发布日期: 2026-06-29
版本号: v0.10.0

本次更新为Open WebUI带来了多项重要功能增强、性能优化与安全修复。主要新增功能包括：支持与团队共享文件夹及其中的聊天记录；新增自动上下文压缩功能，可对长对话进行摘要以适配模型上下文窗口；引入Open WebUI Computer代理支持，可在本地机器上运行完整代理会话；大幅提升了大型知识库的混合搜索速度；支持配置外部知识库连接；重构了记忆系统，区分长期记忆和会话上下文；新增事件函数插件原生，可响应系统全局事件；引入带有Webhook功能的事件系统；管理员可在面板中配置LDAP和OAuth/OIDC认证等。此外，还增加了多项自定义变量、权限控制、界面优化与操作便捷性改进。

在修复方面，本次更新包含多项安全与访问控制修复，如强制执行知识库写权限、API密钥权限、文本转语音权限、模型访问规则，并加固了多项URL处理、会话管理和数据保护机制。同时修复了聊天记录保存、流式传输响应、工具调用渲染、知识库索引、界面显示错误等大量功能问题，提升了系统稳定性与用户体验。

系统变更包括：数据库迁移需提前备份；系统事件现在自动触发；原生工具调用成为默认模式；多项功能（记忆、笔记、频道等）结束测试阶段；客户端Python运行在沙箱环境中。建议生产环境部署尽快更新以修复安全问题。

更新内容 （中文）

新增功能

  • 🤝 与团队共享文件夹。现在您可以与特定用户、群组或所有人共享文件夹及其内的对话，支持读取或写入权限；共享对象会在侧边栏看到共享文件夹，非所有者以只读视图打开对话，管理员通过新的默认关闭的"文件夹共享"权限控制谁可以共享文件夹。提交、提交、提交、提交、提交、提交、提交、提交

  • 🗜️ 长对话自动上下文压缩。超过可配置令牌阈值的对话现在可以自动总结，以保持在模型上下文窗口内，处理时会显示通知；管理员可启用此功能、设置阈值、自定义总结提示词，并可按模型降低阈值。默认关闭。提交、提交、提交、#19594

  • 🖥️ Open WebUI Computer 代理支持。Open WebUI 现在可以通过其 OpenAI 兼容网关连接到 Open WebUI Computer，允许对话在您自己的机器上运行完整的代理会话，支持文件、终端、git 和网络访问。GitHub

  • 🚀 大型知识库上的混合搜索更快。混合搜索现在在 pgvector 设置中直接在数据库中运行，而不是将整个集合加载到内存中，因此查询大型知识库的速度显著提高。提交、#20737

  • 🗂️ 外部知识库。知识库现在可以通过可配置的外部知识连接连接到外部检索源，因此您可以在对话中搜索现有的外部系统，而不仅仅是 Open WebUI 的内置存储。提交

  • 🧠 重新设计的内存系统。内存系统经过全面改进，具有不同的内存类型——长期的个人记忆和每个对话的上下文——通过结构化的添加、更新和删除流程进行管理，为模型提供了一种更可靠的方式来记住和应用它们从您这里学到的内容。提交、提交、提交、提交、提交、提交、提交、提交、提交、提交

  • 🧩 新的插件原语：Event 函数。与 pipe、filter 和 action 函数都在对话内运行不同，新的 Event 函数是第一个钩入系统本身的原语：它响应整个应用程序中发出的事件（注册、配置更改、文件上传、角色更改、删除、启动和关闭等）来运行您自己的 Python 代码。这使得新的行为类型可以直接在 Open WebUI 内实现，从引导和访问控制到审计、生命周期自动化和外部集成。附带函数编辑器中的入门模板。提交、文档

  • 🔔 带有 webhook 的新事件系统。Open WebUI 现在为各种系统活动发出事件——登录、配置更改、启动以及对话、知识库、文件等中的操作。管理员可以将这些事件作为出站 webhook 发送，路由到特定用户或群组，并从新的事件设置管理页面管理哪些事件发送到哪里。提交、提交、提交、提交、提交、提交、提交、提交、提交、#1240、#16426

  • 🔐 从管理面板配置身份验证。LDAP 和 OAuth/OIDC 设置现在有一个专门的身份验证设置页面，因此可以从管理界面配置身份提供程序。提交、#12945

  • 🏷️ 更多自定义请求头变量。自定义请求头现在支持"{{USER_MESSAGE_ID}}"、"{{USER_MESSAGE_PARENT_ID}}“和”{{TASK}}"，让连接的服务可以区分真实用户消息和自动化后台请求（如标题、标签和后续生成）。提交

  • 📄 文件详情转发给外部文档提取器。外部自定义文档提取服务器现在接收文件的 ID、名称和内容类型，这些也可用作自定义请求头变量，因此可以按文件定制提取。提交、#26259

