Added

♿ Accessibility mode reaches the menus. Accessibility mode now marks the menu entry you are pointing at and the model already chosen with a stronger background, across the dropdown menus, their submenus, and the model picker together with its filter and compare controls, so those cues carry the contrast the accessibility guidelines ask for in both themes. Commit, Commit

🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

🌐 Translation updates. Translations for Indonesian were enhanced and expanded.

Fixed

💥 Chat branches stay connected after reloads. A reply saved under an earlier message now stays listed under that message, so branch arrows, exports, reloads, and later edits keep the whole conversation in view, and chats already saved with that link missing are repaired when opened. #29299

🧱 Upgrades fail clearly instead of starting half updated. A failed database upgrade now stops at the migration error that caused it, instead of starting anyway and reporting a missing table or column such as 'chat.timer_at' later, which is the upgrade failure seen after moving from 0.11.0, 0.11.1, or 0.11.2. #29280

🔤 Custom interface fonts reach more of the app. The font chosen in interface settings now applies to dropdowns and other interface text that previously fell back to the standard font. Commit

🔌 Disconnect OAuth only where there is OAuth. The disconnect control on a tool server reached over MCP now appears only where that server signs in through OAuth and an account is connected, rather than on servers that use no sign-in at all. #29296

Original source

Added

🖼️ Richer previews for terminal files. Word documents and slide decks produced in the terminal are now previewed as the finished document rather than an approximation, and every document preview gains a page strip down the side with numbered thumbnails you can click to jump straight to a page, and the notice warning that a preview might differ from the download is gone now that it does not. Commit, Commit, Commit, Commit, Commit

⚡ Less overhead on every message. Deployments without pipelines configured, which is the default, no longer pay setup work for them on each chat message and background task. #29146

🏎️ Lighter model list refreshes. On deployments running several workers, a refresh that finds the model list unchanged no longer has every worker rewrite the whole list to the shared cache, cutting the work and the traffic each refresh costs. #29264

🧵 Smoother busy websocket servers. Large Redis-backed websocket deployments now spend far less time sweeping old sessions, reading their own session data back from Redis, and checking every outgoing websocket message for file attachments Open WebUI does not send, so channel posts, collaboration updates, heartbeats, and live chat updates put less load on busy servers. #28835, #28180

🧰 A new request filter step. Filter authors can now use request to adjust the payload right before each model call, including follow-up calls after tool use, while existing inlet, stream, and outlet filters keep working as before. Commit, Commit

🤏 More room in file previews on touch screens. File previews on phones and tablets no longer show zoom buttons that sit over an already small preview, leaving pinch to zoom to do the job. #29176, #29152

👆 Resizing panels by touch. The divider beside the main sidebar or a side panel can now be dragged on a touchscreen or with a stylus, and a drag made with the mouse keeps following the pointer when it leaves the window. Commit, Commit, Commit

🔤 Choice of interface font. Interface settings now offer a font family field where you can name a font installed on your computer and watch it apply across the interface as you type, with an empty field returning to the standard font. Commit

♿ Wider accessibility mode coverage. Accessibility mode now lifts the contrast of more of the interface, including muted text, table text, icons, the colours elements change to on hover, and the highlight behind sidebar and menu items you point at, so low-contrast areas meet the level the accessibility guidelines ask for in both light and dark themes, and the close button on the folder dialog now announces itself to screen readers, as do document and slide previews, which can now be reached with the keyboard. Commit, Commit, #29160, Commit, Commit

🌐 Translation updates. Polish, Simplified Chinese, German, Irish, Catalan, and Portuguese (Brazil) translations were expanded, corrected, and brought up to date with newer interface text. #29029, #29043, #29108, #29151, #29184, #29179, #29247, #29217

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories

💥 Replies stop breaking mid-chat. A conversation no longer fails in the browser and stops showing the assistant reply until you reload, and chats already saved in that state display and can be edited again. #29250, #29244

⌨️ Preview shortcuts stay in the preview. Arrow keys now page a document or slide preview only while that preview has focus, instead of paging it from anywhere on the page and taking the arrow keys away from whatever you were typing in. Commit, Commit

🧊 Streaming no longer stalls on reasoning models. A reply from a reasoning model now streams through to the end instead of showing its first few words and then freezing until generation finishes. #29053, #29035

💭 Thinking stays in Thoughts. After a model uses a tool, its reasoning for the next step now appears in the collapsed Thoughts section instead of being written into the reply as ordinary text. #29052, #29040

🧠 Large tool calls stream faster through Anthropic-compatible clients. When a streamed tool call sends a large block of arguments, Open WebUI now waits until that block can actually be complete before checking it, instead of doing the same expensive check again on every tiny piece. #28858

🛑 Stop works across instances. Stopping a response now takes effect on deployments that spread people across several instances backed by a Redis cluster, instead of the reply continuing to the end regardless. #29165, #19840

🎯 Fewer needless chat reloads. A conversation holding an older unfinished reply no longer reloads itself each time some other response in it finishes, reloading only for the reply the update actually concerns. Commit

📖 Banners with underlined text. A banner containing underlined text now displays instead of failing to render. #29118, #29115

🧰 Pinned models start with their own tools. Starting a chat from a pinned model in the sidebar now applies that model's tools and skills instead of carrying over the ones from the model you used last. #29058, #29050

❓ Rejected ask_user calls no longer kill the reply. If a model asks the user a question in a way Open WebUI refuses, the model now receives that error and can continue or retry, instead of leaving the chat stopped with no answer. #29252, #29077

🚫 Disabled models no longer vanish. Turning a model off in the admin Models list now keeps it in view so you can turn it back on, instead of it disappearing with no way to recover it. #29037, #29036

✂️ Message text kept intact. Text containing angle brackets and a dollar sign is no longer mistaken for a skill mention and silently removed before your message reaches the model. #29051, #29041

📆 Moved calendar events stay visible. Changing an event's date no longer makes it disappear from the calendar, and events already stuck in that state show up again. #29085, #29067

🔁 Repeats follow the event. A repeating event now works out its occurrences from its own date and time, where a repeat rule carrying a start date of its own could place them on the wrong weekday or at the wrong hour. Commit

🔟 Repeating automations keep their count. An automation set to run a fixed number of times is no longer shown as running once and quietly rewritten to a single run the next time you open and save it. #29261, #29263

🗓️ Schedules survive a save. An automation carrying a start date now shows its real schedule in the list and keeps its weekly or monthly setting when saved, instead of showing raw rule text and falling back to daily. #29263

🧩 Custom automation schedules stay custom. Reopening an automation with a custom repeat rule no longer loses the custom rule from the editor. #29260

🔢 Accurate admin user counts. The counts on the admin Users tabs now follow your search and reset when you switch tabs, instead of showing stale or unfiltered numbers. #29080, #29079

🧷 Sidebar folders stop acting stale. A folder that has been removed from the sidebar is now removed from the internal sidebar registry too, so later sidebar actions do not target a folder that is no longer on screen. #29121

📱 Readable model list on small screens. The model identifier and timestamp in the workspace model list no longer overlap the model name on narrow displays. #29084, #29083

🧱 Long setting values stop crushing labels. Settings rows now let long controls shrink inside the available space instead of squeezing the label beside them. #29229

🧭 Model defaults panels stay usable. The model capabilities and prompt suggestion sections in admin settings now scroll inside their panels instead of growing past the available space. #29235

📲 Dropdowns stay on screen. A dropdown near the edge of a narrow screen now shifts inward to stay fully visible instead of opening past the edge with its option labels cut off. #29226, #29225

🌗 Dropdown lists follow the theme. The list a dropdown opens now takes its light or dark colouring from the rest of the interface instead of the system default. Commit

🎛️ Valves dialog stays in bounds. A valve whose selected options form a long line no longer stretches its input past the edge of the dialog and over the page behind it. #29203, #29202

🧹 Shared chats search resets. Reopening the shared chats dialog now starts with an empty search box and the full list, rather than a leftover search term above unfiltered results. #29082, #29081

🔎 Case-insensitive search beyond English. Searching and filtering by tag now ignore letter case for accented and non-Latin text on installations backed by SQLite, where only unaccented English letters were matched whatever their case. Commit

🏷️ Labels with colons and example URLs translate correctly. Interface text such as Warning:, http://localhost:8000, and https://mineru.net/api/v4 now appears correctly instead of being misread by the translation system. #29161, #29154

🔑 Precise account matching on SQLite. Signing in through an identity provider now matches your account on its exact identifier, so accounts whose identifier is an unusually long or zero-padded number are no longer at risk of being confused with another. Commit

🗃️ Knowledge list loads reliably. The Knowledge page in the workspace now fills in its list on opening instead of occasionally staying empty. Commit

🎟️ Tool servers without a key. A tool server connection saved without a key is no longer sent an empty authorization header, which some servers refused outright. Commit

🐍 Code interpreter starts on Windows. The built-in code interpreter now serves its script and WebAssembly files with the browser-safe file types Windows hosts sometimes overwrite, so Pyodide can load instead of failing before code runs. #29139, #29133

Changed

⏱️ Daily limit on repeats. A calendar event can no longer be set to repeat more often than once a day, and saving one that repeats more often is now refused with a message explaining the limit. Commit

🏷️ High Contrast Mode is now Accessibility Mode. The interface setting previously called 'High Contrast Mode' is now called 'Accessibility Mode', with the same switch in the same place. Commit

