Deleted tool memory. Deleting a tool or a function left the whole of its code in memory for as long as the server ran; it is now let go of along with the rest. #29983
🐌 Sign-in rate limiting. Counting sign-in attempts through Redis no longer stops the whole worker until Redis answers, so a slow Redis stops freezing every other request with it. #29977
♻️ Session pool cleanup. The task that clears out abandoned websocket sessions now carries on through an error from Redis instead of ending for good, and stops properly at shutdown. #29976, #29979
🛰️ Direct connections across workers. A reply streamed over a direct connection no longer goes quiet part way through where several servers share their websocket traffic through Redis; the events it lives on now travel between workers the way the rest already did. Commit
🫧 Empty document ids. A save arriving for a document with no id at all was filed against that empty id and never cleared, so anyone signed in could pile them up; nothing is filed for it now. #29980
🔬 Page fetch CPU spin. Fetching a page through the browser-driven loader never returned where that page opened a WebSocket, holding a worker thread at full CPU for the life of the process and costing another core on every further fetch, which left the whole instance slow. #30050, #30024
🔁 Duplicate search tracebacks. A vector database outage wrote a full traceback twice for every collection and query pair, turning one outage into hundreds of identical stack traces per message on every replica; a single record now names every collection that failed. #29981
🧯 Page fetch logging. Fetching a page through the browser-driven loader filled the log with tracebacks where the page closed while it was still pulling pieces of itself, as sites behind Cloudflare and similar do; those requests are now let go of before the page closes. #29325, #28869
📤 Tool export scope. Exporting all tools at once returned every tool the account could see, the source of a tool shared for reading included; it now returns only the tools it may edit, matching the single-tool export and the way models already export. #29310
🗳️ Partial workspace exports. Exporting the prompts or the models from the workspace wrote out only the page you happened to be looking at, so most of them were quietly left out of the file; both now export everything you are allowed to. #30187
🧳 Imported chats keep more. A chat brought back from an export arrived unpinned and unarchived and without the variables it was saved with, and all three now survive the round trip. #30155, #30151
🗂️ Unarchiving from search. The menu on a search result offered to archive a chat that was already archived and said it had been archived when it had been brought back, and it now names and reports whichever of the two it did. #30177
🙈 Folder filters with no match. A chat search narrowed by a folder name that matches no folder now finds nothing, where the folder filter was quietly dropped and every chat came back. #30273, #29959
🧹 Sidebar after bulk actions. Archiving, deleting or unarchiving every chat at once, or importing a batch of them, left the folders and the pinned chats in the sidebar showing what was no longer there until the page was reloaded, and a bulk action that failed no longer reports success. Commit
🔐 Model pictures follow model access. The picture belonging to a model is now shown only to people who can see that model, where anyone signed in could fetch it and tell an existing model from an unknown one by which picture came back. #29700
🚪 Webhook pictures follow channel access. The picture belonging to a channel webh

Original source

Added

♿ Accessibility mode reaches the menus. Accessibility mode now marks the menu entry you are pointing at and the model already chosen with a stronger background, across the dropdown menus, their submenus, and the model picker together with its filter and compare controls, so those cues carry the contrast the accessibility guidelines ask for in both themes. Commit, Commit

🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

🌐 Translation updates. Translations for Indonesian were enhanced and expanded.

Fixed

💥 Chat branches stay connected after reloads. A reply saved under an earlier message now stays listed under that message, so branch arrows, exports, reloads, and later edits keep the whole conversation in view, and chats already saved with that link missing are repaired when opened. #29299

🧱 Upgrades fail clearly instead of starting half updated. A failed database upgrade now stops at the migration error that caused it, instead of starting anyway and reporting a missing table or column such as 'chat.timer_at' later, which is the upgrade failure seen after moving from 0.11.0, 0.11.1, or 0.11.2. #29280

🔤 Custom interface fonts reach more of the app. The font chosen in interface settings now applies to dropdowns and other interface text that previously fell back to the standard font. Commit

🔌 Disconnect OAuth only where there is OAuth. The disconnect control on a tool server reached over MCP now appears only where that server signs in through OAuth and an account is connected, rather than on servers that use no sign-in at all. #29296

Original source

Added

🖼️ Richer previews for terminal files. Word documents and slide decks produced in the terminal are now previewed as the finished document rather than an approximation, and every document preview gains a page strip down the side with numbered thumbnails you can click to jump straight to a page, and the notice warning that a preview might differ from the download is gone now that it does not. Commit, Commit, Commit, Commit, Commit

⚡ Less overhead on every message. Deployments without pipelines configured, which is the default, no longer pay setup work for them on each chat message and background task. #29146

🏎️ Lighter model list refreshes. On deployments running several workers, a refresh that finds the model list unchanged no longer has every worker rewrite the whole list to the shared cache, cutting the work and the traffic each refresh costs. #29264

🧵 Smoother busy websocket servers. Large Redis-backed websocket deployments now spend far less time sweeping old sessions, reading their own session data back from Redis, and checking every outgoing websocket message for file attachments Open WebUI does not send, so channel posts, collaboration updates, heartbeats, and live chat updates put less load on busy servers. #28835, #28180

🧰 A new request filter step. Filter authors can now use request to adjust the payload right before each model call, including follow-up calls after tool use, while existing inlet, stream, and outlet filters keep working as before. Commit, Commit

🤏 More room in file previews on touch screens. File previews on phones and tablets no longer show zoom buttons that sit over an already small preview, leaving pinch to zoom to do the job. #29176, #29152

👆 Resizing panels by touch. The divider beside the main sidebar or a side panel can now be dragged on a touchscreen or with a stylus, and a drag made with the mouse keeps following the pointer when it leaves the window. Commit, Commit, Commit

🔤 Choice of interface font. Interface settings now offer a font family field where you can name a font installed on your computer and watch it apply across the interface as you type, with an empty field returning to the standard font. Commit

♿ Wider accessibility mode coverage. Accessibility mode now lifts the contrast of more of the interface, including muted text, table text, icons, the colours elements change to on hover, and the highlight behind sidebar and menu items you point at, so low-contrast areas meet the level the accessibility guidelines ask for in both light and dark themes, and the close button on the folder dialog now announces itself to screen readers, as do document and slide previews, which can now be reached with the keyboard. Commit, Commit, #29160, Commit, Commit

🌐 Translation updates. Polish, Simplified Chinese, German, Irish, Catalan, and Portuguese (Brazil) translations were expanded, corrected, and brought up to date with newer interface text. #29029, #29043, #29108, #29151, #29184, #29179, #29247, #29217

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories

💥 Replies stop breaking mid-chat. A conversation no longer fails in the browser and stops showing the assistant reply until you reload, and chats already saved in that state display and can be edited again. #29250, #29244

⌨️ Preview shortcuts stay in the preview. Arrow keys now page a document or slide preview only while that preview has focus, instead of paging it from anywhere on the page and taking the arrow keys away from whatever you were typing in. Commit, Commit

🧊 Streaming no longer stalls on reasoning models. A reply from a reasoning model now streams through to the end instead of showing its first few words and then freezing until generation finishes. #29053, #29035

💭 Thinking stays in Thoughts. After a model uses a tool, its reasoning for the next step now appears in the collapsed Thoughts section instead of being written into the reply as ordinary text. #29052, #29040

🧠 Large tool calls stream faster through Anthropic-compatible clients. When a streamed tool call sends a large block of arguments, Open WebUI now waits until that block can actually be complete before checking it, instead of doing the same expensive check again on every tiny piece. #28858

🛑 Stop works across instances. Stopping a response now takes effect on deployments that spread people across several instances backed by a Redis cluster, instead of the reply continuing to the end regardless. #29165, #19840

🎯 Fewer needless chat reloads. A conversation holding an older unfinished reply no longer reloads itself each time some other response in it finishes, reloading only for the reply the update actually concerns. Commit

📖 Banners with underlined text. A banner containing underlined text now displays instead of failing to render. #29118, #29115

🧰 Pinned models start with their own tools. Starting a chat from a pinned model in the sidebar now applies that model's tools and skills instead of carrying over the ones from the model you used last. #29058, #29050

❓ Rejected ask_user calls no longer kill the reply. If a model asks the user a question in a way Open WebUI refuses, the model now receives that error and can continue or retry, instead of leaving the chat stopped with no answer. #29252, #29077

🚫 Disabled models no longer vanish. Turning a model off in the admin Models list now keeps it in view so you can turn it back on, instead of it disappearing with no way to recover it. #29037, #29036

✂️ Message text kept intact. Text containing angle brackets and a dollar sign is no longer mistaken for a skill mention and silently removed before your message reaches the model. #29051, #29041

📆 Moved calendar events stay visible. Changing an event's date no longer makes it disappear from the calendar, and events already stuck in that state show up again. #29085, #29067

🔁 Repeats follow the event. A repeating event now works out its occurrences from its own date and time, where a repeat rule carrying a start date of its own could place them on the wrong weekday or at the wrong hour. Commit

🔟 Repeating automations keep their count. An automation set to run a fixed number of times is no longer shown as running once and quietly rewritten to a single run the next time you open and save it. #29261, #29263

🗓️ Schedules survive a save. An automation carrying a start date now shows its real schedule in the list and keeps its weekly or monthly setting when saved, instead of showing raw rule text and falling back to daily. #29263

🧩 Custom automation schedules stay custom. Reopening an automation with a custom repeat rule no longer loses the custom rule from the editor. #29260

🔢 Accurate admin user counts. The counts on the admin Users tabs now follow your search and reset when you switch tabs, instead of showing stale or unfiltered numbers. #29080, #29079

🧷 Sidebar folders stop acting stale. A folder that has been removed from the sidebar is now removed from the internal sidebar registry too, so later sidebar actions do not target a folder that is no longer on screen. #29121

📱 Readable model list on small screens. The model identifier and timestamp in the workspace model list no longer overlap the model name on narrow displays. #29084, #29083

🧱 Long setting values stop crushing labels. Settings rows now let long controls shrink inside the available space instead of squeezing the label beside them. #29229

🧭 Model defaults panels stay usable. The model capabilities and prompt suggestion sections in admin settings now scroll inside their panels instead of growing past the available space. #29235

📲 Dropdowns stay on screen. A dropdown near the edge of a narrow screen now shifts inward to stay fully visible instead of opening past the edge with its option labels cut off. #29226, #29225

🌗 Dropdown lists follow the theme. The list a dropdown opens now takes its light or dark colouring from the rest of the interface instead of the system default. Commit

🎛️ Valves dialog stays in bounds. A valve whose selected options form a long line no longer stretches its input past the edge of the dialog and over the page behind it. #29203, #29202

🧹 Shared chats search resets. Reopening the shared chats dialog now starts with an empty search box and the full list, rather than a leftover search term above unfiltered results. #29082, #29081

🔎 Case-insensitive search beyond English. Searching and filtering by tag now ignore letter case for accented and non-Latin text on installations backed by SQLite, where only unaccented English letters were matched whatever their case. Commit

🏷️ Labels with colons and example URLs translate correctly. Interface text such as Warning:, http://localhost:8000, and https://mineru.net/api/v4 now appears correctly instead of being misread by the translation system. #29161, #29154

🔑 Precise account matching on SQLite. Signing in through an identity provider now matches your account on its exact identifier, so accounts whose identifier is an unusually long or zero-padded number are no longer at risk of being confused with another. Commit

🗃️ Knowledge list loads reliably. The Knowledge page in the workspace now fills in its list on opening instead of occasionally staying empty. Commit

🎟️ Tool servers without a key. A tool server connection saved without a key is no longer sent an empty authorization header, which some servers refused outright. Commit

🐍 Code interpreter starts on Windows. The built-in code interpreter now serves its script and WebAssembly files with the browser-safe file types Windows hosts sometimes overwrite, so Pyodide can load instead of failing before code runs. #29139, #29133

Changed

⏱️ Daily limit on repeats. A calendar event can no longer be set to repeat more often than once a day, and saving one that repeats more often is now refused with a message explaining the limit. Commit

🏷️ High Contrast Mode is now Accessibility Mode. The interface setting previously called 'High Contrast Mode' is now called 'Accessibility Mode', with the same switch in the same place. Commit