  • 🎰 新插槽预选上一个模型。当您向多模型对话添加另一个模型时，插槽现在默认为您上次选择的模型，而不是从空开始。#25974

  • ⚡ 更快的模型概览。管理员的模型概览现在通过批量查询加载其反馈历史记录和标签，因此在具有大量对话的实例上打开速度明显更快。提交

  • 🏎️ 更轻量的频道个人资料预览。频道中的个人资料预览现在仅在您悬停打开时加载人员详细信息，而不是提前获取每条消息的详细信息。提交

  • ↩️ 将权限重置为默认值。群组和默认权限对话框现在包含一个按钮，可以一步将所有权限恢复为其内置默认值。#25931

  • 📥 对话导入权限。管理员现在可以使用新的"允许对话导入"权限控制用户是否可以导入或克隆对话。提交、提交、提交、#25927

  • 🔔 每个群组的用户 webhook 权限。管理员现在可以使用新的"用户 Webhook"权限控制哪些用户可以设置个人通知 webhook。#25923

  • ✍️ 可自定义的自动补全提示词。管理员现在可以从管理界面设置自动补全生成的自定义提示词模板。提交、#25879

  • 🔑 可配置的密钥长度。自动生成的密钥长度现在可以通过新的环境变量设置，而不是始终使用固定长度。提交、#25906

  • 🏟️ 竞技场评估模型可通过环境变量配置。竞技场评估模型现在可以通过环境变量定义，以前无法通过这种方式设置。提交

  • ✏️ 从菜单编辑提示词。提示词列表现在在每个提示词的菜单中有一个"编辑"选项，可直接转到其编辑器。#25789

  • 📋 克隆自动化。自动化现在在菜单中有一个"克隆"选项，因此您可以复制一个作为起点。#25790

  • 🔁 重复日历事件。日历事件编辑器现在包含一个重复选项，因此事件可以按计划重复。#25865

  • 🧷 分离的技能导入和导出权限。管理员现在可以使用新的技能导入和导出权限独立控制导入和导出技能。#25921

  • 🏷️ 按标签筛选管理员模型。管理员的"模型"设置页面现在有一个标签筛选器，可用于按基础模型标签缩小模型列表。提交

  • 📊 可排序的分析对话列表。分析中的模型对话列表现在具有可排序的列标题，因此您可以按标题、最后更新时间或用户排序。提交、#26168

  • 🔐 Argon2 密码哈希选项。密码哈希现在可以通过可配置的算法设置使用 Argon2，从而消除了之前默认设置带来的 72 字节密码长度限制。提交、提交、#25656

  • 🔐 可选的静态密钥值加密。工具和函数的密钥值现在可以通过新的选择启用设置进行静态加密，现有存储的值会自动迁移，因此 API 密钥等敏感设置不会以明文形式存储。提交、#23721

  • 🗄️ AWS RDS IAM 数据库身份验证。数据库连接现在可以通过新的选择启用设置使用 AWS RDS IAM 令牌进行身份验证，而不是仅使用静态密码。提交、#23580

  • 🔓 使用 OAuth 2.1 工具的模型自动身份验证。当模型使用需要 OAuth 2.1 的工具时，Open WebUI 现在会自动启动授权流程，而不是使请求失败。提交、#23325、#23272

  • 🔤 用于基于令牌的文本分割的自定义分词器。基于令牌的文档分割现在可以使用可配置的 Hugging Face 分词器模型，因此分块可以与您使用的模型的分词器匹配。提交、#24139

  • 🔒 限制从 MCP 服务器请求的 OAuth 范围。新设置允许管理员限制 Open WebUI 连接到 MCP 服务器时请求的 OAuth 范围。提交、#25981、#25978

  • 🧩 筛选器出口钩子现在可以在 API 请求和响应上运行。筛选函数的出口钩子现在可以为直接 API 调用者运行，包括流式响应，因此响应后处理不再局限于网络界面；这由新设置控制，默认开启。提交、#25650

  • 🖥️ 终端侧边栏自动打开设置。新界面设置控制当您选择终端时文件侧边栏是否自动打开。提交、#25628

  • 📌 拖拽以重新排列固定笔记。侧边栏中的固定笔记现在可以拖拽以重新排序。#25677

  • 🔎 搜索中的对话操作。搜索对话框现在在每个结果上提供上下文菜单，因此您可以直接从搜索对对话执行操作。#25490

  • 🔎 对话搜索结果中的代码片段。搜索您的对话现在会在每个结果中显示匹配内容的片段，因此您可以一目了然地区分结果。提交、提交、提交、#25178

  • 📝 格式化的密钥描述。工具和函数的密钥描述现在渲染 Markdown，因此可以包含格式和链接。提交

  • 🔽 密钥选项的下拉输入。密钥和确认输入现在可以将一组选项显示为下拉列表而不是自由文本，使固定选择设置更易于配置。提交、#26278

  • 🔌 控制 MCP 连接器的 OAuth 资源参数。MCP 连接器现在可以设置为始终发送、从不发送或自动决定是否包含 OAuth 资源参数，以便它们可以与拒绝该参数的提供程序配合使用。提交

  • 🔎 SERPHouse 网页搜索。SERPHouse 现在可以用作网页搜索提供程序。提交、提交、#26254

  • 🔎 Microsoft Web IQ 网页搜索。Microsoft Web IQ 现在可以用作网页搜索提供程序，并附带匹配的页面浏览加载器。#26178

  • ⚠️ 可选的网页搜索确认。管理员现在可以要求用户在网页搜索运行前进行确认，并显示横幅和消息明确表示搜索即将被使用。提交、#24942

  • 🪪 客户端 User-Agent 转发到模型后端。浏览器的 User-Agent 现在传递给所有模型后端，因此上游服务可以看到原始客户端。#26333

  • 🖐️ 从侧边栏拖拽项目到对话中。文件夹、笔记和模型（包括固定笔记）现在可以从侧边栏拖拽到对话输入框中。#25771、提交、#26384

  • 🏷️ 模型编辑器中的标签建议。模型编辑器现在会在您输入时建议现有标签，使重用一致的标签集更容易。提交、#25703

  • 🗣️ 模型编辑器中的语音建议。模型编辑器现在提供可用的文本转语音语音下拉列表，使选择更容易。提交、#25706

  • 🎛️ 工作区基础模型的统一模型选择器。在模型编辑器中选择基础模型现在使用可搜索的模型选择器，而不是普通字段，使查找和选择正确的模型更容易。提交、#24576

  • 🔍 模型编辑器中的可搜索选择器。将操作、筛选器、工具、知识库和技能附加到模型现在使用输入即搜索选择器，而不是长复选框列表，使大型库更易于管理。提交

  • 🖼️ iPhone 图像与 OpenAI 图像编辑兼容。上传的图像现在在发送到 OpenAI 图像编辑之前进行标准化，修复了某些 iPhone 照片格式编辑失败的问题，并新增了管理员切换控制此行为。提交、提交、#26252、#26249