Original source

Added
🚦 Human in the loop tool approval. Where an administrator has turned it on, you can switch a conversation from letting tools run freely to being asked first, so a model that wants to use a tool stops and waits for you to allow or deny it, one call at a time in a saved conversation, by button or by keyboard shortcut, with your choice remembered for this conversation and for future ones, switching back to running freely releasing anything already waiting, and automations, channel replies, and temporary chats unaffected. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🙋‍♂️ Models that can ask you a question. A new built-in tool lets a model pause and put up to three multiple-choice questions to you before continuing, with room to type your own answer instead, and the question survives a reload in a saved conversation, so you can come back and answer it later rather than losing the conversation. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🖇 Agents can now display terminal files directly. A model can now show a file it made in a terminal directly in its reply, with a preview and a download button, instead of describing a path that led nowhere when clicked, and a new interface setting chooses whether these open in the reply or in the files pane. Commit, Commit, Commit, #27650
📶 Streaming rebuilt from the ground up. A reply now streams as small pieces of new text instead of resending the whole message so far with every update, so the data sent over a reply grows with its length rather than with its length squared, which on a server with many people chatting at once means far less processor time spent encoding, passing, and decoding those updates, far less load and memory on the shared cache that carries them between instances, and far less work in your browser, which no longer takes in the whole reply again and redraws the parts of it that have not changed on every update, cutting the data sent and the server work spent appending to a message by up to 1000x on a very long reply, and a reply still in progress is now kept aside on the server, so reopening the conversation after a refresh picks it up where it is rather than showing a blank message, on deployments backed by Redis. Commit, Commit, Commit, Commit
🪵 Much faster throughout. Hundreds of places across the application no longer assemble detailed log text that is switched off and thrown away unread, so sending messages, uploading and indexing files, running searches, signing in, and loading admin pages all get that time back, with the largest gains on busy servers, in long conversations, and on chats that draw from a large knowledge base. #27834, #27837
🚀 Faster model list lookups. Title generation, tag suggestions, autocomplete, and other background steps of a chat turn now fetch the model list in one go, which keeps other people's responses flowing on busy Redis-backed instances with many models. #27821
🛰️ Cheaper log export. Deployments that export their logs to a telemetry collector, with "ENABLE_OTEL" and "ENABLE_OTEL_LOGS" both set, now prepare each exported line once instead of twice, which matters more than it used to now that log text is only assembled when something will actually read it. #27840
📇 Faster permission checks on large instances. Working out which groups you belong to is now a direct lookup rather than a scan of every membership on the server, so chats and the admin user list stay quick as an organization grows. #27822
⚙️ Much faster JSON handling. Saving and opening chats, reading settings, returning results from built-in tools, streaming replies, signing in and signing up, working out your permissions, and reading stored chunk details during knowledge base searches on Valkey and Oracle vector storage are all handled much faster across the application when the "ENABLE_ORJSON" option is turned on. Commit, #28396, #27841, #27807, #27805, #27813
📤 Much faster outbound requests. Conversations and embedding batches sent to Ollama and Anthropic models are packaged for delivery much faster, which is most noticeable in long chats when the "ENABLE_ORJSON" option is turned on. #27811, #27810
🐍 Much faster code interpreter output. Printed output and generated images from code run in chat appear much faster when the "ENABLE_ORJSON" option is turned on. #27812
🪶 Lighter page loads. Several small requests the interface makes on every page load, along with a few administrative ones, no longer set up database access they never used, which took several times longer than the rest of the request put together. #28178
♻️ One less read per message. Sending a message no longer loads the whole conversation from the database twice over, which mattered most in long chats where that record is largest. #28809
🏁 Faster skills on large instances. Opening the skills list, or sending a message that uses one, no longer checks every skill on the instance one at a time, so both are far quicker where many skills exist and most of them are not yours. #28798
🩻 Faster tools on large instances. Listing or exporting tools no longer checks every tool on the instance one at a time, so the integrations menu and the tools workspace open faster where many exist. Commit
🧊 Faster file access checks. Checking whether you may reach a file no longer walks every workspace model you can see looking for it, so opening a folder of files, downloading one, or retrieving from one is much quicker on instances with many models. #28802
🧱 Faster folder listings. Listing your folders now works out your group memberships once for the whole listing rather than again for every item in every folder. #28810
🧼 Less work per update in a long chat. Each update saved while a reply streams no longer re-examines the entire conversation, only the part being added, so the cost of an update stops growing with the length of the chat. #28820
🗃 Cheaper attaching of sources and files to a reply. Adding a source, file, or embedded item to a reply now reads just that one field rather than rebuilding the whole conversation to find it, which on a two hundred message chat is around 3.1 ms per item down to 0.65 ms, and no longer grows with the length of the conversation. Commit, Commit
🚏 Faster workspace model lookups. Working out which workspace models you may edit no longer loads every model on the instance and discards most of them, which also speeds up exporting models and the file access checks that relied on it. #28795
📮 Faster handing off a streaming reply. Passing a reply in progress between instances now writes it once rather than converting it back and forth and scanning it for characters that only matter elsewhere, which on a large non-English conversation took most of the time spent on each write. #28833
🥵 Constant load on an idle instance. An instance sitting idle no longer works through every chat you have once a second looking for timers that are due, which on a large history kept about a quarter of a processor core busy doing nothing and could exhaust memory until the application was killed. #27663, #27622, #27745
📍 Sidebar folders fetched once. Refreshing the sidebar now asks for your folders once rather than three times, on page load and on every action that refreshes it. #28662, #28661
💤 Far fewer writes just from being signed in. Recording that someone is online now writes at most once a minute for each person rather than on every single request, where an open tab alone caused two write transactions a minute before anyone touched anything. #28177, #28165
🛰 Less overhead on every request. The layers each request passes through before it is handled are now one instead of five, which also removes a quarter of that cost from every piece of a streamed reply on instances that set security headers. Commit, #28171
🎏 Turning off compression of live updates. A new "UVICORN_WS_PER_MESSAGE_DEFLATE" setting stops the server compressing every live update it sends, which costs processor time on each one for almost no saving now that a reply streams as small pieces; compression stays on unless it is turned off. #28613
🌡 Faster chat list and unread counts. Opening the sidebar, and the unread markers on folders, no longer read through your whole chat history to produce a short list, which on an instance with 15000 chats took 2 to 4 seconds. #27663, #27622, #27745
🥁 Long replies no longer slow as they grow. A long reply is no longer re-examined from the beginning for reasoning and code blocks on every piece that arrives, so the work stops growing with the length of the reply, which on a long reply is around 190x less time spent on it. #28861
💽 Faster saving of long chats. A chat is now written to the database in one go rather than one message at a time, so saving a long conversation is much quicker and puts far less strain on the database, and saving one where nothing has changed writes nothing at all. #28806
📦 Faster loading of shared folders. Folders shared with you now load in a couple of queries rather than one for each folder and each owner, so the list appears sooner for anyone with many of them. #28804
⚡ Uninterrupted chat during knowledge search. Responses now keep streaming for everyone on the server while knowledge base searches run, instead of pausing until each search finishes. #27824
🔍 Smarter chat search. Searching your chats now finds conversations containing all of your words in any order rather than only the exact phrase you typed, with exact matches still listed first, and the preview snippet points at whichever word it found. Commit
⌨️ Model switching from the message box. Typing "/model" now tells you which model you are on, switching to another by name with "/model" followed by its id, or opening the model picker straight from the slash menu without reaching for the mouse. Commit, Commit
📎 Sending while attachments upload. Sending a message before its files have finished uploading now queues it and sends it automatically once they are ready, instead of refusing with an error, and each queued message shows the progress of its attachments. Commit, Commit, #28381, #28380
📖 Opening a document at the right page. A model showing you a PDF, Word document, or slide deck from a terminal can now open it at a particular page or slide, so a reply that cites something on page 76 can put that page in front of you. Commit, Commit, Commit
💼 Attachments that go straight to a terminal. A terminal connection can now be set to receive files attached in chat into its own working directory rather than into the conversation, which also means files can be attached while using a model that cannot read them itself. Commit, Commit, Commit, Commit
🔦 Searching files in the terminal browser. The file browser now has a search box that finds files by name and by what is inside them, and opening a result takes you to the matching line. Commit
🌲 Browsing files as a tree. The terminal file browser now expands folders in place rather than only navigating into them, remembers what you had open, offers a right-click menu, can show hidden files, sorts by size, expands a folder you hover over while dragging something onto it, and moves a whole selection in one go when you drop it. Commit, Commit
🧰 Managing models on more servers. Administrators can now download, load, and unload models on llama.cpp and LM Studio connections from the manage models dialog, remove them on llama.cpp, and start a download straight from the model picker's search box, alongside the Ollama support that was already there. Commit, Commit, Commit, Commit, #28766
📢 Automations that post to a channel. An automation can now be pointed at a channel instead of a chat, so its scheduled run appears as a message there for everyone to see, chosen from a new destination picker that also covers folders. Commit
🙋 Mentioning people in a channel. Typing an at sign in a channel now lists that channel's own members first, before everyone else on the server, so the people you are likely to mean are at the top. Commit, Commit, #28883
🔗 Attaching any link. Pasting a link into a chat or a knowledge base now works out what is behind it, downloading a document or image as a real attachment rather than treating everything as a web page to be read as text. Commit
🔎 Searching tools and skills in chat. The integrations menu now has a search box for tools and for skills, so a long list can be narrowed by name instead of scrolled through. #26709, Commit, #28807, #28812
🧭 More from the message box. The slash menu now offers settings and, in a new chat, a toggle for temporary chat, alongside the commands that were already there. Commit
🚨 Being told when a file fails to process. A file that cannot be processed for a knowledge base now raises a notification naming the file and what went wrong, and keeps that reason on the file, instead of quietly being marked as failed. #27666, #6311, Commit
🔬 Zoom controls on previewed images. An image opened in the file browser now has zoom in, zoom out, and a reset button showing the current zoom, and pinching, scrolling, and holding a modifier key while scrolling now zoom and pan as they do elsewhere. Commit, Commit, Commit, Commit
🗂️ Recognisable file icons. The terminal file browser now marks each file with an icon for its type, so code, images, archives, documents, and configuration files can be told apart at a glance instead of sharing one generic page icon. Commit, Commit, Commit
📽️ Truer PowerPoint previews. Slide previews now render tables, charts, connectors, gradients, theme colours, bullets, fonts, and text alignment far closer to the original, and the viewer lets you move between slides with the arrow keys or the scroll wheel while the thumbnail strip follows along. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
📄 Faithful Word document previews. Word documents now open as proper pages with headers, footers, footnotes, and embedded images intact, and can be zoomed, rather than being flattened into plain formatted text. Commit, Commit
🗝 Deleting your API key. An API key can now be revoked outright from your account settings, where the only way to retire one was to replace it with a new one. #28874, Commit
🎛️ Settings for the task model. Administrators can now set the generation parameters used for background work such as titles, tags, follow-ups, search queries, and conversation summaries, either from the admin panel or through "TASK_MODEL_PARAMS", instead of those requests always using a fixed token limit that could cut a summary short. #27604, Commit, Commit
🎚️ Default interface settings for everyone. Administrators can now set system-wide defaults for the interface options in Settings, either from the admin panel or through "DEFAULT_INTERFACE_SETTINGS", with each person's own choices still taking precedence and anything left untouched shown as inherited and kept in step with later changes to the defaults. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🔠 Interface scaling throughout. The UI Scale setting and your browser's own text size now resize the whole interface consistently, including the sidebar, menus, dialogs, and file browser, rather than leaving parts of it fixed. Commit, Commit, Commit, Commit
🏷️ Named writing blocks. When a model wraps a draft such as an email in a writing block, the block is now titled with its subject and shows the recipient beside it, rather than every block reading simply as Writing. #28280, #28198
🤝 Files for delegated tasks. A task handed to a sub-agent can now carry the attachments it needs, so an image or document from your conversation reaches the sub-agent instead of arriving as a file reference it cannot open and may answer about anyway. Commit, #28213
📟 Terminal availability and scope. Administrators can now decide for each managed terminal whether it appears in chats and in automations at all, and whether everyone shares a single workspace or each chat or automation gets its own, with per chat terminals waiting until the conversation has been saved. Commit
🔒 Read-only files in the terminal browser. Files and folders you are not allowed to change are now labelled read-only, with uploading, editing, renaming, moving, and deleting turned off for them rather than failing at the moment you try. Commit
🔐 Terminals that use your own login. Managed terminals configured for session authentication now authenticate the terminal connection with your own token, where it previously sent no credentials at all. Commit
🎟 Setting up a tool server that uses OAuth. Adding one is now easier to get right: the connection dialog can authorize the account from the dialog itself, the check button tests the sign-in details rather than reporting a connection failure that was never going to succeed without them, and it is now labelled for what it does rather than suggesting it verifies the whole connection. Commit, #28552
🪤 Control over what embedded pages may do. Two new interface settings decide whether pages shown inside a chat, such as an artifact or an HTML preview, may run scripts and start downloads. Commit, #28924, Commit
🗄 Keeping files removed from a knowledge base. A new "ENABLE_KNOWLEDGE_FILE_RETENTION" setting keeps the stored file and its search data when a file is taken out of a knowledge base, rather than deleting them. Commit
🧾 CSV shape in retrieval. Turning on "ENABLE_RAG_CSV_SUMMARY" adds a short line naming the row count, data row count, column count, and column names of a CSV file to what the model sees, giving it the shape of the table alongside its contents. Commit
🔭 OpenSERP in the search settings. OpenSERP can now be picked as the web search engine in the admin panel, with a field for its address, rather than only being configurable through the environment. #27594, #27592
🪧 Profile changes from single sign-on. A name, email address, or picture updated from an identity provider at sign-in now raises an event naming what changed, and the rest of the session uses the updated record rather than a stale copy. Commit
📯 Group changes from single sign-on. Group memberships added or removed when someone signs in through an identity provider, and groups created automatically along the way, now raise the same events as the equivalent change made by an administrator or over directory sync. #27657
🔔 Sign-in and sign-out events for single sign-on. Signing in through an identity provider now raises the same login event that signing in with a password does, and signing out says which provider the session came from, so a function can set up or tidy up an account in another system when someone arrives or leaves. #27619, #27613
🪛 Naming background worker threads. A new "THREAD_POOL_THREAD_NAME_PREFIX" setting labels the threads that background work runs in, so they can be told apart when reading a profile or a thread dump. Commit
📙 OpenDocument files in a temporary chat. A text document, spreadsheet, or presentation from an office suite that uses the OpenDocument format now has its text read out in the browser when attached to a temporary chat, where the model was handed the raw archive and answered that it could not read the file. Commit, #28906
🌍 Pointing Tavily somewhere else. A new "TAVILY_API_BASE_URL" setting sends Tavily searches and page fetches to a different address, for instances that reach the internet only through a gateway of their own or that use a compatible service. Commit, #28701
🪟 Honest OAuth settings. When single sign-on settings come from the environment rather than being saved in the application, the admin panel now shows them as read-only with a note naming the setting that controls this, instead of accepting edits that were silently discarded on the next restart. #28276
📏 Widening the chat controls pane. The controls pane can now be dragged as wide as you like, where it stopped at a fixed limit regardless of screen size. Commit
📱 Smoother sidebar on mobile. The sidebar now follows your finger as you swipe it open or closed, responds to a quick flick, dims the page behind it as it moves, and gives every chat row a menu button you can reach without a hover you cannot perform on a touchscreen. Commit, Commit, Commit, Commit, Commit, Commit, Commit
🚪 Sidebar that stays put. Opening and closing the sidebar is now a smooth transition that keeps your chat list loaded, instead of rebuilding the list each time. Commit, Commit, Commit, Commit, Commit
👁️ Turning off chat previews. A new setting under Settings and Interface lets you switch off the preview card that appears when you hover a chat in the sidebar, useful for a quieter sidebar, for sharing your screen, or on a slow connection. #27632, #27639
☑️ Checkboxes beside their labels. In the model editor and the admin model defaults, each capability, feature, and tool checkbox now sits directly in front of its own label instead of at the far edge of its column, where it could look like it belonged to the next one, and the label itself can be clicked to toggle it. #27788, #27771, Commit, Commit
✍️ Typing cursor while responding. A blinking cursor now marks where the reply is being written, from the moment you send your message until generation finishes, in place of the previous loading placeholder. Commit
✒️ Underlined text. Underlined text now appears underlined in a reply instead of showing the markup around it, and underlining is kept when you edit in a rich text box rather than being dropped. Commit, #26904
📥 Adding group members from a file. Administrators can now add many people to a group at once by uploading a CSV of names and email addresses, with a template to download and a message naming any row whose address does not match an account. Commit
📑 Apache Tika 4 support. Administrators extracting document text with Tika can now choose which server version they run, from Admin Settings under Documents or through "TIKA_SERVER_VERSION", where only Tika 3 was understood before. Commit, #28939
💓 Tunable heartbeat for live updates. A new "WEBSOCKET_HEARTBEAT_INTERVAL" setting controls how often each open tab checks in with the server, where it was fixed at 30 seconds, so a large deployment can cut background traffic that no one asked for. Commit, #28166
⌛ Expiring abandoned reply state. A new "REDIS_RESPONSE_STREAM_TTL" setting expires the saved state of a reply that never finished, so a server killed mid-answer no longer leaves that data behind for good. Commit
🖨️ File and image detail parts on API requests. A request sent to the OpenAI-compatible endpoint carrying an image detail level or a file part in its message content now forwards both to providers that use the Responses API, where they were dropped, while documents attached inside Open WebUI are unaffected because those still go through knowledge retrieval. Commit
🧺 Leaner stored document metadata. Bulky extraction details such as page layouts, tables and detected languages are no longer kept alongside a document in the vector store, and a new "RAG_METADATA_MAX_VALUE_CHARS" setting drops any remaining oversized value, falling back to the configured upload size limit so a document that expands enormously while being read cannot exhaust a server's memory. Commit, Commit, #29025
💨 No filter work on installs without filters. A completed message on an install with no filter functions and no pipeline filters, which is the default, no longer rebuilds the whole conversation and ships it to the browser as an event nothing acts on. Commit
📂 Opening a file in a knowledge base. A file listed in a knowledge base can now be opened and read straight from that list, where the name was shown but nothing happened when it was clicked. Commit, #28086
🧵 Cheaper saving of a reply as it streams. The resume snapshot taken on every piece of a streamed reply no longer rebuilds the whole answer each time, so the cost of a save stops growing with the length of the reply. #28821
📀 Less repeated work setting up built-in tools. Every chat request no longer rebuilds a fresh copy of each built-in tool's definition from scratch, which was paid once per tool on every message. #28860
🕹️ Control over what a terminal port preview may reach. A new interface setting decides whether a previewed port runs with access to same-origin browser APIs, so you can lock a preview out of them on installs where previews serve content you do not fully trust. Commit
♿ Improved UI accessibility. A closed sidebar is no longer reachable by keyboard or announced by screen readers, the tool call blocks in a response can now be expanded with the keyboard, the buttons that normally appear on hover, such as message actions, file removal, and chat menus, now appear when you reach them with the keyboard as well, whatever you have tabbed to is marked with a clear outline throughout the application, and the rows in the integrations menu now tell a screen reader whether each tool or feature is switched on. Commit, Commit, Commit, Commit, Commit, Commit, #27667, #17150
🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
🌐 Translation updates. Faroese was added, and translations for Slovenian, Hungarian, Finnish, Korean, Portuguese (Brazil), Catalan, and French were enhanced and expanded.
Fixed
🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories
🛂 Knowledge search reaching past what you may read. Searching knowledge bases now applies the list of collections you are allowed to open, where that restriction was handed to the vector store and silently discarded, so results could include material from knowledge bases you have no access to. Commit
💣 Documents that unpack far beyond their size. A Word, Excel, PowerPoint, OpenDocument or EPUB file that expands to far more than it stores is now rejected before it is read, where one could previously be used to exhaust a server's memory. Commit
✂️ Long replies cut off partway. A single oversized piece of a streamed reply, such as a long reasoning trace or a turn carrying many tool calls, no longer ends the answer early with a misleading error about byte counts, which affected every default installation. #28114, #25664
🚧 Web address checks that could be skipped. The fetchable-address test and the operator's web fetch filter list now run on every outgoing request, where a proxied or already-open connection could bypass them and a filter entry written as an address range silently matched nothing at all. #27823
🧑‍💻 Code execution reachable through a tag in a reply. On installs using native function calling, the older path that runs code found inside a tag in the model's reply is no longer active alongside the built-in tool, so code execution happens only through an explicit tool call. #29024
⌚ Recurrence rules that could tie up the server. How often an automation repeats is now taken from the rule the scheduler actually parsed rather than from the text of the rule, so a crafted rule can no longer disagree with what gets scheduled and walk the server through an unbounded run of occurrences, and a rule carrying a time zone on its start date now schedules instead of erroring. Commit
🗝️ Changing a password now ends other sessions. Changing your password, or an administrator resetting it for you, now stops every device that was already signed in, where they had stayed signed in on the old password until their session expired on its own, up to four weeks by default; the device making the change is signed out too and asked to sign in again, and this requires Redis, without which nothing can be revoked and a warning is now logged saying so. #28725, #28647
🧬 Workspace models shadowing a real one. Someone without administrator rights can no longer create, import, or edit a workspace model so that it takes over the identity of a model served by a connected provider, where doing so would have changed what everyone else got when they picked that model. Commit
🌳 Folders disappearing when moved into themselves. Moving a folder inside one of its own subfolders is now refused, where it was accepted and made that folder and everything in it vanish from the sidebar with no way to bring it back, while leaving the server walking the loop endlessly and querying the database as it went, which could exhaust a worker and its memory; any folder already in that state is returned to the top level. #28748
🧨 Searching a knowledge base with a costly pattern. A search pattern written so that it expands enormously before it even runs is now refused, where it could tie up the server; ordinary patterns are unaffected. Commit, #28284
💧 Attaching a very large file from a link. A file fetched from a link is now written to disk as it arrives and stops at the configured size limit, where the whole thing was held in memory first with no limit applied, so a large enough file could exhaust the server; a download that fails partway no longer leaves the partial file behind. #28945
⛓ Deleting one knowledge base removing a shared connection. Deleting an external knowledge base now leaves its connection in place while other knowledge bases still use it, and only an administrator removing the last one clears it, where any user deleting theirs took the connection away from everyone. #28113
📡 Intermittent connection failures. Requests to model providers and to services on the same network no longer fail intermittently with name lookup errors, often surfacing as a misleading model not found message, because addresses are resolved through the system again by default, with the faster resolver still available through "AIOHTTP_CLIENT_ASYNC_DNS_RESOLVER". #28242, #28013, #28215
🗯️ Losing the conversation with memory on. With the memory tool enabled, the model can see the earlier messages in your conversation again, instead of answering the second message as though the first had never been sent. #28400
👻 Vanishing responses. Replies from Responses-API providers that report an empty output at the end of a stream no longer disappear the moment generation finishes, leaving an empty message in their place. #27800, #27789
📥 Queued messages disappearing. Messages waiting to be sent are put back in the queue if sending them fails, rather than vanishing without being sent. Commit
🧵 Replies cut short mid-stream. A reply no longer breaks off part way through when a provider sends the pieces of its response in an unexpected order, which had left the answer truncated and skipped the filters that run once a message finishes. #28312
🧷 Replies not carried into the next turn. With providers that skip parts of the streaming sequence, the finished reply is now taken from the completed message, so it stays available as context for your next question and the citations that arrived with it are no longer dropped. #28310
🌊 Replies arriving in oversized pieces. Very large streamed pieces no longer break the response on default settings, where the reader that splits them safely only ran when a chunk size limit was configured. Commit
🩹 Signing in after a long-delayed upgrade. Accounts on instances that were upgraded from a version older than 0.6.41 to 0.9.6 or newer can sign in again, where an upgrade step had written their single sign-on identity in a form the application could not read afterwards, and a repair step corrects the affected accounts on startup. #28107, #28101, Commit
🔑 Signing in with some identity providers. Logging in through a provider that adds its own vendor-specific information to the header of the sign-in token now completes, rather than failing at the final step with a message claiming the email or password was wrong. #28065, #28062
🔌 Role changes taking effect at once. Changing someone's role now ends their live sessions no matter how the change was made, whether by a directory sync, an identity provider, a trusted header, or deleting the account, so permissions from their old role cannot linger, and their browser reconnects on its own. Commit
🛑 Memory permission being respected. Taking away someone's memory permission now also stops their stored memories being added to the context of their conversations, which one path had continued doing regardless. #27668
🔍 Listing a single connection's models. Asking for the models or version of one particular connection is now restricted to administrators, and a request naming a specific backend is checked against the models that backend actually serves even where the access control bypass is turned on. Commit
⚖️ Sharing defaults matching what was configured. On instances upgraded from older versions, public sharing of tools and notes no longer shows as switched on in the admin panel, and saving any unrelated permission no longer grants everyone a capability that was never enabled. #27716, #27715
🗂️ Folder permissions when starting a chat. Starting a conversation filed into a folder now checks that you are allowed to write to that folder, a check the message sending path had been skipping, and every place a chat can be filed now treats ownership, shared access, and unknown folders the same way. #28366
🪧 Clearer attachment failures. A link that cannot be read now says so and names the link, and a YouTube video whose transcript is refused explains why and points at the proxy setting that exists for it, instead of both being reported as a knowledge base error. #28362, #28361
🔎 Chat search finding recent messages. Searching your chats now looks inside the messages of current conversations on default installations, where it had only been reading an older storage format and missing their content entirely. Commit
🧭 Your place in a compacted chat. Opening a conversation whose history has been compacted now takes you to its most recent message instead of leaving you parked on the summary, and updates to an existing message no longer move your place in the conversation. Commit
🖥️ Chats with a personal terminal. Sending a message with a terminal you added yourself under Settings selected no longer fails with a terminal unavailable error, which had blocked those chats since 0.11.0. #27621, Commit, Commit
📆 Default date for new events. Creating a calendar event now starts on today's date rather than tomorrow's when you open the form in the evening, or yesterday's when you open it early in the morning. #27779, #27778
🗓️ Recurring event times. Repeating calendar events now show at the time you set them for instead of being worked out in the server's time zone and shifted by the gap between the two. #27774, Commit
🧩 Chats during model list refreshes. On direct connections, background work such as title and tag generation no longer fails or runs against a mix of old and new model entries while the model list is being refreshed. #27821
🎛️ Chat Controls staying put. Hovering a chat in the sidebar whose preview contains an artifact no longer forces the Chat Controls pane open and fills it with that artifact, over the chat you currently have open. #27773, #27772
📨 Reliable streaming with unusual characters. Responses containing any of three rare invisible line break characters no longer arrive split or broken when the "ENABLE_ORJSON" option is turned on. #27819
🧮 JSON options honoured again. Options passed to the shared JSON helper are no longer silently ignored when the "ENABLE_ORJSON" option is turned on, falling back to the standard encoder that supports them. Commit
🚫 Duplicate models in lists. Adding a model that is already on a connection's allowed list is now rejected instead of quietly adding it a second time, the arena picker no longer offers models you have already chosen, and existing duplicates are cleaned up the next time the list is saved. #28251, #28249
📁 Dragging chats into shared folders. A shared folder you can write to now highlights and accepts a dropped chat, while one you only have read access to no longer offers itself as a drop target for an action that could only fail. Commit, #28261
⏰ Listing automations through chat. Asking a model to list your automations without naming a folder now returns every automation you have, instead of only the ones that sit outside a folder. Commit
🧠 Faster follow-ups with memory enabled. The memories handed to the model now appear in a stable order from one message to the next, so servers that reuse their work between turns no longer reprocess the whole conversation each time you reply. #28292, Commit, Commit
🎯 Custom model parameters combining. Setting a custom parameter on a model no longer silently discards every custom parameter defined in the global defaults, and a value sent directly in an API request is no longer overwritten by the model's saved settings. Commit, #28241
👥 Sharing with people already added. The access picker no longer offers people and groups that already have access, and the Users heading no longer appears above an empty list. Commit, #28253
🔧 Full tool parameter descriptions. A tool whose parameter description runs over several lines now passes the whole description to the model instead of only its first line. Commit
📝 Notes saved in an unexpected shape. A note whose content was stored as structured data rather than text no longer breaks the notes page for everything else, and opens with that content shown as a formatted code block. Commit, #28222
💬 Direct messages after an account is deleted. A direct message conversation no longer counts a deleted account among its members, and opening a direct message with someone finds the existing conversation instead of starting a second one alongside it. Commit, #28257
🫥 Deactivating a model. Turning a model off no longer removes the wrong entry from the model list, or fails the list outright and leaves the model picker empty for everyone until the model is turned back on. Commit, #28202
💭 Readable errors on chat actions. When moving, renaming, or otherwise changing a chat fails, the message explaining why now appears in place of an unhelpful object placeholder. #28260, #28259
🪪 Authorship in shared chats. A chat shared with you now shows the name and picture of whoever wrote it, in the message list and in the overview panel, rather than crediting the messages to you. #28274, #28273
🖇️ Adding terminals over plain connections. Saving a terminal connection now works when the interface is served without HTTPS, where the dialog would sit there doing nothing because the browser withholds the tool used to generate its identifier. Commit, #28148
🗃️ openGauss vector storage. Deployments using openGauss for vector storage no longer fail the moment they touch it. #27838
🎚️ ColBERT reranker startup. Loading a ColBERT reranker now names the model in the log rather than printing a logging error and a traceback in its place. #27838
🖼️ Images that no longer exist. A message whose image file has been deleted now shows a small unavailable placeholder that cannot be opened, rather than a broken image that spilled the whole reply text into the picture frame and still opened full screen. #27730, #27728, Commit
🛂 Connecting external accounts. Authorizing a tool's external account now completes only for the person who started it, rather than for whoever happens to return with the authorization, and signing out clears the session it relies on. Commit
🪟 Starting up on Windows. The Windows start script now creates the secret key it needs on a fresh installation, instead of printing a run of file not found messages and then refusing to start, and it copes with an installation path that contains spaces. #28061, #28060
🕸️ Overlapping branches in the overview. Branch nodes in a chat's overview keep a clear gap between them when the interface is scaled up, rather than sitting on top of one another. #27995, #27994
🗑️ Delete offered only when allowed. The chat deletion controls in the sidebar, the chat menu, search, archived chats, and data controls no longer appear for people whose permissions do not allow deleting, where using them produced an access denied error. #27714, #27713
🍴 Fork offered only when allowed. The fork action and the fork command no longer appear for people whose chat import permission is turned off, where using them produced an access denied error. #27711, #27692
↕️ Expand button in the message box. The button that enlarges the message box no longer sits on top of a tagged model's dismiss button or the first attached file, and stays reachable in long prompts. #27676, #26736
🔆 Regenerate in high contrast mode. With high contrast mode on, the regenerate button now stays visible on earlier replies instead of appearing only when you hover over them. #27644, #27638
✂️ Clipped icons and avatars. The terminal icon beside the message box and the profile picture in account settings are no longer shaved flat along their left edge. #27691, #27690
🪄 Merged responses after a reload. Merging the answers from several models now works on a conversation you have reopened, instead of the merging model reporting that the other responses were empty. #27673, #26962
🔢 Token counts for background chats. Conversations started by automations, timers, sub-agents, and channels now report their token usage like any other chat, rather than arriving without it even when the model is set up to provide it. #27661, #27653
📐 Settings on tall screens. The settings window now grows with the height of your display instead of stopping short and making you scroll inside it while space sits unused above and below. #27615, #27614
🖱️ Sections opening by accident. Folders, collapsible sections, and tool call blocks now open and close only when you click them, rather than also reacting when you release the mouse over them after dragging or selecting text. Commit
🔁 Rebuilding knowledge base vectors. Rebuilding the vectors for a knowledge base now also rebuilds them for each file it contains, so attaching a single file afterwards finds its content instead of quietly returning nothing and letting the model answer from thin air. #28106, Commit, Commit
📌 Attaching a chat shared with you. Attaching a conversation that was shared with you, directly or through a shared folder, now brings its content along instead of quietly attaching nothing. Commit
🧲 The page staying still when typing. Returning focus to the message box no longer scrolls the conversation, so switching chats, running a command, or picking something from a menu leaves your place on screen alone. Commit
📷 Round profile pictures on narrow screens. Profile pictures in the admin user list and other lists no longer squash into ovals of differing widths when the window is narrow. #28000, #27999
🎙️ Voice mode in the notes editor. The voice mode button is no longer offered in the chat embedded in a note, where it does not apply. Commit, Commit
⏳ Analytics stuck loading. Choosing a custom date range in analytics without picking dates yet no longer leaves the tab spinning forever, including after leaving and coming back to it. #28125, Commit
🧑‍🤝‍🧑 Owner avatars on shared chats. The picture beside a chat someone shared with you now loads, and falls back to the default image if it cannot, rather than leaving a blank gap when the interface and the server are on different addresses. #28272, #28271
🎨 Image generation and web search staying switched off. Turning either off now takes effect at once on every path: sessions opened beforehand can no longer produce images or run searches, an image request no longer reaches the provider on a model using the older tool-calling method, the entry disappears from the integrations menu right away, and an active marker beside the message box no longer lingers after its feature is withdrawn. #27759, #27758, #26842, #27669
📰 Attached pages reaching the model. The text pulled from an attached web page or YouTube video now actually reaches the model, rather than arriving empty so the reply had nothing to work from, and opening the source to check no longer fails. #28378, Commit
🌐 Tavily page fetching. Reading a web page with Tavily selected as the loader works again, having failed on every attempt since 0.10.0. #27636, #27602
🗒️ Reply box in threads. The reply box in a channel thread now stays at the bottom of the panel while you scroll back through the replies, instead of scrolling out of sight with them. #27768, #27767
🎹 Model picker shortcut. The keyboard shortcut for opening the model picker works again, and a link to a chat naming a model you do not have still opens the picker with that name filled in. Commit
⌨️ Reaching the download options by keyboard. In the model picker, arrowing past the last result now moves through the options to fetch that model from each server that can supply it, so they can be chosen with the keyboard instead of only by clicking. Commit, Commit
📂 Opening a folder in the sidebar. Selecting a folder now refreshes just that folder's chats rather than rebuilding the whole folder tree, and a folder that is empty or still loading says so instead of showing nothing. Commit, Commit
⏲️ Changing an automation through chat. Asking a model to change one thing about an automation no longer moves it out of its folder or drops its model when the model fills those fields in blank instead of omitting them. Commit
🔂 Automations that run a set number of times. An automation asked to run a limited number of times is now rejected unless it says when to start counting from, rather than being accepted and then running indefinitely. #27781, #27780
📅 Editing a calendar event through chat. Asking a model to change one thing about an event, such as its title, no longer fails or wipes the details you did not mention. #27777, #27776
🧹 Session cleanup on multi-instance setups. The instance doing the periodic session cleanup now keeps its claim on that job alive between passes, so an idle deployment stops logging a renewal warning every two minutes and the claim no longer lapses for half of every cycle. Commit, #27762
🏠 Starting folder in the file browser. Reopening the file browser now keeps the folder you were in, instead of the breadcrumb losing its starting point and jumping you elsewhere. Commit
🩺 Repairing default model settings. Instances whose stored default and pinned model settings had been written in the wrong shape are corrected on startup, so those defaults take effect again. Commit
🧽 Cleaner conversation history for the model. Internal bookkeeping attached to your messages, such as attachment records and token counts, is no longer sent to the model along with the conversation. Commit
🙈 Needless request from the model picker. Opening the model picker as a non-administrator no longer fires a request to an administrator-only settings endpoint that was always refused. Commit
⏹️ Stopping a reply that is waiting. The stop button now ends a reply that is sitting waiting for you, such as one paused on a tool approval, rather than leaving the conversation stuck part way through. Commit
🏷️ Folder names with unusual characters. Naming a folder is no longer refused because another folder's name happens to be similar, and a name ending in a backslash no longer fails outright on PostgreSQL, because names are now compared exactly rather than treated as a search pattern. #28695, #28694
🤔 Reasoning carried back to Ollama. A model's earlier thinking is now passed back to Ollama in its own native field rather than pasted into the message as tagged text, so reasoning models keep their train of thought across turns. Commit
📎 Default pinned models taking effect. Changing the default pinned models now reaches people who have never chosen their own, where simply having opened the interface once was enough to freeze the list they first saw, and reordering a pin no longer moves the wrong one or reopens the sidebar section afterwards. #28069, #28067
✏️ Editing other people's channel messages. Asking a model to work on a message in a channel now only applies to your own messages, where write access to the channel had been enough to reach anyone's. #28631
🍪 Signed-in tool servers. A tool server that relies on your session now receives the credentials belonging to its own connection, rather than whichever were most recently prepared. #28630
🏗️ Editing a folder from its page. Renaming a folder, changing its icon, creating a subfolder, or deleting it from the folder's own page now updates the sidebar straight away, instead of leaving the old name and icon there, and the new subfolder missing, until a reload. Commit, Commit, #28692, #28690
📣 Long channel names in the sidebar. A channel with a long name no longer squeezes its own menu button out of the row. Commit, #28671, #28670
📬 Mark as unread in chat search. Marking a chat unread from the search dialog now works and updates the sidebar, where the menu entry looked normal but did nothing at all. #28136, #28135
⬆️ Scroll to top on the first click. In a long chat where older messages had not been loaded yet, one click of scroll to top now reaches the first message instead of stopping short and needing a second. #28659, #28658
🔘 Double bullets in the release notes. Each entry in the what's new dialog shows a single bullet again, rather than two sitting at different heights. #28676, #28675
📚 Knowledge search and shared files in chat. A model searching your knowledge bases or reading a file shared with you through a group now works, where it had failed since 0.11.0 and quietly answered as though the knowledge were empty, affecting instances that forward user details to their embedding service and, for shared files, every instance regardless of settings. #27642, #27641
🔖 Skill identifiers that cannot be reac

Original source

Added

🎨 Redesigned interface. Open WebUI has been visually rebuilt from the ground up. All aspects of the User Interface, from the chat view to the admin panel. Now with a narrower conversation column, lighter typography, tidier spacing, consistent menus and dropdowns, clearly outlined text boxes, and settings rearranged. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, #27178, Commit, Commit

🤖 Sub-agents. Administrators can now enable sub-agents, which let a model hand parts of a task to background helper agents that run their own tool-driven conversations and report results back into the chat, tuned through new "ENABLE_SUBAGENTS", concurrency, iteration, and system-prompt settings. Commit, Commit, Commit, Commit

📂 Folder pages. Opening a folder now takes you to its own page, where its chats load a page at a time, can be sorted by title or last updated, and you can start a new chat straight from the folder. Commit

⏲️ Chat timers. The assistant can now set a timer that brings a prompt back into the conversation later, after a delay or at a set time, and can drop it automatically if you read the chat or reply before it fires. Commit

🔔 Notification targets. Notifications now have their own settings tab where you can send them to several webhook destinations, each picking which events it wants, from chats finishing or failing to channel messages and calendar alerts, with a test button and a choice between always notifying or only when you are away, and any webhook you already had is carried over for you. Commit, Commit, Commit, #24750

🗯️ Full replies in channels. A reply from the assistant in a channel is now saved and shown in full, with its reasoning, tool calls and other structured parts, where it previously came through blank. Commit, #26720, #27409, #26707, #26656

📣 Notifications from the assistant. The assistant can now send you a notification itself when something is worth your attention, so a long task can reach you after you have moved on to something else. Commit, Commit

🌎 Share a chat with anyone holding the link. A shared chat can now be set to Open so it opens without signing in, with visitors no longer bounced to the sign-in page on their way to it, which administrators must first allow through a new "Chats Open Sharing" permission that stays off by default, and such pages ask search engines not to index them. Commit, Commit

🔖 Chat variables. A model's system prompt can now declare fields such as text boxes and dropdown lists that you fill in for a conversation, with the values saved alongside the chat and carried over when it is forked or cloned. Commit, Commit, Commit, Commit, Commit, Commit, #26915

🗄️ LDAP group synchronization. Administrators can now map LDAP groups to Open WebUI groups from the authentication settings, with optional automatic creation of missing groups, so a user's group memberships are kept in step with the directory each time they sign in. #27263, #18015

👥 Restrict sharing with groups. Admins can now stop resources from being shared with entire groups through a new "USER_PERMISSIONS_ACCESS_GRANTS_ALLOW_GROUPS" permission, which stays enabled by default so existing group sharing keeps working untouched. Commit, Commit, Commit, Commit, #27124

🤝 Shared folder collaboration. People with access to a shared folder can now use its files and system prompt as knowledge in chat and, with write access, rename and manage the folder, all according to their read or write permission. Commit, Commit, Commit, Commit

👁️ Chat previews in the sidebar. Hovering a chat in the sidebar now shows a compact preview of its recent messages, so you can find the conversation you want without opening it. Commit, Commit, Commit, Commit

🕗 Local message timestamps. Message timestamps now appear on hover in your device's local date and time format, with the full weekday and date shown in a tooltip. Commit, Commit

📇 User variables. You can now store your own values in account settings, such as your role or how you like answers written, and a model's system prompt can insert them wherever they are needed. Commit, Commit, Commit

🧺 Automations that file their chats away. An automation can now be pointed at one of your folders, from the dialog, the editor or by asking the assistant, so each run lands there instead of loose in your chat list, and the folder is cleared automatically if it is later deleted. Commit, Commit, Commit

🔵 See what you have not read yet. Folders in the sidebar now carry a count of chats with something new in them, a folder's own page marks unread chats with a dot, shows a spinner on any still generating, clears the dot as you open one, and keeps itself up to date as replies finish elsewhere, unread chats sort to the top of a folder, and you can mark a single chat unread again mark everything in a folder read, or mark every chat read at once from the sidebar. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit

🗜️ Compact a chat on demand. Typing a compact command in a long conversation now summarizes the earlier turns straight away, instead of waiting for it to happen automatically once the conversation grows past the threshold. Commit, Commit

🌿 Fork a chat. Every response now has a fork button that copies the conversation up to that point into a new chat which remembers where it branched, so you can carry on down a different path without touching the original. Commit, Commit, Commit, Commit

📌 Pin the conversation map. The chat overview now has a pin control that stops it recentring on the newest message, so you can keep looking at the branch you were reading while a reply comes in. #25736

📊 Chat status at a glance. The slash menu now shows how full the context window is, and a new status command opens a panel with context usage, queued messages, running tasks, and the chat ID. Commit, Commit

🎹 Customizable keyboard shortcuts. Most keyboard shortcuts can now be rebound to key combinations of your choosing in settings, which saves them to your account, warns you when two actions share a combination, and offers a reset to the defaults, with moving to the previous or next chat and opening the controls panel available to bind as well. Commit, Commit, #26624

⌨️ Turn keyboard shortcuts off. A new switch in the keyboard settings disables every configurable shortcut and hides its hint, so combinations that clash with your browser or operating system pass straight through. #27300, #1008

⌨️ Skills in slash commands. Typing a slash in the message input now lists your skills alongside your prompts, grouped under headings and with descriptions on hover, so you can attach a skill without leaving the keyboard. Commit

📎 Attach anything with the at menu. Typing an at sign in the message input now searches your folders, knowledge collections, and individual files as well as your models, and pasting a link offers it as a web page or YouTube attachment. Commit

📝 Chat with a note. Chatting with a note now gives you the full chat experience, including model choice, tools and file attachments, alongside suggested prompts, a button to insert a response straight into the note, edits that appear in the note as the assistant makes them, and as many separate conversations per note as you want to keep. Commit, Commit

↕️ Sort your lists. The notes, prompts, models, knowledge, skills, tools and functions lists can now be sorted by title or by when they were last updated, in either direction, by clicking the column headings. Commit, Commit, #27457, #27456