Original source

Added
🚦 Human in the loop tool approval. Where an administrator has turned it on, you can switch a conversation from letting tools run freely to being asked first, so a model that wants to use a tool stops and waits for you to allow or deny it, one call at a time in a saved conversation, by button or by keyboard shortcut, with your choice remembered for this conversation and for future ones, switching back to running freely releasing anything already waiting, and automations, channel replies, and temporary chats unaffected. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🙋‍♂️ Models that can ask you a question. A new built-in tool lets a model pause and put up to three multiple-choice questions to you before continuing, with room to type your own answer instead, and the question survives a reload in a saved conversation, so you can come back and answer it later rather than losing the conversation. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🖇 Agents can now display terminal files directly. A model can now show a file it made in a terminal directly in its reply, with a preview and a download button, instead of describing a path that led nowhere when clicked, and a new interface setting chooses whether these open in the reply or in the files pane. Commit, Commit, Commit, #27650
📶 Streaming rebuilt from the ground up. A reply now streams as small pieces of new text instead of resending the whole message so far with every update, so the data sent over a reply grows with its length rather than with its length squared, which on a server with many people chatting at once means far less processor time spent encoding, passing, and decoding those updates, far less load and memory on the shared cache that carries them between instances, and far less work in your browser, which no longer takes in the whole reply again and redraws the parts of it that have not changed on every update, cutting the data sent and the server work spent appending to a message by up to 1000x on a very long reply, and a reply still in progress is now kept aside on the server, so reopening the conversation after a refresh picks it up where it is rather than showing a blank message, on deployments backed by Redis. Commit, Commit, Commit, Commit
🪵 Much faster throughout. Hundreds of places across the application no longer assemble detailed log text that is switched off and thrown away unread, so sending messages, uploading and indexing files, running searches, signing in, and loading admin pages all get that time back, with the largest gains on busy servers, in long conversations, and on chats that draw from a large knowledge base. #27834, #27837
🚀 Faster model list lookups. Title generation, tag suggestions, autocomplete, and other background steps of a chat turn now fetch the model list in one go, which keeps other people's responses flowing on busy Redis-backed instances with many models. #27821
🛰️ Cheaper log export. Deployments that export their logs to a telemetry collector, with "ENABLE_OTEL" and "ENABLE_OTEL_LOGS" both set, now prepare each exported line once instead of twice, which matters more than it used to now that log text is only assembled when something will actually read it. #27840
📇 Faster permission checks on large instances. Working out which groups you belong to is now a direct lookup rather than a scan of every membership on the server, so chats and the admin user list stay quick as an organization grows. #27822
⚙️ Much faster JSON handling. Saving and opening chats, reading settings, returning results from built-in tools, streaming replies, signing in and signing up, working out your permissions, and reading stored chunk details during knowledge base searches on Valkey and Oracle vector storage are all handled much faster across the application when the "ENABLE_ORJSON" option is turned on. Commit, #28396, #27841, #27807, #27805, #27813
📤 Much faster outbound requests. Conversations and embedding batches sent to Ollama and Anthropic models are packaged for delivery much faster, which is most noticeable in long chats when the "ENABLE_ORJSON" option is turned on. #27811, #27810
🐍 Much faster code interpreter output. Printed output and generated images from code run in chat appear much faster when the "ENABLE_ORJSON" option is turned on. #27812
🪶 Lighter page loads. Several small requests the interface makes on every page load, along with a few administrative ones, no longer set up database access they never used, which took several times longer than the rest of the request put together. #28178
♻️ One less read per message. Sending a message no longer loads the whole conversation from the database twice over, which mattered most in long chats where that record is largest. #28809
🏁 Faster skills on large instances. Opening the skills list, or sending a message that uses one, no longer checks every skill on the instance one at a time, so both are far quicker where many skills exist and most of them are not yours. #28798
🩻 Faster tools on large instances. Listing or exporting tools no longer checks every tool on the instance one at a time, so the integrations menu and the tools workspace open faster where many exist. Commit
🧊 Faster file access checks. Checking whether you may reach a file no longer walks every workspace model you can see looking for it, so opening a folder of files, downloading one, or retrieving from one is much quicker on instances with many models. #28802
🧱 Faster folder listings. Listing your folders now works out your group memberships once for the whole listing rather than again for every item in every folder. #28810
🧼 Less work per update in a long chat. Each update saved while a reply streams no longer re-examines the entire conversation, only the part being added, so the cost of an update stops growing with the length of the chat. #28820
🗃 Cheaper attaching of sources and files to a reply. Adding a source, file, or embedded item to a reply now reads just that one field rather than rebuilding the whole conversation to find it, which on a two hundred message chat is around 3.1 ms per item down to 0.65 ms, and no longer grows with the length of the conversation. Commit, Commit
🚏 Faster workspace model lookups. Working out which workspace models you may edit no longer loads every model on the instance and discards most of them, which also speeds up exporting models and the file access checks that relied on it. #28795
📮 Faster handing off a streaming reply. Passing a reply in progress between instances now writes it once rather than converting it back and forth and scanning it for characters that only matter elsewhere, which on a large non-English conversation took most of the time spent on each write. #28833
🥵 Constant load on an idle instance. An instance sitting idle no longer works through every chat you have once a second looking for timers that are due, which on a large history kept about a quarter of a processor core busy doing nothing and could exhaust memory until the application was killed. #27663, #27622, #27745
📍 Sidebar folders fetched once. Refreshing the sidebar now asks for your folders once rather than three times, on page load and on every action that refreshes it. #28662, #28661
💤 Far fewer writes just from being signed in. Recording that someone is online now writes at most once a minute for each person rather than on every single request, where an open tab alone caused two write transactions a minute before anyone touched anything. #28177, #28165
🛰 Less overhead on every request. The layers each request passes through before it is handled are now one instead of five, which also removes a quarter of that cost from every piece of a streamed reply on instances that set security headers. Commit, #28171
🎏 Turning off compression of live updates. A new "UVICORN_WS_PER_MESSAGE_DEFLATE" setting stops the server compressing every live update it sends, which costs processor time on each one for almost no saving now that a reply streams as small pieces; compression stays on unless it is turned off. #28613
🌡 Faster chat list and unread counts. Opening the sidebar, and the unread markers on folders, no longer read through your whole chat history to produce a short list, which on an instance with 15000 chats took 2 to 4 seconds. #27663, #27622, #27745
🥁 Long replies no longer slow as they grow. A long reply is no longer re-examined from the beginning for reasoning and code blocks on every piece that arrives, so the work stops growing with the length of the reply, which on a long reply is around 190x less time spent on it. #28861
💽 Faster saving of long chats. A chat is now written to the database in one go rather than one message at a time, so saving a long conversation is much quicker and puts far less strain on the database, and saving one where nothing has changed writes nothing at all. #28806
📦 Faster loading of shared folders. Folders shared with you now load in a couple of queries rather than one for each folder and each owner, so the list appears sooner for anyone with many of them. #28804
⚡ Uninterrupted chat during knowledge search. Responses now keep streaming for everyone on the server while knowledge base searches run, instead of pausing until each search finishes. #27824
🔍 Smarter chat search. Searching your chats now finds conversations containing all of your words in any order rather than only the exact phrase you typed, with exact matches still listed first, and the preview snippet points at whichever word it found. Commit
⌨️ Model switching from the message box. Typing "/model" now tells you which model you are on, switching to another by name with "/model" followed by its id, or opening the model picker straight from the slash menu without reaching for the mouse. Commit, Commit
📎 Sending while attachments upload. Sending a message before its files have finished uploading now queues it and sends it automatically once they are ready, instead of refusing with an error, and each queued message shows the progress of its attachments. Commit, Commit, #28381, #28380
📖 Opening a document at the right page. A model showing you a PDF, Word document, or slide deck from a terminal can now open it at a particular page or slide, so a reply that cites something on page 76 can put that page in front of you. Commit, Commit, Commit
💼 Attachments that go straight to a terminal. A terminal connection can now be set to receive files attached in chat into its own working directory rather than into the conversation, which also means files can be attached while using a model that cannot read them itself. Commit, Commit, Commit, Commit
🔦 Searching files in the terminal browser. The file browser now has a search box that finds files by name and by what is inside them, and opening a result takes you to the matching line. Commit
🌲 Browsing files as a tree. The terminal file browser now expands folders in place rather than only navigating into them, remembers what you had open, offers a right-click menu, can show hidden files, sorts by size, expands a folder you hover over while dragging something onto it, and moves a whole selection in one go when you drop it. Commit, Commit
🧰 Managing models on more servers. Administrators can now download, load, and unload models on llama.cpp and LM Studio connections from the manage models dialog, remove them on llama.cpp, and start a download straight from the model picker's search box, alongside the Ollama support that was already there. Commit, Commit, Commit, Commit, #28766
📢 Automations that post to a channel. An automation can now be pointed at a channel instead of a chat, so its scheduled run appears as a message there for everyone to see, chosen from a new destination picker that also covers folders. Commit
🙋 Mentioning people in a channel. Typing an at sign in a channel now lists that channel's own members first, before everyone else on the server, so the people you are likely to mean are at the top. Commit, Commit, #28883
🔗 Attaching any link. Pasting a link into a chat or a knowledge base now works out what is behind it, downloading a document or image as a real attachment rather than treating everything as a web page to be read as text. Commit
🔎 Searching tools and skills in chat. The integrations menu now has a search box for tools and for skills, so a long list can be narrowed by name instead of scrolled through. #26709, Commit, #28807, #28812
🧭 More from the message box. The slash menu now offers settings and, in a new chat, a toggle for temporary chat, alongside the commands that were already there. Commit
🚨 Being told when a file fails to process. A file that cannot be processed for a knowledge base now raises a notification naming the file and what went wrong, and keeps that reason on the file, instead of quietly being marked as failed. #27666, #6311, Commit
🔬 Zoom controls on previewed images. An image opened in the file browser now has zoom in, zoom out, and a reset button showing the current zoom, and pinching, scrolling, and holding a modifier key while scrolling now zoom and pan as they do elsewhere. Commit, Commit, Commit, Commit
🗂️ Recognisable file icons. The terminal file browser now marks each file with an icon for its type, so code, images, archives, documents, and configuration files can be told apart at a glance instead of sharing one generic page icon. Commit, Commit, Commit
📽️ Truer PowerPoint previews. Slide previews now render tables, charts, connectors, gradients, theme colours, bullets, fonts, and text alignment far closer to the original, and the viewer lets you move between slides with the arrow keys or the scroll wheel while the thumbnail strip follows along. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
📄 Faithful Word document previews. Word documents now open as proper pages with headers, footers, footnotes, and embedded images intact, and can be zoomed, rather than being flattened into plain formatted text. Commit, Commit
🗝 Deleting your API key. An API key can now be revoked outright from your account settings, where the only way to retire one was to replace it with a new one. #28874, Commit
🎛️ Settings for the task model. Administrators can now set the generation parameters used for background work such as titles, tags, follow-ups, search queries, and conversation summaries, either from the admin panel or through "TASK_MODEL_PARAMS", instead of those requests always using a fixed token limit that could cut a summary short. #27604, Commit, Commit
🎚️ Default interface settings for everyone. Administrators can now set system-wide defaults for the interface options in Settings, either from the admin panel or through "DEFAULT_INTERFACE_SETTINGS", with each person's own choices still taking precedence and anything left untouched shown as inherited and kept in step with later changes to the defaults. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🔠 Interface scaling throughout. The UI Scale setting and your browser's own text size now resize the whole interface consistently, including the sidebar, menus, dialogs, and file browser, rather than leaving parts of it fixed. Commit, Commit, Commit, Commit
🏷️ Named writing blocks. When a model wraps a draft such as an email in a writing block, the block is now titled with its subject and shows the recipient beside it, rather than every block reading simply as Writing. #28280, #28198
🤝 Files for delegated tasks. A task handed to a sub-agent can now carry the attachments it needs, so an image or document from your conversation reaches the sub-agent instead of arriving as a file reference it cannot open and may answer about anyway. Commit, #28213
📟 Terminal availability and scope. Administrators can now decide for each managed terminal whether it appears in chats and in automations at all, and whether everyone shares a single workspace or each chat or automation gets its own, with per chat terminals waiting until the conversation has been saved. Commit
🔒 Read-only files in the terminal browser. Files and folders you are not allowed to change are now labelled read-only, with uploading, editing, renaming, moving, and deleting turned off for them rather than failing at the moment you try. Commit
🔐 Terminals that use your own login. Managed terminals configured for session authentication now authenticate the terminal connection with your own token, where it previously sent no credentials at all. Commit
🎟 Setting up a tool server that uses OAuth. Adding one is now easier to get right: the connection dialog can authorize the account from the dialog itself, the check button tests the sign-in details rather than reporting a connection failure that was never going to succeed without them, and it is now labelled for what it does rather than suggesting it verifies the whole connection. Commit, #28552
🪤 Control over what embedded pages may do. Two new interface settings decide whether pages shown inside a chat, such as an artifact or an HTML preview, may run scripts and start downloads. Commit, #28924, Commit
🗄 Keeping files removed from a knowledge base. A new "ENABLE_KNOWLEDGE_FILE_RETENTION" setting keeps the stored file and its search data when a file is taken out of a knowledge base, rather than deleting them. Commit
🧾 CSV shape in retrieval. Turning on "ENABLE_RAG_CSV_SUMMARY" adds a short line naming the row count, data row count, column count, and column names of a CSV file to what the model sees, giving it the shape of the table alongside its contents. Commit
🔭 OpenSERP in the search settings. OpenSERP can now be picked as the web search engine in the admin panel, with a field for its address, rather than only being configurable through the environment. #27594, #27592
🪧 Profile changes from single sign-on. A name, email address, or picture updated from an identity provider at sign-in now raises an event naming what changed, and the rest of the session uses the updated record rather than a stale copy. Commit
📯 Group changes from single sign-on. Group memberships added or removed when someone signs in through an identity provider, and groups created automatically along the way, now raise the same events as the equivalent change made by an administrator or over directory sync. #27657
🔔 Sign-in and sign-out events for single sign-on. Signing in through an identity provider now raises the same login event that signing in with a password does, and signing out says which provider the session came from, so a function can set up or tidy up an account in another system when someone arrives or leaves. #27619, #27613
🪛 Naming background worker threads. A new "THREAD_POOL_THREAD_NAME_PREFIX" setting labels the threads that background work runs in, so they can be told apart when reading a profile or a thread dump. Commit
📙 OpenDocument files in a temporary chat. A text document, spreadsheet, or presentation from an office suite that uses the OpenDocument format now has its text read out in the browser when attached to a temporary chat, where the model was handed the raw archive and answered that it could not read the file. Commit, #28906
🌍 Pointing Tavily somewhere else. A new "TAVILY_API_BASE_URL" setting sends Tavily searches and page fetches to a different address, for instances that reach the internet only through a gateway of their own or that use a compatible service. Commit, #28701
🪟 Honest OAuth settings. When single sign-on settings come from the environment rather than being saved in the application, the admin panel now shows them as read-only with a note naming the setting that controls this, instead of accepting edits that were silently discarded on the next restart. #28276
📏 Widening the chat controls pane. The controls pane can now be dragged as wide as you like, where it stopped at a fixed limit regardless of screen size. Commit
📱 Smoother sidebar on mobile. The sidebar now follows your finger as you swipe it open or closed, responds to a quick flick, dims the page behind it as it moves, and gives every chat row a menu button you can reach without a hover you cannot perform on a touchscreen. Commit, Commit, Commit, Commit, Commit, Commit, Commit
🚪 Sidebar that stays put. Opening and closing the sidebar is now a smooth transition that keeps your chat list loaded, instead of rebuilding the list each time. Commit, Commit, Commit, Commit, Commit
👁️ Turning off chat previews. A new setting under Settings and Interface lets you switch off the preview card that appears when you hover a chat in the sidebar, useful for a quieter sidebar, for sharing your screen, or on a slow connection. #27632, #27639
☑️ Checkboxes beside their labels. In the model editor and the admin model defaults, each capability, feature, and tool checkbox now sits directly in front of its own label instead of at the far edge of its column, where it could look like it belonged to the next one, and the label itself can be clicked to toggle it. #27788, #27771, Commit, Commit
✍️ Typing cursor while responding. A blinking cursor now marks where the reply is being written, from the moment you send your message until generation finishes, in place of the previous loading placeholder. Commit
✒️ Underlined text. Underlined text now appears underlined in a reply instead of showing the markup around it, and underlining is kept when you edit in a rich text box rather than being dropped. Commit, #26904
📥 Adding group members from a file. Administrators can now add many people to a group at once by uploading a CSV of names and email addresses, with a template to download and a message naming any row whose address does not match an account. Commit
📑 Apache Tika 4 support. Administrators extracting document text with Tika can now choose which server version they run, from Admin Settings under Documents or through "TIKA_SERVER_VERSION", where only Tika 3 was understood before. Commit, #28939
💓 Tunable heartbeat for live updates. A new "WEBSOCKET_HEARTBEAT_INTERVAL" setting controls how often each open tab checks in with the server, where it was fixed at 30 seconds, so a large deployment can cut background traffic that no one asked for. Commit, #28166
⌛ Expiring abandoned reply state. A new "REDIS_RESPONSE_STREAM_TTL" setting expires the saved state of a reply that never finished, so a server killed mid-answer no longer leaves that data behind for good. Commit
🖨️ File and image detail parts on API requests. A request sent to the OpenAI-compatible endpoint carrying an image detail level or a file part in its message content now forwards both to providers that use the Responses API, where they were dropped, while documents attached inside Open WebUI are unaffected because those still go through knowledge retrieval. Commit
🧺 Leaner stored document metadata. Bulky extraction details such as page layouts, tables and detected languages are no longer kept alongside a document in the vector store, and a new "RAG_METADATA_MAX_VALUE_CHARS" setting drops any remaining oversized value, falling back to the configured upload size limit so a document that expands enormously while being read cannot exhaust a server's memory. Commit, Commit, #29025
💨 No filter work on installs without filters. A completed message on an install with no filter functions and no pipeline filters, which is the default, no longer rebuilds the whole conversation and ships it to the browser as an event nothing acts on. Commit
📂 Opening a file in a knowledge base. A file listed in a knowledge base can now be opened and read straight from that list, where the name was shown but nothing happened when it was clicked. Commit, #28086
🧵 Cheaper saving of a reply as it streams. The resume snapshot taken on every piece of a streamed reply no longer rebuilds the whole answer each time, so the cost of a save stops growing with the length of the reply. #28821
📀 Less repeated work setting up built-in tools. Every chat request no longer rebuilds a fresh copy of each built-in tool's definition from scratch, which was paid once per tool on every message. #28860
🕹️ Control over what a terminal port preview may reach. A new interface setting decides whether a previewed port runs with access to same-origin browser APIs, so you can lock a preview out of them on installs where previews serve content you do not fully trust. Commit
♿ Improved UI accessibility. A closed sidebar is no longer reachable by keyboard or announced by screen readers, the tool call blocks in a response can now be expanded with the keyboard, the buttons that normally appear on hover, such as message actions, file removal, and chat menus, now appear when you reach them with the keyboard as well, whatever you have tabbed to is marked with a clear outline throughout the application, and the rows in the integrations menu now tell a screen reader whether each tool or feature is switched on. Commit, Commit, Commit, Commit, Commit, Commit, #27667, #17150
🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
🌐 Translation updates. Faroese was added, and translations for Slovenian, Hungarian, Finnish, Korean, Portuguese (Brazil), Catalan, and French were enhanced and expanded.
Fixed
🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories
🛂 Knowledge search reaching past what you may read. Searching knowledge bases now applies the list of collections you are allowed to open, where that restriction was handed to the vector store and silently discarded, so results could include material from knowledge bases you have no access to. Commit
💣 Documents that unpack far beyond their size. A Word, Excel, PowerPoint, OpenDocument or EPUB file that expands to far more than it stores is now rejected before it is read, where one could previously be used to exhaust a server's memory. Commit
✂️ Long replies cut off partway. A single oversized piece of a streamed reply, such as a long reasoning trace or a turn carrying many tool calls, no longer ends the answer early with a misleading error about byte counts, which affected every default installation. #28114, #25664
🚧 Web address checks that could be skipped. The fetchable-address test and the operator's web fetch filter list now run on every outgoing request, where a proxied or already-open connection could bypass them and a filter entry written as an address range silently matched nothing at all. #27823
🧑‍💻 Code execution reachable through a tag in a reply. On installs using native function calling, the older path that runs code found inside a tag in the model's reply is no longer active alongside the built-in tool, so code execution happens only through an explicit tool call. #29024
⌚ Recurrence rules that could tie up the server. How often an automation repeats is now taken from the rule the scheduler actually parsed rather than from the text of the rule, so a crafted rule can no longer disagree with what gets scheduled and walk the server through an unbounded run of occurrences, and a rule carrying a time zone on its start date now schedules instead of erroring. Commit
🗝️ Changing a password now ends other sessions. Changing your password, or an administrator resetting it for you, now stops every device that was already signed in, where they had stayed signed in on the old password until their session expired on its own, up to four weeks by default; the device making the change is signed out too and asked to sign in again, and this requires Redis, without which nothing can be revoked and a warning is now logged saying so. #28725, #28647
🧬 Workspace models shadowing a real one. Someone without administrator rights can no longer create, import, or edit a workspace model so that it takes over the identity of a model served by a connected provider, where doing so would have changed what everyone else got when they picked that model. Commit
🌳 Folders disappearing when moved into themselves. Moving a folder inside one of its own subfolders is now refused, where it was accepted and made that folder and everything in it vanish from the sidebar with no way to bring it back, while leaving the server walking the loop endlessly and querying the database as it went, which could exhaust a worker and its memory; any folder already in that state is returned to the top level. #28748
🧨 Searching a knowledge base with a costly pattern. A search pattern written so that it expands enormously before it even runs is now refused, where it could tie up the server; ordinary patterns are unaffected. Commit, #28284
💧 Attaching a very large file from a link. A file fetched from a link is now written to disk as it arrives and stops at the configured size limit, where the whole thing was held in memory first with no limit applied, so a large enough file could exhaust the server; a download that fails partway no longer leaves the partial file behind. #28945
⛓ Deleting one knowledge base removing a shared connection. Deleting an external knowledge base now leaves its connection in place while other knowledge bases still use it, and only an administrator removing the last one clears it, where any user deleting theirs took the connection away from everyone. #28113
📡 Intermittent connection failures. Requests to model providers and to services on the same network no longer fail intermittently with name lookup errors, often surfacing as a misleading model not found message, because addresses are resolved through the system again by default, with the faster resolver still available through "AIOHTTP_CLIENT_ASYNC_DNS_RESOLVER". #28242, #28013, #28215
🗯️ Losing the conversation with memory on. With the memory tool enabled, the model can see the earlier messages in your conversation again, instead of answering the second message as though the first had never been sent. #28400
👻 Vanishing responses. Replies from Responses-API providers that report an empty output at the end of a stream no longer disappear the moment generation finishes, leaving an empty message in their place. #27800, #27789
📥 Queued messages disappearing. Messages waiting to be sent are put back in the queue if sending them fails, rather than vanishing without being sent. Commit
🧵 Replies cut short mid-stream. A reply no longer breaks off part way through when a provider sends the pieces of its response in an unexpected order, which had left the answer truncated and skipped the filters that run once a message finishes. #28312
🧷 Replies not carried into the next turn. With providers that skip parts of the streaming sequence, the finished reply is now taken from the completed message, so it stays available as context for your next question and the citations that arrived with it are no longer dropped. #28310
🌊 Replies arriving in oversized pieces. Very large streamed pieces no longer break the response on default settings, where the reader that splits them safely only ran when a chunk size limit was configured. Commit
🩹 Signing in after a long-delayed upgrade. Accounts on instances that were upgraded from a version older than 0.6.41 to 0.9.6 or newer can sign in again, where an upgrade step had written their single sign-on identity in a form the application could not read afterwards, and a repair step corrects the affected accounts on startup. #28107, #28101, Commit
🔑 Signing in with some identity providers. Logging in through a provider that adds its own vendor-specific information to the header of the sign-in token now completes, rather than failing at the final step with a message claiming the email or password was wrong. #28065, #28062
🔌 Role changes taking effect at once. Changing someone's role now ends their live sessions no matter how the change was made, whether by a directory sync, an identity provider, a trusted header, or deleting the account, so permissions from their old role cannot linger, and their browser reconnects on its own. Commit
🛑 Memory permission being respected. Taking away someone's memory permission now also stops their stored memories being added to the context of their conversations, which one path had continued doing regardless. #27668
🔍 Listing a single connection's models. Asking for the models or version of one particular connection is now restricted to administrators, and a request naming a specific backend is checked against the models that backend actually serves even where the access control bypass is turned on. Commit
⚖️ Sharing defaults matching what was configured. On instances upgraded from older versions, public sharing of tools and notes no longer shows as switched on in the admin panel, and saving any unrelated permission no longer grants everyone a capability that was never enabled. #27716, #27715
🗂️ Folder permissions when starting a chat. Starting a conversation filed into a folder now checks that you are allowed to write to that folder, a check the message sending path had been skipping, and every place a chat can be filed now treats ownership, shared access, and unknown folders the same way. #28366
🪧 Clearer attachment failures. A link that cannot be read now says so and names the link, and a YouTube video whose transcript is refused explains why and points at the proxy setting that exists for it, instead of both being reported as a knowledge base error. #28362, #28361
🔎 Chat search finding recent messages. Searching your chats now looks inside the messages of current conversations on default installations, where it had only been reading an older storage format and missing their content entirely. Commit
🧭 Your place in a compacted chat. Opening a conversation whose history has been compacted now takes you to its most recent message instead of leaving you parked on the summary, and updates to an existing message no longer move your place in the conversation. Commit
🖥️ Chats with a personal terminal. Sending a message with a terminal you added yourself under Settings selected no longer fails with a terminal unavailable error, which had blocked those chats since 0.11.0. #27621, Commit, Commit
📆 Default date for new events. Creating a calendar event now starts on today's date rather than tomorrow's when you open the form in the evening, or yesterday's when you open it early in the morning. #27779, #27778
🗓️ Recurring event times. Repeating calendar events now show at the time you set them for instead of being worked out in the server's time zone and shifted by the gap between the two. #27774, Commit
🧩 Chats during model list refreshes. On direct connections, background work such as title and tag generation no longer fails or runs against a mix of old and new model entries while the model list is being refreshed. #27821
🎛️ Chat Controls staying put. Hovering a chat in the sidebar whose preview contains an artifact no longer forces the Chat Controls pane open and fills it with that artifact, over the chat you currently have open. #27773, #27772
📨 Reliable streaming with unusual characters. Responses containing any of three rare invisible line break characters no longer arrive split or broken when the "ENABLE_ORJSON" option is turned on. #27819
🧮 JSON options honoured again. Options passed to the shared JSON helper are no longer silently ignored when the "ENABLE_ORJSON" option is turned on, falling back to the standard encoder that supports them. Commit
🚫 Duplicate models in lists. Adding a model that is already on a connection's allowed list is now rejected instead of quietly adding it a second time, the arena picker no longer offers models you have already chosen, and existing duplicates are cleaned up the next time the list is saved. #28251, #28249
📁 Dragging chats into shared folders. A shared folder you can write to now highlights and accepts a dropped chat, while one you only have read access to no longer offers itself as a drop target for an action that could only fail. Commit, #28261
⏰ Listing automations through chat. Asking a model to list your automations without naming a folder now returns every automation you have, instead of only the ones that sit outside a folder. Commit
🧠 Faster follow-ups with memory enabled. The memories handed to the model now appear in a stable order from one message to the next, so servers that reuse their work between turns no longer reprocess the whole conversation each time you reply. #28292, Commit, Commit
🎯 Custom model parameters combining. Setting a custom parameter on a model no longer silently discards every custom parameter defined in the global defaults, and a value sent directly in an API request is no longer overwritten by the model's saved settings. Commit, #28241
👥 Sharing with people already added. The access picker no longer offers people and groups that already have access, and the Users heading no longer appears above an empty list. Commit, #28253
🔧 Full tool parameter descriptions. A tool whose parameter description runs over several lines now passes the whole description to the model instead of only its first line. Commit
📝 Notes saved in an unexpected shape. A note whose content was stored as structured data rather than text no longer breaks the notes page for everything else, and opens with that content shown as a formatted code block. Commit, #28222
💬 Direct messages after an account is deleted. A direct message conversation no longer counts a deleted account among its members, and opening a direct message with someone finds the existing conversation instead of starting a second one alongside it. Commit, #28257
🫥 Deactivating a model. Turning a model off no longer removes the wrong entry from the model list, or fails the list outright and leaves the model picker empty for everyone until the model is turned back on. Commit, #28202
💭 Readable errors on chat actions. When moving, renaming, or otherwise changing a chat fails, the message explaining why now appears in place of an unhelpful object placeholder. #28260, #28259
🪪 Authorship in shared chats. A chat shared with you now shows the name and picture of whoever wrote it, in the message list and in the overview panel, rather than crediting the messages to you. #28274, #28273
🖇️ Adding terminals over plain connections. Saving a terminal connection now works when the interface is served without HTTPS, where the dialog would sit there doing nothing because the browser withholds the tool used to generate its identifier. Commit, #28148
🗃️ openGauss vector storage. Deployments using openGauss for vector storage no longer fail the moment they touch it. #27838
🎚️ ColBERT reranker startup. Loading a ColBERT reranker now names the model in the log rather than printing a logging error and a traceback in its place. #27838
🖼️ Images that no longer exist. A message whose image file has been deleted now shows a small unavailable placeholder that cannot be opened, rather than a broken image that spilled the whole reply text into the picture frame and still opened full screen. #27730, #27728, Commit
🛂 Connecting external accounts. Authorizing a tool's external account now completes only for the person who started it, rather than for whoever happens to return with the authorization, and signing out clears the session it relies on. Commit
🪟 Starting up on Windows. The Windows start script now creates the secret key it needs on a fresh installation, instead of printing a run of file not found messages and then refusing to start, and it copes with an installation path that contains spaces. #28061, #28060
🕸️ Overlapping branches in the overview. Branch nodes in a chat's overview keep a clear gap between them when the interface is scaled up, rather than sitting on top of one another. #27995, #27994
🗑️ Delete offered only when allowed. The chat deletion controls in the sidebar, the chat menu, search, archived chats, and data controls no longer appear for people whose permissions do not allow deleting, where using them produced an access denied error. #27714, #27713
🍴 Fork offered only when allowed. The fork action and the fork command no longer appear for people whose chat import permission is turned off, where using them produced an access denied error. #27711, #27692
↕️ Expand button in the message box. The button that enlarges the message box no longer sits on top of a tagged model's dismiss button or the first attached file, and stays reachable in long prompts. #27676, #26736
🔆 Regenerate in high contrast mode. With high contrast mode on, the regenerate button now stays visible on earlier replies instead of appearing only when you hover over them. #27644, #27638
✂️ Clipped icons and avatars. The terminal icon beside the message box and the profile picture in account settings are no longer shaved flat along their left edge. #27691, #27690
🪄 Merged responses after a reload. Merging the answers from several models now works on a conversation you have reopened, instead of the merging model reporting that the other responses were empty. #27673, #26962
🔢 Token counts for background chats. Conversations started by automations, timers, sub-agents, and channels now report their token usage like any other chat, rather than arriving without it even when the model is set up to provide it. #27661, #27653
📐 Settings on tall screens. The settings window now grows with the height of your display instead of stopping short and making you scroll inside it while space sits unused above and below. #27615, #27614
🖱️ Sections opening by accident. Folders, collapsible sections, and tool call blocks now open and close only when you click them, rather than also reacting when you release the mouse over them after dragging or selecting text. Commit
🔁 Rebuilding knowledge base vectors. Rebuilding the vectors for a knowledge base now also rebuilds them for each file it contains, so attaching a single file afterwards finds its content instead of quietly returning nothing and letting the model answer from thin air. #28106, Commit, Commit
📌 Attaching a chat shared with you. Attaching a conversation that was shared with you, directly or through a shared folder, now brings its content along instead of quietly attaching nothing. Commit
🧲 The page staying still when typing. Returning focus to the message box no longer scrolls the conversation, so switching chats, running a command, or picking something from a menu leaves your place on screen alone. Commit
📷 Round profile pictures on narrow screens. Profile pictures in the admin user list and other lists no longer squash into ovals of differing widths when the window is narrow. #28000, #27999
🎙️ Voice mode in the notes editor. The voice mode button is no longer offered in the chat embedded in a note, where it does not apply. Commit, Commit
⏳ Analytics stuck loading. Choosing a custom date range in analytics without picking dates yet no longer leaves the tab spinning forever, including after leaving and coming back to it. #28125, Commit
🧑‍🤝‍🧑 Owner avatars on shared chats. The picture beside a chat someone shared with you now loads, and falls back to the default image if it cannot, rather than leaving a blank gap when the interface and the server are on different addresses. #28272, #28271
🎨 Image generation and web search staying switched off. Turning either off now takes effect at once on every path: sessions opened beforehand can no longer produce images or run searches, an image request no longer reaches the provider on a model using the older tool-calling method, the entry disappears from the integrations menu right away, and an active marker beside the message box no longer lingers after its feature is withdrawn. #27759, #27758, #26842, #27669
📰 Attached pages reaching the model. The text pulled from an attached web page or YouTube video now actually reaches the model, rather than arriving empty so the reply had nothing to work from, and opening the source to check no longer fails. #28378, Commit
🌐 Tavily page fetching. Reading a web page with Tavily selected as the loader works again, having failed on every attempt since 0.10.0. #27636, #27602
🗒️ Reply box in threads. The reply box in a channel thread now stays at the bottom of the panel while you scroll back through the replies, instead of scrolling out of sight with them. #27768, #27767
🎹 Model picker shortcut. The keyboard shortcut for opening the model picker works again, and a link to a chat naming a model you do not have still opens the picker with that name filled in. Commit
⌨️ Reaching the download options by keyboard. In the model picker, arrowing past the last result now moves through the options to fetch that model from each server that can supply it, so they can be chosen with the keyboard instead of only by clicking. Commit, Commit
📂 Opening a folder in the sidebar. Selecting a folder now refreshes just that folder's chats rather than rebuilding the whole folder tree, and a folder that is empty or still loading says so instead of showing nothing. Commit, Commit
⏲️ Changing an automation through chat. Asking a model to change one thing about an automation no longer moves it out of its folder or drops its model when the model fills those fields in blank instead of omitting them. Commit
🔂 Automations that run a set number of times. An automation asked to run a limited number of times is now rejected unless it says when to start counting from, rather than being accepted and then running indefinitely. #27781, #27780
📅 Editing a calendar event through chat. Asking a model to change one thing about an event, such as its title, no longer fails or wipes the details you did not mention. #27777, #27776
🧹 Session cleanup on multi-instance setups. The instance doing the periodic session cleanup now keeps its claim on that job alive between passes, so an idle deployment stops logging a renewal warning every two minutes and the claim no longer lapses for half of every cycle. Commit, #27762
🏠 Starting folder in the file browser. Reopening the file browser now keeps the folder you were in, instead of the breadcrumb losing its starting point and jumping you elsewhere. Commit
🩺 Repairing default model settings. Instances whose stored default and pinned model settings had been written in the wrong shape are corrected on startup, so those defaults take effect again. Commit
🧽 Cleaner conversation history for the model. Internal bookkeeping attached to your messages, such as attachment records and token counts, is no longer sent to the model along with the conversation. Commit
🙈 Needless request from the model picker. Opening the model picker as a non-administrator no longer fires a request to an administrator-only settings endpoint that was always refused. Commit
⏹️ Stopping a reply that is waiting. The stop button now ends a reply that is sitting waiting for you, such as one paused on a tool approval, rather than leaving the conversation stuck part way through. Commit
🏷️ Folder names with unusual characters. Naming a folder is no longer refused because another folder's name happens to be similar, and a name ending in a backslash no longer fails outright on PostgreSQL, because names are now compared exactly rather than treated as a search pattern. #28695, #28694
🤔 Reasoning carried back to Ollama. A model's earlier thinking is now passed back to Ollama in its own native field rather than pasted into the message as tagged text, so reasoning models keep their train of thought across turns. Commit
📎 Default pinned models taking effect. Changing the default pinned models now reaches people who have never chosen their own, where simply having opened the interface once was enough to freeze the list they first saw, and reordering a pin no longer moves the wrong one or reopens the sidebar section afterwards. #28069, #28067
✏️ Editing other people's channel messages. Asking a model to work on a message in a channel now only applies to your own messages, where write access to the channel had been enough to reach anyone's. #28631
🍪 Signed-in tool servers. A tool server that relies on your session now receives the credentials belonging to its own connection, rather than whichever were most recently prepared. #28630
🏗️ Editing a folder from its page. Renaming a folder, changing its icon, creating a subfolder, or deleting it from the folder's own page now updates the sidebar straight away, instead of leaving the old name and icon there, and the new subfolder missing, until a reload. Commit, Commit, #28692, #28690
📣 Long channel names in the sidebar. A channel with a long name no longer squeezes its own menu button out of the row. Commit, #28671, #28670
📬 Mark as unread in chat search. Marking a chat unread from the search dialog now works and updates the sidebar, where the menu entry looked normal but did nothing at all. #28136, #28135
⬆️ Scroll to top on the first click. In a long chat where older messages had not been loaded yet, one click of scroll to top now reaches the first message instead of stopping short and needing a second. #28659, #28658
🔘 Double bullets in the release notes. Each entry in the what's new dialog shows a single bullet again, rather than two sitting at different heights. #28676, #28675
📚 Knowledge search and shared files in chat. A model searching your knowledge bases or reading a file shared with you through a group now works, where it had failed since 0.11.0 and quietly answered as though the knowledge were empty, affecting instances that forward user details to their embedding service and, for shared files, every instance regardless of settings. #27642, #27641
🔖 Skill identifiers that cannot be reac