  • 🟢 llama.cpp 的已加载模型指示器。通过 llama.cpp 提供的模型现在报告它们当前是否加载到内存中（包括休眠状态），因此加载指示器也适用于它们。提交

  • 🧱 在客户端渲染结构化模型输出。推理、工具调用和服务器端工具步骤（如网页和文件搜索）现在从模型的结构化输出在浏览器中渲染，而不是在服务器上展平为消息文本，从而更准确和可编辑地渲染这些项目。提交、提交

  • 📜 出站连接的自定义 CA 包。新环境变量允许您将 Open WebUI 指向自定义 CA 证书包，每个连接的 SSL 设置现在接受包路径，因此企业或内部 CA 背后的部署可以保持证书验证，而不是禁用它。提交、提交

  • 🖥️ 更多终端服务器编排器控制。连接编排器终端服务器的管理员现在可以从连接设置配置会话生命周期策略，并刷新或重置正在运行的终端会话，包括仅针对空闲会话。提交

  • 📁 终端文件浏览器可以保持在根文件夹内。终端文件导航器现在固定到定义的根和主目录，因此用户可以被保留在其工作区内，而不是意外浏览到系统文件夹。提交

  • 🧠 内存切换遵循服务器默认值。当用户未设置自己的内存偏好时，现在遵循管理员的全局内存设置，而不是默认为关闭。#25909

  • 🧹 一次取消共享所有共享对话。“共享对话"对话框现在有一个按钮，可以一次停止共享所有共享对话。#25848

  • 📈 带有日期选择器的更丰富的分析。分析仪表板现在允许您选择日期范围并显示额外的列。#25922、#25919

  • 🔢 对话和文件对话框中的计数。“对话"和"文件"对话框现在在其标题中显示对话和文件的总数。#25872、#25873

  • ⚡ 更快的数学渲染。渲染的数学现在被缓存和重用，因此具有重复或未更改数学表达式的消息渲染更高效。#25847

  • ⚡ 更轻量的 Markdown 设置。Markdown 扩展设置现在运行一次，而不是每次渲染时运行，避免了重复工作和扩展堆叠。#25837

  • ⚡ 更快的只读代码块。只读代码块现在跳过语言自动检测，因此渲染更快。#25824

  • ⚡ 非阻塞音频模型加载。加载语音模型不再阻塞服务器，使其在初始化时保持响应。#25806

  • ⚡ 更快的 URL 安全检查。获取的 URL 的安全检查现在在主循环之外解析地址，因此它不再阻塞其他工作。#25825

  • ⚡ 频道反应和回复的查询更少。频道反应和线程回复现在通过批量查询加载，减少了繁忙频道上的数据库负载。#25831

  • ⚡ 更轻量的流式传输。流式响应现在跳过重新处理未更改的消息内容，减少了每次更新的工作量。#26325、#26326

  • ⚡ 更流畅的工具调用渲染。显示工具调用现在迭代解析其内容，避免了在深度嵌套数据上的减速。#26146

  • ⚡ 隐藏的工具调用详情零开销。当工具调用参数折叠时，它们不再在幕后渲染，显著加快了大量使用工具的对话速度。提交、#26147

  • ⚡ 代理更精简的读取知识文件。让模型读取知识文件的内置工具现在返回有界限的分页输出块，具有默认和硬性上限，而不是可能一次返回整个大文件，从而显著减少令牌使用量。提交、#26139

  • ⚡ 大型知识库上更轻量、更快的文件搜索。列出和搜索文件现在默认不再返回每个文件的完整提取文本，内容匹配现在长度受限，因此这些请求更轻量，在非常大的知识库上搜索的速度显著提高。提交、提交、提交、#25774、#25741、#26145、#25867

  • ⚡ 更快的密码哈希和批量用户导入。密码哈希和验证不再阻塞服务器，从 CSV 导入用户现在以单批处理，保持大型导入和登录的响应性。提交、#25804、#25805

  • ⚡ 非阻塞模型下载。下载大型 Ollama 模型不再在文件读取和校验时阻塞服务器，使其在大下载期间保持响应。#25829

  • ⚡ 非阻塞上传和链接获取。哈希上传的文件和获取 URL 现在在主循环之外运行，因此大上传和链接预览不会阻塞其他请求。#25822

  • ⚡ 更多阻塞工作移出主循环。音频、管道和插件处理中的额外阻塞操作现在在工作线程中运行，使服务器在负载下保持响应。#26381

  • ⚡ 不可达的后端不会阻塞模型加载。加载模型和工具服务器现在不再在关闭或响应缓慢的后端上阻塞，因此当一个连接不可达时，模型列表保持响应。#26289

  • ⚡ 批量流式更新。流式响应现在在发送之前将相同类型的小更新分组，减少了快速令牌流和工具调用输出期间的开销。提交、#26202

  • 🔄 一般改进。在应用程序中实施了多项改进，以增强性能、稳定性和安全性。

  • 🌐 更新的翻译。更新了加泰罗尼亚语、巴西葡萄牙语（pt-BR）、爱尔兰语、德语（de-DE）和西班牙语（es-ES）翻译。

修复内容

  • 🛡️ 安全公告：此版本包含安全和访问控制修复。我们建议尽快更新生产部署。此版本中的所有安全修复可能未在修复部分中全部列出——有些可能会被保留一段时间，以让管理员有时间升级。公告