🗒️ Notes without stored contents. A note whose contents were never filled in now opens and saves normally instead of failing. Commit

📄 Note attachments. Notes now have an upload option in their menu and show attached files above the note itself, where you can open or remove them, instead of only accepting files dropped onto the page. Commit, Commit

🗂️ The assistant can search your attachments. A new Files capability lets the model list the files attached to the chat and search them by meaning or by exact text, and read the parts it needs, rather than having their whole contents pushed into the conversation up front, and knowledge collections or notes attached to a chat are now announced to the model so it can query those the same way. Commit, Commit, #26711, #27232, #26708

🔎 Search in the attachment menu. The attachment menu now lets you search your knowledge bases, notes, files, and chats instead of scrolling to find them, with matching text shown for chats. Commit

⚗️ Default file upload mode. You can now choose in settings how attached files are handled by default, rather than picking that on each upload. #20900, #18431

⬇️ Response auto-scroll toggle. A new interface setting lets you stop the view following a reply as it is written, so you can read earlier text while generation continues. Commit, #26826

📜 Client certificates for SearXNG. Web search can now present a client certificate to a SearXNG instance that requires one, through new "SEARXNG_CLIENT_CERT_FILE" and "SEARXNG_CLIENT_KEY_FILE" settings. Commit, #26992

🔭 OpenSERP web search. Web search can now run against a self-hosted OpenSERP instance, which returns results from several major search engines without any API key, configured through a new "OPENSERP_BASE_URL" setting. #27437, #27438

🥇 Model order as a setting. Administrators can now set the order models appear in through a new "MODEL_ORDER_LIST" variable, so the arrangement survives a restart on instances that do not persist configuration. #27420, #27206

⏱️ Idle cap for streamed replies. Administrators can now set an "AIOHTTP_CLIENT_STREAM_IDLE_TIMEOUT" that ends a streamed reply when the provider stops sending anything for that long, instead of holding the connection open until the overall timeout expires. Commit, Commit

🖼️ Media types an extraction engine may handle. Administrators can now list which image and video types the configured content extraction engine is allowed to process, instead of media being passed to it only when the engine is the external one, so an engine with its own text recognition can take images. Commit, #26940, #14768

🧵 Where a channel reply lands. Administrators can now choose whether a reply to a mention posts in a thread under that message or straight into the channel. Commit, #27410

📚 Limits for knowledge tools. Administrators can now set how much a knowledge search or file view may return, how many files one search may scan, and how many matches are reported, and a knowledge command's whole output is now capped so a single call cannot flood the conversation. Commit, #27524, #27327, #26139

🎛️ File streaming chunk size. Administrators can now tune how large each chunk of a streamed file transfer is through a new "AIOHTTP_FILE_STREAM_CHUNK_SIZE" setting. Commit

🪛 Model for summarizing long chats. Administrators can now pick a dedicated model to write context compaction summaries, separate from the task model, with the conversation's own model used when none is chosen. #26806, #27051

📏 Context compaction token cap. Administrators can now set a "Token Cap" that limits how high per-model context compaction thresholds are allowed to reach, giving finer control over long-conversation summarization. Commit, Commit, Commit

⚖️ Retained messages after compaction. Administrators can now set what share of recent messages survives when a long conversation is summarized, between a tenth and half of it. Commit, #27050

🧠 Memory as a per-model capability. Whether a model receives your stored memories is now a switch on the model itself, so it can be left on for everyday assistants and off for ones that should start from nothing. Commit, #26861, #18610

☑️ Searchable model pickers. When editing a model, the Tools, Skills, Knowledge, Voice, Filters and Actions pickers now let you search and toggle items in place, select or clear them all at once, and see what is active at a glance. Commit, Commit, Commit, Commit, Commit, Commit, #26758

🎚️ Switch for single sign-on. OAuth and OIDC now have their own on and off switch in the authentication settings, matching the LDAP one above it, so sign-in through a provider can be turned off without clearing the configuration. #26988

🖲️ One sign-in attempt at a time. The sign-in, sign-up and LDAP form now disables its buttons while a request is in flight, so a slow response no longer turns repeated clicks or Enter presses into several concurrent attempts. #27416, #27264

🛂 Trusted clients for token exchange. Administrators can now list which OAuth clients may have their tokens exchanged for a session, through a new "OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS" setting, so a token a person obtained by signing in to an unrelated application of the same provider can no longer be turned into a session as that person. #27546, Commit, Commit

🚪 Throttle for token exchange. Administrators can now cap how often the OAuth token exchange endpoint may be called from one address through new "OAUTH_TOKEN_EXCHANGE_RATE_LIMIT" and "OAUTH_TOKEN_EXCHANGE_RATE_LIMIT_WINDOW" settings, which bound automated attempts with leaked or guessed tokens and stay off until set. Commit

🔏 PKCE for every sign-in provider. The code challenge setting now applies to Google, Microsoft and GitHub sign-in as well as OpenID Connect, so the same protection covers every provider. Commit, #27302

🔤 Embeddings through the OpenAI-compatible API. Integrations built on OpenAI client libraries can now create embeddings through the Ollama proxy, so embedding requests go through the same sign-in and model access rules as chat instead of needing direct access to Ollama. #27332, Commit, #27328, Docs:#1331

🎚️ Passthrough parameters per connection. Administrators can now list request parameters that a connection should receive untranslated, under a new Advanced section in connection settings, so provider-specific options reach the upstream API intact. Commit

🅰️ Anthropic requests passed straight through. Requests to the Anthropic-compatible API aimed at an Anthropic or LiteLLM connection now reach the provider untouched rather than being translated on the way, and LiteLLM is selectable as a connection type. Commit

💭 Reasoning in Anthropic responses. Responses from the Anthropic-compatible API now carry the model's reasoning as thinking blocks, in both streamed and complete responses. Commit

🧩 Structured output through the Anthropic-compatible API. Requests can now ask for a JSON schema or JSON object response and set a reasoning effort, which are carried through to the upstream model. Commit

🪧 Group names in forwarded headers. Custom headers on a connection can now carry the groups a person belongs to, by name or by id, so an upstream service or gateway can apply its own rules per group. #27236, #26834

🪪 User identity forwarded to Mistral OCR. Document extraction through Mistral OCR now carries the requesting user's identity when user info forwarding is enabled, so a gateway in front of it can attribute requests per user like other outbound integrations already do. #27253, #27250

🔢 Anthropic token-counting endpoint. The Anthropic-compatible API now offers a token-counting endpoint, so integrations can check how many input tokens a request will use before sending it. Commit, Commit

🖲️ Terminal instructions read fresh. The instructions a terminal server provides are now fetched for each request, so changing them on the server takes effect immediately instead of after re-saving the connection or restarting. #27242

🖥️ Live terminal server policies. Administrators can now read an orchestrator terminal server's current policy and lifecycle settings directly in connection settings rather than relying on a locally cached copy. Commit, Commit

🌍 Model privacy at a glance. Admins can now make a model public or private straight from its menu in the model list, where each model is marked as public, shared, or private. Commit

📈 Personal usage dashboard. A new Usage tab in settings shows your own activity over time, including a token-activity heatmap, current and longest streaks, lifetime and peak token counts, your longest active chat, and your most used models and tools. Commit

🧠 Memories in settings. Your memories are now listed directly in personalization settings where you can search, add, edit, and remove them, instead of being tucked behind a separate manage dialog. Commit

💾 Import notes and automations. Notes can now be brought in from text and markdown files, and automations can be exported and imported as files, so you can move them between instances. Commit, Commit

🧮 Counts in the tabs. The workspace tabs now show how many models, knowledge bases, prompts, skills, and tools you have, and the admin tabs do the same for users, groups, leaderboard entries, and feedback, so you can see the size of each section without opening it. Commit, Commit, Commit

🧾 Group permissions at a glance. The groups list now shows whether each group uses custom or default permissions, without opening it. Commit, Commit

📤 Streamed file transfers. Uploading a model, pipeline or audio file now sends it in chunks instead of holding the whole thing in memory, and reading and writing files no longer blocks other requests, so large transfers no longer spike memory or stall the server. Commit, #27351, #27349

🧰 Built-in tool descriptions built once. The descriptions handed to the model for the built-in tools are now worked out once at startup rather than rebuilt on every message. Commit, Commit, #27374, #27396

🪺 Records read without a double pass. Loading a model, tool, prompt, skill, note, knowledge base, channel or calendar no longer converts the record twice on the way out. Commit, #27377

🔧 Faster tool and knowledge base listings. Listing tools no longer loads each one's full source, and working out which tools and knowledge bases you can see takes a single check rather than one per item. #27387

🧊 Quicker collection checks on Chroma. Checking whether a collection exists now asks for that one collection instead of listing them all, which grew slower with every knowledge base and file. Commit, #27394

🔠 Tokenizer loaded once. The tokenizer used to split documents is now kept after first use rather than being loaded again for every file. Commit, #27394

📗 Faster knowledge base file lists. Opening a knowledge base now loads just the file names and details instead of the entire extracted text of every document, so large collections appear almost instantly. #27386, #26144

🗝️ Faster file access checks. Working out whether you can open a file no longer scales with how many workspace models and knowledge bases exist, so opening files and listing folder contents stays quick on large instances. #27383

🕰️ Faster automation scheduling. Working out when an automation that repeats every few minutes or hours runs next is now near instant, instead of taking twenty seconds or more and slowing further each year. Commit, #26954

📁 Faster folder loading. Your folder list no longer runs a separate lookup for every folder to check where it sits, so it loads in a single pass. Commit

🎯 One round of requests per folder click. Selecting a folder in the sidebar now fetches the folder, the folder tree, and each expanded folder's chats once instead of two to four times. #27540, #27539

🎧 No wasted work when nobody is listening. Updates for a chat whose tab has been closed, or for requests made through the API, are no longer packaged up only to be discarded, which matters most on long streamed replies. #27366, Commit

📑 Cheaper audit logging. With audit logging on, each request is no longer authenticated a second time just to record the log entry, so audited instances carry noticeably less overhead. #27373

🪧 Cheaper tagging after each reply. Saving the tags generated for a conversation now updates just that field instead of loading, rewriting and re-reading the whole conversation, which cost more the longer the chat. #27382

✍️ Faster saves across the app. Saving a chat, note, prompt, tool or user setting no longer re-reads the record it just wrote, so writes finish sooner, most noticeably on long conversations. #27381, #27379, Commit, Commit

🛢️ Less database overhead per request. SQLite installations no longer run a connection check before every database call, and requests that never touch the database skip the bookkeeping that used to run regardless. #27385

⚡ Faster memory lookups. Stored memories are now indexed so retrieving them stays quick as the number you have grows. Commit, #26957

🪪 Fewer checks before a reply starts. Working out whether you may use a model now looks up the model and your group memberships once instead of repeating both, including for every model a workspace model is built on. #27378

👤 Lighter user activity checks. Checking whether someone is currently active now reads only that timestamp rather than their whole profile, including their profile image. Commit, #27224

📨 Fewer settings lookups when sending a message. Sending a chat message now reads the settings behind tools, file retrieval, voice, skills and the code interpreter in fewer trips to the database, so replies start sooner. #27223

🪄 Lighter conversion for Ollama requests. Preparing a request for an Ollama model no longer copies the entire conversation before sending it, which cost more with every message and repeated on each tool-call round. #27371

🦙 Fewer settings lookups on Ollama requests. Ollama chat, generation and embedding requests now read their connection settings once instead of up to four times, so each request reaches the server sooner. #27226

🧹 Less repeated work on every response. Security headers are now worked out once at startup rather than rebuilt for each response, and ordinary page requests skip the redirect handling they never needed, so responses carry less overhead. #27229

🚀 Lower per-request overhead. Requests no longer each perform a settings lookup before they are handled, trimming a little latency from everything the app does. Commit, #27395, Commit, Commit, #27227

💨 Leaner filter handling while streaming. Filters applied to a streaming reply no longer re-read their settings and each plugin's full source from the database for every chunk, so responses with filters enabled cost the server far less work. #27228, #27372, Commit, Commit, Commit, #27392

🚦 No filter bookkeeping without filters. Streamed API responses only build up the full reply for outlet filters when the model actually has one configured, instead of doing it for every request. Commit, #27391

✂️ Cheaper tag detection while streaming. Watching a reply for reasoning and code blocks now examines only the newly arrived text rather than rescanning the whole answer on every chunk, so a long answer no longer costs progressively more as it grows. #27360

🌊 Steadier long responses. Building up a streamed reply no longer costs more work as it grows, so long answers keep pace instead of slowing down toward the end. #27231, #27359, Commit, #27390

📦 Faster JSON handling as an option. Administrators can now switch the whole application to a faster encoder through a new "ENABLE_ORJSON" setting, covering request bodies, responses, upstream provider payloads and live updates, where the encoding of live updates was the largest single cost on the workers handling them in clustered deployments; it stays off by default because the faster encoder is stricter about what it accepts. #27583

⚙️ Faster Redis handling. The compiled "hiredis" parser now ships as a dependency and is used automatically, so deployments backed by Redis spend noticeably less processor time reading responses. #27282

🔗 Fewer Redis round trips per chat. Deployments backed by Redis now look up the model and connected sessions once per request instead of twice, and fetch the model list in a single call. #27225

🛰️ Fewer Sentinel lookups. Redis Sentinel deployments no longer ask which server is the primary and open a fresh connection before every single command, which had caused heavy connection churn and stalls under load. Commit, #27213, #27210

📡 Lighter live connection handling. Typing indicators, shared document edits and reconnections no longer re-read your account or copy the full participant list each time, and idle sessions are no longer rewritten every few seconds. Commit, #27393

🏎️ Faster chat search on PostgreSQL. Searching chats on PostgreSQL now reads from the message table instead of unpacking each conversation's stored data row by row, so results stay quick as your history grows. Commit, #27221

⚡ Lighter model lists. Model lists no longer carry embedded profile images in their data, so they load faster. Commit, Commit

🏗️ Fewer queries when building the model list. Assembling the model list now makes fewer database round trips and no longer fetches every plugin's source code along the way, so it comes together faster. Commit, #27389

🪶 Model lists without knowledge text. Model lists no longer include the extracted text of files attached to a model as knowledge, so they stay small regardless of how large those knowledge bases are. Commit, #27287

🔛 Functions can react to being switched on or off. Two new events fire just before a function is enabled or disabled, and the function being enabled receives its own event even though it is not active yet, so it can run whatever setup or teardown it needs. Commit, #26754, #26748

🔛 Multiple choice settings in plugins. A tool or function can now offer a setting where you tick several options from a list, fixed or worked out at the time it is shown, instead of asking you to type a comma-separated list of allowed values. #26884, #26848

🔌 Disable plugins entirely. Administrators can now completely turn off the built-in Tools and Functions plugin surfaces through a new "ENABLE_PLUGINS" setting, which hides them across the workspace and admin areas and removes their execution paths. Commit, Commit, Commit, Commit

🧵 Lighter chat listings and search. Building a page of chat search results or a folder listing no longer copies each full conversation to read its title and dates, so those pages come together faster and use far less memory while they are built. #27388

📮 Name lookups off the thread pool. Looking up a hostname no longer occupies one of the limited threads shared by every other piece of blocking work, so model calls, searches, page fetches and tool calls stop queueing behind each other once a few lookups are slow. #27440

🥬 Faster web page parsing. Pages pulled in by web search and web retrieval are now read with a faster parser, cutting roughly a tenth off the time spent on a ten result search. #27439

🧭 No pointless lookups when filtering search results. Filtering web search results against a domain list no longer resolves every result to an address first, which had turned a three second search into half a minute wherever the resolver was slow or a name did not resolve. Commit, #26920

🚄 Leaner passthrough streaming. Responses the server only relays now go straight through in whole network reads instead of being split line by line, roughly halving the work spent shuttling a streamed reply on those routes. #27384

🧶 Web page parsing off the critical path. Reading those pages no longer holds up everything else on the server, so other people's replies, live updates and health checks keep flowing during a search instead of stalling for a second or more. #27446

🈶 Faster uploads of non-English text files. Working out the encoding of an uploaded text file now samples the part that needs it rather than scanning the whole file, taking a four megabyte Japanese or Chinese document from several seconds down to well under one. #27445

♿ Improved UI accessibility. Keyboard and screen reader users can now tell which chat in the sidebar is the one being viewed, open reasoning and detail blocks in a response, expand sidebar sections and open a folder without a mouse, sort the admin user list from the keyboard and hear which column it is sorted by, open a dropdown and its submenus with the keyboard, close them again with Escape and land back where they started, hear which value a dropdown is set to rather than only its label, hear what each admin settings switch, group permission toggle, checkbox, API key field and advanced model parameter slider controls, have the message box announced by its placeholder instead of as an unnamed field, press Enter on Cancel in a confirmation dialog without triggering the delete, reach the regenerate control, jump straight past the sidebar to the conversation with a skip link, hear what an icon-only button does across chat, calls, file previews, modals and the admin pages rather than an unlabelled button, placeholder text, section headings, field descriptions, inactive tab labels, timestamps, counters and icons are now readable against their background when High Contrast Mode is on, and sidebar buttons across notes, automations, the playground, and admin pages announce whether they open or close the sidebar. #27510, #27513, #27503, #27494, #27491, #27490, #27489, #27488, #27555, #27556, #27554, #27558, #27501, #27492, #27509, #27502, #26769, Commit, Commit, #26768, #26770, Commit, Commit, Commit, #27508

🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

🌐 Translation updates. Slovenian is now available, and translations for English (UK), Finnish, German, Japanese, Portuguese (Brazil) and Portuguese (Portugal) were enhanced and expanded.

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories

🔒 Terminal file preview isolation. Previewing an HTML file in the system terminal now runs it in an isolated context by default, closing a cross-site scripting hole that could expose your login session or, for privileged accounts, run code on the server. #26907

➗ Malformed maths in a message. Maths that fails to render is now shown as plain text rather than being placed into the page as markup, closing a way for a crafted formula in a chat, channel or shared conversation to run code in the browser of anyone reading it. #26718

🔩 Updated file upload parsing library. The library that parses file uploads and form submissions has been updated to a release that addresses a security advisory affecting that parsing path. #26991

🛑 Deactivated accounts lose live access. Real-time connections now apply the same role check as the rest of the application, so an account moved out of the user or admin role can no longer keep its channels and shared notes open on an existing token. #27537

🛅 Writing into someone else's chat. Completion and action requests now confirm you own the chat they name before anything is written to it, so a filter or action can no longer be pointed at another person's conversation. #27486

🎟️ Ollama version no longer readable anonymously. Reading the configured Ollama backend's version now requires signing in, closing a route that let anyone learn the version in use and count how many backends are configured. #27199

🔐 Folder sharing permission. The folder sharing setting in default and group permissions now saves instead of being silently discarded, so allowing or restricting folder sharing actually takes effect. #27296, #27120

🔕 Webhook permission enforcement. People without permission to use webhooks can no longer save webhook notification destinations to their settings, so the permission is enforced when settings are saved rather than only reflected in the interface. #27297, Commit

🛎️ Stopping someone else's generation. Deleting a chat now checks who you are before anything is cancelled, so knowing another person's chat id no longer lets you cut off their reply or title generation on a request that is refused anyway. #27006

🚥 Automation limits in chat. Automations that the assistant creates or reschedules on your behalf now respect the same maximum count and minimum interval as the ones you set up yourself, instead of being able to exceed both. #27523, #27121

⏲️ Cancelling someone else's timers. Marking a chat as read now only clears your own pending timers on it, instead of clearing everyone's, which had let another person's scheduled prompt be silently cancelled without them being told. #27472

🗑️ Deleting a shared folder's subfolders. Deleting a folder is now limited to its owner or an administrator at every level, so someone with write access to a shared folder can no longer delete a subfolder and take the owner's chats with it. #27003

📕 Tool source shown to people who can only use it. Opening a tool you were given read access to no longer returns its source code, which read access was never meant to include. #27005

🎯 Model settings in the list endpoint. Listing models no longer includes each one's parameters and system prompt for people with read access only, matching what opening a single model already returned. #27004

🖌️ Image generation and web search without permission. Turning on image generation or web search through the older request format now checks your permission first, so someone denied those features can no longer trigger them, and the billing that comes with them, by asking for that format. #26703

🎗️ Terminal single sign-on tokens. The token forwarded to a terminal server for single sign-on is now taken from your own session on the server rather than from a header the browser supplied, so a caller can no longer send someone else's token in its place. #26719

🫗 Web search results scoped to you. The temporary collections holding a web search's pages are now tied to the person who ran the search, closing the one place where that scoping was not applied. #26706

🧺 Knowledge base cleanup reaching other collections. Tidying up a knowledge base now acts only on files and folders that belong to it, so someone with write access to one knowledge base can no longer delete folders or search data belonging to another. #26722

⌛ Searches that could stall the server. A search pattern inside knowledge base commands now runs under a time budget, so a pattern that would take minutes to evaluate can no longer hold up everyone else on the instance. #27471

🚫 Disabled terminal servers are refused. A terminal connection an administrator has turned off can no longer be reached by browsing its files, opening a session, or calling its tools, rather than only disappearing from the interface. Commit

🧫 Files attached to a shared folder. Adding files to a folder is now refused unless the folder's owner can read them, and a folder's files are checked against what its owner can still read before they are used as knowledge in chat, so a collaborator can no longer place files into someone else's folder or keep serving files the owner has since lost access to. #27464, Commit

🧷 Knowledge claimed by a direct connection. Files listed as knowledge on a model supplied by the browser for a direct connection are now filtered against your own access before anything is retrieved, so a crafted request can no longer pull in documents you cannot otherwise open. Commit, #26723

🪜 Reaching a restricted model through a shared one. A shared workspace model can no longer be used to reach an underlying model the person could not otherwise use, which previously slipped through when that model had no entry of its own. #26905, #26900

🖌️ Shared image checkpoint changes. Only administrators can now change the instance-wide Automatic1111 checkpoint, so an ordinary image generation request no longer switches the image model for everyone. #27244

💬 Channel message ownership. Only the author of a channel message, or an administrator, can now edit or delete it, instead of anyone able to post in that channel. #27197

🗄️ Chats shared with an administrator. An administrator can now open a chat that was deliberately shared with them even when broad admin access to other people's chats is turned off, instead of being refused a chat any other recipient could read. #27127

📓 Notes in folder knowledge are access checked. Notes attached to a folder are now filtered against your own access before the list reaches the assistant, rather than relying on later checks further along. #26739

🧱 Code interpreter module blocking. Modules an administrator has blocked for the code interpreter are now actually blocked, and other imports inside interpreter code work again. #27245

📉 Charts in the code interpreter. Code that draws a chart now runs in the default code interpreter setup, instead of failing with a syntax error unless file persistence was turned on. #26800, #26660

🎬 Chat action availability. Chat actions can no longer be triggered when they are disabled, not assigned to the model in use, or on a model the caller cannot access, matching the actions the interface actually offers. #27243

🗨️ Response text where it was missing. Assistant replies are no longer stored without their text, so copying, exporting, searching and reusing a conversation return the reply instead of nothing. Commit, #26799, #26436

🧪 Filter edits that survive a reload. A change a filter makes to a finished response is now saved with the conversation, instead of showing on screen and reverting the next time the chat is opened. #27414, #27017

📃 Action functions receive the response text. Running an action on a response now passes the assistant's text to the function, instead of handing it an empty message. #26798, #26672

🍎 Blank messages on Safari. Assistant responses no longer render as empty in Safari and on iPhone and iPad, where a browser painting bug left on-screen messages unpainted. #26805, #26712, #26844

➡️ Prompts opened from a link. A prompt passed in through a link that sends automatically now waits for tool servers to finish loading, so external tools are available on that first message instead of the model reporting it has none. Commit, #24176

🪟 Tool result prompt submission. Interactive tool result embeds that send a prompt back to the chat work again, showing the confirmation dialog before submitting instead of silently doing nothing. #26914, #26912

📻 Live updates in a second tab. Opening Open WebUI again while already connected now joins the new tab to your event stream, so notifications and chat updates reach every open tab instead of only the first one. Commit

🔁 Connection recovery on new chats. Chats started from the home page now recover automatically after a dropped connection, such as from mobile backgrounding, a VPN or IP change, or waking from sleep, instead of getting stuck loading until a manual refresh. #26913, #26844

🪫 Terminal choice cleared on load. Your selected terminal is no longer dropped while the list of terminals is still loading, so it survives a page refresh. Commit, Commit, Commit, #26775, #26677

🔌 Dropped sessions during keepalive. Live connections no longer break on a routine keepalive check, which had cut the session so that anything the server needed to run in your browser failed afterwards, most visibly the code execution tool reporting the client as disconnected on every run. #27553, #27550

✂️ Context compaction turn boundaries. Long-conversation compaction now summarizes only completed earlier turns instead of sometimes cutting through the middle of a single turn, keeping the current turn's tool calls and results intact. #27035, Commit, Commit

🪆 Summaries on a direct connection. Summarizing a long conversation on a direct connection can now use the configured summary model rather than being limited to the connection's own model. #26806

🪟 System prompt through compaction. The system message now stays at the front of the conversation when a long chat is summarized, instead of being folded into the summary and lost from that point on. Commit, Commit, Commit, #26713, #26710

🧷 Context compaction continuity. After a compaction, the retained recent messages now stay in the prompt on every following turn instead of disappearing after the first, preserving conversational continuity and prompt caching. #27037, Commit, Commit

🔟 Context size after tool calls. The context meter and long-conversation compaction now read the size of the latest request rather than adding up every call in a tool loop, and understand the counts reported by Ollama and llama.cpp as well as the OpenAI-style ones, so compaction no longer fires far below its threshold, or never at all, and the usage shown is no longer inflated. Commit, Commit, #27031, #26752, #24410

💭 Reasoning that arrives late or empty. Reasoning sent by a provider after the answer has started is now shown in its proper place above the answer rather than appended after it, and reasoning notes carrying nothing no longer open an empty thinking block. Commit, #26687, #26645

📐 System prompt lost during tool calls. A model's system prompt now stays in place through every round of tool calls, instead of being dropped after the first one and, with memories enabled, replaced by the memory block alone. #26857, #26836

🪶 Memories from structured replies. A reply delivered as structured output is now read when memories are reviewed after a turn, so nothing worth remembering is skipped just because of how the answer arrived. Commit, #26705, #26651

🎲 Stable skill ordering. Skills available to a model are now listed in the same order on every request, instead of shuffling between requests and quietly defeating prompt caching. Commit, #26986

🛑 Stopping an answer the moment it starts. Each answer in a chat now carries its own task identifier from the first event onward, so stopping one immediately after sending no longer misses. Commit