Original source

Added

🎨 Redesigned interface. Open WebUI has been visually rebuilt from the ground up. All aspects of the User Interface, from the chat view to the admin panel. Now with a narrower conversation column, lighter typography, tidier spacing, consistent menus and dropdowns, clearly outlined text boxes, and settings rearranged. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, #27178, Commit, Commit

🤖 Sub-agents. Administrators can now enable sub-agents, which let a model hand parts of a task to background helper agents that run their own tool-driven conversations and report results back into the chat, tuned through new "ENABLE_SUBAGENTS", concurrency, iteration, and system-prompt settings. Commit, Commit, Commit, Commit

📂 Folder pages. Opening a folder now takes you to its own page, where its chats load a page at a time, can be sorted by title or last updated, and you can start a new chat straight from the folder. Commit

⏲️ Chat timers. The assistant can now set a timer that brings a prompt back into the conversation later, after a delay or at a set time, and can drop it automatically if you read the chat or reply before it fires. Commit

🔔 Notification targets. Notifications now have their own settings tab where you can send them to several webhook destinations, each picking which events it wants, from chats finishing or failing to channel messages and calendar alerts, with a test button and a choice between always notifying or only when you are away, and any webhook you already had is carried over for you. Commit, Commit, Commit, #24750

🗯️ Full replies in channels. A reply from the assistant in a channel is now saved and shown in full, with its reasoning, tool calls and other structured parts, where it previously came through blank. Commit, #26720, #27409, #26707, #26656

📣 Notifications from the assistant. The assistant can now send you a notification itself when something is worth your attention, so a long task can reach you after you have moved on to something else. Commit, Commit

🌎 Share a chat with anyone holding the link. A shared chat can now be set to Open so it opens without signing in, with visitors no longer bounced to the sign-in page on their way to it, which administrators must first allow through a new "Chats Open Sharing" permission that stays off by default, and such pages ask search engines not to index them. Commit, Commit

🔖 Chat variables. A model's system prompt can now declare fields such as text boxes and dropdown lists that you fill in for a conversation, with the values saved alongside the chat and carried over when it is forked or cloned. Commit, Commit, Commit, Commit, Commit, Commit, #26915

🗄️ LDAP group synchronization. Administrators can now map LDAP groups to Open WebUI groups from the authentication settings, with optional automatic creation of missing groups, so a user's group memberships are kept in step with the directory each time they sign in. #27263, #18015

👥 Restrict sharing with groups. Admins can now stop resources from being shared with entire groups through a new "USER_PERMISSIONS_ACCESS_GRANTS_ALLOW_GROUPS" permission, which stays enabled by default so existing group sharing keeps working untouched. Commit, Commit, Commit, Commit, #27124

🤝 Shared folder collaboration. People with access to a shared folder can now use its files and system prompt as knowledge in chat and, with write access, rename and manage the folder, all according to their read or write permission. Commit, Commit, Commit, Commit

👁️ Chat previews in the sidebar. Hovering a chat in the sidebar now shows a compact preview of its recent messages, so you can find the conversation you want without opening it. Commit, Commit, Commit, Commit

🕗 Local message timestamps. Message timestamps now appear on hover in your device's local date and time format, with the full weekday and date shown in a tooltip. Commit, Commit

📇 User variables. You can now store your own values in account settings, such as your role or how you like answers written, and a model's system prompt can insert them wherever they are needed. Commit, Commit, Commit

🧺 Automations that file their chats away. An automation can now be pointed at one of your folders, from the dialog, the editor or by asking the assistant, so each run lands there instead of loose in your chat list, and the folder is cleared automatically if it is later deleted. Commit, Commit, Commit

🔵 See what you have not read yet. Folders in the sidebar now carry a count of chats with something new in them, a folder's own page marks unread chats with a dot, shows a spinner on any still generating, clears the dot as you open one, and keeps itself up to date as replies finish elsewhere, unread chats sort to the top of a folder, and you can mark a single chat unread again mark everything in a folder read, or mark every chat read at once from the sidebar. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit

🗜️ Compact a chat on demand. Typing a compact command in a long conversation now summarizes the earlier turns straight away, instead of waiting for it to happen automatically once the conversation grows past the threshold. Commit, Commit

🌿 Fork a chat. Every response now has a fork button that copies the conversation up to that point into a new chat which remembers where it branched, so you can carry on down a different path without touching the original. Commit, Commit, Commit, Commit

📌 Pin the conversation map. The chat overview now has a pin control that stops it recentring on the newest message, so you can keep looking at the branch you were reading while a reply comes in. #25736

📊 Chat status at a glance. The slash menu now shows how full the context window is, and a new status command opens a panel with context usage, queued messages, running tasks, and the chat ID. Commit, Commit

🎹 Customizable keyboard shortcuts. Most keyboard shortcuts can now be rebound to key combinations of your choosing in settings, which saves them to your account, warns you when two actions share a combination, and offers a reset to the defaults, with moving to the previous or next chat and opening the controls panel available to bind as well. Commit, Commit, #26624

⌨️ Turn keyboard shortcuts off. A new switch in the keyboard settings disables every configurable shortcut and hides its hint, so combinations that clash with your browser or operating system pass straight through. #27300, #1008

⌨️ Skills in slash commands. Typing a slash in the message input now lists your skills alongside your prompts, grouped under headings and with descriptions on hover, so you can attach a skill without leaving the keyboard. Commit

📎 Attach anything with the at menu. Typing an at sign in the message input now searches your folders, knowledge collections, and individual files as well as your models, and pasting a link offers it as a web page or YouTube attachment. Commit

📝 Chat with a note. Chatting with a note now gives you the full chat experience, including model choice, tools and file attachments, alongside suggested prompts, a button to insert a response straight into the note, edits that appear in the note as the assistant makes them, and as many separate conversations per note as you want to keep. Commit, Commit

↕️ Sort your lists. The notes, prompts, models, knowledge, skills, tools and functions lists can now be sorted by title or by when they were last updated, in either direction, by clicking the column headings. Commit, Commit, #27457, #27456

🗒️ Notes without stored contents. A note whose contents were never filled in now opens and saves normally instead of failing. Commit

📄 Note attachments. Notes now have an upload option in their menu and show attached files above the note itself, where you can open or remove them, instead of only accepting files dropped onto the page. Commit, Commit

🗂️ The assistant can search your attachments. A new Files capability lets the model list the files attached to the chat and search them by meaning or by exact text, and read the parts it needs, rather than having their whole contents pushed into the conversation up front, and knowledge collections or notes attached to a chat are now announced to the model so it can query those the same way. Commit, Commit, #26711, #27232, #26708

🔎 Search in the attachment menu. The attachment menu now lets you search your knowledge bases, notes, files, and chats instead of scrolling to find them, with matching text shown for chats. Commit

⚗️ Default file upload mode. You can now choose in settings how attached files are handled by default, rather than picking that on each upload. #20900, #18431

⬇️ Response auto-scroll toggle. A new interface setting lets you stop the view following a reply as it is written, so you can read earlier text while generation continues. Commit, #26826

📜 Client certificates for SearXNG. Web search can now present a client certificate to a SearXNG instance that requires one, through new "SEARXNG_CLIENT_CERT_FILE" and "SEARXNG_CLIENT_KEY_FILE" settings. Commit, #26992

🔭 OpenSERP web search. Web search can now run against a self-hosted OpenSERP instance, which returns results from several major search engines without any API key, configured through a new "OPENSERP_BASE_URL" setting. #27437, #27438

🥇 Model order as a setting. Administrators can now set the order models appear in through a new "MODEL_ORDER_LIST" variable, so the arrangement survives a restart on instances that do not persist configuration. #27420, #27206

⏱️ Idle cap for streamed replies. Administrators can now set an "AIOHTTP_CLIENT_STREAM_IDLE_TIMEOUT" that ends a streamed reply when the provider stops sending anything for that long, instead of holding the connection open until the overall timeout expires. Commit, Commit

🖼️ Media types an extraction engine may handle. Administrators can now list which image and video types the configured content extraction engine is allowed to process, instead of media being passed to it only when the engine is the external one, so an engine with its own text recognition can take images. Commit, #26940, #14768

🧵 Where a channel reply lands. Administrators can now choose whether a reply to a mention posts in a thread under that message or straight into the channel. Commit, #27410

📚 Limits for knowledge tools. Administrators can now set how much a knowledge search or file view may return, how many files one search may scan, and how many matches are reported, and a knowledge command's whole output is now capped so a single call cannot flood the conversation. Commit, #27524, #27327, #26139

🎛️ File streaming chunk size. Administrators can now tune how large each chunk of a streamed file transfer is through a new "AIOHTTP_FILE_STREAM_CHUNK_SIZE" setting. Commit

🪛 Model for summarizing long chats. Administrators can now pick a dedicated model to write context compaction summaries, separate from the task model, with the conversation's own model used when none is chosen. #26806, #27051

📏 Context compaction token cap. Administrators can now set a "Token Cap" that limits how high per-model context compaction thresholds are allowed to reach, giving finer control over long-conversation summarization. Commit, Commit, Commit

⚖️ Retained messages after compaction. Administrators can now set what share of recent messages survives when a long conversation is summarized, between a tenth and half of it. Commit, #27050

🧠 Memory as a per-model capability. Whether a model receives your stored memories is now a switch on the model itself, so it can be left on for everyday assistants and off for ones that should start from nothing. Commit, #26861, #18610

☑️ Searchable model pickers. When editing a model, the Tools, Skills, Knowledge, Voice, Filters and Actions pickers now let you search and toggle items in place, select or clear them all at once, and see what is active at a glance. Commit, Commit, Commit, Commit, Commit, Commit, #26758

🎚️ Switch for single sign-on. OAuth and OIDC now have their own on and off switch in the authentication settings, matching the LDAP one above it, so sign-in through a provider can be turned off without clearing the configuration. #26988

🖲️ One sign-in attempt at a time. The sign-in, sign-up and LDAP form now disables its buttons while a request is in flight, so a slow response no longer turns repeated clicks or Enter presses into several concurrent attempts. #27416, #27264

🛂 Trusted clients for token exchange. Administrators can now list which OAuth clients may have their tokens exchanged for a session, through a new "OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS" setting, so a token a person obtained by signing in to an unrelated application of the same provider can no longer be turned into a session as that person. #27546, Commit, Commit

🚪 Throttle for token exchange. Administrators can now cap how often the OAuth token exchange endpoint may be called from one address through new "OAUTH_TOKEN_EXCHANGE_RATE_LIMIT" and "OAUTH_TOKEN_EXCHANGE_RATE_LIMIT_WINDOW" settings, which bound automated attempts with leaked or guessed tokens and stay off until set. Commit

🔏 PKCE for every sign-in provider. The code challenge setting now applies to Google, Microsoft and GitHub sign-in as well as OpenID Connect, so the same protection covers every provider. Commit, #27302

🔤 Embeddings through the OpenAI-compatible API. Integrations built on OpenAI client libraries can now create embeddings through the Ollama proxy, so embedding requests go through the same sign-in and model access rules as chat instead of needing direct access to Ollama. #27332, Commit, #27328, Docs:#1331

🎚️ Passthrough parameters per connection. Administrators can now list request parameters that a connection should receive untranslated, under a new Advanced section in connection settings, so provider-specific options reach the upstream API intact. Commit

🅰️ Anthropic requests passed straight through. Requests to the Anthropic-compatible API aimed at an Anthropic or LiteLLM connection now reach the provider untouched rather than being translated on the way, and LiteLLM is selectable as a connection type. Commit

💭 Reasoning in Anthropic responses. Responses from the Anthropic-compatible API now carry the model's reasoning as thinking blocks, in both streamed and complete responses. Commit

🧩 Structured output through the Anthropic-compatible API. Requests can now ask for a JSON schema or JSON object response and set a reasoning effort, which are carried through to the upstream model. Commit

🪧 Group names in forwarded headers. Custom headers on a connection can now carry the groups a person belongs to, by name or by id, so an upstream service or gateway can apply its own rules per group. #27236, #26834

🪪 User identity forwarded to Mistral OCR. Document extraction through Mistral OCR now carries the requesting user's identity when user info forwarding is enabled, so a gateway in front of it can attribute requests per user like other outbound integrations already do. #27253, #27250

🔢 Anthropic token-counting endpoint. The Anthropic-compatible API now offers a token-counting endpoint, so integrations can check how many input tokens a request will use before sending it. Commit, Commit

🖲️ Terminal instructions read fresh. The instructions a terminal server provides are now fetched for each request, so changing them on the server takes effect immediately instead of after re-saving the connection or restarting. #27242

🖥️ Live terminal server policies. Administrators can now read an orchestrator terminal server's current policy and lifecycle settings directly in connection settings rather than relying on a locally cached copy. Commit, Commit

🌍 Model privacy at a glance. Admins can now make a model public or private straight from its menu in the model list, where each model is marked as public, shared, or private. Commit

📈 Personal usage dashboard. A new Usage tab in settings shows your own activity over time, including a token-activity heatmap, current and longest streaks, lifetime and peak token counts, your longest active chat, and your most used models and tools. Commit

🧠 Memories in settings. Your memories are now listed directly in personalization settings where you can search, add, edit, and remove them, instead of being tucked behind a separate manage dialog. Commit

💾 Import notes and automations. Notes can now be brought in from text and markdown files, and automations can be exported and imported as files, so you can move them between instances. Commit, Commit