  • 🔐 上传时强制执行知识库写入权限。将上传的文件附加到知识库现在需要与其余知识 API 相同的写入权限，因此没有写入权限的用户不能再通过引用其 ID 将文件添加到集合中。#26001

  • 🗝️ 所有密钥端点强制执行 API 密钥权限。查看和删除 API 密钥现在遵循 API 密钥权限，与已应用于密钥创建的保护相匹配。#25992

  • 🔊 语音端点强制执行文本转语音权限。OpenAI 语音代理现在遵守文本转语音权限，因此不允许使用该功能的人无法再使用它。#25993

  • 🎲 竞技场回退时强制执行模型访问。通过竞技场模型间接访问模型在后台和任务请求时现在强制执行该模型的访问规则，关闭了可能绕过这些规则的路径。#26046

  • ⏰ 计划自动化在账户停用时停止。计划自动化现在在每次运行前重新检查所有者的账户状态和权限，因此当账户被停用或自动化访问被撤销时它们会停止。#26047

  • 🚧 代理后拒绝高度编码的路径。经过重复解码后仍然编码的请求路径现在被拒绝，而不是转发，防止了可能溜过的路径遍历。#26050

  • 🌐 图像 URL 获取增强了针对 DNS 重绑定的保护。获取用户提供的图像 URL 现在在连接时重新检查目标地址，关闭了可用于通过公共主机名访问内部地址的路径。#25960

  • 🛂 网页获取黑名单按主机名匹配。网页获取筛选器现在按域边界将条目与请求的主机名匹配，因此被阻止的主机不能再通过添加路径溜过，相似域名也不再被误认为是允许的。#25949

  • 🪪 MCP 连接器请求最小权限范围。通过 OAuth 动态注册的 MCP 连接器现在仅请求特定资源的范围，而不是授权服务器的完整目录。#25958

  • 🙈 频道成员列表不再暴露私有数据。查看频道的成员现在仅返回基本的配置文件详细信息，而不再暴露其他成员的设置、关联账户数据和个人信息。提交

  • 🛟 SCIM 同步无法降级管理员。将用户标记为非活动的 SCIM 配置同步现在无法剥夺现有管理员的角色，防止实例被锁定在自己的管理之外。#25948

  • 👻 协作笔记拒绝未经身份验证的在线状态事件。剩余的实时笔记协作事件现在需要经过身份验证的会话，因此在线状态和光标不能再由仅知道笔记 ID 的人伪造。#25946

  • ⏱️ 登录时长不再揭示哪些账户存在。登录现在无论账户是否存在都花费相同的时间，消除了可能用于发现有效账户的计时差异。提交、提交

  • 🔌 终端连接无法重定向到另一个用户。终端会话标识符现在在传递给上游之前安全编码，关闭了篡改连接用户身份的方式。#26042

  • 📡 实时事件仅到达您自己的会话。服务器现在验证实时事件仅传递给请求用户自己的活动会话，而不是信任客户端提供的会话标识符。#25763

  • 🔓 已撤销的会话在实时连接时被拒绝。实时和终端 WebSocket 连接现在遵守令牌撤销和过期，因此已注销或过期的会话无法再保持活动连接。提交、#25764、#25686

  • 🕳️ URL 获取中关闭了另一个 DNS 重绑定漏洞。获取 URL 内容现在在连接时重新检查目标地址，关闭了另一个可通过公共主机名访问内部地址的路径。#25775

  • 🗣️ Azure 语音输入已转义。构建 Azure 文本转语音请求时，语音和语言值现在被转义，防止格式错误或注入标记。#25776

  • ⚙️ 界面设置更新遵循其权限。保存界面设置现在强制执行界面权限，因此没有该权限的用户无法再通过 API 更改这些设置。#25996

  • 🗄️ 未知知识集默认被拒绝。检索现在默认拒绝未知或未指定作用域的集合名称，关闭了可能用于访问正常访问检查之外的集合的旧路径。提交

  • 🙈 错误响应不再泄露内部信息。服务器错误响应现在返回经过清理的消息，而不是原始异常文本，因此内部详细信息不会暴露给登录用户。提交、提交、提交、提交、#26375、#26374

  • 📏 服务器端强制执行上传大小限制。最大上传大小现在在服务器端强制执行，因此无法被忽略限制的客户端绕过。提交、提交、#25869

  • 🖼️ OAuth 个人资料图片已验证。来自 OAuth 提供程序的个人资料图片 URL 现在在存储时得到验证并检查其类型，防止不安全的图像来源。提交、#24548

  • 📦 前端依赖项的安全更新。更新了多个前端依赖项以修补已知的安全漏洞。#26281

  • 🤝 对话共享遵循用户共享权限。共享对话对话框现在对没有该权限的人隐藏与特定用户共享的选项，与在其他地方强制执行的访问规则相匹配。#25915

  • 📤 对话导出在各处都遵循其权限。每个对话导出现在都检查导出权限，因此没有该权限的用户无法再通过其中一个下拉菜单导出对话。#25914

  • 📂 文件写入权限需要真正的所有权。通过知识库或工作区模型编辑或删除文件现在要求对象的所有者确实拥有该文件，因此只读文件无法再通过从您控制的对象引用而获得写入权限。#26032