⏸️ Deleting while a reply is being written. The delete control is now hidden on messages while a response is generating or a task is running, so a conversation can no longer be left with the finished reply detached from the messages before it. Commit, #26668

🎁 Feedback while a download is prepared. Downloading a file or folder from the terminal now tells you it is being prepared, will not start the same archive twice if you click again, and reports a failure instead of quietly giving up or leaving a preview spinning. #27421, #27055

📥 Moving an archived chat into a folder. Moving an archived chat into a folder now takes it out of the archive so it appears there, and the folder's contents refresh straight away after a move from the menu. #27485, #27484

📜 Chats past the first sixty in a folder. Folder listings now page through every chat instead of stopping at a fixed limit, so older chats no longer appear to vanish from a folder once it grows past sixty. #26786, Commit

📌 Sidebar highlight follows the open chat. The sidebar no longer keeps a chat highlighted after you move to another page, so deleting or archiving it there no longer throws you back to a new chat, and cloning no longer leaves two chats looking selected. #26977

🔀 Sidebar ordering during replies. Background updates such as follow-up suggestions, sources, and status no longer bump a chat to the top of the sidebar or change its last-updated time, and neither does saving a chat's variables or settings, nor the automatic title generation on a new chat. Commit, Commit

🖱️ One hover preview at a time. Moving between chats in the sidebar, or between avatars in the admin user list, channel messages and member lists, no longer leaves an earlier preview open behind the new one. #27549, #27548, #27578, #27577

✨ Folder lists no longer flash. Clicking a folder title in the sidebar no longer empties the chat lists of your expanded folders for a moment before they reappear. #27535, #27533

🫧 Flickering sidebar rows. Moving the pointer across a chat in the sidebar no longer makes its title and timestamp flicker in and out, or draw the timestamp underneath the action buttons. #27474, #27473

⭐ Rating scale in multi-model replies. The rating scale in the feedback panel is no longer cut off when several models answer side by side, so every score can be picked. #26846

🧑‍🤝‍🧑 Duplicate models side by side. Adding the same model twice in a side-by-side chat now keeps each column's own answer after a reload, instead of every column collapsing onto the first one. #26980

⬅️ Back button after opening admin or workspace. Going back in the browser now returns you to the page you came from, instead of being pushed forward again to where you just were. #27478, #27477

🎛️ Typing a top_k value. The top_k box in advanced parameters now accepts whole numbers up to its limit and rejects anything else, instead of letting the slider and the box disagree over what is allowed. Commit, #26669

🌙 Date pickers in dark mode. The calendar and clock icons on date and time fields are now visible in dark mode, across the calendar, automation schedules, account settings and analytics. #27275, #27274

🪞 Settings content stays inside the window. Long chat titles in Archived Chats now shorten with the full title on hover, and the admin analytics tables and chart no longer stretch past the edge of the settings window. #27306, #27305, #27329

🔗 Settings links that open in place. A link to a settings tab now opens it without a page refresh, and the Add Terminal button in the terminal menu goes straight to the Integrations tab instead of flashing the admin panel and doing nothing. #27552, #27551

🎰 Model choice on a fresh chat. Starting a new chat now falls back to your default model when the previous selection is no longer available, instead of leaving the picker empty, while a model named in the link still wins. Commit, #26697

📱 Model selector on small screens. The model list now stays fully on screen and sizes itself to the space available, instead of running past the edge or hiding behind the on-screen keyboard on phones. Commit, Commit, Commit

📲 Sidebar stays open over the calendar. Opening the calendar from the account menu on a phone now closes the sidebar, as every other entry in that menu already did. #26979

🗓️ Automation dialog on narrow screens. The buttons along the bottom of the automation dialog now sit on their own row on a phone, instead of the schedule and model pickers wrapping and pushing Cancel into the middle. #27027

📐 Input menu with keyboard open. The message input's attachment menu now stays on screen and resizes to fit when the on-screen keyboard is open on mobile, instead of running off the edge. Commit

🎈 Dropdowns that follow their content. A menu now stays in place as its contents grow or shrink, instead of running past the edge of the screen when a submenu swaps in taller content, and no longer bounces as it opens. #27460, #27458

🧾 Attachment menus load once. Opening a submenu of the attachment menu now requests its list a single time instead of twice. #27461, #27459

🔦 Chat search on PostgreSQL. Searching your chats now finds matches in current conversations on PostgreSQL setups, instead of only matching chats still stored in the older format. Commit

🧲 Search quality with prefix-based embedding models. Memories, knowledge base descriptions and searches against an external vector database now carry the query and content markers your embedding model expects, so results are no longer quietly worse than they should be on models that rely on them. Commit, #26958, #26353

🥄 Counting matches in knowledge base commands. Piping text into a search inside knowledge base commands now honours the count and filenames-only flags, instead of returning the matching lines regardless. #26721, #26715

🔍 Knowledge base file search. Searching inside knowledge base files now returns matching lines with correct line numbers, and patterns that list alternatives separated by a pipe find matches instead of silently returning none. #27249, Commit, Commit, #26795, #26781, #26744

🖨️ PDF text recognition. The text recognition package is now included again, so the application starts and PDFs with image text extraction enabled upload correctly instead of failing. #26851, #26646, #26994

🧿 Mistral OCR on a stock install. Extracting documents with Mistral OCR now works out of the box, instead of failing on a missing name resolution library that the code assumed was present. #27440

📧 Outlook message uploads. Uploading a .msg email now works, where it previously failed because the package it relied on could not be installed alongside the rest of the application at all. #26704, #26690

🖇️ Uploads with PaddleOCR-VL selected. With PaddleOCR-VL chosen as the document loader, only PDFs and images now go to it and everything else falls back to the usual handling, so text, markdown, spreadsheet and Word files index instead of being rejected. #27529, #24988, #26759

🪙 Documents containing special tokens. Splitting text by tokens no longer fails when the content contains reserved marker sequences, so those pages and files can be fetched and added to a knowledge base. Commit, #27094

📚 Knowledge base upload reliability. Adding a file directly to a knowledge base now finishes processing and linking the file before reporting success, so uploaded files are reliably searchable. Commit

🛠️ Web loader settings from the admin panel. The web loader picked in admin settings is now actually used, along with its certificate checking, request pacing and proxy settings, so instances that fetch pages through an external loader work again instead of trying to reach the internet directly with whatever was configured at startup. #26749, #26747, Commit, #27083, #27025, #27061

🚧 Quoted entries in the web fetch filter list. Stray quote marks around a filter entry, w

Original source

Added

💭 Streamed reasoning display. Models that emit thinking or reasoning now show that content as it streams, and it renders correctly in the chat overview and in exported conversations. Commit, Commit, Commit, Commit

🗂️ Folder uploads to knowledge bases. Dragging a folder into a knowledge base, or syncing one, now recreates its subfolder structure instead of flattening everything into loose files. #26130, Commit

🧠 Memory system context toggle. Administrators can now keep memory tools available while choosing not to add stored memories to the system context, using the new 'Memory System Context' toggle in admin settings. Commit

🧹 Tidier automatic memories. Automatically saved memories now focus on enduring details like preferences and goals and skip one-off things like meals, routine events, or passing mood unless you ask to remember them. Commit

🎙️ Speech-to-text request format. OpenAI-compatible speech-to-text can now send audio as either a multipart upload or base64 JSON, selectable in admin audio settings. Commit

🧰 API configs via environment. Administrators can now set per-connection Ollama and OpenAI API configurations through the "OLLAMA_API_CONFIGS" and "OPENAI_API_CONFIGS" environment variables. Commit

📡 Provider failure events. Failed Ollama and OpenAI-compatible provider requests now emit a structured event describing the error type, provider, and status, giving administrators clearer visibility into upstream failures. Commit

🏟️ Arena models via environment. Administrators can now define evaluation arena models through the "EVALUATION_ARENA_MODELS" environment variable. #26174

♿ Clearer high-contrast sidebar selection. With high-contrast mode enabled, the currently selected chat in the sidebar now stands out with stronger colors, making it easier to tell which chat is active. #26469, Commit

🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

🌐 Translation updates. Translations for Thai, Portuguese (Brazil), Catalan, and Spanish were enhanced and expanded.

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section — some may be withheld for a short time to give administrators time to upgrade. Advisories

🔐 Fewer unexpected logouts. A single request returning an authorization error no longer signs you out while your session is still valid, since the app now confirms the session status before redirecting to login. Commit

🔒 Web search domain filtering. Domain allow and block rules for web search results are now matched against the host, closing a gap where some URLs could slip past the filter. Commit

🕵️ Image prompt log privacy. Image generation workflows are no longer written to server logs at the default log level, keeping user-authored prompt content out of operator-visible logs. #26400, Commit

🗄️ Safer database upgrades. Upgrading an existing SQLite database no longer crashes during the user-table migration or corrupts saved user settings, resolving failures that could block startup or break login after an upgrade. #26403, Commit

⚙️ Saving settings as a non-admin. Non-admin users can once again save their interface settings, such as the default model and theme, which previously failed with a server error while the interface incorrectly reported success. #26627, Commit

🕒 Sidebar chat timestamps. Chats in the sidebar now show when they were last active instead of when they were created, so the time label matches their position in the list and refreshes after each new message. #26454, #26451

🎯 Default model after refresh. Your selected model is no longer cleared when you reload the page, as model selection now waits for the model list to finish loading. Commit

⏳ Tool dialogs no longer hang. Dismissing a tool or function input dialog by clicking outside it now cancels the pending request instead of leaving the chat spinning indefinitely. #26417, Commit

🐍 Reliable code execution loading. Running Python code in chat now loads its runtime reliably, fixing sandbox startup failures that broke code execution and the Pyodide file viewer in recent releases. #26625, #26390

🤖 Models with null capabilities. Chatting with a model whose capabilities are unset no longer fails with an error when the memory feature or automations are involved. #26412, Commit, Commit

🔎 Searchable responses. Chat search again finds assistant messages whose text is stored as structured output, which were previously skipped. #26405

🔔 Chat notification previews. Background chat completion notifications and toasts now show a clean response preview instead of appearing blank for messages stored as structured output. Commit

💾 Banner and config startup. Setting configuration such as "WEBUI_BANNERS" no longer causes a startup failure, since admin configuration values are now stored correctly regardless of their data type. #26431, Commit

📑 RAG Template visibility. The RAG Template editor now stays visible in admin document settings even when Bypass Embedding and Retrieval is enabled, since the template still applies to document content in that mode. #26126, Commit

🧬 Editing derived models. Editing a workspace model no longer clears its base model, including when that base is a preset or the model itself. Commit, Commit