🧮 Counts in the tabs. The workspace tabs now show how many models, knowledge bases, prompts, skills, and tools you have, and the admin tabs do the same for users, groups, leaderboard entries, and feedback, so you can see the size of each section without opening it. Commit, Commit, Commit

🧾 Group permissions at a glance. The groups list now shows whether each group uses custom or default permissions, without opening it. Commit, Commit

📤 Streamed file transfers. Uploading a model, pipeline or audio file now sends it in chunks instead of holding the whole thing in memory, and reading and writing files no longer blocks other requests, so large transfers no longer spike memory or stall the server. Commit, #27351, #27349

🧰 Built-in tool descriptions built once. The descriptions handed to the model for the built-in tools are now worked out once at startup rather than rebuilt on every message. Commit, Commit, #27374, #27396

🪺 Records read without a double pass. Loading a model, tool, prompt, skill, note, knowledge base, channel or calendar no longer converts the record twice on the way out. Commit, #27377

🔧 Faster tool and knowledge base listings. Listing tools no longer loads each one's full source, and working out which tools and knowledge bases you can see takes a single check rather than one per item. #27387

🧊 Quicker collection checks on Chroma. Checking whether a collection exists now asks for that one collection instead of listing them all, which grew slower with every knowledge base and file. Commit, #27394

🔠 Tokenizer loaded once. The tokenizer used to split documents is now kept after first use rather than being loaded again for every file. Commit, #27394

📗 Faster knowledge base file lists. Opening a knowledge base now loads just the file names and details instead of the entire extracted text of every document, so large collections appear almost instantly. #27386, #26144

🗝️ Faster file access checks. Working out whether you can open a file no longer scales with how many workspace models and knowledge bases exist, so opening files and listing folder contents stays quick on large instances. #27383

🕰️ Faster automation scheduling. Working out when an automation that repeats every few minutes or hours runs next is now near instant, instead of taking twenty seconds or more and slowing further each year. Commit, #26954

📁 Faster folder loading. Your folder list no longer runs a separate lookup for every folder to check where it sits, so it loads in a single pass. Commit

🎯 One round of requests per folder click. Selecting a folder in the sidebar now fetches the folder, the folder tree, and each expanded folder's chats once instead of two to four times. #27540, #27539

🎧 No wasted work when nobody is listening. Updates for a chat whose tab has been closed, or for requests made through the API, are no longer packaged up only to be discarded, which matters most on long streamed replies. #27366, Commit

📑 Cheaper audit logging. With audit logging on, each request is no longer authenticated a second time just to record the log entry, so audited instances carry noticeably less overhead. #27373

🪧 Cheaper tagging after each reply. Saving the tags generated for a conversation now updates just that field instead of loading, rewriting and re-reading the whole conversation, which cost more the longer the chat. #27382

✍️ Faster saves across the app. Saving a chat, note, prompt, tool or user setting no longer re-reads the record it just wrote, so writes finish sooner, most noticeably on long conversations. #27381, #27379, Commit, Commit

🛢️ Less database overhead per request. SQLite installations no longer run a connection check before every database call, and requests that never touch the database skip the bookkeeping that used to run regardless. #27385

⚡ Faster memory lookups. Stored memories are now indexed so retrieving them stays quick as the number you have grows. Commit, #26957

🪪 Fewer checks before a reply starts. Working out whether you may use a model now looks up the model and your group memberships once instead of repeating both, including for every model a workspace model is built on. #27378

👤 Lighter user activity checks. Checking whether someone is currently active now reads only that timestamp rather than their whole profile, including their profile image. Commit, #27224

📨 Fewer settings lookups when sending a message. Sending a chat message now reads the settings behind tools, file retrieval, voice, skills and the code interpreter in fewer trips to the database, so replies start sooner. #27223

🪄 Lighter conversion for Ollama requests. Preparing a request for an Ollama model no longer copies the entire conversation before sending it, which cost more with every message and repeated on each tool-call round. #27371

🦙 Fewer settings lookups on Ollama requests. Ollama chat, generation and embedding requests now read their connection settings once instead of up to four times, so each request reaches the server sooner. #27226

🧹 Less repeated work on every response. Security headers are now worked out once at startup rather than rebuilt for each response, and ordinary page requests skip the redirect handling they never needed, so responses carry less overhead. #27229

🚀 Lower per-request overhead. Requests no longer each perform a settings lookup before they are handled, trimming a little latency from everything the app does. Commit, #27395, Commit, Commit, #27227

💨 Leaner filter handling while streaming. Filters applied to a streaming reply no longer re-read their settings and each plugin's full source from the database for every chunk, so responses with filters enabled cost the server far less work. #27228, #27372, Commit, Commit, Commit, #27392

🚦 No filter bookkeeping without filters. Streamed API responses only build up the full reply for outlet filters when the model actually has one configured, instead of doing it for every request. Commit, #27391

✂️ Cheaper tag detection while streaming. Watching a reply for reasoning and code blocks now examines only the newly arrived text rather than rescanning the whole answer on every chunk, so a long answer no longer costs progressively more as it grows. #27360

🌊 Steadier long responses. Building up a streamed reply no longer costs more work as it grows, so long answers keep pace instead of slowing down toward the end. #27231, #27359, Commit, #27390

📦 Faster JSON handling as an option. Administrators can now switch the whole application to a faster encoder through a new "ENABLE_ORJSON" setting, covering request bodies, responses, upstream provider payloads and live updates, where the encoding of live updates was the largest single cost on the workers handling them in clustered deployments; it stays off by default because the faster encoder is stricter about what it accepts. #27583

⚙️ Faster Redis handling. The compiled "hiredis" parser now ships as a dependency and is used automatically, so deployments backed by Redis spend noticeably less processor time reading responses. #27282

🔗 Fewer Redis round trips per chat. Deployments backed by Redis now look up the model and connected sessions once per request instead of twice, and fetch the model list in a single call. #27225

🛰️ Fewer Sentinel lookups. Redis Sentinel deployments no longer ask which server is the primary and open a fresh connection before every single command, which had caused heavy connection churn and stalls under load. Commit, #27213, #27210

📡 Lighter live connection handling. Typing indicators, shared document edits and reconnections no longer re-read your account or copy the full participant list each time, and idle sessions are no longer rewritten every few seconds. Commit, #27393

🏎️ Faster chat search on PostgreSQL. Searching chats on PostgreSQL now reads from the message table instead of unpacking each conversation's stored data row by row, so results stay quick as your history grows. Commit, #27221

⚡ Lighter model lists. Model lists no longer carry embedded profile images in their data, so they load faster. Commit, Commit

🏗️ Fewer queries when building the model list. Assembling the model list now makes fewer database round trips and no longer fetches every plugin's source code along the way, so it comes together faster. Commit, #27389

🪶 Model lists without knowledge text. Model lists no longer include the extracted text of files attached to a model as knowledge, so they stay small regardless of how large those knowledge bases are. Commit, #27287

🔛 Functions can react to being switched on or off. Two new events fire just before a function is enabled or disabled, and the function being enabled receives its own event even though it is not active yet, so it can run whatever setup or teardown it needs. Commit, #26754, #26748

🔛 Multiple choice settings in plugins. A tool or function can now offer a setting where you tick several options from a list, fixed or worked out at the time it is shown, instead of asking you to type a comma-separated list of allowed values. #26884, #26848

🔌 Disable plugins entirely. Administrators can now completely turn off the built-in Tools and Functions plugin surfaces through a new "ENABLE_PLUGINS" setting, which hides them across the workspace and admin areas and removes their execution paths. Commit, Commit, Commit, Commit

🧵 Lighter chat listings and search. Building a page of chat search results or a folder listing no longer copies each full conversation to read its title and dates, so those pages come together faster and use far less memory while they are built. #27388

📮 Name lookups off the thread pool. Looking up a hostname no longer occupies one of the limited threads shared by every other piece of blocking work, so model calls, searches, page fetches and tool calls stop queueing behind each other once a few lookups are slow. #27440

🥬 Faster web page parsing. Pages pulled in by web search and web retrieval are now read with a faster parser, cutting roughly a tenth off the time spent on a ten result search. #27439

🧭 No pointless lookups when filtering search results. Filtering web search results against a domain list no longer resolves every result to an address first, which had turned a three second search into half a minute wherever the resolver was slow or a name did not resolve. Commit, #26920

🚄 Leaner passthrough streaming. Responses the server only relays now go straight through in whole network reads instead of being split line by line, roughly halving the work spent shuttling a streamed reply on those routes. #27384

🧶 Web page parsing off the critical path. Reading those pages no longer holds up everything else on the server, so other people's replies, live updates and health checks keep flowing during a search instead of stalling for a second or more. #27446

🈶 Faster uploads of non-English text files. Working out the encoding of an uploaded text file now samples the part that needs it rather than scanning the whole file, taking a four megabyte Japanese or Chinese document from several seconds down to well under one. #27445

♿ Improved UI accessibility. Keyboard and screen reader users can now tell which chat in the sidebar is the one being viewed, open reasoning and detail blocks in a response, expand sidebar sections and open a folder without a mouse, sort the admin user list from the keyboard and hear which column it is sorted by, open a dropdown and its submenus with the keyboard, close them again with Escape and land back where they started, hear which value a dropdown is set to rather than only its label, hear what each admin settings switch, group permission toggle, checkbox, API key field and advanced model parameter slider controls, have the message box announced by its placeholder instead of as an unnamed field, press Enter on Cancel in a confirmation dialog without triggering the delete, reach the regenerate control, jump straight past the sidebar to the conversation with a skip link, hear what an icon-only button does across chat, calls, file previews, modals and the admin pages rather than an unlabelled button, placeholder text, section headings, field descriptions, inactive tab labels, timestamps, counters and icons are now readable against their background when High Contrast Mode is on, and sidebar buttons across notes, automations, the playground, and admin pages announce whether they open or close the sidebar. #27510, #27513, #27503, #27494, #27491, #27490, #27489, #27488, #27555, #27556, #27554, #27558, #27501, #27492, #27509, #27502, #26769, Commit, Commit, #26768, #26770, Commit, Commit, Commit, #27508

🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

🌐 Translation updates. Slovenian is now available, and translations for English (UK), Finnish, German, Japanese, Portuguese (Brazil) and Portuguese (Portugal) were enhanced and expanded.

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories

🔒 Terminal file preview isolation. Previewing an HTML file in the system terminal now runs it in an isolated context by default, closing a cross-site scripting hole that could expose your login session or, for privileged accounts, run code on the server. #26907

➗ Malformed maths in a message. Maths that fails to render is now shown as plain text rather than being placed into the page as markup, closing a way for a crafted formula in a chat, channel or shared conversation to run code in the browser of anyone reading it. #26718

🔩 Updated file upload parsing library. The library that parses file uploads and form submissions has been updated to a release that addresses a security advisory affecting that parsing path. #26991

🛑 Deactivated accounts lose live access. Real-time connections now apply the same role check as the rest of the application, so an account moved out of the user or admin role can no longer keep its channels and shared notes open on an existing token. #27537

🛅 Writing into someone else's chat. Completion and action requests now confirm you own the chat they name before anything is written to it, so a filter or action can no longer be pointed at another person's conversation. #27486

🎟️ Ollama version no longer readable anonymously. Reading the configured Ollama backend's version now requires signing in, closing a route that let anyone learn the version in use and count how many backends are configured. #27199

🔐 Folder sharing permission. The folder sharing setting in default and group permissions now saves instead of being silently discarded, so allowing or restricting folder sharing actually takes effect. #27296, #27120

🔕 Webhook permission enforcement. People without permission to use webhooks can no longer save webhook notification destinations to their settings, so the permission is enforced when settings are saved rather than only reflected in the interface. #27297, Commit

🛎️ Stopping someone else's generation. Deleting a chat now checks who you are before anything is cancelled, so knowing another person's chat id no longer lets you cut off their reply or title generation on a request that is refused anyway. #27006

🚥 Automation limits in chat. Automations that the assistant creates or reschedules on your behalf now respect the same maximum count and minimum interval as the ones you set up yourself, instead of being able to exceed both. #27523, #27121

⏲️ Cancelling someone else's timers. Marking a chat as read now only clears your own pending timers on it, instead of clearing everyone's, which had let another person's scheduled prompt be silently cancelled without them being told. #27472

🗑️ Deleting a shared folder's subfolders. Deleting a folder is now limited to its owner or an administrator at every level, so someone with write access to a shared folder can no longer delete a subfolder and take the owner's chats with it. #27003

📕 Tool source shown to people who can only use it. Opening a tool you were given read access to no longer returns its source code, which read access was never meant to include. #27005

🎯 Model settings in the list endpoint. Listing models no longer includes each one's parameters and system prompt for people with read access only, matching what opening a single model already returned. #27004

🖌️ Image generation and web search without permission. Turning on image generation or web search through the older request format now checks your permission first, so someone denied those features can no longer trigger them, and the billing that comes with them, by asking for that format. #26703

🎗️ Terminal single sign-on tokens. The token forwarded to a terminal server for single sign-on is now taken from your own session on the server rather than from a header the browser supplied, so a caller can no longer send someone else's token in its place. #26719

🫗 Web search results scoped to you. The temporary collections holding a web search's pages are now tied to the person who ran the search, closing the one place where that scoping was not applied. #26706

🧺 Knowledge base cleanup reaching other collections. Tidying up a knowledge base now acts only on files and folders that belong to it, so someone with write access to one knowledge base can no longer delete folders or search data belonging to another. #26722

⌛ Searches that could stall the server. A search pattern inside knowledge base commands now runs under a time budget, so a pattern that would take minutes to evaluate can no longer hold up everyone else on the instance. #27471

🚫 Disabled terminal servers are refused. A terminal connection an administrator has turned off can no longer be reached by browsing its files, opening a session, or calling its tools, rather than only disappearing from the interface. Commit

🧫 Files attached to a shared folder. Adding files to a folder is now refused unless the folder's owner can read them, and a folder's files are checked against what its owner can still read before they are used as knowledge in chat, so a collaborator can no longer place files into someone else's folder or keep serving files the owner has since lost access to. #27464, Commit

🧷 Knowledge claimed by a direct connection. Files listed as knowledge on a model supplied by the browser for a direct connection are now filtered against your own access before anything is retrieved, so a crafted request can no longer pull in documents you cannot otherwise open. Commit, #26723

🪜 Reaching a restricted model through a shared one. A shared workspace model can no longer be used to reach an underlying model the person could not otherwise use, which previously slipped through when that model had no entry of its own. #26905, #26900

🖌️ Shared image checkpoint changes. Only administrators can now change the instance-wide Automatic1111 checkpoint, so an ordinary image generation request no longer switches the image model for everyone. #27244

💬 Channel message ownership. Only the author of a channel message, or an administrator, can now edit or delete it, instead of anyone able to post in that channel. #27197

🗄️ Chats shared with an administrator. An administrator can now open a chat that was deliberately shared with them even when broad admin access to other people's chats is turned off, instead of being refused a chat any other recipient could read. #27127

📓 Notes in folder knowledge are access checked. Notes attached to a folder are now filtered against your own access before the list reaches the assistant, rather than relying on later checks further along. #26739

🧱 Code interpreter module blocking. Modules an administrator has blocked for the code interpreter are now actually blocked, and other imports inside interpreter code work again. #27245

📉 Charts in the code interpreter. Code that draws a chart now runs in the default code interpreter setup, instead of failing with a syntax error unless file persistence was turned on. #26800, #26660

🎬 Chat action availability. Chat actions can no longer be triggered when they are disabled, not assigned to the model in use, or on a model the caller cannot access, matching the actions the interface actually offers. #27243

🗨️ Response text where it was missing. Assistant replies are no longer stored without their text, so copying, exporting, searching and reusing a conversation return the reply instead of nothing. Commit, #26799, #26436

🧪 Filter edits that survive a reload. A change a filter makes to a finished response is now saved with the conversation, instead of showing on screen and reverting the next time the chat is opened. #27414, #27017

📃 Action functions receive the response text. Running an action on a response now passes the assistant's text to the function, instead of handing it an empty message. #26798, #26672