  • 🖌️ 图像编辑端点强制执行权限。图像编辑端点现在检查图像编辑开关和图像生成权限，与图像生成相匹配，因此无法由没有访问权限的用户调用。#26009

  • 📁 所有文件夹操作强制执行文件夹权限。每个文件夹操作现在都检查文件夹权限，因此该设置始终被遵守，而不仅仅是在列出文件夹时。提交

  • 🧩 代码执行设置关闭时折叠。代码执行设置部分现在在切换禁用时折叠，保持设置页面整洁。#25970

  • 📅 笔记中的德语日期格式。笔记视图中的日期现在为德语正确显示，之前无法渲染。#25985

  • 🎙️ 当语音无法加载时 ElevenLabs 语音继续工作。通过 ElevenLabs 的文本转语音现在不会在无法获取可用语音列表时失败，而是拒绝每个语音。提交、#26075

  • 🪟 默认权限模态框关闭时重置。在未保存的情况下关闭默认权限对话框现在会丢弃未保存的编辑，而不是在下次打开时保留它们。提交

  • 👯 使用相同模型的并排对话。运行两个使用相同模型的窗格不再会导致其中一个窗格在重新加载后卡住等待或显示另一个窗格的回复，因为现在每个窗格的消息被单独跟踪。提交、#25982

  • 💾 调整模型访问权限时不再丢失模型编辑。调整模型的访问权限不再自动保存并丢弃您对该模型的其他未保存更改。#26004

  • 🔧 通过 Anthropic 兼容 API 的并行工具调用。调用 Open WebUI 消息端点的外部 Anthropic 兼容客户端现在在模型一次发出多个工具调用或在其最终消息中返回时可靠地接收工具调用。提交、#25963、#25964

  • 🗃️ 通过 Anthropic 兼容 API 保留提示缓存。通过 Anthropic 兼容 API 的请求现在保留其提示缓存标记，而不是将其剥离，因此依赖缓存的客户端可以按预期工作。提交、#25998、#25964

  • 🔁 减少冗余数据加载。多个视图不再同时触发重复的后台获取，避免了重叠请求可能导致的偶尔故障。#25943、#25942、#25934、#25935、#25838、提交

  • 🔎 管理员和工作区中更稳定的搜索框。用户、知识库、提示词、工具和类似列表的搜索字段现在仅在您输入时运行，并正确重置到第一页，而不是偶尔自行重新搜索。提交、#25938

  • 📊 管理员反馈列表在 PostgreSQL 上再次加载。管理员反馈列表现在在 PostgreSQL 设置上不再无法加载，之前会返回服务器错误。提交、#25953

  • 🗂️ 删除嵌套文件夹时正确检查对话。删除包含子文件夹的文件夹现在在应用删除权限检查时考虑这些子文件夹中的对话，而不仅仅是顶层文件夹的对话。提交、#25920

  • 🖱️ 将对话拖入文件夹更可靠。将对话拖入文件夹在无法解析对话的情况下不再抛出错误。#25928

  • 🛠️ 工作区菜单为技能权限显示。仅具有技能权限的用户现在在其菜单中看到"工作区"条目，之前仅对其他工作区权限显示。#25925

  • 🧠 管理员始终可以访问记忆。管理员现在可以访问记忆端点，无论内存权限切换如何，与其他功能的工作方式相匹配。#25924

  • 🖼️ 图像设置页面在配置加载失败时存活。管理员图像设置页面现在在其配置无法加载时不会崩溃，而是显示页面。#25933

  • 🧵 代码块在线程中渲染。代码块现在在线程视图中正确显示，之前重复的消息标识符破坏了它们的渲染。提交、#25917

  • 🔵 对话上不再有错误的未读徽章。对话在自动更改（如标题生成或固定、归档和在文件夹之间移动）后不再显示未读指示器，新创建的对话被正确标记为已读，因此刷新后不会显示为未读。#25912、#25782、#25108

  • 📌 固定笔记保持同步。固定、取消固定或删除笔记现在一致地更新侧边栏的固定列表，而不是显示过时的固定状态。#25918、#25640

  • 📅 全天日历事件保留其日期。保存全天日历事件现在不会为某些时区的用户偏移一天。#25864

  • 🧷 损坏的对话历史记录恢复更可靠。当对话的当前位置缺失或指向格式错误的消息时，Open WebUI 现在从最新的有效消息修复它——在客户端和服务器上——而不是冒着损坏历史记录视图的风险。提交、提交、#26298、#26258、#26257

  • 💾 保存对话不再丢失消息。对话更新现在在服务器上与现有历史记录合并，明确跟踪已删除的消息，而不是覆盖它，防止并发或部分保存导致消息丢失。提交、提交、提交、#25657

  • 📺 频道消息更新保留在其频道内。如果消息不再存在或属于不同的频道，则跳过频道消息的流式更新，防止错误更新。提交

  • 📌 固定频道消息为所有人更新。固定或取消固定频道消息现在实时为所有成员更新，并且可以从线程视图工作，而不仅仅为固定它的人更改。提交

  • 📄 Mistral OCR 上传再次工作。通过 Mistral 的文档 OCR 在上游库更改破坏其文件上传后已修复。#25779

  • 🗂️ Chroma 集合检测已修复。Open WebUI 现在正确检测现有的 Chroma 集合，修复了始终报告它们缺失的情况。#25780

  • 📊 Vega-Lite 图表可靠渲染。对话中的 Vega-Lite 图表现在通过其代码块语言标签检测，因此正确渲染。#25843

  • 🏷️ 长对话标签列表滚动。当对话有许多标签时，对话菜单中的标签部分现在可以滚动而不是溢出。#26031

  • ⌨️ Enter 键在 iOS 上正确显示。键盘快捷键列表中的 Enter 键符号在 iOS 上不再渲染为表情符号。#26173

  • 🔗 名称中的空格不再破坏 MCP 连接。用户名和信息标题现在在转发之前被修剪，修复了显示名称包含前导或尾随空格时 MCP 连接失败的问题。#26182、#26181