Original source

Added
🤝 Share folders with your team. You can now share a folder and the chats inside it with specific users, groups, or everyone, with read or write access; people you share with see shared folders in their sidebar and open the chats in a read-only view when they are not the owner, and administrators control who is allowed to share folders with a new "Folders Sharing" permission that is off by default. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🗜️ Automatic context compaction for long chats. Conversations that grow past a configurable token threshold can now be summarized automatically so they stay within a model's context window, with a notification shown while it happens; administrators can enable it, set the threshold, customize the summarization prompt, and lower the threshold per model. It is off by default. Commit, Commit, Commit, #19594
🖥️ Open WebUI Computer agent support. Open WebUI can now connect to Open WebUI Computer through its OpenAI-compatible gateway, letting chats run full agent sessions on your own machine with file, terminal, git, and web access. GitHub
🚀 Much faster hybrid search on large knowledge bases. Hybrid search now runs natively in the database on pgvector setups instead of loading an entire collection into memory, so querying large knowledge bases is dramatically faster. Commit, #20737
🗂️ External knowledge bases. Knowledge bases can now be backed by an external retrieval source through configurable external knowledge connections, so you can search an existing external system from chat instead of only Open WebUI's built-in store. Commit
🧠 Reworked memory system. Memory has been overhauled with distinct memory types — long-lived personal memories and per-conversation context — managed through a structured add, update, and delete flow, giving models a more reliable way to remember and apply what they've learned about you. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
🧩 New plugin primitive: the Event function. Where pipe, filter, and action functions all run inside a conversation, the new Event function is the first primitive that hooks into the system itself: it runs your own Python in response to events emitted across the whole application — sign-ups, configuration changes, file uploads, role changes, deletions, startup and shutdown, and more. That makes a new class of behavior possible directly inside Open WebUI, from onboarding and access control to auditing, lifecycle automation, and external integrations. Comes with starter boilerplate in the function editor. Commit, Docs
🔔 New event system with webhooks. Open WebUI now emits events for a wide range of system activity — sign-ins, configuration changes, startup, and actions across chats, knowledge, files, and more. Administrators can send these as outbound webhooks, route them to specific users or groups, and manage which events go where from a new event settings admin page. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, #1240, #16426
🔐 Configure authentication from the admin panel. LDAP and OAuth/OIDC settings now have a dedicated Authentication settings page, so providers can be configured from the admin interface. Commit, #12945
🏷️ More custom header variables. Custom request headers now support "{{USER_MESSAGE_ID}}", "{{USER_MESSAGE_PARENT_ID}}", and "{{TASK}}", letting connected services tell apart real user messages from automated background requests like title, tag, and follow-up generation. Commit
📄 File details forwarded to external document extractors. External custom document-extraction servers now receive the file's ID, name, and content type, and these are also available as custom header variables, so extraction can be tailored per file. Commit, #26259
🎰 Last model pre-selected for new slots. When you add another model to a multi-model chat, the slot now defaults to the model you last picked instead of starting empty. #25974
⚡ Faster model overview. The admin model overview now loads its feedback history and tags through batched queries, so it opens noticeably faster on instances with many chats. Commit
🏎️ Lighter channel profile previews. Profile previews in channels now load a person's details only when you hover to open one, rather than fetching them for every message up front. Commit
↩️ Reset permissions to defaults. The group and default permission dialogs now include a button to restore all permissions back to their built-in defaults in one step. #25931
📥 Chat import permission. Administrators can now control whether users are allowed to import or clone chats, with a new "Allow Chat Import" permission. Commit, Commit, Commit, #25927
🔔 Per-group user webhook permission. Administrators can now control which users may set a personal notification webhook, with a new "User Webhooks" permission. #25923
✍️ Customizable autocomplete prompt. Administrators can now set a custom prompt template for autocomplete generation from the admin interface settings. Commit, #25879
🔑 Configurable secret key length. The auto-generated secret key length can now be set with a new environment variable, instead of always using a fixed length. Commit, #25906
🏟️ Arena evaluation models configurable via environment. Arena evaluation models can now be defined through an environment variable, which previously could not be set that way. Commit
✏️ Edit prompts from the menu. The prompts list now has an Edit option in each prompt's menu, taking you straight to its editor. #25789
📋 Clone automations. Automations now have a Clone option in their menu, so you can duplicate one as a starting point. #25790
🔁 Recurring calendar events. The calendar event editor now includes a repeat option, so events can recur on a schedule. #25865
🧷 Separate skills import and export permissions. Administrators can now control importing and exporting skills independently, with new skills import and export permissions. #25921
🏷️ Filter admin models by tag. The admin Models settings page now has a tag filter for narrowing the model list by base-model tags. Commit
📊 Sortable analytics chat list. The model chat list in analytics now has sortable column headers, so you can order it by title, last updated, or user. Commit, #26168
🔐 Argon2 password hashing option. Password hashing can now use Argon2 through a configurable algorithm setting, removing the 72-byte password length limit that came with the previous default. Commit, Commit, #25656
🔐 Optional encryption of valve values at rest. Tool and function valve values can now be encrypted at rest through a new opt-in setting, with existing stored values migrated automatically, so sensitive settings like API keys aren't kept in plaintext. Commit, #23721
🗄️ AWS RDS IAM database authentication. The database connection can now authenticate using AWS RDS IAM tokens through a new opt-in setting, instead of only a static password. Commit, #23580
🔓 Automatic auth for models with OAuth 2.1 tools. When a model uses tools that require OAuth 2.1, Open WebUI now initiates the authorization flow automatically instead of failing the request. Commit, #23325, #23272
🔤 Custom tokenizer for token-based text splitting. Token-based document splitting can now use a configurable Hugging Face tokenizer model, so chunking can match the tokenizer of the model you use. Commit, #24139
🔒 Restrict OAuth scopes requested from MCP servers. A new setting lets administrators limit which OAuth scopes Open WebUI requests when connecting to MCP servers. Commit, #25981, #25978
🧩 Filter Outlet Hook can now run on API requests and responses. A filter function's outlet hook now runs for direct API callers, including streaming responses, so response post-processing isn't limited to the web interface; this is controlled by a new setting and on by default. Commit, #25650
🖥️ Setting for terminal sidebar auto-open. A new interface setting controls whether the files sidebar opens automatically when you select a terminal. Commit, #25628
📌 Reorder pinned notes by dragging. Pinned notes in the sidebar can now be dragged to reorder them. #25677
🔎 Chat actions in search. The search dialog now offers a context menu on each result, so you can act on a chat directly from search. #25490
🔎 Snippets in chat search results. Searching your chats now shows a snippet of the matching content in each result, so you can tell results apart at a glance. Commit, Commit, Commit, #25178
📝 Formatted valve descriptions. Valve descriptions for tools and functions now render Markdown, so they can include formatting and links. Commit
🔽 Dropdown inputs for valve options. Valve and confirmation inputs can now present a set of options as a dropdown instead of free text, making fixed-choice settings easier to configure. Commit, #26278
🔌 Control the OAuth resource parameter for MCP connectors. MCP connectors can now be set to always send, never send, or automatically decide whether to include the OAuth resource parameter, so they work with providers that reject it. Commit
🔎 SERPHouse web search. SERPHouse can now be used as a web search provider. Commit, Commit, #26254
🔎 Microsoft Web IQ web search. Microsoft Web IQ can now be used as a web search provider, with a matching page-browse loader. #26178
⚠️ Optional web search confirmation. Administrators can now require users to confirm before a web search runs, with a banner and message making it clear when search is about to be used. Commit, #24942
🪪 Client User-Agent forwarded to model backends. The browser's User-Agent is now passed through to all model backends, so upstream services can see the originating client. #26333
🖐️ Drag items from the sidebar into chat. Folders, notes, and models — including pinned notes — can now be dragged from the sidebar into the chat input. #25771, Commit, #26384
🏷️ Tag suggestions in the model editor. The model editor now suggests existing tags as you type, making it easier to reuse a consistent set. Commit, #25703
🗣️ Voice suggestions in the model editor. The model editor now offers a dropdown of available text-to-speech voices, making it easier to pick one. Commit, #25706
🎛️ Unified model picker for workspace base model. Choosing a base model in the model editor now uses the searchable model selector instead of a plain field, making it easier to find and pick the right model. Commit, #24576
🔍 Searchable pickers in the model editor. Attaching actions, filters, tools, knowledge, and skills to a model now uses type-to-search pickers instead of long checkbox lists, making large libraries easier to manage. Commit
🖼️ iPhone images work with OpenAI image editing. Uploaded images are now normalized before being sent to OpenAI image editing, fixing edits that failed for certain iPhone photo formats, with a new admin toggle to control the behavior. Commit, Commit, #26252, #26249
🟢 Loaded-model indicator for llama.cpp. Models served through llama.cpp now report whether they're currently loaded in memory, including the sleeping state, so the loaded indicator works for them too. Commit
🧱 Structured model output rendered on the client. Reasoning, tool calls, and server-side tool steps such as web and file search are now rendered in the browser from the model's structured output instead of being flattened into the message text on the server, giving more accurate and editable rendering of these items. Commit, Commit
📜 Custom CA bundle for outbound connections. A new environment variable lets you point Open WebUI at a custom CA certificate bundle, and the per-connection SSL settings now accept a bundle path, so deployments behind a corporate or internal CA can keep certificate verification on instead of disabling it. Commit, Commit
🖥️ More terminal server orchestrator controls. Admins connecting an orchestrator terminal server can now configure session lifecycle policies and refresh or reset running terminal sessions, including targeting only idle ones, from the connection settings. Commit
📁 Terminal file browser can stay within a root folder. The terminal file navigator now anchors to a defined root and home directory, so users can be kept within their workspace instead of browsing into system folders by accident. Commit
🧠 Memory toggle follows the server default. When a user hasn't set their own memory preference, it now follows the admin's global memory setting instead of defaulting to off. #25909
🧹 Unshare all shared chats at once. The Shared Chats dialog now has a button to stop sharing every shared chat in one action. #25848
📈 Richer analytics with a date picker. The analytics dashboard now lets you choose a date range and shows additional columns. #25922, #25919
🔢 Chat and file counts in their dialogs. The Chats and Files dialogs now show the total number of chats and files in their titles. #25872, #25873
⚡ Faster math rendering. Rendered math is now cached and reused, so messages with repeated or unchanged math expressions render more efficiently. #25847
⚡ Lighter Markdown setup. Markdown extension setup now runs once instead of on every render, avoiding repeated work and extension stacking. #25837
⚡ Snappier read-only code blocks. Read-only code blocks now skip language auto-detection, so they render faster. #25824
⚡ Non-blocking audio model loading. Loading speech models no longer blocks the server, keeping it responsive while they initialize. #25806
⚡ Faster URL safety checks. The safety check on fetched URLs now resolves addresses off the main loop, so it no longer blocks other work. #25825
⚡ Fewer queries for channel reactions and replies. Channel reactions and thread replies now load through batched queries, reducing database load on busy channels. #25831
⚡ Lighter streaming. Streaming responses now skip re-processing message content that hasn't changed, reducing work on every update. #26325, #26326
⚡ Smoother tool-call rendering. Displaying tool calls now parses their content iteratively, avoiding slowdowns on deeply nested data. #26146
⚡ Hidden tool-call details cost nothing. When tool-call arguments are collapsed, they are no longer rendered behind the scenes, noticeably speeding up chats with heavy tool use. Commit, #26147
⚡ Leaner knowledge-file reading for agents. The built-in tools that let a model read knowledge files now return output in bounded, paginated chunks with a default and a hard cap, instead of potentially returning an entire large file at once, sharply reducing token usage. Commit, #26139
⚡ Lighter, faster file search on large knowledge bases. Listing and searching files no longer returns each file's full extracted text by default, and content matching is now length-bounded, so these requests are far lighter and searching across very large knowledge bases is dramatically faster. Commit, Commit, Commit, #25774, #25741, #26145, #25867
⚡ Faster password hashing and bulk user import. Password hashing and verification no longer block the server, and importing users from a CSV is now processed in a single batch, keeping large imports and sign-ins responsive. Commit, #25804, #25805
⚡ Non-blocking model downloads. Downloading large Ollama models no longer blocks the server on file reads and checksums, keeping it responsive during big downloads. #25829
⚡ Non-blocking uploads and link fetches. Hashing uploaded files and fetching URLs now run off the main loop, so large uploads and link previews don't hold up other requests. #25822
⚡ More blocking work moved off the main loop. Additional blocking operations in audio, pipelines, and plugin handling now run in worker threads, keeping the server responsive under load. #26381
⚡ Unreachable backends don't stall model loading. Loading models and tool servers no longer blocks on backends that are down or slow to respond, so the model list stays responsive when one connection is unreachable. #26289
⚡ Batched streaming updates. Streaming responses now group small updates of the same type before sending them, reducing overhead during fast token streams and tool-call output. Commit, #26202
🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
🌐 Updated translations. Catalan, Brazilian Portuguese (pt-BR), Irish, German (de-DE), and Spanish (es-ES) translations were updated.
Fixed
🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section — some may be withheld for a short time to give administrators time to upgrade. Advisories
🔐 Knowledge base write access enforced on upload. Attaching an uploaded file to a knowledge base now requires the same write access as the rest of the knowledge API, so users without write access can no longer add files to a collection by referencing its ID. #26001
🗝️ API key permission enforced on all key endpoints. Viewing and deleting API keys now respects the API keys permission, matching the protection already applied to key creation. #25992
🔊 Text-to-speech permission enforced on the speech endpoint. The OpenAI speech proxy now honors the text-to-speech permission, so it can no longer be used by people who are not allowed to use that feature. #25993
🎲 Model access enforced on arena fallback. Reaching a model indirectly through an arena model on background and task requests now enforces that model's access rules, closing a path that could otherwise bypass them. #26046
⏰ Scheduled automations stop for deactivated accounts. Scheduled automations now re-check the owner's account status and permissions before each run, so they stop when an account is deactivated or has automations access revoked. #26047
🚧 Heavily encoded paths rejected behind the proxy. Request paths that remain encoded after repeated decoding are now rejected instead of forwarded, preventing a path traversal that could otherwise slip through. #26050
🌐 Image URL fetches hardened against DNS rebinding. Fetching user-supplied image URLs now re-checks the destination address at connection time, closing a path that could be used to reach internal addresses behind a public hostname. #25960
🛂 Web fetch blocklist matches on hostname. The web fetch filter now matches entries against the request's hostname on domain boundaries, so blocked hosts can no longer slip through with an added path and lookalike domains are no longer mistaken for allowed ones. #25949
🪪 MCP connectors request least-privilege scopes. MCP connectors that register dynamically over OAuth now request only the scopes for the specific resource rather than the authorization server's full catalog. #25958
🙈 Channel member lists no longer expose private data. Viewing a channel's members now returns only basic profile details, instead of also exposing other members' settings, linked-account data, and personal information. Commit
🛟 SCIM sync can't demote an admin. A SCIM provisioning sync that marks a user inactive can no longer strip an existing administrator's role, preventing an instance from being locked out of its own administration. #25948
👻 Collaborative notes reject unauthenticated presence events. The remaining real-time note-collaboration events now require an authenticated session, so presence and cursors can no longer be spoofed by someone who only knows a note's ID. #25946
⏱️ Login timing no longer reveals which accounts exist. Sign-in now takes the same amount of time whether or not an account exists, removing a timing difference that could be used to discover valid accounts. Commit, Commit
🔌 Terminal connections can't be redirected to another user. Terminal session identifiers are now safely encoded before being passed upstream, closing a way to tamper with the connection's user identity. #26042
📡 Real-time events only reach your own session. The server now verifies that a real-time event is delivered only to the requesting user's own active session, instead of trusting a client-supplied session identifier. #25763
🔓 Revoked sessions are rejected on real-time connections. Real-time and terminal WebSocket connections now honor token revocation and expiry, so a signed-out or expired session can no longer keep a live connection open. Commit, #25764, #25686
🕳️ Another DNS-rebinding gap closed in URL fetching. Fetching a URL's content now re-checks the destination address at connection time, closing another path that could reach internal addresses behind a public hostname. #25775
🗣️ Azure speech input is escaped. Voice and language values are now escaped when building Azure text-to-speech requests, preventing malformed or injected markup. #25776
⚙️ Interface settings update respects its permission. Saving interface settings now enforces the interface permission, so users without it can no longer change those settings through the API. #25996
🗄️ Unknown knowledge collections are denied by default. Retrieval now rejects unknown or unscoped collection names by default, closing a legacy path that could be used to reach collections outside the normal access checks. Commit
🙈 Error responses no longer leak internals. Server error responses now return sanitized messages instead of raw exception text, so internal details aren't exposed to signed-in users. Commit, Commit, Commit, Commit, #26375, #26374
📏 Upload size limit enforced on the server. The maximum upload size is now enforced server-side, so it can't be bypassed by a client that ignores the limit. Commit, Commit, #25869
🖼️ OAuth profile pictures are validated. Profile picture URLs from OAuth providers are now validated and their type checked when stored, preventing unsafe image sources. Commit, #24548
📦 Security updates to frontend dependencies. Several frontend dependencies were updated to patch known security vulnerabilities. #26281
🤝 Chat sharing respects the user-sharing permission. The share-chat dialog now hides the option to share with specific users from people who lack that permission, matching the access rules enforced elsewhere. #25915
📤 Chat export respects its permission everywhere. Every chat export menu now checks the export permission, so users without it can no longer export chats through one of the dropdown menus. #25914
📂 File write access requires real ownership. Editing or deleting a file through a knowledge base or workspace model now requires that the object's owner actually owns the file, so a read-only file can no longer gain write access by being referenced from an object you control. #26032
🖌️ Image edit endpoint enforces permission. The image-edit endpoint now checks the image-edit switch and the image-generation permission, matching image generation, so it can't be called by users who lack access. #26009
📁 Folder permission enforced on all folder actions. Every folder operation now checks the folders permission, so the setting is respected consistently instead of only when listing folders. Commit
🧩 Code Execution settings collapse when off. The Code Execution settings section now collapses when the toggle is disabled, keeping the settings page tidy. #25970
📅 German date format in Notes. Dates in the Notes view now display correctly for German, where they previously failed to render. #25985
🎙️ ElevenLabs speech keeps working when voices can't load. Text-to-speech through ElevenLabs no longer fails when the available-voice list can't be fetched, instead of rejecting every voice. Commit, #26075
🪟 Default Permissions modal resets on close. Closing the Default Permissions dialog without saving now discards unsaved edits instead of keeping them around the next time you open it. Commit
👯 Side-by-side chat with the same model. Running two panes with the same model no longer leaves one pane stuck waiting or showing the other pane's reply after a reload, since each pane's messages are now tracked separately. Commit, #25982
💾 Model edits no longer lost when changing access. Adjusting a model's access no longer auto-saves on its own and discards your other unsaved changes to that model. #26004
🔧 Parallel tool calls over the Anthropic-compatible API. External Anthropic-compatible clients calling Open WebUI's messages endpoint now receive tool calls reliably when a model issues several at once or returns them in its final message. Commit, #25963, #25964
🗃️ Prompt caching preserved over the Anthropic-compatible API. Requests through the Anthropic-compatible API now keep their prompt-caching markers instead of having them stripped, so clients that rely on caching work as intended. Commit, #25998, #25964
🔁 Fewer redundant data loads. Several views no longer fire duplicate background fetches at once, avoiding occasional glitches from overlapping requests. #25943, #25942, #25934, #25935, #25838, Commit
🔎 Steadier search boxes across admin and workspace. Search fields for users, knowledge, prompts, tools, and similar lists now run only as you type and reset to the first page correctly, instead of occasionally re-searching on their own. Commit, #25938
📊 Admin feedback list loads again on PostgreSQL. The admin feedback list no longer fails to load on PostgreSQL setups, where it previously returned a server error. Commit, #25953
🗂️ Deleting nested folders checks chats correctly. Deleting a folder that contains subfolders now accounts for the chats inside those subfolders when applying the delete-permission check, instead of only the top-level folder's chats. Commit, #25920
🖱️ Dragging chats into folders is more reliable. Dragging a chat into a folder no longer throws an error in cases where the chat couldn't be resolved. #25928
🛠️ Workspace menu shows for the skills permission. Users who only have the skills permission now see the Workspace entry in their menu, which previously appeared only for other workspace permissions. #25925
🧠 Admins can always reach memories. Administrators can now use the memories endpoints regardless of the memories permission toggle, matching how admin access works for other features. #25924
🖼️ Image settings page survives a config load failure. The admin image settings page no longer crashes when its configuration fails to load, showing the page instead. #25933
🧵 Code blocks render in channel threads. Code blocks now display correctly in a channel's thread view, where duplicated message identifiers previously broke their rendering. Commit, #25917
🔵 No more false unread badges on chats. Chats no longer show an unread indicator after automatic changes like title generation or pinning, archiving, and moving them between folders, and newly created chats are marked read correctly so they don't appear unread after a refresh. #25912, #25782, #25108
📌 Pinned notes stay in sync. Pinning, unpinning, or deleting a note now updates the sidebar's pinned list consistently, instead of showing a stale pin state. #25918, #25640
📅 All-day calendar events keep their date. Saving an all-day calendar event no longer shifts it by a day for users in certain time zones. #25864
🧷 Damaged chat history recovers more reliably. When a chat's current position is missing or points at a malformed message, Open WebUI now repairs it from the latest valid message — on both the client and the server — instead of risking a broken history view. Commit, Commit, #26298, #26258, #26257
💾 Saving a chat no longer drops messages. Chat updates are now merged with the existing history on the server, with explicit tracking of deleted messages, instead of overwriting it, preventing message loss from concurrent or partial saves. Commit, Commit, Commit, #25657
📺 Channel message updates stay in their channel. Streaming updates to a channel message are now skipped if the message no longer exists or belongs to a different channel, preventing stray updates. Commit
📌 Pinned channel messages update for everyone. Pinning or unpinning a channel message now updates live for all members and works from thread views, instead of only changing for the person who pinned it. Commit
📄 Mistral OCR uploads work again. Document OCR through Mistral has been repaired after an upstream library change broke its file uploads. #25779
🗂️ Chroma collection detection fixed. Open WebUI now correctly detects existing Chroma collections, fixing a case where it always reported them as missing. #25780
📊 Vega-Lite charts render reliably. Vega-Lite charts in chat are now detected by their code block language tag, so they render correctly. #25843
🏷️ Long chat tag lists scroll. The tags section in the chat menu now scrolls instead of overflowing when a chat has many tags. #26031
⌨️ Enter key shows correctly on iOS. The Enter key symbol in the keyboard shortcuts list no longer renders as an emoji on iOS. #26173
🔗 Whitespace in names no longer breaks MCP connections. User name and info headers are now trimmed before being forwarded, fixing MCP connection failures when a display name contained leading or trailing whitespace. #26182, #26181
🈳 Search no longer fires mid-composition. Typing in search with an input method editor (such as Japanese, Chinese, or Korean) no longer triggers a search when you press Enter to confirm a composition. #26238, #26285, #26172
🧰 Valves icon stays visible. The icon for configuring valves no longer disappears, so user-configurable tool and function settings remain reachable. #26256
🎛️ Chat controls persist across navigation. Edits to chat controls are now kept when navigating between chats, and reverting a control to the chat's saved value persists correctly, instead of being lost. #26336, #25793
🔍 Chat search tool handles empty queries. The built-in chat search tool no longer crashes when called with an empty query. Commit, #26310
📑 More robust MinerU document processing. Document processing through MinerU now handles its ZIP results more safely, including very large outputs. Commit, #26263
⏰ Scheduled automations with session-auth tools work. Automations that use session-authenticated tools or terminals now authenticate correctly when running on a schedule, instead of failing. Commit, #26247, #26137
📝 Model system prompt preserved with knowledge. A model's system prompt is no longer dropped when knowledge retrieval runs with native tool calling. Commit, #26217
🔑 Expired sessions return you to sign-in. When a request fails because your session has expired, Open WebUI now redirects you to the sign-in page instead of leaving you on a broken view. Commit, #26237
🎯 Ejecting a workspace model unloads the right model. Unloading a workspace model now resolves to its underlying base model, so the correct model is freed from memory. Commit, #26269
🔄 Edited models refresh in the admin list. After editing a model in the admin settings, the models list now updates right away instead of needing a manual reload. Commit
🗂️ Workspace model bulk actions and search work across pages. Bulk actions on workspace models now apply across all of them, and search results paginate correctly. #26274
🧩 MCP resource results come through. Tool results that return resource content — including binary blobs and URI references — are no longer silently dropped, and image results are attached as files. #25260, #24038, Commit
🔗 Broader MCP server compatibility for OAuth. Open WebUI now discovers an MCP server's protected resource metadata even when the server doesn't advertise it, and recognizes more OAuth preflight variations, so more MCP servers connect. #25980, #25954, Commit, #26068
📤 Clearer upload error messages. Failed uploads now show a readable explanation instead of an opaque error stub. #25961
📋 Cloned prompts get a proper title. Cloning a prompt now adds the clone suffix to the correct field, so the duplicate is named as expected. #25800
📐 Long default group names don't overflow. A long default group name no longer overflows its row in the admin authentication settings. #25685
🖐️ Sidebar drags don't trigger uploads. Dragging a chat item in the sidebar no longer shows the file-upload overlay. #25675
🔁 Recovers from a stuck streaming response. If the signal that a response finished is missed — for example after a mobile app is backgrounded mid-stream — Open WebUI now recovers the chat instead of leaving it stuck in a streaming state. Commit, Commit, Commit, #26320, #26315
🧠 Model skills load on demand instead of filling the prompt. A model's attached skills are now presented to the model as a manifest it can load when needed, rather than having their full content inserted into the system prompt; skills you mention inline still get their content included directly. Commit, Commit, #25592, #25599
🗂️ Empty metadata no longer breaks Chroma indexing. Document metadata with empty values is now filtered out before indexing, fixing a case that could fail on Chroma. Commit, #26342, #26339
🔁 Updating a knowledge file won't break the knowledge base. When a file's content is updated, its new embeddings are now added before the old ones are removed, so a failed reindex leaves the knowledge base intact and usable instead of empty. Commit, #23789, #23787
🔤 Documents with special tokens index correctly. Measuring chunk sizes no longer fails when a document contains text that looks like a special token. #26210
📝 Note file attachments stay in sync. Updating the files attached to a note now keeps the editor and saved note in sync. Commit
📱 Better banner layout on mobile. Notification banners now lay out correctly on small screens. Commit, #24912
📂 Knowledge file listing includes attached files. Listing files through the knowledge tools now also shows files attached directly to a model, not only those inside a knowledge base, fixing cases where listing returned no results for a model with a single attached file. Commit, #26301
🏷️ Chat titles generate after long first responses. A new chat now gets its title even when the first response takes a long time, such as one with extensive reasoning or many tool calls, instead of staying "New Chat". Commit, #26240
🔌 Cancelling an MCP request no longer errors. Stopping a response that was using MCP tools now shuts the connection down cleanly instead of surfacing a server error. Commit
🧠 Reasoning details preserved across turns. Models that return structured or encrypted reasoning data, such as Gemini, no longer have their assistant message split mid-stream, keeping reasoning continuity across turns. Commit, #23852
📡 Error messages show for non-standard streaming responses. Providers that send errors over non-standard server-sent events now surface a readable error instead of nothing. #23228
🔑 Whitespace in terminal server keys no longer breaks auth. Terminal server API keys are now trimmed before use, so a key with stray leading or trailing whitespace still authenticates. Commit, Commit
🔥 One bad URL no longer fails Firecrawl scraping. When fetching multiple pages through Firecrawl, a single failing URL is now skipped instead of aborting the whole batch, and rate limits are respected between requests. Commit, #24183
📱 Usable chat input on mobile with many tools. When skills, tools, terminal, web search, and image generation buttons fill the chat input, the row of buttons now scrolls horizontally while the menu, voice, and send controls stay reachable, instead of pushing them off-screen. Commit, #26142
👤 Owner avatars only show on shared folders. Chat owner avatars in a folder's chat list now appear only when the folder is actually shared, instead of showing whenever owner information happened to be present. Commit
📜 No stray scrollbar on the About page. Extra spacing that caused an unnecessary scrollbar on the About settings page has been removed. #25802
🚪 Sign out works from the Account Pending page. Signing out while your account is pending now goes through the proper sign-out flow, so single sign-on sessions are ended and you are no longer left stuck on the pending screen. #25681, #25644
🔢 Built-in tools accept numeric arguments. Built-in tools no longer crash when a model passes a number or a string where a specific scalar type is expected; values are now coerced to the declared type. Commit, #25638, #25731, #25641
⏱️ MinerU timeout saves. The MinerU API timeout can now be saved from the admin settings, accepting a numeric value. Commit, #25604, #25603
🔧 Background completion no longer clears active tasks. Finishing a chat in the background no longer wipes the set of active tasks, fixing a case where ongoing task indicators could be lost. Commit, #25217
👁️ Workspace base model selector respects visibility. The base model selector in the workspace now hides models you don't have access to, matching their visibility settings. #25668
🧵 Channel threads bind to the right channel. A channel thread's parent and replies are now tied to the channel in the URL, preventing mismatches when switching channels. #25766
🗑️ Unsharing cleans up orphaned rows. Unsharing a chat now handles leftover shared-chat records, avoiding stale entries. #25632
🔎 Web search results reach the model with retrieval on. Web search results are now passed to the model even when embedding and retrieval are enabled, instead of being left out. #25600
🔢 Group count follows search. The groups count now reflects the filtered search results instead of the full list. #25689
␣ Space key works when renaming. Pressing space while renaming a file or folder no longer opens it, so spaces can be typed in names. #25627
🩹 Missing local embedding model no longer blocks startup. A missing local embedding model now surfaces as a deferred error instead of preventing the server from starting. #25683
🔤 Consistent settings label capitalization. Toggle labels in settings now use consistent title casing. #25765
♿ Better screen-reader labels on toggles. Integration and switch toggles now expose proper accessibility labels and pressed state for screen readers. #25258, #25230
📜 Long dropdowns scroll. Dropdown selects now scroll when their list is long, so all options stay reachable. Commit, #25608
🔽 Collapsible sections don't misfire on load. Collapsible sections no longer trigger their change action when first rendered, avoiding unintended toggles on page load. Commit, #25229
➗ Large math expressions no longer crash rendering. Parsing math delimiters no longer overflows on very large or deeply nested input, so messages with heavy math render instead of failing. #25845
🗄️ Oversized chunks no longer break Milvus indexing. Overly long text chunks are now trimmed before being sent to Milvus, so a single large chunk can no longer fail the whole batch and leave a file with no embeddings. #25857, #25858
📝 Code editor stays open when empty. The code editor drawer no longer collapses when its content is empty. #25855
💽 Settings no longer lost after a restart. Admin configuration is now stored more reliably, fixing cases where external connections and model parameters could be lost after restarting the server. Commit, Commit, Commit, #24743, #25911, #25959
📜 Visible chat scrollbar. The chat area now shows a scrollbar, making it easier to scroll through long responses. Commit, #25833
🎚️ Default model parameters apply to requests. Default model parameters are now applied to outbound requests, so settings like temperature and the context window take effect as configured. Commit, Commit, #24930, #26209
🟢 Ollama loaded-model indicator restored. The indicator showing which Ollama model is loaded in VRAM works again after recent changes. #25586, #25732
🪪 Static MCP connectors recover missing OAuth details. MCP connectors configured with static OAuth credentials now fill in a missing scope or resource from the server's published metadata, so they connect correctly instead of failing when those values were left out. Commit, #25898
📊 Token usage and cost stats no longer wiped by background tasks. A response's token usage and cost are now preserved when background tasks like title, tag, and follow-up generation run on the same chat, instead of being overwritten. Commit
🔗 Model share link updated. Sharing a model now opens the current community post page, fixing the link that pointed at the old endpoint. #25801
Changed
⚠️ Database Migrations: This update contains database migrations. Please be sure to back up your database before updating, as downgrading after the migration is not supported.
🔔 System events now fire automatically. With the new event system, Open WebUI emits events for activity like startup, sign-ins, and configuration changes, so any webhook you already have configured may begin receiving calls for these newly emitted events after upgrading. Review your event and webhook settings after updating so you only receive the events you want. Commit
🔀 Native tool calling is now the default. Every chat and model that had not explicitly chosen a tool-calling mode now runs Native, which relies on a model's built-in tool support, while the old behavior has been renamed "Legacy" and made the explicit opt-out; if your models depend on the previous approach you must switch them back to "Legacy" per chat, per model, or globally in your default model parameters to preserve their behavior. Commit
🗂️ Authentication settings moved to their own page. LDAP, OAuth, and related authentication settings have moved out of the General settings page into a dedicated Authentication page in the admin panel. Commit
🎓 Several features are no longer beta. Memories, Notes, Channels, and High Contrast Mode have graduated out of beta and no longer carry a beta label. Commit
🔧 Local web fetch setting renamed. The "ENABLE_RAG_LOCAL_WEB_FETCH" environment variable is now "ENABLE_LOCAL_WEB_FETCH", reflecting that it applies beyond retrieval; the old name still works as a deprecated alias. Commit
🔧 You.com search key renamed. You.com web search now prefers the "YDC_API_KEY" environment variable, with the previous "YOUCOM_API_KEY" still accepted as a fallback. Commit, #26316
🧪 Client-side Python now runs sandboxed. Client-side Python (Pyodide) now runs in a sandboxed, opaque-origin iframe by default, isolating executed code from your session, cookies, local storage, and the app's own endpoints, while full Python, JavaScript, and external network access keep working. Code that relied on reaching same-origin Open WebUI endpoints from Pyodide will no longer be able to, and Pyodide is now marked legacy in the admin Code Execution settings. Commit, Commit, Commit, Commit, Commit

Original source

Added

📦 Official knowledge base sync tool. A new companion tool from Open WebUI, oikb, keeps a knowledge base in sync with a local directory, GitHub repo, S3 bucket, Confluence space, or any of more than 40 other sources, uploading only new and changed files using the incremental sync support added in this release. oikb

📂 Smart directory sync for knowledge bases. Local directories can now be synced into a knowledge base in one action: file checksums are compared against what's already stored, and only added or modified files are uploaded while removed files and orphaned subdirectories are cleaned up, with the directory structure mirrored automatically and per-file progress shown throughout. #19190, #19394, Commit, Commit, Commit, Commit, Commit, Commit

🗂️ Knowledge base folders. Files inside a knowledge base can now be organized into nested folders, with breadcrumb navigation that makes it much easier to manage and find content in large collections. Commit, Commit, Commit, Commit, Commit, Commit

🧰 Filesystem tool for knowledge bases. A new built-in tool, enabled via the "ENABLE_KB_EXEC" environment variable, lets AI models browse and search knowledge base contents using familiar filesystem commands such as 'ls', 'cat', 'grep', 'find', 'head', 'tail', and 'sed', including pipes between them. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit

✏️ File renaming in knowledge bases. Files inside a knowledge base can now be renamed directly from the workspace, with the new name reflected wherever the file is referenced. Commit

😀 Emoji picker in message input. A new emoji button in the rich text formatting toolbar lets you browse and insert emojis directly into your messages. #24704

🪄 Per-chat skills toggle. Skills can now be turned on or off for a conversation directly from the chat Integrations menu, the same way tools and capabilities already work, instead of only through the model preset. #25036, #25037

🔎 Access preview for users and groups. Administrators can now preview exactly which models, knowledge bases, and tools a given user or group can access, making it easier to audit and verify permission setups. Commit

📄 Configurable knowledge base file page size. Administrators can now request a larger page size when listing a knowledge base's files through the API, reducing the number of requests needed to retrieve large collections instead of paging through fixed increments of 30. #25148, Commit

🔃 Persistent processing indicator for knowledge files. Files still being processed in a knowledge base now keep showing a processing indicator across page reloads, so you can tell what's still ingesting after navigating away and back. #25031, Commit

📑 MinerU file type configuration. Administrators can now configure which file types are processed by the MinerU document loader, via the new "MINERU_FILE_EXTENSIONS" setting, extending it beyond PDF to formats like DOCX, PPTX, and XLSX. Commit

📃 Legacy Word document support. Older ".doc" Word files can now have their text extracted by the default document extraction engine, in addition to the modern ".docx" format. Commit

📁 Create subfolders from the folder header. Chat folders can now have subfolders created directly from the folder header in the chat view, not just from the sidebar. Commit

⚡ Faster initial page loads. The configuration endpoint that loads on every page visit no longer runs an unnecessary user-count query, making the initial application load lighter on the database, especially on instances with many users. Commit

🚀 Faster tool-enabled chat completions. Chat completions that use multiple tools now start faster because the tools they reference are fetched from the database in a single batch query instead of one query per tool. #24808, Commit

🏎️ More responsive web search under load. Web search through SearXNG, Google PSE, Brave, Serper, and Serpstack now uses non-blocking network calls, so the server stays responsive to other users while a search is in flight, and concurrent multi-query searches complete faster. Commit

🐎 Lighter Ollama backend connections. Requests to Ollama backends now reuse a shared connection pool instead of opening a fresh session each time, reducing TCP and TLS handshake overhead for installs that poll Ollama frequently or have multiple backends configured. Commit

💽 Fewer redundant model-list writes. On multi-instance deployments backed by Redis, the model list is no longer rewritten when it hasn't changed, cutting a major source of redundant writes. #25469, #25474, Commit

📉 Faster websocket disconnect cleanup. Disconnecting from a collaborative session no longer triggers a scan across the entire Redis keyspace, using a per-session index instead, which keeps disconnects cheap on large deployments. #25466, Commit

📝 Frontmatter auto-fill for tools, functions, and skills. Opening a tool, function, or skill editor now auto-fills the name, id, and description fields from the file's frontmatter, saving you from re-entering metadata already declared in the source. #24649, Commit

🪪 More user placeholders in custom headers. Custom-header templates for direct connections and tool servers now support "{{USER_EMAIL}}" and "{{USER_ROLE}}" alongside the existing user and session placeholders. Commit

⏱️ Configurable MCP connection timeout. The timeout for the initial handshake with an MCP tool server is now configurable via the new "MCP_INITIALIZE_TIMEOUT" setting, so servers that are slow to start or expose many tools can finish connecting instead of timing out. #25011, Commit

📐 Profile image size limit. Administrators can now cap the size of inline profile images via the new "PROFILE_IMAGE_MAX_DATA_URI_SIZE" setting, bounding how much database and cache space inline avatars and model icons can consume. #25468, #25476

🎫 Wildcard OAuth role mapping. Administrators can now set "*" in the allowed OAuth roles to grant the user role to any authenticated OAuth user, instead of having to enumerate every accepted role. #25062, Commit

📊 Paginated feedback history. The feedback and evaluation history list is now paginated, keeping it responsive for instances that have accumulated large numbers of feedback entries. Commit

🔘 Bulk enable or disable automations. Automations can now be enabled or disabled in bulk from an actions menu on the automations page, instead of toggling each one individually. Commit

➡️ Optional auto-redirect to single sign-on. Administrators can now enable "OAUTH_AUTO_REDIRECT" so that, on deployments with a single sign-on provider and no other login methods, users are sent straight to the provider instead of seeing a login page first. #25067, Commit

☁️ Azure AI Foundry v1 with Entra ID. Open WebUI now supports Azure AI Foundry's OpenAI v1 endpoint together with Microsoft Entra ID authentication, so these connections work without manual workarounds. #24761, #24985, Commit

🌎 Linkup web search provider. Administrators can now select Linkup as the web search provider from the admin settings, with options to configure the API key and search depth. #24752, Commit

🧊 Valkey vector database support. Valkey can now be used as the vector database backend, configurable through new "VALKEY_URL" and related settings including index type, distance metric, and HNSW tuning. #24769, Commit

🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

🌐 Translation updates. Translations for Spanish (Spain), Swedish, German, Korean, Catalan, Russian, Irish, Simplified Chinese, Traditional Chinese, Finnish, Polish, Turkish, and Malay were enhanced and expanded.