🍎 Blank messages on Safari. Assistant responses no longer render as empty in Safari and on iPhone and iPad, where a browser painting bug left on-screen messages unpainted. #26805, #26712, #26844

➡️ Prompts opened from a link. A prompt passed in through a link that sends automatically now waits for tool servers to finish loading, so external tools are available on that first message instead of the model reporting it has none. Commit, #24176

🪟 Tool result prompt submission. Interactive tool result embeds that send a prompt back to the chat work again, showing the confirmation dialog before submitting instead of silently doing nothing. #26914, #26912

📻 Live updates in a second tab. Opening Open WebUI again while already connected now joins the new tab to your event stream, so notifications and chat updates reach every open tab instead of only the first one. Commit

🔁 Connection recovery on new chats. Chats started from the home page now recover automatically after a dropped connection, such as from mobile backgrounding, a VPN or IP change, or waking from sleep, instead of getting stuck loading until a manual refresh. #26913, #26844

🪫 Terminal choice cleared on load. Your selected terminal is no longer dropped while the list of terminals is still loading, so it survives a page refresh. Commit, Commit, Commit, #26775, #26677

🔌 Dropped sessions during keepalive. Live connections no longer break on a routine keepalive check, which had cut the session so that anything the server needed to run in your browser failed afterwards, most visibly the code execution tool reporting the client as disconnected on every run. #27553, #27550

✂️ Context compaction turn boundaries. Long-conversation compaction now summarizes only completed earlier turns instead of sometimes cutting through the middle of a single turn, keeping the current turn's tool calls and results intact. #27035, Commit, Commit

🪆 Summaries on a direct connection. Summarizing a long conversation on a direct connection can now use the configured summary model rather than being limited to the connection's own model. #26806

🪟 System prompt through compaction. The system message now stays at the front of the conversation when a long chat is summarized, instead of being folded into the summary and lost from that point on. Commit, Commit, Commit, #26713, #26710

🧷 Context compaction continuity. After a compaction, the retained recent messages now stay in the prompt on every following turn instead of disappearing after the first, preserving conversational continuity and prompt caching. #27037, Commit, Commit

🔟 Context size after tool calls. The context meter and long-conversation compaction now read the size of the latest request rather than adding up every call in a tool loop, and understand the counts reported by Ollama and llama.cpp as well as the OpenAI-style ones, so compaction no longer fires far below its threshold, or never at all, and the usage shown is no longer inflated. Commit, Commit, #27031, #26752, #24410

💭 Reasoning that arrives late or empty. Reasoning sent by a provider after the answer has started is now shown in its proper place above the answer rather than appended after it, and reasoning notes carrying nothing no longer open an empty thinking block. Commit, #26687, #26645

📐 System prompt lost during tool calls. A model's system prompt now stays in place through every round of tool calls, instead of being dropped after the first one and, with memories enabled, replaced by the memory block alone. #26857, #26836

🪶 Memories from structured replies. A reply delivered as structured output is now read when memories are reviewed after a turn, so nothing worth remembering is skipped just because of how the answer arrived. Commit, #26705, #26651

🎲 Stable skill ordering. Skills available to a model are now listed in the same order on every request, instead of shuffling between requests and quietly defeating prompt caching. Commit, #26986

🛑 Stopping an answer the moment it starts. Each answer in a chat now carries its own task identifier from the first event onward, so stopping one immediately after sending no longer misses. Commit

⏸️ Deleting while a reply is being written. The delete control is now hidden on messages while a response is generating or a task is running, so a conversation can no longer be left with the finished reply detached from the messages before it. Commit, #26668

🎁 Feedback while a download is prepared. Downloading a file or folder from the terminal now tells you it is being prepared, will not start the same archive twice if you click again, and reports a failure instead of quietly giving up or leaving a preview spinning. #27421, #27055

📥 Moving an archived chat into a folder. Moving an archived chat into a folder now takes it out of the archive so it appears there, and the folder's contents refresh straight away after a move from the menu. #27485, #27484

📜 Chats past the first sixty in a folder. Folder listings now page through every chat instead of stopping at a fixed limit, so older chats no longer appear to vanish from a folder once it grows past sixty. #26786, Commit

📌 Sidebar highlight follows the open chat. The sidebar no longer keeps a chat highlighted after you move to another page, so deleting or archiving it there no longer throws you back to a new chat, and cloning no longer leaves two chats looking selected. #26977

🔀 Sidebar ordering during replies. Background updates such as follow-up suggestions, sources, and status no longer bump a chat to the top of the sidebar or change its last-updated time, and neither does saving a chat's variables or settings, nor the automatic title generation on a new chat. Commit, Commit

🖱️ One hover preview at a time. Moving between chats in the sidebar, or between avatars in the admin user list, channel messages and member lists, no longer leaves an earlier preview open behind the new one. #27549, #27548, #27578, #27577

✨ Folder lists no longer flash. Clicking a folder title in the sidebar no longer empties the chat lists of your expanded folders for a moment before they reappear. #27535, #27533

🫧 Flickering sidebar rows. Moving the pointer across a chat in the sidebar no longer makes its title and timestamp flicker in and out, or draw the timestamp underneath the action buttons. #27474, #27473

⭐ Rating scale in multi-model replies. The rating scale in the feedback panel is no longer cut off when several models answer side by side, so every score can be picked. #26846

🧑‍🤝‍🧑 Duplicate models side by side. Adding the same model twice in a side-by-side chat now keeps each column's own answer after a reload, instead of every column collapsing onto the first one. #26980

⬅️ Back button after opening admin or workspace. Going back in the browser now returns you to the page you came from, instead of being pushed forward again to where you just were. #27478, #27477

🎛️ Typing a top_k value. The top_k box in advanced parameters now accepts whole numbers up to its limit and rejects anything else, instead of letting the slider and the box disagree over what is allowed. Commit, #26669

🌙 Date pickers in dark mode. The calendar and clock icons on date and time fields are now visible in dark mode, across the calendar, automation schedules, account settings and analytics. #27275, #27274

🪞 Settings content stays inside the window. Long chat titles in Archived Chats now shorten with the full title on hover, and the admin analytics tables and chart no longer stretch past the edge of the settings window. #27306, #27305, #27329

🔗 Settings links that open in place. A link to a settings tab now opens it without a page refresh, and the Add Terminal button in the terminal menu goes straight to the Integrations tab instead of flashing the admin panel and doing nothing. #27552, #27551

🎰 Model choice on a fresh chat. Starting a new chat now falls back to your default model when the previous selection is no longer available, instead of leaving the picker empty, while a model named in the link still wins. Commit, #26697

📱 Model selector on small screens. The model list now stays fully on screen and sizes itself to the space available, instead of running past the edge or hiding behind the on-screen keyboard on phones. Commit, Commit, Commit

📲 Sidebar stays open over the calendar. Opening the calendar from the account menu on a phone now closes the sidebar, as every other entry in that menu already did. #26979

🗓️ Automation dialog on narrow screens. The buttons along the bottom of the automation dialog now sit on their own row on a phone, instead of the schedule and model pickers wrapping and pushing Cancel into the middle. #27027

📐 Input menu with keyboard open. The message input's attachment menu now stays on screen and resizes to fit when the on-screen keyboard is open on mobile, instead of running off the edge. Commit

🎈 Dropdowns that follow their content. A menu now stays in place as its contents grow or shrink, instead of running past the edge of the screen when a submenu swaps in taller content, and no longer bounces as it opens. #27460, #27458

🧾 Attachment menus load once. Opening a submenu of the attachment menu now requests its list a single time instead of twice. #27461, #27459

🔦 Chat search on PostgreSQL. Searching your chats now finds matches in current conversations on PostgreSQL setups, instead of only matching chats still stored in the older format. Commit

🧲 Search quality with prefix-based embedding models. Memories, knowledge base descriptions and searches against an external vector database now carry the query and content markers your embedding model expects, so results are no longer quietly worse than they should be on models that rely on them. Commit, #26958, #26353

🥄 Counting matches in knowledge base commands. Piping text into a search inside knowledge base commands now honours the count and filenames-only flags, instead of returning the matching lines regardless. #26721, #26715

🔍 Knowledge base file search. Searching inside knowledge base files now returns matching lines with correct line numbers, and patterns that list alternatives separated by a pipe find matches instead of silently returning none. #27249, Commit, Commit, #26795, #26781, #26744

🖨️ PDF text recognition. The text recognition package is now included again, so the application starts and PDFs with image text extraction enabled upload correctly instead of failing. #26851, #26646, #26994

🧿 Mistral OCR on a stock install. Extracting documents with Mistral OCR now works out of the box, instead of failing on a missing name resolution library that the code assumed was present. #27440

📧 Outlook message uploads. Uploading a .msg email now works, where it previously failed because the package it relied on could not be installed alongside the rest of the application at all. #26704, #26690

🖇️ Uploads with PaddleOCR-VL selected. With PaddleOCR-VL chosen as the document loader, only PDFs and images now go to it and everything else falls back to the usual handling, so text, markdown, spreadsheet and Word files index instead of being rejected. #27529, #24988, #26759

🪙 Documents containing special tokens. Splitting text by tokens no longer fails when the content contains reserved marker sequences, so those pages and files can be fetched and added to a knowledge base. Commit, #27094

📚 Knowledge base upload reliability. Adding a file directly to a knowledge base now finishes processing and linking the file before reporting success, so uploaded files are reliably searchable. Commit

🛠️ Web loader settings from the admin panel. The web loader picked in admin settings is now actually used, along with its certificate checking, request pacing and proxy settings, so instances that fetch pages through an external loader work again instead of trying to reach the internet directly with whatever was configured at startup. #26749, #26747, Commit, #27083, #27025, #27061

🚧 Quoted entries in the web fetch filter list. Stray quote marks around a filter entry, w

Original source

Added

💭 Streamed reasoning display. Models that emit thinking or reasoning now show that content as it streams, and it renders correctly in the chat overview and in exported conversations. Commit, Commit, Commit, Commit

🗂️ Folder uploads to knowledge bases. Dragging a folder into a knowledge base, or syncing one, now recreates its subfolder structure instead of flattening everything into loose files. #26130, Commit

🧠 Memory system context toggle. Administrators can now keep memory tools available while choosing not to add stored memories to the system context, using the new 'Memory System Context' toggle in admin settings. Commit

🧹 Tidier automatic memories. Automatically saved memories now focus on enduring details like preferences and goals and skip one-off things like meals, routine events, or passing mood unless you ask to remember them. Commit

🎙️ Speech-to-text request format. OpenAI-compatible speech-to-text can now send audio as either a multipart upload or base64 JSON, selectable in admin audio settings. Commit

🧰 API configs via environment. Administrators can now set per-connection Ollama and OpenAI API configurations through the "OLLAMA_API_CONFIGS" and "OPENAI_API_CONFIGS" environment variables. Commit

📡 Provider failure events. Failed Ollama and OpenAI-compatible provider requests now emit a structured event describing the error type, provider, and status, giving administrators clearer visibility into upstream failures. Commit

🏟️ Arena models via environment. Administrators can now define evaluation arena models through the "EVALUATION_ARENA_MODELS" environment variable. #26174

♿ Clearer high-contrast sidebar selection. With high-contrast mode enabled, the currently selected chat in the sidebar now stands out with stronger colors, making it easier to tell which chat is active. #26469, Commit

🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

🌐 Translation updates. Translations for Thai, Portuguese (Brazil), Catalan, and Spanish were enhanced and expanded.

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section — some may be withheld for a short time to give administrators time to upgrade. Advisories

🔐 Fewer unexpected logouts. A single request returning an authorization error no longer signs you out while your session is still valid, since the app now confirms the session status before redirecting to login. Commit

🔒 Web search domain filtering. Domain allow and block rules for web search results are now matched against the host, closing a gap where some URLs could slip past the filter. Commit

🕵️ Image prompt log privacy. Image generation workflows are no longer written to server logs at the default log level, keeping user-authored prompt content out of operator-visible logs. #26400, Commit

🗄️ Safer database upgrades. Upgrading an existing SQLite database no longer crashes during the user-table migration or corrupts saved user settings, resolving failures that could block startup or break login after an upgrade. #26403, Commit

⚙️ Saving settings as a non-admin. Non-admin users can once again save their interface settings, such as the default model and theme, which previously failed with a server error while the interface incorrectly reported success. #26627, Commit

🕒 Sidebar chat timestamps. Chats in the sidebar now show when they were last active instead of when they were created, so the time label matches their position in the list and refreshes after each new message. #26454, #26451

🎯 Default model after refresh. Your selected model is no longer cleared when you reload the page, as model selection now waits for the model list to finish loading. Commit

⏳ Tool dialogs no longer hang. Dismissing a tool or function input dialog by clicking outside it now cancels the pending request instead of leaving the chat spinning indefinitely. #26417, Commit

🐍 Reliable code execution loading. Running Python code in chat now loads its runtime reliably, fixing sandbox startup failures that broke code execution and the Pyodide file viewer in recent releases. #26625, #26390

🤖 Models with null capabilities. Chatting with a model whose capabilities are unset no longer fails with an error when the memory feature or automations are involved. #26412, Commit, Commit

🔎 Searchable responses. Chat search again finds assistant messages whose text is stored as structured output, which were previously skipped. #26405

🔔 Chat notification previews. Background chat completion notifications and toasts now show a clean response preview instead of appearing blank for messages stored as structured output. Commit

💾 Banner and config startup. Setting configuration such as "WEBUI_BANNERS" no longer causes a startup failure, since admin configuration values are now stored correctly regardless of their data type. #26431, Commit

📑 RAG Template visibility. The RAG Template editor now stays visible in admin document settings even when Bypass Embedding and Retrieval is enabled, since the template still applies to document content in that mode. #26126, Commit

🧬 Editing derived models. Editing a workspace model no longer clears its base model, including when that base is a preset or the model itself. Commit, Commit