  • 🈳 搜索在组合时不再触发。在使用输入法编辑器（如日语、中文或韩语）搜索时输入不再在按 Enter 确认组合时触发搜索。#26238、#26285、#26172

  • 🧰 密钥图标保持可见。配置密钥的图标不再消失，因此用户可配置的工具和函数设置保持可访问。#26256

  • 🎛️ 对话控件在导航中持续。对话控件的编辑现在在对话之间导航时保留，并且将控件恢复到对话的保存值时正确持久化，而不是丢失。#26336、#25793

  • 🔍 对话搜索工具处理空查询。内置的对话搜索工具在使用空查询调用时不再崩溃。提交、#26310

  • 📑 更强大的 MinerU 文档处理。通过 MinerU 的文档处理现在更安全地处理其 ZIP 结果，包括非常大的输出。提交、#26263

  • ⏰ 使用会话认证工具的计划自动化工作。使用会话认证工具或终端的自动化现在在计划运行时正确进行身份验证，而不是失败。提交、#26247、#26137

  • 📝 模型系统提示与知识库一起保留。当知识库检索与原生工具调用一起运行时，模型的系统提示不再被丢弃。提交、#26217

  • 🔑 过期的会话将您返回登录。当请求因会话过期而失败时，Open WebUI 现在将您重定向到登录页面，而不是让您停留在损坏的视图上。提交、#26237

  • 🎯 弹出工作区模型卸载正确的模型。卸载工作区模型现在解析为其基础模型，因此正确的模型被从内存中释放。提交、#26269

  • 🔄 编辑的模型在管理员列表中刷新。在管理员设置中编辑模型后，模型列表现在立即更新，而不需要手动重新加载。提交

  • 🗂️ 工作区模型批量操作和搜索跨页工作。工作区模型的批量操作现在应用于所有模型，搜索结果正确分页。#26274

  • 🧩 MCP 资源结果通过。返回资源内容（包括二进制 blob 和 URI 引用）的工具结果不再被静默丢弃，图像结果作为文件附加。#25260、#24038、提交

  • 🔗 更广泛的 MCP 服务器 OAuth 兼容性。Open WebUI 现在即使在 MCP 服务器未宣传其受保护资源元数据时也能发现它，并识别更多 OAuth 预检变体，因此更多 MCP 服务器可以连接。#25980、#25954、提交、#26068

  • 📤 更清晰的上传错误消息。失败的上传现在显示可读的解释，而不是不透明的错误存根。#25961

  • 📋 克隆的提示词获得正确的标题。克隆提示词现在将克隆后缀添加到正确的字段，因此副本按预期命名。#25800

  • 📐 长默认群组名称不会溢出。长默认群组名称在管理员身份验证设置中不再溢出其行。#25685

  • 🖐️ 侧边栏拖拽不会触发上传。在侧边栏中拖拽对话项目不再显示文件上传覆盖层。#25675

  • 🔁 从卡住的流式响应中恢复。如果响应完成的信号丢失——例如在移动应用程序在流式传输过程中转到后台后——Open WebUI 现在恢复对话，而不是让它卡在流式状态。提交、提交、提交、#26320、#26315

  • 🧠 模型技能按需加载，而不是填充提示。模型附加的技能现在作为模型可以在需要时加载的清单呈现给模型，而不是将它们的全部内容插入系统提示；您在内联中提到的技能仍然直接包含其内容。提交、提交、#25592、#25599

  • 🗂️ 空元数据不再破坏 Chroma 索引。具有空值的文档元数据现在在索引之前被过滤掉，修复了可能在 Chroma 上失败的情况。提交、#26342、#26339

  • 🔁 更新知识文件不会破坏知识库。当文件内容更新时，其新嵌入现在在旧嵌入之前添加，因此重新索引失败会留下完整且可用的知识库，而不是空的。提交、#23789、#23787

  • 🔤 包含特殊令牌的文档正确索引。测量块大小现在不会在文档包含看起来像特殊令牌的文本时失败。#26210

  • 📝 笔记文件附件保持同步。更新附加到笔记的文件现在保持编辑器和保存的笔记同步。提交

  • 📱 移动设备上更好的横幅布局。通知横幅现在在小屏幕上正确布局。提交、#24912

  • 📂 知识库文件列表包含附加文件。通过知识工具列出文件现在还显示直接附加到模型的文件，而不仅仅是知识库中的文件，修复了列出未返回具有单个附加文件的模型的情况。提交、#26301

  • 🏷️ 长第一个响应后生成对话标题。新对话现在即使第一个响应花费很长时间（例如具有广泛推理或许多工具调用的响应）也能获得其标题，而不是保持"新对话”。提交、#26240

  • 🔌 取消 MCP 请求不再出错。停止使用 MCP 工具的响应现在干净地关闭连接，而不是显示服务器错误。提交

  • 🧠 推理细节跨轮次保留。返回结构化或加密推理数据的模型（如 Gemini）的助手消息不再在流式传输中被分割，保持跨轮次的推理连续性。提交、#23852

  • 📡 非标准流式响应的错误消息显示。通过非标准服务器发送事件发送错误的提供程序现在显示可读的错误，而不是没有内容。#23228

  • 🔑 终端服务器密钥中的空格不再破坏身份验证。终端服务器 API 密钥现在在使用前被修剪，因此带有杂乱前导或尾随空格的密钥仍然可以进行身份验证。提交、提交

  • 🔥 一个错误的 URL 不再导致 Firecrawl 抓取失败。通过 Firecrawl 获取多个页面时，单个失败的 URL 现在被跳过，而不是中止整个批处理，并且请求之间遵守速率限制。提交、#24183