Fixed

🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section — some may be withheld for a short time to give administrators time to upgrade. Advisories

🛡️ Tool server permission enforcement. The per-user permission for inline tool servers is now enforced on chat-completion requests, so users without that permission can no longer bypass the admin setting by supplying tool servers directly in their requests. Commit

🔒 Knowledge base access check in search tool. The built-in knowledge search tool now verifies that the caller can access a knowledge base before searching it by id, preventing users from reading the contents of knowledge bases they have not been granted access to. #25113

🗄️ Cross-user access to retrieval collections. Resolving the documents used for retrieval now verifies the caller's access to each referenced file and rejects client-supplied collection names, preventing a crafted request from pulling another user's files or vector collections into its context. Commit

🔣 Collection name validation. Vector collection names are now rejected unless they contain only safe characters, preventing malformed names from reaching the vector store or breaking out of a database query expression. #24982

🚫 Unscoped retrieval collections denied by default. Retrieval requests for collection names that don't correspond to a known file, memory, web-search, or knowledge base are now denied for non-admins by default, with a new "ENABLE_RETRIEVAL_UNSCOPED_COLLECTIONS" setting to restore the previous behavior if needed. Commit

📜 Prompt history authorization. Comparing, deleting, and restoring prompt versions now verify the history entry belongs to the prompt you're authorized for, preventing access to or modification of another prompt's version history. #25056

🚦 Code interpreter permission on the legacy path. The legacy code-execution path now enforces the same permission and capability checks as the current one, so users without the code interpreter permission can no longer trigger code execution through it. #24724

🧱 API key endpoint restriction bypass. The endpoint allow-list that limits which paths an API key may reach is now matched against the routed request path directly, preventing a crafted request from slipping past the restriction. #25123

🚧 System prompt bypass via request parameter. The flag that skips a model's configured system prompt can no longer be set by external clients through a request parameter, so admin-configured system prompts can't be bypassed from the API. #25156

🚪 Terminal proxy path traversal. The terminal proxy now fully decodes request paths before validating them, blocking multi-encoded payloads that could otherwise escape the intended path. #25157

🪤 Cache file path traversal. The cache file server now requires an exact directory boundary match, closing a gap where a sibling directory whose name began with the cache directory's name could be used to serve files from outside it. #25086

🔀 Ollama backend selection access check. Requests can no longer target an arbitrary Ollama backend by index; a caller-supplied backend selector is now verified against the backends that actually serve the requested model. Commit

🔓 Cross-user file exfiltration via image URLs. When a chat message references a file by id in an "image_url" field, the server now resolves that file only for its owner, an administrator, or a user with an explicit read grant, preventing other authenticated users from extracting a file's contents by routing it through the model. #24625, Commit

📌 Chat file attachment access checks. Attaching files to a chat now links only files the caller can read, preventing a user from associating another user's file with their chat to access its contents. #25054

🧾 Model knowledge file ownership checks. Creating or updating a model now verifies that any knowledge files attached to it are files the editor can access, preventing another user's files from being attached to a model. #25055, Commit

📅 Calendar event move authorization. Updating a calendar event to move it into a different calendar now requires write access on the destination calendar, preventing users from injecting events into calendars they cannot write to. #24764

📣 Channel chat access control. Generating a response in a channel context now verifies the caller's access to that channel and scopes the included messages, preventing access to channels or messages the user isn't permitted to see. #24725

🕸️ Web loader SSRF gating with Playwright. When the Playwright-based web loader is in use, page navigations and redirects are now validated the same way as the default loader, closing a gap where the Playwright path could reach internal or otherwise blocked URLs. #24756

🛂 DNS rebinding protection for URL fetches. The IP address validated for an outbound URL fetch is now the same one used for the actual connection, closing a DNS rebinding window where an attacker-controlled hostname could resolve to a public IP during the safety check and then to a private IP when the connection was opened. #24759

🪞 OAuth profile picture redirect handling. The OAuth profile picture fetch now follows redirects only when administrators have explicitly allowed it, closing a window where a redirect from an externally validated URL could be used to reach internal addresses. #24809

🧼 Model profile image script injection. Model profile images are now validated on save and only served inline when they are a known-safe image type, preventing a crafted SVG profile image from running scripts in other users' browsers, while existing legacy images that fail validation are cleared gracefully instead of breaking the model list. #25060, #25173

🧯 Diagram rendering script injection. Mermaid diagrams rendered in chat are now sanitized before display, preventing a crafted diagram from running scripts in the viewer's browser. #25219

🔐 Shared-chat file write protection. Access to a file through a shared chat now only grants read access, so users who can read a shared chat can no longer modify or delete files attached to it. #24755

🔏 Cross-origin embed prompt control. When Open WebUI is embedded in an iframe on a different origin, the embedding page can now only drive the chat input or submit prompts if the user has explicitly opted in via the "iframe Sandbox Allow Same Origin" setting, preventing untrusted host pages from triggering confirmation dialogs or controlling the chat. #24767, Commit

🗂️ Chat folder ownership checks. Creating a chat or updating a chat's folder now verifies the referenced folder belongs to the current user, preventing chats from being associated with folders owned by other people. #24588

🧩 Chat recovery from corrupted history. Chats whose internal message graph was left in a malformed state by a failed regeneration now open and load correctly, with missing roles, parent references, and current-message pointers reconstructed automatically instead of breaking the chat. #24424, #24157, #20474, #24799, Commit

📨 Imported chats with folders appear correctly. Importing grouped chats no longer leaves them invisible when a referenced folder is missing; such chats now appear in the chat list instead of being silently orphaned. #24910, Commit

🎟️ MCP tool server sessions stay connected. OAuth-authenticated MCP tool server sessions are no longer mistakenly refreshed and deleted by the single sign-on session handler, so those connections stay active. #24618, Commit

🤝 MCP OAuth scope discovery. The OAuth flow for MCP tool servers now reads the scopes a server advertises through its Protected Resource Metadata, so connecting to servers that declare their own scopes succeeds. #24730, #24690

🔍 Web search reliability. Web search again fetches page content reliably with the default web loader engine, a new "USER_AGENT" environment variable lets administrators set a real browser user-agent so fetches aren't blocked by Cloudflare, Wikipedia, and other bot-detection systems, and the startup script no longer fails to launch when these new environment variables are unset. #24560, #24793, #24683, Commit

🔥 Firecrawl web search results. Web search using Firecrawl now returns results correctly regardless of which response format the Firecrawl version uses. #24712

🦅 Kagi web search. Web search using Kagi works again after its API endpoint and request method were updated to match Kagi's current API. #25015

🔢 Bracketed numbers in code blocks. Numbers in square brackets such as "[0]" inside code blocks are no longer stripped out as if they were source citations, so code displays and copies correctly. #24948, Commit

🔌 API chat completions reliability. Direct calls to the chat completions API no longer fail with an internal error when no chat session identifier is supplied. #24553, #25235, Commit, Commit

🖼️ ComfyUI image generation and editing. Generating and editing images via a ComfyUI backend now works again, including when ComfyUI is hosted on a private or internal network where URL validation was previously blocking the admin-configured endpoint. #24565, Commit, Commit

🖌️ Image generation with non-standard response headers. Image generation now works with backends that return valid JSON without a standard content-type header, instead of rejecting the response. #24838

🐘 Knowledge search on large documents. Searching knowledge bases on PostgreSQL no longer fails when scanning across documents with very large extracted text content. #24670, Commit

💬 Chat title generation. Automatically generated chat titles now use the model currently selected in the dropdown for the active chat and fall back to the model from the active message branch otherwise, and a clear message is shown if no model is available instead of an unhelpful error. #24604, #24745, Commit, Commit

🧮 Message search and analytics consistency. Edits, deletions, and branch changes made in a chat are now reflected in message search results and analytics counts instead of leaving stale entries behind. #25205, Commit

🩹 Graceful handling of in-chat task failures. When web search query generation, image prompt generation, or a tool call fails or references a missing tool, the chat now falls back or surfaces a clear error instead of breaking partway through the response. #25038, #25144, Commit

🎛️ Filter changes to message output. Filter functions that modify a message's structured output after generation now have those changes saved and displayed, instead of being discarded when only the output, not the text content, was changed. #24884

⏩ Titles and tags reflect filtered output. Outlet filters now run before automatic title, tag, and follow-up generation, so those are based on the final filtered message instead of the unfiltered version. #24717

💾 Action-replaced message content persists. Message content replaced by an action function through its event emitter is now kept when the chat is saved, instead of reverting to the original after a page reload. #24585, #25485

🏷️ Skill mentions in messages. Mentioning a skill in a message now keeps the skill's name as readable text instead of removing it, and selecting a skill without typing anything no longer causes an error on providers that reject empty messages. #24929, Commit

🧹 Usage timer cleanup on send failure. The background usage-stats timer started during message generation is now always cleared, even when sending a message fails, preventing leaked timers from accumulating over a session. #25478

🗑️ Background tasks stop when a chat is removed. Deleting or archiving a chat now cancels any in-flight generation or title and tag tasks for it, instead of leaving orphaned background work running. #25050, Commit

⌨️ Responsive knowledge file search. Searching for knowledge files in the chat picker and model knowledge selector now matches on file names by default instead of scanning the full extracted text of every document on each keystroke, keeping the search responsive on large deployments, with content search available as an explicit opt-in. #25082, #25119, Commit

📥 Document processing with empty embeddings. Saving documents to the vector database no longer crashes when an embedding step returns no vectors, allowing the process to continue instead of failing the whole upload. #25166

🔤 Non-UTF-8 text and CSV uploads. Text and CSV files saved in legacy encodings, including Latin-1, Windows-1252, and Chinese encodings such as GB18030, are now detected and loaded correctly instead of being rejected as binary or failing with an empty-content error. #25172, #24973, Commit, Commit

🧽 Null bytes in nested data no longer break saves. Data containing null bytes nested inside structured fields is now sanitized correctly before being written, preventing database errors that the previous check failed to catch. #25018, Commit

🧠 Clear error when no embedding model is configured. Using knowledge or retrieval features without a loaded embedding model now returns a clear setup error explaining what to configure, instead of failing with a cryptic crash. Commit

🧲 Memory search quality. Memory searches now apply the configured embedding query prefix, so retrieval works correctly with embedding models that require one for queries. #24921, Commit

📚 Knowledge tool context overflow. The built-in tool that lists a model's knowledge no longer dumps every file in every knowledge base into the model's context; it now returns summaries by default and paginates file listings only for a requested knowledge base. #25105, Commit

⏳ Terminal session stability. The terminal proxy no longer hangs when one direction of the connection closes before the other, so terminal sessions shut down cleanly instead of stalling. #25464, #25479

🧷 Tool call continuity with strict providers. Chats that contain incomplete tool calls or orphaned tool results no longer fail to continue when sent to providers that strictly validate tool pairings, such as Anthropic and AWS Bedrock Converse. #24758, #24940, #24798, Commit

🛑 Stream termination for pipe functions. Streamed responses from pipe functions now always send the standard end-of-stream marker, so chat clients and external integrations reliably detect when a response is complete instead of waiting on streams that already finished. #24763

🔊 Non-blocking text-to-speech transcoding. Converting text-to-speech audio to MP3 no longer blocks the server's event loop, so other requests stay responsive even while a TTS response is being transcoded. #24876

🎚️ Default text-to-speech voice. Text-to-speech requests now honor the voice specified in the request and fall back to the configured default only when none is given, instead of always using the admin default or failing. #15143, #25035, Commit, Commit

🪝 Reliable knowledge base file linking. Files uploaded to a knowledge collection are now linked on the server as part of the upload itself, so they remain attached to the collection even if you navigate away or close the page before processing finishes. #24807, Commit

☁️ Azure connections on custom hostnames. Connections marked as the Azure provider now use the Azure code path even when the endpoint does not contain "azure" in its hostname, fixing custom Azure deployments served from non-standard domains. #24882, Commit

🗓️ Clearing calendar event fields. Removing the description or location from a calendar event now saves correctly instead of silently keeping the previous value. #25026, Commit, Commit

💭 Advanced parameter settings. Custom reasoning tags and custom model parameters are now saved correctly instead of being dropped, and the presence penalty and repeat penalty no longer save the frequency penalty's value instead of their own. #25183, #25200, #25204

📏 Long username display. Long usernames no longer overflow their containers in the admin user list, user modals, and sidebar. #25185

🎯 All skills selectable in the model editor. The model editor's skills selector now lists every skill you have access to, with a search box for large lists, instead of showing only the first 30 with no way to reach the rest. #24873, Commit

🔔 Accurate knowledge upload feedback. Dragging files into a knowledge base no longer shows an upload notification before the upload has actually been processed. #25484

♿ High-contrast timestamp readability. The user message timestamp now uses the correct colors in high-contrast mode instead of inverted ones, keeping it readable. #25461

♿ Keyboard and screen reader access to menus. The integrations, more-options, and user menus are now real buttons with labels and keyboard support, so they can be opened with the keyboard and announced by screen readers. Commit

🖱️ Focus-loss handling in editors. Workspace and admin editors for models, tools, functions, and skills again respond correctly when the browser window loses focus, after the wrong event name was being listened for. #25459

🛟 Resilience to corrupted local storage. Corrupted data in the browser's local storage no longer crashes the interface; affected settings and dismissed-banner state now fall back to safe defaults. #25481

📶 Quieter reconnection notifications. Brief connection interruptions, such as backgrounding a mobile tab, no longer flash a "connection lost" warning, and the "reconnected" message only appears if a disconnect was actually shown. Commit

🍎 Safari PDF handling. PDF processing now works in Safari, which doesn't support the stream iteration the previous code relied on. #25151, #25473

🎙️ Voice mode mute shortcut listing. The keyboard shortcut for muting voice mode now appears in the keyboard shortcuts help modal. #25193

📎 Document attachments in channel model replies. Tagging a model in a channel thread now forwards uploaded non-image documents such as PDFs and DOCX files into the model's context, so document summarization and comparison workflows that already worked in direct chat now work in channels too. #24896, #24898, Commit

🙈 Hidden models in channel mentions. Models marked as hidden no longer appear in the channel message-input model mention selector, matching how hidden models are excluded elsewhere in the interface. #24892

🧵 Channel thread and pinned message stability. Opening a channel thread or the pinned messages view no longer fails to render when a message or its data is missing. #25209

📺 YouTube short link transcripts. Pasting a "youtu.be" short link into a chat now loads the video transcript correctly instead of failing with an empty-content error. #24856, Commit

🙉 Hidden models in default-model and automation pickers. The admin pickers for default models and default pinned models, and the automation model dropdown, now filter out hidden models, consistent with how hidden models are treated elsewhere. #24869, Commit, Commit

🔊 Speech-to-text SSL setting honored. Speech-to-text requests now respect the "AIOHTTP_CLIENT_SESSION_SSL" setting, so administrators using self-signed certificates or custom SSL configurations can use STT engines that were previously failing TLS verification. #24568, #24857, Commit, Commit

🔗 Placeholders in MCP connection headers. Custom header templates configured on MCP server connections now have their "{{USER_ID}}", "{{USER_NAME}}", "{{USER_EMAIL}}", "{{USER_ROLE}}", "{{CHAT_ID}}", and "{{MESSAGE_ID}}" placeholders interpolated at request time, matching how custom headers already work for direct connections and tool servers. #24822

🪟 Bing search CLI smoke test. Running the Bing web-search module from the command line for a quick connectivity check no longer raises an error about missing arguments. #24765, #24768

🩺 Database health check recovery. After a transient database connection error, the health check endpoint now recovers automatically instead of staying permanently broken on the affected worker. Commit

🥾 Startup on non-Unicode consoles. Open WebUI no longer crashes at startup when the console can't encode the banner's box-drawing characters, such as on Windows or with redirected or headless output, falling back to a plain-text banner instead. #24965, #25482

🆕 First admin signup after a reset. Creating the first administrator account is no longer blocked by a previously stored signup setting, so a fresh or reset instance can always be bootstrapped. #24821

🪵 JSON exception logging. With JSON log formatting enabled, exceptions are now recorded correctly with a structured type, message, and stacktrace instead of being dropped, and a logging failure can no longer crash the application. #25135, Commit

🧭 Workspace skills permission. Users granted only the "workspace.skills" permission can now see the workspace entry in the sidebar and are correctly routed to the skills page from the workspace index. #24729

🔁 Resilient database migrations. Database migrations now skip tables, indexes, and columns that already exist and add missing primary keys to legacy tables, so upgrades succeed even when parts of the schema were manually or partially created beforehand. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, #24722

Changed

⚠️ Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.

⚙️ Tool-call iteration cap renamed and raised. The environment variable that limits how many tool calls a single chat response may make is now "CHAT_RESPONSE_MAX_TOOL_CALL_ITERATIONS", with its default raised from 30 to 256 and a new "-1" value for unlimited; the previous "CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES" name continues to work as a fallback, and chats that hit the cap now show a clear error in-chat instead of stopping silently. #24918, Commit

🔐 Reduced public "/api/config" exposure. The "/api/config" response no longer includes several feature flags ("enable_api_keys", "enable_password_change_form", "enable_version_update_check", "enable_public_active_users_count", "enable_easter_eggs") for unauthenticated callers, reducing information disclosure to anonymous visitors. Commit, Commit

🔑 "WEBUI_SECRET_KEY" is now a hard requirement even for unsupported deployments. Deployments that start the backend in an explicitly unsupported way (such as invoking uvicorn directly) without setting "WEBUI_SECRET_KEY" will now refuse to start instead of falling back to an empty key; the supported start methods (start.sh, start_windows.bat, and "open-webui serve") still set or auto-generate it automatically, so standard deployments are unaffected. Direct Uvicorn startup is not supported. #25218

Original source

Added

🛡️ Redirect-based SSRF protection. All outbound HTTP requests now block 3xx redirects by default via a new AIOHTTP_CLIENT_ALLOW_REDIRECTS environment variable, preventing redirect-based SSRF where a public URL silently redirects to internal addresses (RFC 1918, loopback, cloud-metadata endpoints). Affected call sites include web fetch, image loading, OAuth discovery, tool server execution, and code interpreter login. #24491

🛡️ Iframe content security policy. Administrators can now configure a Content-Security-Policy for all srcdoc iframes (Artifacts, tool embeds, file previews, citation modals) via the IFRAME_CSP environment variable, restricting what LLM-generated or user-uploaded HTML can load and execute inside previews. Commit

🎛️ Granular markdown rendering controls. Users can now independently disable Markdown rendering for user messages and assistant responses from Interface settings, preventing unintended formatting when pasting text that contains Markdown-sensitive characters. Commit

🔧 Terminal proxy response headers. Administrators can now inject custom response headers into terminal proxy responses via the TERMINAL_PROXY_HEADERS environment variable (JSON object), enabling deployment-specific security headers like sandbox policies for proxied content. Commit

🔌 Channel streaming and tool support. Mentioning a model in a Channel now streams responses in real time and supports the full chat completion pipeline, including native and default function calling, built-in tools (web search, image generation), user tools, MCP tools, filters, and RAG knowledge injection — the same capabilities available in standard chats.

📝 Notes create and open reliability. Creating new notes and opening existing notes no longer fails with a TypeError caused by is_pinned being passed to the SQLAlchemy model on create, and passed twice to NoteResponse on read. #24484, #24486

🔐 Skill public sharing permission enforcement. Creating or updating skills now filters access grants through the sharing.public_skills permission, preventing non-admin users from making skills publicly accessible without the required permission. #24494

🔐 Calendar public sharing permission enforcement. Creating or updating calendars now filters access grants through a new sharing.public_calendars permission, preventing users from making calendars publicly readable or writable without explicit admin-granted sharing permission. #24493

🔐 Feedback user attribution spoofing. Submitting evaluation feedback can no longer forge the user_id field through mass-assignment, preventing authenticated users from attributing ratings to other users and corrupting Elo leaderboard rankings and admin feedback exports. #24508

🛡️ Image URL redirect-based SSRF. Chat messages containing image URLs no longer follow 3xx redirects to internal addresses during base64 conversion, closing the most reachable redirect-based SSRF variant that required no special permissions or feature flags. #24524

🛡️ Collection write access on file processing. The process_file and process_files_batch retrieval endpoints now enforce collection write-access checks before embedding content, preventing authenticated users from injecting file content into another user's knowledge-base collection. #24524

🔐 Tool source code update authorization. Updating a tool's Python source code now requires workspace.tools or workspace.tools_import permission, preventing users with only a write-access grant from overwriting executable tool code while still allowing metadata edits. #24513

🔐 Channel message ownership enforcement. Updating or deleting messages in group and DM channels now requires message ownership, preventing channel members from tampering with or silently removing other members' messages. #24506

🔐 Channel pin write permission. Pinning and unpinning messages on standard channels now requires write permission instead of read permission, preventing read-only users from modifying pinned content. #24521

🛡️ Image generation URL validation. Generated image URLs are now validated through validate_url() before fetching, aligning the defense-in-depth posture with sibling image-loading paths. #24518

🔐 Model params exposure for read-only users. The per-model API endpoint now strips the params dict (including system prompts) from responses to callers without write access, preventing read-only users from viewing admin-curated model configuration. #24525

🛡️ URL parser SSRF bypass. URL validation now rejects backslash, tab, CR, and LF characters that cause urllib and requests/aiohttp to disagree on the target host, closing a parser-confusion SSRF bypass. #24534

🛡️ Profile image MIME-type allowlist. Serving profile images from data URIs now enforces a strict MIME-type allowlist (PNG, JPEG, GIF, WEBP by default, configurable via PROFILE_IMAGE_ALLOWED_MIME_TYPES) and sets X-Content-Type-Options: nosniff, preventing stored-XSS through SVG or other executable content types. Commit

🔐 File ownership in folder and knowledge attachments. Attaching files to folders or knowledge bases now verifies per-file read access, and folder file lists in chat middleware are filtered to entries the caller can read, preventing unauthorized file content from being injected into RAG context. Commit

🔐 Shared chat access for owners and admins. Chat owners can now view and clone their own shared chats without requiring an explicit access grant, and administrators can manage shared chat access controls on any chat. Commit, Commit

🧵 Legacy chat history self-healing. Loading legacy conversations now automatically detects broken parent-link graphs in migrated message records, merges missing messages from the embedded JSON history, and backfills them to the normalized table so future loads use the fast path without data loss. Commit

🎛️ Filter selector reactivity. Model filter checkboxes now derive state reactively from the current filter list and selected IDs instead of capturing a one-time snapshot at mount, so checkboxes update correctly when model contexts or filter configurations change at runtime. Commit

🌐 Portuguese (Brazil) translation updates. Translations for newly added UI items were added along with a consistency pass across existing entries. #24503

Changed

🧹 Removed unauthenticated retrieval status endpoint. The unauthenticated GET /api/v1/retrieval/ status endpoint has been removed as dead code — retrieval configuration is already available through authenticated admin endpoints. #24497

📋 PR template issue requirement. Pull requests now require a linked Issue or Discussion reference, ensuring better traceability for all contributions. PRs without a linked issue or discussion may be closed without review.

Original source

Added

🔇 Voice Mode mute control. Voice Mode now includes a dedicated mute toggle with an "M" shortcut and auto-unmute after assistant playback, so you can prevent accidental interruptions from background noise without leaving the call overlay. Commit, #23832

🚀 Faster prompt list loading. Prompt and prompt-tag pages now load much faster for non-admin users, even with large prompt libraries, because accessible prompts are filtered efficiently in a single database query. #24288, #24258

⚡ Faster chat history loading. Chat history maps now load from normalized message records when available, reducing overhead for large conversations while preserving fallback behavior for legacy chats. Commit, #23159

🗑️ Delete from conversation menu. You can now delete the current conversation directly from the chat menu with a confirmation step, so cleanup is faster without searching through the full chat list. Commit, #24329

⬆️ Scroll to Top shortcut. Long conversations now include a Scroll to Top action in the chat menu when you are away from the top, making it much faster to jump back to the beginning of a chat. Commit, #24133

📅 Calendar creation flow. Users can now create calendars from a dedicated modal and a quick-add action in the calendar sidebar, making calendar setup faster from the calendar workspace. Commit, Commit

🧭 Unified model unload controls. Administrators can now unload running models from the model selector across supported providers, with loaded-state indicators shown for Ollama and llama.cpp models. Commit

⚡ Health check responsiveness. Health and readiness probes now avoid blocking database calls and skip sync session commit handling on probe paths, improving responsiveness and reducing false unready transitions during database pressure. #24380, #24384

🎛️ Playground controls panel. The Playground now includes a dedicated Controls toggle so you can adjust parameters like temperature and related settings per chat run without changing model-level defaults. Commit, #24103

🎙️ STT file extension controls. Administrators can now configure which audio file extensions are accepted for speech-to-text uploads, helping enforce safer and more predictable upload policies. Commit

📷 Remembered call camera selection. Voice call overlay now remembers your last selected camera and restores it automatically when available, so you do not need to reselect it every time you start voice mode. Commit, #24416

👥 User group prompt variable. System and template prompts now support the "{{USER_GROUPS}}" variable, which expands to the user’s group memberships so prompts can adapt to role- or access-based context automatically. Commit, #24462

🔐 Public chat sharing permission control. Administrators can now control whether users are allowed to create publicly shareable chats through a dedicated permission setting. Commit

🔐 Profile image forwarding control. Administrators can now disable external profile image URL forwarding with the "ENABLE_PROFILE_IMAGE_URL_FORWARDING" setting to prevent browser metadata leaks to third-party servers. #24420

🏷️ Dynamic header template variables. Administrators can now use chat, message, and user template variables in custom connection and tool server headers so each request can carry per-conversation context automatically. Commit, #24164

🛂 MCP OAuth server URL setting. Static OAuth tool server setups can now define a separate OAuth server URL, making discovery and client registration work when authentication endpoints are hosted separately from the tool server URL. Commit, #24164, #24216

⚡ Faster memory query performance. Per-user memory lookups and deletions now run much faster at scale because the memory user filter is indexed for existing and new installations. Commit, #23836

🚀 Smarter function dependency installs. Function dependencies are now skipped when they were already preinstalled and unchanged, reducing first-load delays and repeated package installation churn after startup. Commit, #24166

🔎 Brave LLM Context web search. Administrators can now choose Brave LLM Context as a web search provider to retrieve richer grounded passages with a configurable context token budget. Commit, #24120

🗂️ Open Terminal date sorting. Open Terminal now includes sort controls for name and date, with directory-first ordering and modified-time visibility to make file browsing faster. Commit, #24425

🎤 Voice mode prompt toggle. Administrators can now explicitly enable or disable the Voice Mode custom prompt behavior from Interface settings, giving finer control over how voice replies are guided. Commit

🧮 LaTeX copy shortcut. You can now click rendered LaTeX expressions to copy the raw formula to your clipboard, making it easier to reuse equations outside chat. Commit, #24244

✨ Smoother rich text editing. The message composer now defers formatting toolbar refresh work to the next animation frame, reducing typing jank while formatting controls stay accurate. Commit, #24013

🖼️ Arena model profile images. Arena models can now reliably display configured profile images instead of falling back to the default icon. Commit, #24412

🔄 Replaceable tool embed updates. Pipes and Tools can now overwrite previously emitted rich-UI embeds in-place by passing a replace flag on the embeds event, enabling live dashboards and progress panels that update without stacking duplicate entries.

✏️ Assistant response editing and continuation. You can now edit and restructure assistant output items — including reasoning blocks, tool calls, and text content — from a dedicated editor view, and continue generating from the edited state so the model receives full prior context.

🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

🌐 Translation updates. Translations for Chinese, Catalan, Filipino, and Korean were enhanced and expanded.