Original source

Added
🤝 Share folders with your team. You can now share a folder and the chats inside it with specific users, groups, or everyone, with read or write access; people you share with see shared folders in their sidebar and open the chats in a read-only view when they are not the owner, and administrators control who is allowed to share folders with a new "Folders Sharing" permission that is off by default. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🗜️ Automatic context compaction for long chats. Conversations that grow past a configurable token threshold can now be summarized automatically so they stay within a model's context window, with a notification shown while it happens; administrators can enable it, set the threshold, customize the summarization prompt, and lower the threshold per model. It is off by default. Commit, Commit, Commit, #19594
🖥️ Open WebUI Computer agent support. Open WebUI can now connect to Open WebUI Computer through its OpenAI-compatible gateway, letting chats run full agent sessions on your own machine with file, terminal, git, and web access. GitHub
🚀 Much faster hybrid search on large knowledge bases. Hybrid search now runs natively in the database on pgvector setups instead of loading an entire collection into memory, so querying large knowledge bases is dramatically faster. Commit, #20737
🗂️ External knowledge bases. Knowledge bases can now be backed by an external retrieval source through configurable external knowledge connections, so you can search an existing external system from chat instead of only Open WebUI's built-in store. Commit
🧠 Reworked memory system. Memory has been overhauled with distinct memory types — long-lived personal memories and per-conversation context — managed through a structured add, update, and delete flow, giving models a more reliable way to remember and apply what they've learned about you. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🧩 New plugin primitive: the Event function. Where pipe, filter, and action functions all run inside a conversation, the new Event function is the first primitive that hooks into the system itself: it runs your own Python in response to events emitted across the whole application — sign-ups, configuration changes, file uploads, role changes, deletions, startup and shutdown, and more. That makes a new class of behavior possible directly inside Open WebUI, from onboarding and access control to auditing, lifecycle automation, and external integrations. Comes with starter boilerplate in the function editor. Commit, Docs
🔔 New event system with webhooks. Open WebUI now emits events for a wide range of system activity — sign-ins, configuration changes, startup, and actions across chats, knowledge, files, and more. Administrators can send these as outbound webhooks, route them to specific users or groups, and manage which events go where from a new event settings admin page. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, #1240, #16426
🔐 Configure authentication from the admin panel. LDAP and OAuth/OIDC settings now have a dedicated Authentication settings page, so providers can be configured from the admin interface. Commit, #12945
🏷️ More custom header variables. Custom request headers now support "{{USER_MESSAGE_ID}}", "{{USER_MESSAGE_PARENT_ID}}", and "{{TASK}}", letting connected services tell apart real user messages from automated background requests like title, tag, and follow-up generation. Commit
📄 File details forwarded to external document extractors. External custom document-extraction servers now receive the file's ID, name, and content type, and these are also available as custom header variables, so extraction can be tailored per file. Commit, #26259
🎰 Last model pre-selected for new slots. When you add another model to a multi-model chat, the slot now defaults to the model you last picked instead of starting empty. #25974
⚡ Faster model overview. The admin model overview now loads its feedback history and tags through batched queries, so it opens noticeably faster on instances with many chats. Commit
🏎️ Lighter channel profile previews. Profile previews in channels now load a person's details only when you hover to open one, rather than fetching them for every message up front. Commit
↩️ Reset permissions to defaults. The group and default permission dialogs now include a button to restore all permissions back to their built-in defaults in one step. #25931
📥 Chat import permission. Administrators can now control whether users are allowed to import or clone chats, with a new "Allow Chat Import" permission. Commit, Commit, Commit, #25927
🔔 Per-group user webhook permission. Administrators can now control which users may set a personal notification webhook, with a new "User Webhooks" permission. #25923
✍️ Customizable autocomplete prompt. Administrators can now set a custom prompt template for autocomplete generation from the admin interface settings. Commit, #25879
🔑 Configurable secret key length. The auto-generated secret key length can now be set with a new environment variable, instead of always using a fixed length. Commit, #25906
🏟️ Arena evaluation models configurable via environment. Arena evaluation models can now be defined through an environment variable, which previously could not be set that way. Commit
✏️ Edit prompts from the menu. The prompts list now has an Edit option in each prompt's menu, taking you straight to its editor. #25789
📋 Clone automations. Automations now have a Clone option in their menu, so you can duplicate one as a starting point. #25790
🔁 Recurring calendar events. The calendar event editor now includes a repeat option, so events can recur on a schedule. #25865
🧷 Separate skills import and export permissions. Administrators can now control importing and exporting skills independently, with new skills import and export permissions. #25921
🏷️ Filter admin models by tag. The admin Models settings page now has a tag filter for narrowing the model list by base-model tags. Commit
📊 Sortable analytics chat list. The model chat list in analytics now has sortable column headers, so you can order it by title, last updated, or user. Commit, #26168
🔐 Argon2 password hashing option. Password hashing can now use Argon2 through a configurable algorithm setting, removing the 72-byte password length limit that came with the previous default. Commit, Commit, #25656
🔐 Optional encryption of valve values at rest. Tool and function valve values can now be encrypted at rest through a new opt-in setting, with existing stored values migrated automatically, so sensitive settings like API keys aren't kept in plaintext. Commit, #23721
🗄️ AWS RDS IAM database authentication. The database connection can now authenticate using AWS RDS IAM tokens through a new opt-in setting, instead of only a static password. Commit, #23580
🔓 Automatic auth for models with OAuth 2.1 tools. When a model uses tools that require OAuth 2.1, Open WebUI now initiates the authorization flow automatically instead of failing the request. Commit, #23325, #23272
🔤 Custom tokenizer for token-based text splitting. Token-based document splitting can now use a configurable Hugging Face tokenizer model, so chunking can match the tokenizer of the model you use. Commit, #24139
🔒 Restrict OAuth scopes requested from MCP servers. A new setting lets administrators limit which OAuth scopes Open WebUI requests when connecting to MCP servers. Commit, #25981, #25978
🧩 Filter Outlet Hook can now run on API requests and responses. A filter function's outlet hook now runs for direct API callers, including streaming responses, so response post-processing isn't limited to the web interface; this is controlled by a new setting and on by default. Commit, #25650
🖥️ Setting for terminal sidebar auto-open. A new interface setting controls whether the files sidebar opens automatically when you select a terminal. Commit, #25628
📌 Reorder pinned notes by dragging. Pinned notes in the sidebar can now be dragged to reorder them. #25677
🔎 Chat actions in search. The search dialog now offers a context menu on each result, so you can act on a chat directly from search. #25490
🔎 Snippets in chat search results. Searching your chats now shows a snippet of the matching content in each result, so you can tell results apart at a glance. Commit, Commit, Commit, #25178
📝 Formatted valve descriptions. Valve descriptions for tools and functions now render Markdown, so they can include formatting and links. Commit
🔽 Dropdown inputs for valve options. Valve and confirmation inputs can now present a set of options as a dropdown instead of free text, making fixed-choice settings easier to configure. Commit, #26278
🔌 Control the OAuth resource parameter for MCP connectors. MCP connectors can now be set to always send, never send, or automatically decide whether to include the OAuth resource parameter, so they work with providers that reject it. Commit
🔎 SERPHouse web search. SERPHouse can now be used as a web search provider. Commit, Commit, #26254
🔎 Microsoft Web IQ web search. Microsoft Web IQ can now be used as a web search provider, with a matching page-browse loader. #26178
⚠️ Optional web search confirmation. Administrators can now require users to confirm before a web search runs, with a banner and message making it clear when search is about to be used. Commit, #24942
🪪 Client User-Agent forwarded to model backends. The browser's User-Agent is now passed through to all model backends, so upstream services can see the originating client. #26333
🖐️ Drag items from the sidebar into chat. Folders, notes, and models — including pinned notes — can now be dragged from the sidebar into the chat input. #25771, Commit, #26384
🏷️ Tag suggestions in the model editor. The model editor now suggests existing tags as you type, making it easier to reuse a consistent set. Commit, #25703
🗣️ Voice suggestions in the model editor. The model editor now offers a dropdown of available text-to-speech voices, making it easier to pick one. Commit, #25706
🎛️ Unified model picker for workspace base model. Choosing a base model in the model editor now uses the searchable model selector instead of a plain field, making it easier to find and pick the right model. Commit, #24576
🔍 Searchable pickers in the model editor. Attaching actions, filters, tools, knowledge, and skills to a model now uses type-to-search pickers instead of long checkbox lists, making large libraries easier to manage. Commit
🖼️ iPhone images work with OpenAI image editing. Uploaded images are now normalized before being sent to OpenAI image editing, fixing edits that failed for certain iPhone photo formats, with a new admin toggle to control the behavior. Commit, Commit, #26252, #26249
🟢 Loaded-model indicator for llama.cpp. Models served through llama.cpp now report whether they're currently loaded in memory, including the sleeping state, so the loaded indicator works for them too. Commit
🧱 Structured model output rendered on the client. Reasoning, tool calls, and server-side tool steps such as web and file search are now rendered in the browser from the model's structured output instead of being flattened into the message text on the server, giving more accurate and editable rendering of these items. Commit, Commit
📜 Custom CA bundle for outbound connections. A new environment variable lets you point Open WebUI at a custom CA certificate bundle, and the per-connection SSL settings now accept a bundle path, so deployments behind a corporate or internal CA can keep certificate verification on instead of disabling it. Commit, Commit
🖥️ More terminal server orchestrator controls. Admins connecting an orchestrator terminal server can now configure session lifecycle policies and refresh or reset running terminal sessions, including targeting only idle ones, from the connection settings. Commit
📁 Terminal file browser can stay within a root folder. The terminal file navigator now anchors to a defined root and home directory, so users can be kept within their workspace instead of browsing into system folders by accident. Commit
🧠 Memory toggle follows the server default. When a user hasn't set their own memory preference, it now follows the admin's global memory setting instead of defaulting to off. #25909
🧹 Unshare all shared chats at once. The Shared Chats dialog now has a button to stop sharing every shared chat in one action. #25848
📈 Richer analytics with a date picker. The analytics dashboard now lets you choose a date range and shows additional columns. #25922, #25919
🔢 Chat and file counts in their dialogs. The Chats and Files dialogs now show the total number of chats and files in their titles. #25872, #25873
⚡ Faster math rendering. Rendered math is now cached and reused, so messages with repeated or unchanged math expressions render more efficiently. #25847
⚡ Lighter Markdown setup. Markdown extension setup now runs once instead of on every render, avoiding repeated work and extension stacking. #25837
⚡ Snappier read-only code blocks. Read-only code blocks now skip language auto-detection, so they render faster. #25824
⚡ Non-blocking audio model loading. Loading speech models no longer blocks the server, keeping it responsive while they initialize. #25806
⚡ Faster URL safety checks. The safety check on fetched URLs now resolves addresses off the main loop, so it no longer blocks other work. #25825
⚡ Fewer queries for channel reactions and replies. Channel reactions and thread replies now load through batched queries, reducing database load on busy channels. #25831
⚡ Lighter streaming. Streaming responses now skip re-processing message content that hasn't changed, reducing work on every update. #26325, #26326
⚡ Smoother tool-call rendering. Displaying tool calls now parses their content iteratively, avoiding slowdowns on deeply nested data. #26146
⚡ Hidden tool-call details cost nothing. When tool-call arguments are collapsed, they are no longer rendered behind the scenes, noticeably speeding up chats with heavy tool use. Commit, #26147
⚡ Leaner knowledge-file reading for agents. The built-in tools that let a model read knowledge files now return output in bounded, paginated chunks with a default and a hard cap, instead of potentially returning an entire large file at once, sharply reducing token usage. Commit, #26139
⚡ Lighter, faster file search on large knowledge bases. Listing and searching files no longer returns each file's full extracted text by default, and content matching is now length-bounded, so these requests are far lighter and searching across very large knowledge bases is dramatically faster. Commit, Commit, Commit, #25774, #25741, #26145, #25867
⚡ Faster password hashing and bulk user import. Password hashing and verification no longer block the server, and importing users from a CSV is now processed in a single batch, keeping large imports and sign-ins responsive. Commit, #25804, #25805
⚡ Non-blocking model downloads. Downloading large Ollama models no longer blocks the server on file reads and checksums, keeping it responsive during big downloads. #25829
⚡ Non-blocking uploads and link fetches. Hashing uploaded files and fetching URLs now run off the main loop, so large uploads and link previews don't hold up other requests. #25822
⚡ More blocking work moved off the main loop. Additional blocking operations in audio, pipelines, and plugin handling now run in worker threads, keeping the server responsive under load. #26381
⚡ Unreachable backends don't stall model loading. Loading models and tool servers no longer blocks on backends that are down or slow to respond, so the model list stays responsive when one connection is unreachable. #26289
⚡ Batched streaming updates. Streaming responses now group small updates of the same type before sending them, reducing overhead during fast token streams and tool-call output. Commit, #26202
🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
🌐 Updated translations. Catalan, Brazilian Portuguese (pt-BR), Irish, German (de-DE), and Spanish (es-ES) translations were updated.
Fixed
🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section — some may be withheld for a short time to give administrators time to upgrade. Advisories
🔐 Knowledge base write access enforced on upload. Attaching an uploaded file to a knowledge base now requires the same write access as the rest of the knowledge API, so users without write access can no longer add files to a collection by referencing its ID. #26001
🗝️ API key permission enforced on all key endpoints. Viewing and deleting API keys now respects the API keys permission, matching the protection already applied to key creation. #25992
🔊 Text-to-speech permission enforced on the speech endpoint. The OpenAI speech proxy now honors the text-to-speech permission, so it can no longer be used by people who are not allowed to use that feature. #25993
🎲 Model access enforced on arena fallback. Reaching a model indirectly through an arena model on background and task requests now enforces that model's access rules, closing a path that could otherwise bypass them. #26046
⏰ Scheduled automations stop for deactivated accounts. Scheduled automations now re-check the owner's account status and permissions before each run, so they stop when an account is deactivated or has automations access revoked. #26047
🚧 Heavily encoded paths rejected behind the proxy. Request paths that remain encoded after repeated decoding are now rejected instead of forwarded, preventing a path traversal that could otherwise slip through. #26050
🌐 Image URL fetches hardened against DNS rebinding. Fetching user-supplied image URLs now re-checks the destination address at connection time, closing a path that could be used to reach internal addresses behind a public hostname. #25960
🛂 Web fetch blocklist matches on hostname. The web fetch filter now matches entries against the request's hostname on domain boundaries, so blocked hosts can no longer slip through with an added path and lookalike domains are no longer mistaken for allowed ones. #25949
🪪 MCP connectors request least-privilege scopes. MCP connectors that register dynamically over OAuth now request only the scopes for the specific resource rather than the authorization server's full catalog. #25958
🙈 Channel member lists no longer expose private data. Viewing a channel's members now returns only basic profile details, instead of also exposing other members' settings, linked-account data, and personal information. Commit
🛟 SCIM sync can't demote an admin. A SCIM provisioning sync that marks a user inactive can no longer strip an existing administrator's role, preventing an instance from being locked out of its own administration. #25948
👻 Collaborative notes reject unauthenticated presence events. The remaining real-time note-collaboration events now require an authenticated session, so presence and cursors can no longer be spoofed by someone who only knows a note's ID. #25946
⏱️ Login timing no longer reveals which accounts exist. Sign-in now takes the same amount of time whether or not an account exists, removing a timing difference that could be used to discover valid accounts. Commit, Commit
🔌 Terminal connections can't be redirected to another user. Terminal session identifiers are now safely encoded before being passed upstream, closing a way to tamper with the connection's user identity. #26042
📡 Real-time events only reach your own session. The server now verifies that a real-time event is delivered only to the requesting user's own active session, instead of trusting a client-supplied session identifier. #25763
🔓 Revoked sessions are rejected on real-time connections. Real-time and terminal WebSocket connections now honor token revocation and expiry, so a signed-out or expired session can no longer keep a live connection open. Commit, #25764, #25686
🕳️ Another DNS-rebinding gap closed in URL fetching. Fetching a URL's content now re-checks the destination address at connection time, closing another path that could reach internal addresses behind a public hostname. #25775
🗣️ Azure speech input is escaped. Voice and language values are now escaped when building Azure text-to-speech requests, preventing malformed or injected markup. #25776
⚙️ Interface settings update respects its permission. Saving interface settings now enforces the interface permission, so users without it can no longer change those settings through the API. #25996
🗄️ Unknown knowledge collections are denied by default. Retrieval now rejects unknown or unscoped collection names by default, closing a legacy path that could be used to reach collections outside the normal access checks. Commit
🙈 Error responses no longer leak internals. Server error responses now return sanitized messages instead of raw exception text, so internal details aren't exposed to signed-in users. Commit, Commit, Commit, Commit, #26375, #26374