  • 📱 具有许多工具的移动设备上的可用对话输入。当技能、工具、终端、网页搜索和图像生成按钮填满对话输入时，按钮行现在水平滚动，同时菜单、语音和发送控件保持可访问，而不是将它们推到屏幕外。提交、#26142

  • 👤 所有者头像仅在共享文件夹上显示。文件夹对话列表中的对话所有者头像现在仅在文件夹实际共享时显示，而不是在所有者信息恰好存在时显示。提交

  • 📜 关于页面上没有多余的滚动条。导致关于设置页面上不必要的滚动条的额外间距已移除。#25802

  • 🚪 从"账户待处理"页面可以注销。在账户待处理时注销现在会经过正确的注销流程，因此单点登录会话结束，您不再停留在待处理屏幕上。#25681、#25644

  • 🔢 内置工具接受数字参数。内置工具在模型传递数字或字符串（预期特定标量类型）时不再崩溃；值现在被强制转换为声明的类型。提交、#25638、#25731、#25641

  • ⏱️ MinerU 超时可保存。MinerU API 超时现在可以从管理员设置保存，接受数值。提交、#25604、#25603

  • 🔧 后台完成不再清除活动任务。在后台完成对话不再清除活动任务集，修复了可能丢失进行中任务指示器的情况。提交、#25217

  • 👁️ 工作区基础模型选择器遵循可见性。工作区中的基础模型选择器现在隐藏您没有访问权限的模型，与其可见性设置相匹配。#25668

  • 🧵 频道线程绑定到正确的频道。频道线程的父级和回复现在绑定到 URL 中的频道，防止切换频道时的不匹配。#25766

  • 🗑️ 取消共享清理孤立行。取消共享对话现在处理剩余的共享对话记录，避免过时条目。#25632

  • 🔎 启用检索时网页搜索结果到达模型。网页搜索结果现在即使启用了嵌入和检索也会传递给模型，而不是被排除在外。#25600

  • 🔢 群组计数跟随搜索。群组计数现在反映筛选后的搜索结果，而不是完整列表。#25689

  • ␣ 重命名时空格键正常工作。重命名文件或文件夹时按空格不再打开它，因此可以在名称中输入空格。#25627

  • 🩹 缺失的本地嵌入模型不再阻止启动。缺失的本地嵌入模型现在显示为延迟错误，而不是阻止服务器启动。#25683

  • 🔤 一致的设置标签大写。设置中的切换标签现在使用一致的标题大小写。#25765

  • ♿ 切换上更好的屏幕阅读器标签。集成和切换开关现在为屏幕阅读器公开适当的可访问性标签和按下状态。#25258、#25230

  • 📜 长下拉列表滚动。下拉选择现在在列表较长时滚动，因此所有选项保持可访问。提交、#25608

  • 🔽 可折叠部分在加载时不会误触发。可折叠部分现在不会在首次渲染时触发其更改操作，避免页面加载时的意外切换。提交、#25229

  • ➗ 大型数学表达式不再导致渲染崩溃。解析数学分隔符现在不会在非常大或深度嵌套的输入上溢出，因此具有大量数学内容的消息会渲染而不是失败。#25845

  • 🗄️ 过大的块不再破坏 Milvus 索引。过长的文本块现在在发送到 Milvus 之前被修剪，因此单个大块无法再使整个批处理失败并导致文件没有嵌入。#25857、#25858

  • 📝 代码编辑器在空时保持打开。代码编辑器抽屉在其内容为空时不再折叠。#25855

  • 💽 重启后设置不再丢失。管理员配置现在存储更可靠，修复了重启服务器后可能丢失外部连接和模型参数的情况。提交、提交、提交、#24743、#25911、#25959

  • 📜 可见的对话滚动条。对话区域现在显示滚动条，使滚动长响应更容易。提交、#25833

  • 🎚️ 默认模型参数应用于请求。默认模型参数现在应用于出站请求，因此温度和上下文窗口等设置按配置生效。提交、提交、#24930、#26209

  • 🟢 Ollama 已加载模型指示器恢复。在最近更改后，显示哪个 Ollama 模型加载到 VRAM 中的指示器再次工作。#25586、#25732

  • 🪪 静态 MCP 连接器恢复缺失的 OAuth 详细信息。配置了静态 OAuth 凭据的 MCP 连接器现在从服务器发布的元数据中填充缺失的范围或资源，因此当这些值被遗漏时它们可以正确连接，而不是失败。提交、#25898

  • 📊 令牌使用情况和成本统计不再被后台任务清除。响应的令牌使用情况和成本现在在标题、标签和后续生成等后台任务在同一对话上运行时被保留，而不是被覆盖。提交

  • 🔗 模型共享链接已更新。共享模型现在打开当前社区帖子页面，修复了指向旧端点的链接。#25801

变更内容

  • ⚠️ 数据库迁移：此更新包含数据库迁移。请务必在更新前备份您的数据库，因为迁移后不支持降级。

  • 🔔 系统事件现在自动触发。通过新的事件系统，Open WebUI 为启动、登录和配置更改等活动发出事件，因此您已经配置的任何 webhook 在升级后可能开始接收这些新发出的事件的调用。更新后查看您的事件和 webhook 设置，以便只接收您想要的事件。提交