Fixed

🧵 Background code execution reliability. Code execution no longer hangs indefinitely when you switch conversations or browser tabs during a run, and disconnected or inactive sessions now fail with a clear timeout error instead of endless processing. Commit, #24089

🎙️ Voice recording MIME fallback support. Voice recording now tries a broader set of browser-supported audio formats and resets halted audio playback cleanly, improving microphone capture reliability in browsers where recording previously failed to start. Commit, #24162

🧠 Direct-connection task generation reliability. Title, tags, follow-up, emoji, query, and related task-generation endpoints now work correctly when chats use direct-connection models instead of failing with model-not-found errors. Commit, Commit, #24092

🔧 Parameterized URL tool readiness. New chats now wait for model defaults to finish applying before auto-submit, preventing early requests that can miss configured external tools. Commit, #24176

🚦 MCP cleanup response reliability. Successful native MCP tool calls no longer get replaced by a 500 "No response returned" error during cleanup, so valid chat responses are now returned consistently. #24105

🧵 Active task state recovery. Chat input no longer stays blocked by unrelated background tasks after a response is already complete, and interrupted assistant replies are now marked done more reliably. Commit, #23264

📌 Per-user note pinning behavior. Pinned notes are now tracked per user instead of with a shared note-level flag, so one person’s pin changes no longer affect everyone else. Commit

🧱 Custom header value coercion. Custom header values are now converted to text before requests are sent, preventing request failures when non-text values are configured. Commit, #24164

🔗 HTTP share link copy fallback. Copy Link now works reliably on HTTP deployments by using a selection-based fallback when secure clipboard APIs are unavailable. Commit, #24135

🧵 Regeneration loading lock recovery. Chats no longer get stuck in a permanent loading state after failed regenerations because invalid message-tree references are repaired before rendering. Commit, #24424

📸 Complete chat image capture. Downloaded chat snapshots now include all messages more reliably through visibility overrides and layout timing improvements during capture. Commit, Commit, #24088

🗓️ Calendar deletion lock handling. Calendar deletion now avoids SQLite write-lock contention by revoking calendar access grants in a separate transaction after calendar and event removal. Commit

🧩 Filter and internal tool coexistence. Internal tools now remain available when filters add provider-native tools, so filter-added tools no longer replace the built-in tool set during request processing. Commit, #24237

🛠️ OpenAPI tool spec compatibility. OpenAPI tool integrations now handle null or non-operation path entries more safely and parse path-level parameters consistently, preventing crashes and improving tool execution reliability across imperfect OpenAPI specs. Commit, Commit, #24376

🧰 OpenAPI tool schema parsing. OpenAPI tool imports now ignore non-method path item fields and correctly resolve nested composition schemas, preventing invalid tool parsing for compatible specs. Commit, #23254

🌍 Web search proxy compatibility. DuckDuckGo search now respects configured proxy environments more reliably, and trust-env behavior defaults to enabled so proxied web loading does not fail unexpectedly. Commit, #23810

🧾 Final markdown render flush. Streaming markdown now forces an immediate final parse when generation completes, preventing stale or partially rendered final output. Commit, #24088

🛡️ Webhook avatar URL validation. Channel webhook profile image URLs are now validated before saving, preventing invalid or unsafe avatar URLs from being accepted. #24370

📝 System prompt editor scroll stability. Editing large system prompts no longer jumps the page back to the top, so you can continue editing long model prompts without losing your place. Commit, #23999

🔎 Knowledge content search matching. Knowledge file search now matches both file titles and file content, so relevant files are easier to find even when the keyword is not in the filename. Commit, #24297

⚡ Faster prompt tag loading. Prompt tag filters now load much faster for non-admin users by fetching only accessible tags directly, avoiding per-prompt permission checks and unnecessary prompt data loading. #24287, #24258

🧾 Citation overflow badge readability. Citation overflow badges now keep multi-digit counts readable in a single compact bubble, preventing wrapped or cramped display when many sources are attached. Commit, #24391

🌐 Yandex result parsing guard. Yandex web search no longer fails when some XML fields are missing in individual results, so valid search responses continue to return usable sources instead of dropping to no results. Commit, #24243

🎧 Safer voice transcription uploads. Empty or failed voice conversions are now rejected with a clear error instead of continuing as malformed audio, reducing failed transcription attempts from corrupted or near-empty recordings. Commit

🎚️ Safer chunked STT processing. Chunked transcription now limits worker concurrency when no external STT engine is configured, reducing failed transcription behavior caused by overly parallel local processing. Commit

📈 Imported chat analytics coverage. Imported ChatGPT conversations now carry proper model and timestamp metadata and reliably write imported messages into analytics-backed storage, so imported chats are reflected correctly in Admin Analytics totals and model usage views. Commit, #24263

📎 Knowledge collection persistence. Knowledge collections selected with the chat input selector now remain attached after reloads and chat switches, so attached context no longer disappears between sessions. Commit, #24142

🧹 Embedding model name trimming. Embedding model names entered in Documents settings now automatically trim surrounding whitespace, preventing silent embedding failures caused by accidental trailing spaces. Commit, #24090

🔊 PCM TTS playback compatibility. Text-to-speech audio returned as PCM is now converted to MP3 before delivery, so speech playback works correctly with providers that return raw PCM audio. Commit, #24143

🪟 Windows PostgreSQL startup compatibility. Windows pip installs using PostgreSQL now start reliably with psycopg async by using a compatible event loop policy instead of the default Proactor loop. Commit, #24152

⏱️ MCP OAuth timeout control. OAuth token exchanges for MCP tool server connections now respect the configurable client timeout setting, reducing callback failures with slower providers. Commit, #24138

📄 PDF text search restoration. PDF previews now include a proper text layer so browser text selection and find-in-page search work again instead of rendering only image-like pages. Commit, #24149

🔑 Android password autofill support. Password inputs now expose the expected field name metadata, improving password manager autofill reliability on Android login pages. Commit, #24137

🎤 Non-blocking STT processing. Speech-to-text transcription no longer blocks the server event loop during both live transcription and uploaded audio file processing, so other users can continue using chats and live connections under concurrent load. #24338, #24379, #24169

🌐 SearXNG language parameter handling. Web searches now send clean multi-language values without trailing separators, so SearXNG requests no longer fail when multiple languages are selected. Commit, #24198

📂 File modal open-link behavior. Clicking a file name in the file details modal now opens the correct file content in a new tab for uploaded file items instead of failing to open. #24125

📎 Chat attachment display recovery. Files attached by chat tools now appear reliably in assistant responses, including non-image file attachments that were previously hidden. Commit, #24332

🧱 Channel embed rendering guard. Channel message embeds now appear only for model-generated messages and are suppressed in reply previews, preventing unintended embed expansion in regular user posts. Commit

🛡️ Safer image URL handling. Untrusted external image URLs are now blocked in profile and rich-text image rendering paths, preventing unintended client-side requests to attacker-controlled domains. #24420

🛡️ Sanitized spreadsheet HTML previews. Spreadsheet previews now sanitize generated HTML before rendering, reducing the risk of unsafe content being executed when opening office files in chat and file modals. #24468

🧰 Multi-worker tool update consistency. Updated tool code now refreshes correctly across workers without requiring a full service restart, so chats no longer run stale tool versions after edits. Commit, #24400, #24433

🧩 Default model metadata env parsing. The "DEFAULT_MODEL_METADATA" environment setting is now parsed and applied correctly, including when persistent config is disabled, so configured model capability defaults are no longer ignored at startup. Commit, #24319

🔄 Config import and Redis consistency. Imported settings now remain effective after import because configuration values are immediately synchronized to Redis, preventing stale cached values from overriding imported permissions and settings. Commit, Commit, #24346

🔔 LDAP signup webhook parity. New accounts created through LDAP now trigger the same signup webhook notifications as password and OAuth signups, so downstream provisioning and audit automations receive consistent events. Commit, #24377

🦆 DDGS auto-backend compatibility. Web search now handles DDGS automatic backend selection correctly and safely falls back on empty or rate-limited responses, preventing search failures in newer DDGS versions. Commit, #24188

🤖 Automation update tool reliability. Updating existing automations in chat now works correctly instead of failing with a missing method error. Commit, #24405

📅 Calendar event permission checks. Calendar event update and delete actions now handle ownership and access checks more reliably, returning clean access-denied results when appropriate. Commit

🛡️ Safer cached file delivery. Cached files that are not recognized as image, audio, or video now download as attachments instead of rendering inline, reducing the risk of unsafe browser content handling. Commit

📊 Streaming token analytics accuracy. Admin Analytics now records and aggregates token usage correctly for streaming chats across Responses API and OpenAI-compatible providers, including fallback handling for provider usage formats that use prompt and completion token keys. Commit, Commit, #24217, #24294, #24241

🔗 Admin shared chat links. Admin users can now open and clone shared chat links reliably without 401 errors because shared links are now resolved by share ID first, with safe fallback behavior for direct chat ID access. Commit, #24311, #24096

💾 Chat settings persistence. System prompts and other chat-level settings now persist correctly after creating a new chat and reloading, preventing prompt loss in affected conversations. Commit, #24193, #24270

💾 Chat control autosave persistence. Changes to chat controls like system prompt, parameters, and attached files are now autosaved on existing chats, so edits are no longer lost when you refresh or navigate away before sending a message. Commit, #23897

☁️ OneDrive option visibility. OneDrive personal and business upload options now appear only when their respective client IDs are configured, preventing unavailable options from showing in attachment menus. Commit, #24411

🧠 Reasoning content leakage prevention. Tool-call round-trip messages no longer wrap reasoning text in <think> tags inside the content field, preventing raw markup from leaking into chat output for models whose templates don't strip think tags (e.g. Gemma 4). #23844

🖥️ Terminal sidebar auto-open guard. The terminal sidebar no longer auto-opens on chat load when OpenTerminal is disabled, because stale terminal IDs saved on models or in localStorage are now validated against available terminal servers before use.

🔁 Single-confirmation connection deletion. Deleting OpenAI, Ollama, tool server, and terminal server connections now shows exactly one confirmation dialog instead of two, because redundant outer confirmation wrappers were removed from all connection components.

🧵 Reliable background task cleanup. The chat task lifecycle now deregisters completed tasks before checking for remaining siblings, eliminating the off-by-one timing issue that could leave the stop button stuck or dismiss the sidebar activity spinner too early.

Changed

⚠️ Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.

🚪 Signout request method. The signout endpoint now requires POST instead of GET, so custom clients and integrations must update logout calls accordingly. #24420

Original source

Added

🧠 PaddleOCR-vl document extraction. Administrators can now use PaddleOCR-vl as a content extraction engine for document processing, with configurable API URL and token settings in document retrieval configuration. #23945

🔥 Firecrawl v2 API. Firecrawl web loading now uses the v2 API directly with proper retry logic, exponential backoff on rate limits, and configurable timeout handling, improving reliability for both cloud and self-hosted Firecrawl setups. #23934

⏰ Calendar event reminder customization. Calendar events now support a configurable reminder_minutes parameter, allowing models to set custom reminder durations instead of the default 10-minute notification.

🔑 Custom API key header. Administrators can now configure a custom header name for API key authentication via the CUSTOM_API_KEY_HEADER environment variable, enabling compatibility with reverse proxies that use the Authorization header for their own authentication.

🔌 OAuth session disconnection. Users can now disconnect OAuth sessions for specific providers (e.g., MCP connections) through a new API endpoint, enabling cleaner re-authentication workflows.

📚 Source overflow indicator. The Sources button now shows a +N badge when more than three sources are available, so hidden sources are clearly indicated in chat responses. #23918

⚡ Model list performance. Model list API responses now strip base64 profile image data from paginated results, and model tags are fetched via a dedicated efficient query instead of loading all models. This significantly reduces payload sizes and improves workspace Models page responsiveness.

⚡ Model avatar cache reuse. Default model profile images now redirect to a shared static path instead of reading files from disk per-request, reducing repeated I/O and improving loading efficiency when multiple models use the fallback icon. #24015

🚀 Faster splash image loading. Splash screen images are now prioritized earlier during page load with preload links, improving first-load LCP behavior and reducing delayed image discovery. #24011

🧵 Streaming markdown performance stability. Streaming responses now stay more memory-efficient by preventing repeated cleanup callback registration during markdown updates. #24048

📊 Telemetry gauge reliability. OpenTelemetry user gauge callbacks now use synchronous database queries directly, eliminating cross-thread async bridging issues that could cause silent failures in metric collection.

🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.

🌐 Translation updates. Translations for Finnish, Korean, Portuguese (Brazil), and Dutch were enhanced and expanded.

Fixed

🔧 MCP task cancellation stability. Interrupted MCP tool calls no longer cause CPU spikes or runaway cleanup behavior. MCP client disconnection now runs in the same asyncio task as connection, respecting cancel scope constraints, and chat-active events are properly shielded during cancellation.

🧠 Persistent chat skill injection. Skills mentioned in persisted chats now inject into the system prompt reliably. Skill ID extraction from <$skillId|label> message tags is now handled server-side, and tags are stripped before messages reach the model.

🗄️ Async database driver migration. The async database backend now uses psycopg (v3) instead of asyncpg, eliminating brittle SSL parameter translation and supporting native libpq connection strings including sslmode, options, and target_session_attrs without any stripping or conversion.

🐳 Docker ARM64 reliability. Docker images built for arm64 via QEMU cross-compilation no longer produce 0-byte corrupted Python dependencies. UV_LINK_MODE=copy is now set in the Dockerfile to force reliable file installation.

🛠️ Throttle request handling. Request handling no longer fails when user activity status updates are throttled with a non-zero interval. #23979

✍️ Rich text extension conflicts. Rich text editing no longer triggers duplicate extension conflicts for lists and code blocks, improving editor stability. #24009

🔇 Fetch URL null content guard. The fetch_url built-in tool now safely handles None content returned by web loaders instead of crashing with a TypeError.

🌐 OAuth discovery fallback. OAuth protected resource discovery now falls back to well-known RFC 9728 URIs when the WWW-Authenticate header doesn't contain a resource_metadata link, improving compatibility with more MCP server implementations.

🔐 Session token resolution. Session user endpoints now gracefully handle missing Authorization headers by falling back to cookie and request state tokens, preventing errors when used behind forward-auth proxies.

🚫 Direct API error responses. Chat completion requests without a WebSocket channel (direct API calls) now return proper HTTP error responses instead of silently returning null on failure.

📡 Cancelled response stream cleanup. Cancelled chat generation now explicitly closes the upstream response body iterator, preventing orphaned async generators from spinning in anyio internals.

🔒 Model profile image path safety. Model profile image endpoints now validate and sanitize static asset redirect paths, preventing path traversal through encoded dots or malicious URL patterns.

📊 RAG template validation UI. The Documents settings page now displays a warning when RAG templates contain multiple [context] or {{CONTEXT}} placeholders, helping administrators avoid accidental redundant context injection.

🧩 Automation model detection. The create_automation tool now correctly detects the current model ID even when model_id is not yet set in metadata, falling back to the model dict.

🔄 MCP resource content handling. MCP tool results with the resource content type are now correctly detected and their resource.text payload is extracted, instead of being silently ignored.

🔄 Ollama and OpenAI metadata forwarding. Ollama and OpenAI proxy routes now forward request metadata to downstream handlers, ensuring consistent context propagation.

🧹 Browser-native message virtualization. The custom JavaScript-based message culling system (spacers, height caching, scroll listeners) was replaced with CSS content-visibility: auto, letting the browser natively skip rendering of off-screen messages without destroying component trees. This eliminates scroll jump artifacts and mount/destroy thrashing while preserving memory efficiency in long conversations.

📻 Redis notification compatibility. Redis pub/sub now handles missing or incompatible client_name support more gracefully, preventing connection errors with certain Redis configurations.

Changed

⚙️ psycopg v3 async driver. The async database driver has been migrated from asyncpg to psycopg (v3). This is a transparent change for most deployments, but custom connection strings with asyncpg-specific parameters may need adjustment.

🔑 Brotli dependency update. Brotli has been updated to address CVE-2025-6176.

🖥️ Windows startup script. The Windows startup batch script has been updated for improved compatibility.

Original source

Fixed

🐛 Missing aiosqlite dependency. Fixed a startup crash (ModuleNotFoundError: No module named 'aiosqlite') when installing Open WebUI via pip or uv by adding the missing aiosqlite package to pyproject.toml. The dependency was listed in requirements.txt but not in the published package metadata, so it was not installed automatically. #23916

🐛 Missing asyncpg dependency. Added the missing asyncpg package to pyproject.toml to prevent the same startup crash for PostgreSQL users. Like aiosqlite, it was present in requirements.txt but absent from the published package dependencies.