📏 Upload size limit enforced on the server. The maximum upload size is now enforced server-side, so it can't be bypassed by a client that ignores the limit. Commit, Commit, #25869
🖼️ OAuth profile pictures are validated. Profile picture URLs from OAuth providers are now validated and their type checked when stored, preventing unsafe image sources. Commit, #24548
📦 Security updates to frontend dependencies. Several frontend dependencies were updated to patch known security vulnerabilities. #26281
🤝 Chat sharing respects the user-sharing permission. The share-chat dialog now hides the option to share with specific users from people who lack that permission, matching the access rules enforced elsewhere. #25915
📤 Chat export respects its permission everywhere. Every chat export menu now checks the export permission, so users without it can no longer export chats through one of the dropdown menus. #25914
📂 File write access requires real ownership. Editing or deleting a file through a knowledge base or workspace model now requires that the object's owner actually owns the file, so a read-only file can no longer gain write access by being referenced from an object you control. #26032
🖌️ Image edit endpoint enforces permission. The image-edit endpoint now checks the image-edit switch and the image-generation permission, matching image generation, so it can't be called by users who lack access. #26009
📁 Folder permission enforced on all folder actions. Every folder operation now checks the folders permission, so the setting is respected consistently instead of only when listing folders. Commit
🧩 Code Execution settings collapse when off. The Code Execution settings section now collapses when the toggle is disabled, keeping the settings page tidy. #25970
📅 German date format in Notes. Dates in the Notes view now display correctly for German, where they previously failed to render. #25985
🎙️ ElevenLabs speech keeps working when voices can't load. Text-to-speech through ElevenLabs no longer fails when the available-voice list can't be fetched, instead of rejecting every voice. Commit, #26075
🪟 Default Permissions modal resets on close. Closing the Default Permissions dialog without saving now discards unsaved edits instead of keeping them around the next time you open it. Commit
👯 Side-by-side chat with the same model. Running two panes with the same model no longer leaves one pane stuck waiting or showing the other pane's reply after a reload, since each pane's messages are now tracked separately. Commit, #25982
💾 Model edits no longer lost when changing access. Adjusting a model's access no longer auto-saves on its own and discards your other unsaved changes to that model. #26004
🔧 Parallel tool calls over the Anthropic-compatible API. External Anthropic-compatible clients calling Open WebUI's messages endpoint now receive tool calls reliably when a model issues several at once or returns them in its final message. Commit, #25963, #25964
🗃️ Prompt caching preserved over the Anthropic-compatible API. Requests through the Anthropic-compatible API now keep their prompt-caching markers instead of having them stripped, so clients that rely on caching work as intended. Commit, #25998, #25964
🔁 Fewer redundant data loads. Several views no longer fire duplicate background fetches at once, avoiding occasional glitches from overlapping requests. #25943, #25942, #25934, #25935, #25838, Commit
🔎 Steadier search boxes across admin and workspace. Search fields for users, knowledge, prompts, tools, and similar lists now run only as you type and reset to the first page correctly, instead of occasionally re-searching on their own. Commit, #25938
📊 Admin feedback list loads again on PostgreSQL. The admin feedback list no longer fails to load on PostgreSQL setups, where it previously returned a server error. Commit, #25953
🗂️ Deleting nested folders checks chats correctly. Deleting a folder that contains subfolders now accounts for the chats inside those subfolders when applying the delete-permission check, instead of only the top-level folder's chats. Commit, #25920
🖱️ Dragging chats into folders is more reliable. Dragging a chat into a folder no longer throws an error in cases where the chat couldn't be resolved. #25928
🛠️ Workspace menu shows for the skills permission. Users who only have the skills permission now see the Workspace entry in their menu, which previously appeared only for other workspace permissions. #25925
🧠 Admins can always reach memories. Administrators can now use the memories endpoints regardless of the memories permission toggle, matching how admin access works for other features. #25924
🖼️ Image settings page survives a config load failure. The admin image settings page no longer crashes when its configuration fails to load, showing the page instead. #25933
🧵 Code blocks render in channel threads. Code blocks now display correctly in a channel's thread view, where duplicated message identifiers previously broke their rendering. Commit, #25917
🔵 No more false unread badges on chats. Chats no longer show an unread indicator after automatic changes like title generation or pinning, archiving, and moving them between folders, and newly created chats are marked read correctly so they don't appear unread after a refresh. #25912, #25782, #25108
📌 Pinned notes stay in sync. Pinning, unpinning, or deleting a note now updates the sidebar's pinned list consistently, instead of showing a stale pin state. #25918, #25640
📅 All-day calendar events keep their date. Saving an all-day calendar event no longer shifts it by a day for users in certain time zones. #25864
🧷 Damaged chat history recovers more reliably. When a chat's current position is missing or points at a malformed message, Open WebUI now repairs it from the latest valid message — on both the client and the server — instead of risking a broken history view. Commit, Commit, #26298, #26258, #26257
💾 Saving a chat no longer drops messages. Chat updates are now merged with the existing history on the server, with explicit tracking of deleted messages, instead of overwriting it, preventing message loss from concurrent or partial saves. Commit, Commit, Commit, #25657
📺 Channel message updates stay in their channel. Streaming updates to a channel message are now skipped if the message no longer exists or belongs to a different channel, preventing stray updates. Commit
📌 Pinned channel messages update for everyone. Pinning or unpinning a channel message now updates live for all members and works from thread views, instead of only changing for the person who pinned it. Commit
📄 Mistral OCR uploads work again. Document OCR through Mistral has been repaired after an upstream library change broke its file uploads. #25779
🗂️ Chroma collection detection fixed. Open WebUI now correctly detects existing Chroma collections, fixing a case where it always reported them as missing. #25780
📊 Vega-Lite charts render reliably. Vega-Lite charts in chat are now detected by their code block language tag, so they render correctly. #25843
🏷️ Long chat tag lists scroll. The tags section in the chat menu now scrolls instead of overflowing when a chat has many tags. #26031
⌨️ Enter key shows correctly on iOS. The Enter key symbol in the keyboard shortcuts list no longer renders as an emoji on iOS. #26173
🔗 Whitespace in names no longer breaks MCP connections. User name and info headers are now trimmed before being forwarded, fixing MCP connection failures when a display name contained leading or trailing whitespace. #26182, #26181
🈳 Search no longer fires mid-composition. Typing in search with an input method editor (such as Japanese, Chinese, or Korean) no longer triggers a search when you press Enter to confirm a composition. #26238, #26285, #26172
🧰 Valves icon stays visible. The icon for configuring valves no longer disappears, so user-configurable tool and function settings remain reachable. #26256
🎛️ Chat controls persist across navigation. Edits to chat controls are now kept when navigating between chats, and reverting a control to the chat's saved value persists correctly, instead of being lost. #26336, #25793
🔍 Chat search tool handles empty queries. The built-in chat search tool no longer crashes when called with an empty query. Commit, #26310
📑 More robust MinerU document processing. Document processing through MinerU now handles its ZIP results more safely, including very large outputs. Commit, #26263
⏰ Scheduled automations with session-auth tools work. Automations that use session-authenticated tools or terminals now authenticate correctly when running on a schedule, instead of failing. Commit, #26247, #26137
📝 Model system prompt preserved with knowledge. A model's system prompt is no longer dropped when knowledge retrieval runs with native tool calling. Commit, #26217
🔑 Expired sessions return you to sign-in. When a request fails because your session has expired, Open WebUI now redirects you to the sign-in page instead of leaving you on a broken view. Commit, #26237
🎯 Ejecting a workspace model unloads the right model. Unloading a workspace model now resolves to its underlying base model, so the correct model is freed from memory. Commit, #26269
🔄 Edited models refresh in the admin list. After editing a model in the admin settings, the models list now updates right away instead of needing a manual reload. Commit
🗂️ Workspace model bulk actions and search work across pages. Bulk actions on workspace models now apply across all of them, and search results paginate correctly. #26274
🧩 MCP resource results come through. Tool results that return resource content — including binary blobs and URI references — are no longer silently dropped, and image results are attached as files. #25260, #24038, Commit
🔗 Broader MCP server compatibility for OAuth. Open WebUI now discovers an MCP server's protected resource metadata even when the server doesn't advertise it, and recognizes more OAuth preflight variations, so more MCP servers connect. #25980, #25954, Commit, #26068
📤 Clearer upload error messages. Failed uploads now show a readable explanation instead of an opaque error stub. #25961
📋 Cloned prompts get a proper title. Cloning a prompt now adds the clone suffix to the correct field, so the duplicate is named as expected. #25800
📐 Long default group names don't overflow. A long default group name no longer overflows its row in the admin authentication settings. #25685
🖐️ Sidebar drags don't trigger uploads. Dragging a chat item in the sidebar no longer shows the file-upload overlay. #25675
🔁 Recovers from a stuck streaming response. If the signal that a response finished is missed — for example after a mobile app is backgrounded mid-stream — Open WebUI now recovers the chat instead of leaving it stuck in a streaming state. Commit, Commit, Commit, #26320, #26315
🧠 Model skills load on demand instead of filling the prompt. A model's attached skills are now presented to the model as a manifest it can load when needed, rather than having their full content inserted into the system prompt; skills you mention inline still get their content included directly. Commit, Commit, #25592, #25599
🗂️ Empty metadata no longer breaks Chroma indexing. Document metadata with empty values is now filtered out before indexing, fixing a case that could fail on Chroma. Commit, #26342, #26339
🔁 Updating a knowledge file won't break the knowledge base. When a file's content is updated, its new embeddings are now added before the old ones are removed, so a failed reindex leaves the knowledge base intact and usable instead of empty. Commit, #23789, #23787
🔤 Documents with special tokens index correctly. Measuring chunk sizes no longer fails when a document contains text that looks like a special token. #26210
📝 Note file attachments stay in sync. Updating the files attached to a note now keeps the editor and saved note in sync. Commit
📱 Better banner layout on mobile. Notification banners now lay out correctly on small screens. Commit, #24912
📂 Knowledge file listing includes attached files. Listing files through the knowledge tools now also shows files attached directly to a model, not only those inside a knowledge base, fixing cases where listing returned no results for a model with a single attached file. Commit, #26301
🏷️ Chat titles generate after long first responses. A new chat now gets its title even when the first response takes a long time, such as one with extensive reasoning or many tool calls, instead of staying "New Chat". Commit, #26240
🔌 Cancelling an MCP request no longer errors. Stopping a response that was using MCP tools now shuts the connection down cleanly instead of surfacing a server error. Commit
🧠 Reasoning details preserved across turns. Models that return structured or encrypted reasoning data, such as Gemini, no longer have their assistant message split mid-stream, keeping reasoning continuity across turns. Commit, #23852
📡 Error messages show for non-standard streaming responses. Providers that send errors over non-standard server-sent events now surface a readable error instead of nothing. #23228
🔑 Whitespace in terminal server keys no longer breaks auth. Terminal server API keys are now trimmed before use, so a key with stray leading or trailing whitespace still authenticates. Commit, Commit
🔥 One bad URL no longer fails Firecrawl scraping. When fetching multiple pages through Firecrawl, a single failing URL is now skipped instead of aborting the whole batch, and rate limits are respected between requests. Commit, #24183
📱 Usable chat input on mobile with many tools. When skills, tools, terminal, web search, and image generation buttons fill the chat input, the row of buttons now scrolls horizontally while the menu, voice, and send controls stay reachable, instead of pushing them off-screen. Commit, #26142
👤 Owner avatars only show on shared folders. Chat owner avatars in a folder's chat list now appear only when the folder is actually shared, instead of showing whenever owner information happened to be present. Commit
📜 No stray scrollbar on the About page. Extra spacing that caused an unnecessary scrollbar on the About settings page has been removed. #25802
🚪 Sign out works from the Account Pending page. Signing out while your account is pending now goes through the proper sign-out flow, so single sign-on sessions are ended and you are no longer left stuck on the pending screen. #25681, #25644
🔢 Built-in tools accept numeric arguments. Built-in tools no longer crash when a model passes a number or a string where a specific scalar type is expected; values are now coerced to the declared type. Commit, #25638, #25731, #25641
⏱️ MinerU timeout saves. The MinerU API timeout can now be saved from the admin settings, accepting a numeric value. Commit, #25604, #25603
🔧 Background completion no longer clears active tasks. Finishing a chat in the background no longer wipes the set of active tasks, fixing a case where ongoing task indicators could be lost. Commit, #25217
👁️ Workspace base model selector respects visibility. The base model selector in the workspace now hides models you don't have access to, matching their visibility settings. #25668
🧵 Channel threads bind to the right channel. A channel thread's parent and replies are now tied to the channel in the URL, preventing mismatches when switching channels. #25766
🗑️ Unsharing cleans up orphaned rows. Unsharing a chat now handles leftover shared-chat records, avoiding stale entries. #25632
🔎 Web search results reach the model with retrieval on. Web search results are now passed to the model even when embedding and retrieval are enabled, instead of being left out. #25600
🔢 Group count follows search. The groups count now reflects the filtered search results instead of the full list. #25689
␣ Space key works when renaming. Pressing space while renaming a file or folder no longer opens it, so spaces can be typed in names. #25627
🩹 Missing local embedding model no longer blocks startup. A missing local embedding model now surfaces as a deferred error instead of preventing the server from starting. #25683
🔤 Consistent settings label capitalization. Toggle labels in settings now use consistent title casing. #25765
♿ Better screen-reader labels on toggles. Integration and switch toggles now expose proper accessibility labels and pressed state for screen readers. #25258, #25230
📜 Long dropdowns scroll. Dropdown selects now scroll when their list is long, so all options stay reachable. Commit, #25608
🔽 Collapsible sections don't misfire on load. Collapsible sections no longer trigger their change action when first rendered, avoiding unintended toggles on page load. Commit, #25229
➗ Large math expressions no longer crash rendering. Parsing math delimiters no longer overflows on very large or deeply nested input, so messages with heavy math render instead of failing. #25845
🗄️ Oversized chunks no longer break Milvus indexing. Overly long text chunks are now trimmed before being sent to Milvus, so a single large chunk can no longer fail the whole batch and leave a file with no embeddings. #25857, #25858
📝 Code editor stays open when empty. The code editor drawer no longer collapses when its content is empty. #25855
💽 Settings no longer lost after a restart. Admin configuration is now stored more reliably, fixing cases where external connections and model parameters could be lost after restarting the server. Commit, Commit, Commit, #24743, #25911, #25959
📜 Visible chat scrollbar. The chat area now shows a scrollbar, making it easier to scroll through long responses. Commit, #25833
🎚️ Default model parameters apply to requests. Default model parameters are now applied to outbound requests, so settings like temperature and the context window take effect as configured. Commit, Commit, #24930, #26209
🟢 Ollama loaded-model indicator restored. The indicator showing which Ollama model is loaded in VRAM works again after recent changes. #25586, #25732
🪪 Static MCP connectors recover missing OAuth details. MCP connectors configured with static OAuth credentials now fill in a missing scope or resource from the server's published metadata, so they connect correctly instead of failing when those values were left out. Commit, #25898
📊 Token usage and cost stats no longer wiped by background tasks. A response's token usage and cost are now preserved when background tasks like title, tag, and follow-up generation run on the same chat, instead of being overwritten. Commit
🔗 Model share link updated. Sharing a model now opens the current community post page, fixing the link that pointed at the old endpoint. #25801
Changed
⚠️ Database Migrations: This update contains database migrations. Please be sure to back up your database before updating, as downgrading after the migration is not supported.
🔔 System events now fire automatically. With the new event system, Open WebUI emits events for activity like startup, sign-ins, and configuration changes, so any webhook you already have configured may begin receiving calls for these newly emitted events after upgrading. Review your event and webhook settings after updating so you only receive the events you want. Commit
🔀 Native tool calling is now the default. Every chat and model that had not explicitly chosen a tool-calling mode now runs Native, which relies on a model's built-in tool support, while the old behavior has been renamed "Legacy" and made the explicit opt-out; if your models depend on the previous approach you must switch them back to "Legacy" per chat, per model, or globally in your default model parameters to preserve their behavior. Commit
🗂️ Authentication settings moved to their own page. LDAP, OAuth, and related authentication settings have moved out of the General settings page into a dedicated Authentication page in the admin panel. Commit
🎓 Several features are no longer beta. Memories, Notes, Channels, and High Contrast Mode have graduated out of beta and no longer carry a beta label. Commit
🔧 Local web fetch setting renamed. The "ENABLE_RAG_LOCAL_WEB_FETCH" environment variable is now "ENABLE_LOCAL_WEB_FETCH", reflecting that it applies beyond retrieval; the old name still works as a deprecated alias. Commit
🔧 You.com search key renamed. You.com web search now prefers the "YDC_API_KEY" environment variable, with the previous "YOUCOM_API_KEY" still accepted as a fallback. Commit, #26316
🧪 Client-side Python now runs sandboxed. Client-side Python (Pyodide) now runs in a sandboxed, opaque-origin iframe by default, isolating executed code from your session, cookies, local storage, and the app's own endpoints, while full Python, JavaScript, and external network access keep working. Code that relied on reaching same-origin Open WebUI endpoints from Pyodide will no longer be able to, and Pyodide is now marked legacy in the admin Code Execution settings. Commit, Commit, Commit, Commit, Commit

Original source