Original source

Caution
⚠️ Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.
Added
🖥️ Official Open WebUI Desktop App. Open WebUI is now available as a native desktop app for Mac, Windows, and Linux. No Docker, no terminal, no setup. Runs Open WebUI locally without any server setup, or connects to your existing remote Open WebUI instances. Switch between multiple servers instantly from the sidebar. Comes with a system-wide floating chat bar (Shift+Cmd+I on macOS, Shift+Ctrl+I on Windows/Linux), system-wide push-to-talk, offline support after first launch, automatic updates, and zero telemetry. #8262, Desktop
🤖 Scheduled chat automations. You can now schedule the AI to run tasks automatically on a recurring basis: daily digests, periodic reports, anything you'd otherwise need to remember to ask for. Create and manage automations from the Automations page or directly in chat, with full run history and manual trigger controls. #23303, Commit, Commit, Commit, Commit
🧰 Automation tools in chat. Built-in chat tools can now create, update, list, pause, and delete scheduled automations directly in conversation when automation access is enabled. Commit
⏱️ Automation scheduling limits. Administrators can now set "AUTOMATION_MAX_COUNT" and "AUTOMATION_MIN_INTERVAL" to limit how many automations each non-admin user can create and prevent overly frequent schedules that could overload the system. Commit
📋 Task management tool. AI models can now create, update, and track tasks within a chat conversation, breaking down complex requests into manageable steps with real-time status updates. Commit
🗓️ Calendar workspace and event management. Open WebUI now has a full Calendar workspace. Create and manage events, set up recurring schedules, get reminders via in-app toasts or browser notifications, and see your scheduled automations alongside your calendar. #23880
🔔 Calendar reminders and alerts. Calendar events now support reminder options from no alert up to one hour before start time, with upcoming alerts delivered through in-app toasts, browser notifications, and optional webhooks while avoiding duplicate sends. Commit
⚙️ Scheduler reminder configuration. Administrators can now configure calendar reminder processing with "SCHEDULER_POLL_INTERVAL" and "CALENDAR_ALERT_LOOKAHEAD_MINUTES", while existing "AUTOMATION_POLL_INTERVAL" setups continue to work as a legacy fallback. Commit
☁️ Azure responses support. Azure OpenAI connections now support the newer "/openai/v1" format, enabling chat, responses, and proxy calls to work correctly with that endpoint style. #23484
🤖 Ollama responses support. The Ollama proxy now supports the Responses API, letting clients use "/v1/responses" directly with Ollama-hosted models through Open WebUI. #23483
🧩 Responses tool output rendering. Built-in tool outputs in Responses API flows now render more consistently so downstream chat output is easier to interpret. Commit, #23482
🔎 Responses citation visibility. Responses API flows now emit citation sources more consistently, making linked references easier to preserve and display in chat output. Commit, #23774
📎 Attach previously uploaded files. The chat input menu now includes a Files tab for browsing and attaching previously uploaded files, eliminating the need to re-upload files you have already shared. Commit
🧷 Default model terminal selection. Workspace model editors can now preselect an Open Terminal connection, so new chats automatically start with the model’s configured terminal ready to use. Commit, #23605
🎙️ Mistral TTS support. Mistral can now be used as a text-to-speech provider, with admin settings for the API key, base URL, voices, and model selection. Commit
🎧 STT preprocessing bypass option. Administrators can now enable "AUDIO_STT_SKIP_PREPROCESSING" to send audio files directly to the speech-to-text backend, reducing memory and CPU consumption during large uploads for better transcription performance and stability on constrained deployments. #23661
🗑️ Admin model deletion. Administrators can now delete Ollama models directly from the model selector menu, making it easier to clean up unused or unwanted models. Commit
🔌 Backend outlet filters for local and persisted chats. Pipeline and function outlet filters now run reliably in backend completion flows for persisted chats and temporary local chats. #3237, Commit
🎨 Emoji shortcode support. Typing a colon in the chat input now opens an emoji suggestion menu, making it easier to insert emojis using shortcodes like 👋. Commit
📌 Recently used emojis. The emoji picker now shows your most recently used emojis at the top, making it faster to find emojis you use often. Commit
👆 Swipe to reply on mobile. Swiping right on a message now triggers a reply, making it easier to respond on touch devices with a natural gesture. Commit
📱 Screen-awake voice recording. Voice recording now keeps the screen awake during active dictation and safely re-acquires wake lock after visibility changes, helping prevent long transcriptions from being cut off on mobile devices. #23145
🔔 Unread chat indicators. Sidebar chats now show unread status and are marked as read when opened, making it easier to spot conversations with new activity. Commit
🔌 WebSocket reconnect status feedback. Open WebUI now warns when the real-time connection drops and confirms when it reconnects, while avoiding a reconnect message on the initial page load. Commit
📍 Pinned notes in sidebar. Notes can now be pinned to the sidebar for quick access, and you can also create a new note directly from the pinned notes section. Commit, Commit
🗂️ Model selector focus. The model selector now resets its search only when it opens, making the popup feel more predictable while still focusing the search field automatically. Commit
🗂️ Model selector layout. The model selector now behaves more predictably as a custom popup, and the completions playground uses a simpler model picker for easier selection. Commit
🎚️ Active filter valve shortcut. Active filter badges now expose valve configuration directly in the chat input area, so filter tuning is faster during conversations. Commit, #23811, #23813
🎨 Theme updates. Other windows can now update the app theme directly, keeping the interface in sync when theme changes are triggered externally. Commit
🚀 Async performance and responsiveness improvements. The core backend database and request paths now run asynchronously across the application, massively improving responsiveness and performance under concurrent load and reducing request blocking during heavy activity. Commit, Commit
⚡ Drawer performance and memory optimization. Drawer interactions now stay smoother over long sessions by removing stale keyboard listeners on teardown, which reduces memory growth and avoids accumulated event handling overhead. #23724
🚀 Chat history memory culling. Long conversations now stay responsive no matter how many messages they contain. Off-screen messages are unloaded automatically and reloaded as you scroll, keeping memory usage low and the UI smooth on both desktop and mobile. #23067, Commit, Commit
🧵 Async file and knowledge processing performance. File processing, knowledge reindexing, and channel message helper paths now consistently await async operations, preventing skipped processing steps and improving reliability and performance of indexing and tool responses. Commit
🚀 Persistent chat payload efficiency. Persisted chats now use server-side history loading instead of repeatedly resending full message payloads, improving multimodal performance and reducing stale-history overwrite risk across devices. #19064, Commit, Commit
🧵 Non-blocking file storage operations. Uploading, reading, transcribing, and deleting files now offloads storage I/O to background threads, keeping the application responsive during file-heavy workflows. Commit
🏎️ Streaming response performance. Streaming responses now process each output line in a single step instead of two separate yields, reducing async overhead and improving responsiveness during long-running generations. #23266
🔎 Faster mention parsing. Chat text with HTML-like content, file paths, or tool output now parses mentions more efficiently, which helps keep typing and rendering responsive in messages that contain many '<' characters. #23551
🧪 Code block rendering performance. Code blocks now reuse a shared HTML unescape helper, reducing extra browser work when displaying encoded output in chat. #23553
🚀 Inline code rendering performance. Inline code tokens in streaming responses now fade in with a lightweight CSS animation, making chat output feel smoother while reducing interface overhead during rapid token updates. #23258
🎞️ Streaming text token animation performance. Streaming text tokens now use a lightweight CSS intro animation, making output feel smoother while reducing transition overhead and preventing tokens from fading out when generation completes. #23257
🎯 Template token scan optimization. Streaming responses now skip unnecessary token-replacement processing when no template markers are present, reducing per-update overhead and keeping chat output smoother during rapid generation. #23161
🔬 Chinese text processing guard performance. Streaming responses without Chinese characters now skip unnecessary Chinese-format processing checks, reducing per-update overhead and keeping output smoother during rapid generation. #23162
🧠 HTML entity decode performance. Streaming text decoding now avoids repeated document parsing for HTML entity handling, reducing memory churn and improving responsiveness in token-heavy chat output. #23165
🏷️ Chat title update performance. Chat title updates now run in a single database operation instead of multiple round trips, improving responsiveness and reducing overhead when titles are generated or renamed. #23214
📂 Faster chat list queries performance. Chat and folder lists now load more efficiently by fetching only the fields needed for sidebar views, improving responsiveness when browsing large conversation histories. Commit
📈 Sidebar memory optimization. Sidebar chat items now use shared drag-preview resources and safer listener cleanup, reducing memory growth and keeping large chat lists more responsive during long sessions. #23209
🧠 Image viewer memory optimization. Viewing images and SVGs now uses significantly less memory and performs faster, keeping the application snappy and responsive even when browsing through many media files during extended sessions. #23236
📡 Optimized user activity tracking performance. User activity updates now use a single database query instead of multiple operations, improving response times across all authenticated requests. #23215
👥 Faster channel thread author loading. Channel thread responses now load author details in a single batch query, reducing database overhead and improving responsiveness in threads with many participants. #23795
💨 Optimized shared chat deletion. Deleting shared chats by user is now faster and more memory-efficient by only loading necessary data. #23216
🗃️ Faster chat tag loading. Chat tag lookups now load only the metadata needed instead of full chat payloads, improving responsiveness for chats with large histories. #23798
📎 Faster chat file deduplication. Attaching files to chat messages now checks duplicates more efficiently, reducing overhead when handling larger file lists. #23800
📈 Faster message diff checks. Chat message and status updates now compare content more efficiently during streaming, making active conversations feel smoother and more responsive. #23370
⚖️ Faster deep equality checks. Chat message updates, model selection, note editing, code block refreshes, and rich text state comparisons now use deep equality checks that reduce unnecessary UI work and improve responsiveness in active sessions. #23845
🏃 Faster knowledge access updates. Updating access grants for knowledge items now completes with less backend overhead, making permission changes apply more quickly. #23799
🧹 Mermaid render cleanup performance. Mermaid diagrams now always clean up temporary render elements after failures, reducing DOM buildup and keeping repeated rendering more stable over time. #23727
🖼️ Model image lookup efficiency. Model profile image requests now reuse the current request database session, reducing per-request overhead and improving response efficiency. #23796
👤 User endpoint query reduction. Session-based user settings and status endpoints now avoid redundant user re-fetches, reducing unnecessary database load while preserving behavior. #23794
🚦 Faster startup performance. Open WebUI now checks for Torch MPS support only on macOS, avoiding unnecessary startup work on other platforms. #23438
🛡️ Redis timeout consistency. Redis connections now honor the "REDIS_SOCKET_CONNECT_TIMEOUT" setting across standard and cluster setups, helping workers fail faster when Redis is unreachable. #23572
🧰 AIOHTTP pool controls. Administrators can now tune shared outbound HTTP connection behavior with "AIOHTTP_POOL_CONNECTIONS", "AIOHTTP_POOL_CONNECTIONS_PER_HOST", and "AIOHTTP_POOL_DNS_TTL" for better control under high concurrency. Commit
⏱️ MCP tool server timeout configuration. Administrators can now configure request timeouts for MCP tool server connections via the AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER environment variable. Commit
🎫 Static OAuth tool authentication. Tool server authentication now works reliably for both "oauth_2.1" and "oauth_2.1_static" connection types, so OAuth-backed tool access is correctly detected and forwarded during chat requests. Commit
🗄️ Configurable storage local cache. Administrators can now disable persistent local caching for cloud-backed uploads with the "STORAGE_LOCAL_CACHE" setting, reducing local disk usage by cleaning temporary upload copies after processing. Commit
🚪 Back-channel logout. OpenID Connect providers can now trigger centralized logout through the "ENABLE_OAUTH_BACKCHANNEL_LOGOUT" setting, helping administrators invalidate user sessions more reliably across connected devices. Commit
🛡️ Expanded security header controls. Administrators can now configure additional browser security headers, including "CONTENT_SECURITY_POLICY_REPORT_ONLY", "CROSS_ORIGIN_EMBEDDER_POLICY", "CROSS_ORIGIN_OPENER_POLICY", and "CROSS_ORIGIN_RESOURCE_POLICY", for stricter and more flexible deployment hardening. Commit
🖼️ Image MIME fallback option. Administrators can now enable "ENABLE_IMAGE_CONTENT_TYPE_EXTENSION_FALLBACK" so image-to-base64 conversion can still detect common image types by file extension when MIME metadata is missing, improving compatibility on minimal container images and older file records. Commit
🛡️ Public sharing permissions. Public channels, models, notes, prompts, and tools now respect allowed access grants more consistently, helping administrators control who can share content more safely. Commit
🆔 Skill lookup by ID. Skill instructions now include each skill’s ID, and the skill viewer now finds skills by ID in a case-insensitive way so attached skills are identified more reliably in chats. Commit
🏷️ Source context metadata. Retrieval source context now includes each source’s resource type and resource ID metadata, helping downstream model workflows preserve richer source identity during processing. Commit
🗂️ Feedback filtering. Administrators can now filter feedback history by model and export only the feedback they need. Commit
📤 CSV feedback export. Feedback history can now be exported as either JSON or CSV, making it easier to analyze feedback in spreadsheet tools. Commit
📝 Optional GET audit logging. Administrators can now enable auditing for GET requests with the "ENABLE_AUDIT_GET_REQUESTS" setting when they need fuller request visibility. Commit
🕒 Model access updates. Changing a model’s access grants now updates its timestamp, so recently modified models stay easier to find and sort correctly. Commit
💬 Queued message handling. Queued chat messages now send more reliably without advancing the queue too early, keeping follow-up prompts in the intended order. Commit
🔒 Rendered content safety. Placeholder descriptions and the pending account notice now render markdown with safer sanitization ordering, reducing the risk of unsafe HTML appearing in these views. Commit
🛡️ Safer placeholder rendering. Chat placeholder descriptions and the pending account notice now sanitize rendered markdown more consistently, reducing the risk of unsafe content being shown in these views. Commit
🧮 Usage analytics accuracy. Token usage is now normalized before chat messages are saved, so model and user usage reports stay accurate across OpenAI-compatible providers. Commit
🧩 Richer Anthropic tool results. Anthropic-compatible tool calls now preserve more tool result content types, including images and structured search or document outputs, so models can use fuller tool context instead of receiving only plain text fragments. #23188, Commit
🖼️ ComfyUI request reliability. ComfyUI image generation and editing now use shared async connections with consistent SSL handling, making image uploads and workflow runs more reliable under concurrent load. Commit
🎛️ Reranking batch size control. Administrators can now set "RAG_RERANKING_BATCH_SIZE" in Documents settings to control reranking workload size, helping balance retrieval speed and resource usage for their deployment. Commit
🔗 Shared chat access controls. You can now control who has access to a shared chat by granting access to specific users or groups, instead of sharing with anyone who has the link.
🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
🌐 Translation updates. Translations for Irish, Catalan, German, Simplified Chinese, Hindi, and Portuguese (Brazil) were enhanced and expanded.
Fixed
🛡️ Model description XSS protection. Model descriptions shown in chat placeholders are now sanitized before rendering, preventing malicious links from executing scripts and helping protect user sessions from takeover. #23621
🧠 Memory search filtering. Memory search now correctly filters by the query text instead of returning unrelated results. Commit, #23826
📊 Shared chat analytics consistency. Usage and message-count analytics now count assistant activity consistently across regular and shared chats, improving accuracy in model, user, chat, and time-based reporting views. Commit
🧭 Safer in-flight chat navigation. Sending a message no longer overwrites your active chat or causes duplicate background notifications when you switch conversations before a response finishes. Commit
🗣️ Pipeline error detail visibility. Pipeline inlet and outlet failures now preserve and surface provider error details more reliably in chat error messages, making troubleshooting failed requests much clearer. Commit
📨 Shared chat event routing. Message update and send events now target the chat owner’s event channel, so shared chats receive the correct real-time updates instead of routing events to the acting user. Commit
🔐 Consistent outbound SSL handling. External requests for tools, functions, terminals, webhooks, retrieval loaders, audio provider discovery, and OpenAI-compatible embedding calls now consistently apply the configured SSL client setting, improving reliability for deployments that require custom certificate or verification behavior. Commit, Commit
🖼️ Image SSL setting support. Image generation now respects the configured SSL session setting, preventing avoidable connection failures in strict certificate environments. Commit, #23777
🗂️ Folder ownership assignment hardening. Folder create and update inputs now reject unexpected extra fields, preventing clients from overriding protected values like ownership through mass-assignment payloads. #23648
🔐 Knowledge file deletion ownership checks. Collaborators with knowledge base write access can no longer permanently delete files they do not own, preventing unintended file removal across other linked chats and knowledge bases. Commit, #23636
🗑️ Knowledge deletion reliability. Deleting a knowledge base by ID now completes reliably without unexpected failures. Commit, #23776, #23814
🔐 OAuth 2.1 PKCE enforcement. OAuth 2.1 providers now default to S256 PKCE even when discovery metadata omits supported challenge methods, preventing login failures with providers that require PKCE by default. #23667, Commit
🔐 Static OAuth scope handling. Static OAuth credential flows now prioritize administrator-defined scopes and handle OAuth 2.1 static flow behavior more reliably. Commit, #23668, #23696, #23783
🔐 Static OAuth tool registration reliability. Static OAuth tool server registration now resolves and uses saved admin credentials more reliably, preventing registration failures when valid client credentials are provided. #23670, Commit, Commit
⏳ OAuth token expiry fallback. OAuth sessions now always store a safe expiry value even when providers omit "expires_in" or "expires_at", so token refresh checks continue working and tool calls are less likely to fail later with unexpected authorization errors. #23669, Commit
🔑 Anthropic x-api-key model access. Anthropic-compatible clients can now authenticate with the "x-api-key" header across all relevant API routes, so model listing requests like GET "/api/v1/models" no longer fail with unauthorized errors. #23319, Commit
🔑 SSO password option visibility. Account settings now hide password change controls when password-change access is disabled, avoiding misleading password options for SSO-focused setups. #15292, Commit
🔑 Open Terminal MCP authentication. Open Terminal MCP tool calls now include the configured API key when calling internal routes, preventing unauthorized errors for commands like file reads and command execution. #106
🧯 Provider error freeze recovery. Task-based chat requests now surface provider HTTP errors through normal failure handling, so content-filter and other upstream 4xx responses no longer leave chats stuck in a perpetual loading state. #23663, Commit
🔄 Immediate outlet filter updates. Assistant messages modified by outlet filters now appear correctly as soon as streaming completes, without requiring a page refresh. #23829
🌊 Middleware cancellation reliability. Long-running requests now complete more reliably by preventing middleware-level cancellations from interrupting in-flight database and embedding work, reducing unexpected failures and noisy error logs when connections close early. #23709
🚦 Async vector search responsiveness. File processing, memory updates, and knowledge retrieval no longer block the server event loop during vector database operations, so other chats and requests stay responsive while indexing or search is running. #23706
🗒️ Notes chat llama.cpp compatibility. Notes AI chat no longer sends empty assistant prefill messages that can conflict with reasoning-enabled llama.cpp responses, preventing immediate 400 errors in Notes conversations. Commit, #23703
🧩 Ollama thinking field preservation. Messages modified by filters now keep the Ollama "thinking" field when sent to the model, so reasoning-aware workflows and custom filter-based passthrough setups work reliably. Commit, #22508
🧾 Reasoning content preservation. Assistant tool-call messages now retain reasoning content across turns, improving reliability for reasoning-heavy model workflows. Commit, #23175, #23742
🧭 Background task scoping for new chats. Chat title and auto-tag generation now run only for the first message of a new conversation and only once in multi-model responses, preventing duplicate or incorrectly triggered background tasks in follow-up flows. Commit
📚 Channel document context retention. Channel conversations now preserve and load the correct stored message history so model responses can use uploaded and retrieved document context more reliably. #23686, Commit, Commit
⏳ Interrupted response recovery. Assistant placeholder messages now start as incomplete and recover more safely after interrupted generations, preventing silent empty replies after refreshes or dropped requests. #23176, Commit, Commit
🧰 Large tool result rendering. Tool call details now display large result payloads reliably in chat instead of intermittently showing empty output for bigger tool responses. #18743, Commit
🧼 Null-byte document sanitization. PDF and other document ingests now sanitize null bytes and invalid surrogate characters before pgvector writes, preventing PostgreSQL upload failures and allowing affected files to index successfully. #22992, Commit
📝 Knowledge text editor stability. The Knowledge "Add Text Content" modal now uses a plain text editor, avoiding current rich text editor issues and keeping drafting behavior consistent with existing knowledge editing flows. Commit
🎤 STT SSL setting consistency. Speech and related outbound media requests now consistently use shared async HTTP sessions and honor the configured SSL verification setting, improving compatibility with self-signed deployments. #23672, Commit
🎙️ Mistral speech input format. Mistral speech-to-text requests now use the correct chat-completions audio input format for better compatibility. Commit, #23822
🖼️ Optional image size parameter. Image generation no longer sends the "size" field when no size is configured, improving compatibility with providers that reject unsupported size arguments. #23611, Commit
🔎 FireCrawl timeout reliability. FireCrawl web loading now uses direct scrape requests and improved timeout handling for single-URL fetches, reducing empty results and premature timeout failures with local FireCrawl setups. #23411, Commit
🖱️ Custom action icon drag prevention. Custom user-added action icons in chat responses are no longer accidentally draggable, so clicks and hover interactions behave consistently with built-in action icons. #23412
🖼️ Image URL conversion reliability. Sending image URLs to AI models no longer fails with "cannot pickle 'coroutine' object" errors, so image inputs now convert to base64 reliably during request processing. #23685
📂 Channel input menu dismissal. In Workspace Channels, the message input dropdown now closes immediately after selecting "Upload Files" or "Capture", matching normal chat input behavior and preventing the menu from staying open unnecessarily. #23684
📋 Clipboard copy scroll stability. Copying content with the fallback clipboard method no longer triggers unwanted page scrolling during focus, keeping your current reading position stable. Commit
🖼️ Profile image URL validation. Profile saves now accept valid Open WebUI profile-image paths, trusted external HTTP(S) avatar URLs, and safe raster data-image formats while rejecting unsafe URL patterns that could be abused. #23389
👤 Partial user profile updates. User update API requests can now modify only the fields you provide, so administrators no longer need to resubmit unchanged name, email, and profile image values when changing a single setting like role. #23424, Commit
🚨 Provider SSE error visibility. Provider failures returned with streaming content types are now surfaced as proper API errors and logged clearly, so issues like context-window limits no longer fail silently during chat generation. #23379
🧵 Queued prompt race prevention. Chat request queues now prevent overlapping processing for the same chat, avoiding duplicate queue handling when multiple queue-processing triggers fire close together. #23181, Commit
🛑 Cancellation event delivery reliability. Cancelled chat processing now safely emits task-cancel and error events only when an event emitter is available, while provider HTTP errors now also route through task-cancel handling so chats recover from blocked-loading states more reliably. #23663, Commit, Commit
🔑 OIDC key-rotation recovery. OIDC login now retries token authorization with refreshed provider signing keys after a bad-signature failure, so logins recover automatically after identity-provider key rotation without requiring a service restart. #23582, Commit
🌍 Non-ASCII tag filtering. Prompt and model tag filters now handle non-Latin tags more reliably across SQLite and PostgreSQL, so tags like Cyrillic values return the expected items in Workspace lists. #23381, #23427, Commit
🏷️ Prompt tag query accuracy. Prompt tag filtering now uses JSON-element-aware queries so tag-based lookups return the correct prompts. Commit, #23386
🗃️ SQLite async pool compatibility. SQLite async database setup no longer forces an explicit queue pool class, avoiding pool configuration conflicts in SQLite deployments. Commit
🧠 Knowledge embedding deadlock prevention. Knowledge file processing now runs blocking vector-save work in a worker thread while keeping async status updates reliable, preventing file processing from stalling during long embedding operations. Commit, Commit
🤖 Automation worker async DB handling. Automation claiming and run recording now use async database sessions consistently, improving worker stability for scheduled automations. Commit
🕒 Automation timezone scheduling. Scheduled automations now calculate each user’s next run time using that user’s saved timezone, preventing run drift caused by server-time fallback. Commit
🔎 Notes search matching. Notes search now handles multi-word and hyphenated queries more reliably, so relevant notes and snippets are easier to find from partial phrase searches. Commit
📐 Display math rendering. Chat markdown now correctly recognizes and renders "$$...$$" expressions as display math, improving reliability for multiline and escaped KaTeX content while keeping malformed delimiters from disrupting message rendering. #23526, Commit
🚫 LDAP empty-password rejection. LDAP login now rejects empty or whitespace-only passwords before bind attempts, preventing unauthenticated simple-bind behavior from granting access on permissive LDAP server configurations. #23633
🌐 IPv6 SSRF address blocking. URL validation now uses standard IP address checks for both IPv4 and IPv6, preventing private, loopback, link-local, reserved, and mapped-address SSRF bypasses through IPv6 hostname resolution. #23453
🔒 API key endpoint restriction bypass. API key endpoint restrictions are now enforced regardless of whether the key is sent through Authorization headers, cookies, or "x-api-key", preventing bypass through alternate key transport paths. #23637
🔐 Channel sharing permission enforcement. Channel creation and updates now enforce allowed access grant rules for public sharing, preventing unauthorized wildcard sharing on group channels. #23638
🛑 Socket role invalidation. Socket sessions now disconnect automatically when a user is demoted or deleted, preventing stale admin privileges from persisting until reconnect. #23642
🛂 Tool server access checks. Tool listing now correctly awaits server access checks, preventing users from seeing server-backed tools they do not have permission to use. Commit
🛑 Task endpoint access control. Global task listing and direct task stop endpoints are now restricted to administrators, while regular users can stop only their own chat tasks through a scoped chat endpoint. #23454
🧱 Redis cache key isolation. Tool server and terminal server cache entries now include the Redis key prefix, preventing multiple Open WebUI instances that share one Redis database from overwriting each other’s cached connection data. #23649
🧠 Client session leak prevention. Outbound provider requests now use a shared session pool with safer response cleanup and shutdown handling, preventing aiohttp session buildup and reducing memory growth during heavy concurrent API traffic. #23540, Commit
🧩 Tool enum value handling. Tool schema generation now safely handles enum values as strings, preventing failures when OpenAPI parameters include non-string enum entries. #23597, Commit
🧷 Responses model access control. The OpenAI-compatible Responses endpoint now enforces per-model permissions, preventing non-admin users from accessing models they are not allowed to use. #23481
🛡️ Collection process endpoint permissions. Collection processing endpoints now enforce collection ownership checks for web and text processing requests. Commit, #23634
📚 Knowledge query access enforcement. Knowledge-base collection queries now block unauthorized enumeration and require read access before returning results. Commit, #23635, #23452
🔍 RAG collection query permissions. Vector search collection queries now enforce access checks before retrieval results are returned. Commit, #23627
🔗 Chained base model access checks. Chained base model execution now enforces per-model access rules to prevent unauthorized model usage. Commit, Commit, #23647
✍️ Collaborative document write checks. Collaborative document updates now require proper write permission before changes are accepted. Commit, Commit, #23624
📥 Model import ownership validation. Model import now enforces ownership and access grant checks to prevent unauthorized imports. Commit, #23628
🚫 Inactive member channel access. Deactivated group members can no longer read or write channel content through direct API calls, so channel permissions now match active membership status. #23623
🎛️ Ollama endpoint model permissions. Restricted models are now protected on Ollama show, generate, embed, and embeddings endpoints, preventing authenticated users from using private models without read access. #23631
🧭 Azure deployment path validation. Azure model names are now validated and safely encoded before request URL construction, preventing path traversal attempts from reaching unintended Azure endpoints. #23629
👥 Private channel member list access. Standard channel member lists now require proper read permission, preventing unauthorized users from enumerating members of private channels by direct API calls. #23625
🌀 Tool server schema recursion safety. Tool server OpenAPI conversion now handles circular request schema references safely, preventing conversion crashes and ensuring one bad tool server spec does not break the full tool server list. #23588, Commit
🧱 Safer file path handling. File upload, transcription cache, and model download paths now use safer path construction helpers to reduce path parsing risks and improve cross-platform path safety. Commit
🧾 Prompt save error feedback. Saving prompt edits now shows a clear error toast if the save fails, so failed updates are visible instead of silently failing in the editor flow. Commit
🧾 Tool call JSON rendering. Tool call arguments and structured results now render as plain formatted JSON blocks instead of markdown code fences, preventing formatting quirks and making tool output easier to read consistently. Commit
👥 First-user admin race protection. Concurrent first-time LDAP or OAuth registrations can no longer create multiple admin accounts, so only the true first account is promoted during initial setup. #23626
🔒 SCIM token checks. SCIM authentication now compares tokens in a safer way, helping prevent timing-based token guessing attacks. #23577
🔒 Safer file access checks. HTML file previews now treat missing or non-admin owners as inaccessible, preventing accidental access to files that should not be shown. Commit
🖼️ ComfyUI request hangs. Concurrent image generation and editing requests to ComfyUI now complete reliably instead of getting stuck when the same user starts multiple requests at once. #23592, #23591
🧭 Permission-aware built-in tools. Built-in tools now consistently respect user feature permissions for memories, web search, image generation, code interpreter, notes, channels, and automations, preventing tools from being exposed to users without access. Commit
🛑 Interrupted MCP cleanup stability. Interrupted MCP tool calls no longer leave runaway cleanup behavior that can drive container CPU usage to 100%, keeping instances stable after cancellations or dropped connections. #23143
🚪 OAuth redirect URI reliability. OAuth login redirects now use provider client metadata more consistently, preventing incorrect HTTP callback URLs behind reverse proxies and improving sign-in reliability for providers such as Feishu. #23203, #23128
🌐 OAuth redirect handling. OAuth provider token exchange now follows redirects automatically, improving sign-in reliability with identity providers that redirect token endpoint requests. #23409, Commit
☁️ OneDrive picker redirect handling. OneDrive file picker authentication now uses the current app origin as the redirect URI, improving sign-in reliability when launching the picker from deployed environments. #23450, Commit
🍪 OAuth session cookie persistence. OIDC sign-in now correctly sets the "oauth_session_id" cookie, so "system_oauth" connections can forward user OAuth tokens to upstream providers as expected. #23251, #23250
🔑 OAuth session cookie handling. OAuth callback processing no longer fails on undefined cookie expiry data, so OAuth session cookies are stored correctly after sign-in. #23207, #23197
🔏 Ollama SSL handling. Ollama model management and file uploads now respect the configured SSL verification setting, so self-signed certificates work when SSL verification is disabled. #23503, Commit
🛡️ OAuth avatar URL validation. OAuth sign-in now validates profile picture URLs before fetching them, preventing invalid image links from causing login-time errors. #23356
🔑 User invite token expiry. New user invite logins now respect the configured "JWT_EXPIRES_IN" setting, so signup tokens expire as expected instead of using the default lifetime. #23576
🚪 Channel access checks. Channel actions now verify the current user when checking access, improving permission enforcement across channel views and message actions. Commit
📣 Channel message lookups. Channel message details and pinning now work more reliably when the sender account is missing, avoiding failures in those views. Commit
📌 Pinned webhook message handling. Viewing pinned webhook messages now works reliably even when webhook profile data is missing, preventing server errors and frontend crashes in channel pinned message dialogs. #23414
🛡️ Note edit permission enforcement. Note saving now requires write access instead of read access, preventing unauthorized users from modifying notes while preserving expected collaboration permissions. Commit
🗂️ Archived chats menu visibility. The 'Archived Chats' option in the user menu is now shown reliably for all users, so non-admin accounts can consistently access archived conversations. Commit
💾 Error message persistence. LLM errors that occur during streaming are now saved to the database even if the connection drops, so users can see what went wrong when they reconnect. #23231
🚫 Missing message completion guard. Chat completion finalization now skips invalid requests without a message identifier, preventing unnecessary error toasts caused by rare frontend concurrency timing. #23184
🧠 Active message completion accuracy. Switching chats or refreshing during generation no longer marks the currently streaming assistant message as finished too early, so thinking blocks and action buttons appear at the correct time. #23171
📞 Call overlay visibility. Incoming call events now open the call overlay and controls reliably, preventing cases where the call interface briefly appeared and then disappeared. Commit
💬 Prompt submission handling. Chat messages now preserve attached files more reliably when prompts are sent, including queued messages and shared prompt actions. Commit
🧾 Prompt variable form saving. Prompt variable forms now save reliably without runtime errors or an unresponsive save action, so input values and placeholders work correctly when applying prompt templates with variables. #23225, #23480
🛟 Task model fallback safety. Task routing now handles missing default model entries safely, preventing task execution failures when the previously selected model is no longer available. #23169
📊 Usage statistic preservation. Follow-up generation no longer overwrites existing token usage fields, so stored usage statistics remain accurate for the main response. #23152
📝 Writing block parsing reliability. ":::writing" blocks now parse more reliably when headers or extra inline text are present, preventing malformed rendering and duplicate output artifacts. #23174
🧾 Code block line break reliability. Blank lines in submitted code blocks are now preserved more reliably instead of being collapsed. Commit, #20302, #23451
✂️ Citation spacing cleanup. When citations are disabled for a model, citation markers and their leftover spacing are now removed together so punctuation and copied text remain cleanly formatted. #23141
🧰 Pipe tool access. Pipe functions now receive built-in and MCP tools in tools, so tools like Web Search and code execution are available when enabled. #23365
📚 Batch file processing database handling. Batch knowledge file processing now consistently uses the active database session, preventing failures caused by missing database context during file ownership checks and update writes. #23137
⚙️ Default model parameter loading. The "DEFAULT_MODEL_PARAMS" environment variable is now parsed and applied correctly, so default generation settings are honored reliably without being ignored at startup. #23223
🔧 Web search settings save reliability. Saving web search configuration now works without server errors, so administrators can update "WEB_FETCH_MAX_CONTENT_LENGTH" and related retrieval settings successfully from the admin interface. Commit, #23127
🔍 Web search result count. The built-in search_web tool now respects the admin-configured "Search Result Count" setting instead of always returning 5 results when using Native Function Calling mode. #23488, #23485
🖼️ Open Terminal file response handling. Open Terminal tool responses now preserve binary content types in user-side connections, so image and non-text file reads work consistently instead of being forced into plain text. #23125
🖥️ Terminal label casing. Terminal names in the chat input now display exactly as stored instead of being automatically capitalized, so domain-style server names appear correctly. #23518
🖼️ Gravatar profile photo saving. Gravatar profile images can now be saved successfully from account settings, with clearer validation and error handling instead of failing with generic object errors. #23156
🪟 Details expansion preference. Tool call detail groups now honor the 'Always Expand Details' chat setting, so they open expanded by default when that preference is enabled. #23262, #23255
🖱️ Rapid sidebar action protection. Archive and delete actions in the chat sidebar now ignore repeated clicks while a request is in progress, preventing duplicate requests and stacked error toasts. #23172
📲 Mobile model selector positioning. The mobile model selector dropdown now applies a constrained viewport width and left offset, preventing overflow and making model selection easier on small screens. #23310
🔽 Task list toggle icons. The task list collapse button now shows the correct arrow direction, making task sections easier to expand and collapse at a glance. Commit, #23354
➕ Attachment menu auto-close. The chat attachment menu now closes immediately after selecting upload actions like file upload, camera capture, web attach, Google Drive, or OneDrive, preventing the menu from lingering on screen. Commit, #23320
🧹 Per-chat draft clearing. Sent message drafts are now cleared using the active chat key, so sent text no longer reappears in the input after a refresh. Commit, #23296
✉️ Context-aware input action button. The input now shows the send action when text or files are present during generation, while keeping stop controls for truly empty input states to avoid action confusion. Commit, #23306
📉 Pyodide prompt cache stability. Pyodide code interpreter context is now appended to the system prompt instead of user messages, preserving stable prefix caching across turns and reducing repeated token costs in long native tool-calling chats. #23269
🧪 Temp chat outlet filtering. Outlet filters now process temporary chats more reliably, preserving assistant output and usage data so local chat responses stay consistent when filter pipelines are enabled. Commit
Changed
⚠️ Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.
🧨 Plugin async migration required. Custom plugins for Tools, Functions, and Pipelines may require migration to the new async backend signatures after upgrading, so plugin maintainers should update handlers and database call patterns for compatibility and follow the 0.9.0 plugin migration guide. Migration Guide
🔄 Automation terminal source. Automations now use the terminal configured on the selected model instead of a separate per-automation terminal picker, keeping terminal behavior consistent between chat and scheduled runs. Commit
🚧 OpenAI passthrough now opt-in. Direct OpenAI catch-all proxy requests are now disabled by default and require enabling "ENABLE_OPENAI_API_PASSTHROUGH", so deployments relying on passthrough must explicitly turn it on after upgrading. #23640
🗄️ SQLite WAL default enabled. SQLite deployments now default to enabling write-ahead logging, improving concurrent read and write behavior without requiring manual configuration. Commit

Original source

Added

• 🌐 Translation updates. Translations for Simplified Chinese, Catalan, Portuguese (Brazil), Finnish, and Lithuanian were enhanced and expanded.

Fixed

• 🔒 Terminal server connection security. Terminal server verification and policy saving now proxy through the backend, preventing API key exposure and CORS errors when connecting to in-cluster services. Commit, Commit
• 🛠️ Terminal tools exception handling. Exceptions in middleware.py due to invalid return values from get_terminal_tools() have been resolved. Commit
• 📦 Missing beautifulsoup4 dependency. Users can now start Open WebUI using uvx without encountering the "bs4 module missing" error. Commit
• 🔌 API files list error. The /api/v1/files/ endpoint no longer returns a 500 error, fixing a regression that prevented file listing via the API. Commit
• 📜 License data loading. License data now loads correctly, displaying the expected color and logo in the interface. Commit
• 👑 Admin model visibility. Administrators can now see models even when no access control is configured yet, allowing them to manage all available models. Commit
• 📊 Tool call embed visibility. Rich UI embeds from tool calls (like visualizations) are now rendered outside collapsed groups and remain visible without requiring manual expansion. Commit, Commit

Original source