  • 🔀 原生工具调用现在是默认设置。每个未明确选择工具调用模式的对话和模型现在运行 Native，它依赖于模型的内置工具支持，而旧行为已重命名为"Legacy"并设为显式禁用；如果您的模型依赖于以前的方法，您必须按对话、按模型或在您的默认模型参数中全局将它们切换回"Legacy"以保留其行为。提交

  • 🗂️ 身份验证设置移至其自己的页面。LDAP、OAuth 和相关身份验证设置已从"常规"设置页面移至管理员面板中专用的"身份验证"页面。提交

  • 🎓 多项功能不再是测试版。记忆、笔记、频道和高对比度模式已毕业脱离测试版，不再带有测试版标签。提交

  • 🔧 本地网页获取设置已重命名。“ENABLE_RAG_LOCAL_WEB_FETCH"环境变量现在是"ENABLE_LOCAL_WEB_FETCH”，反映其应用于检索以外的用途；旧名称仍作为已弃用别名有效。提交

  • 🔧 You.com 搜索密钥已重命名。You.com 网页搜索现在首选"YDC_API_KEY"环境变量，之前的"YOUCOM_API_KEY"仍作为后备接受。提交、#26316

  • 🧪 客户端 Python 现在在沙盒中运行。客户端 Python (Pyodide) 现在在沙盒化的不透明源 iframe 中运行，默认将执行的代码与您的会话、cookie、本地存储和应用程序自己的端点隔离，同时完整的 Python、JavaScript 和外部网络访问继续工作。依赖于从 Pyodide 到达同源 Open WebUI 端点的代码将不再能够工作，并且 Pyodide 现在在管理员"代码执行"设置中被标记为旧版。提交、提交、提交、提交、提交

更新内容 （原始）

Added

  • 🤝 Share folders with your team. You can now share a folder and the chats inside it with specific users, groups, or everyone, with read or write access; people you share with see shared folders in their sidebar and open the chats in a read-only view when they are not the owner, and administrators control who is allowed to share folders with a new “Folders Sharing” permission that is off by default. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
  • 🗜️ Automatic context compaction for long chats. Conversations that grow past a configurable token threshold can now be summarized automatically so they stay within a model’s context window, with a notification shown while it happens; administrators can enable it, set the threshold, customize the summarization prompt, and lower the threshold per model. It is off by default. Commit, Commit, Commit, #19594
  • 🖥️ Open WebUI Computer agent support. Open WebUI can now connect to Open WebUI Computer through its OpenAI-compatible gateway, letting chats run full agent sessions on your own machine with file, terminal, git, and web access. GitHub
  • 🚀 Much faster hybrid search on large knowledge bases. Hybrid search now runs natively in the database on pgvector setups instead of loading an entire collection into memory, so querying large knowledge bases is dramatically faster. Commit, #20737
  • 🗂️ External knowledge bases. Knowledge bases can now be backed by an external retrieval source through configurable external knowledge connections, so you can search an existing external system from chat instead of only Open WebUI’s built-in store. Commit
  • 🧠 Reworked memory system. Memory has been overhauled with distinct memory types — long-lived personal memories and per-conversation context — managed through a structured add, update, and delete flow, giving models a more reliable way to remember and apply what they’ve learned about you. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
  • 🧩 New plugin primitive: the Event function. Where pipe, filter, and action functions all run inside a conversation, the new Event function is the first primitive that hooks into the system itself: it runs your own Python in response to events emitted across the whole application — sign-ups, configuration changes, file uploads, role changes, deletions, startup and shutdown, and more. That makes a new class of behavior possible directly inside Open WebUI, from onboarding and access control to auditing, lifecycle automation, and external integrations. Comes with starter boilerplate in the function editor. Commit, Docs
  • 🔔 New event system with webhooks. Open WebUI now emits events for a wide range of system activity — sign-ins, configuration changes, startup, and actions across chats, knowledge, files, and more. Administrators can send these as outbound webhooks, route them to specific users or groups, and manage which events go where from a new event settings admin page. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, #1240, #16426
  • 🔐 Configure authentication from the admin panel. LDAP and OAuth/OIDC settings now have a dedicated Authentication settings page, so providers can be configured from the admin interface. Commit, #12945
  • 🏷️ More custom header variables. Custom request headers now support “{{USER_MESSAGE_ID}}”, “{{USER_MESSAGE_PARENT_ID}}”, and “{{TASK}}”, letting connected services tell apart real user messages from automated background requests like title, tag, and follow-up generation. Commit
  • 📄 File details forwarded to external document extractors. External custom document-extraction servers now receive the file’s ID, name, and content type, and these are also available as custom header variables, so extraction can be tailored per file. Commit, #26259
  • 🎰 Last model pre-selected for new slots. When you add another model to a multi-model chat, the slot now defaults to the model you last picked instead of starting empty. #25974
  • ⚡ Faster model overview. The admin model overview now loads its feedback history and tags through batched queries, so it opens noticeably faster on instances with many chats. Commit
  • 🏎️ Lighter channel profile previews. Profile previews in channels now load a person’s details only when you hover to open one, rather than fetching them for every message up front. Commit
  • ↩️ Reset permissions to defaults. The group and default permission dialogs now include a button to restore all permissions back to their built-in defaults in one step. #25931
  • 📥 Chat import permission. Administrators can now control whether users are allowed to import or clone chats, with a new “Allow Chat Import” permission. Commit, Commit, Commit, #25927
  • 🔔 Per-group user webhook permission. Administrators can now control which users may set a personal notification webhook, with a new “User Webhooks” permission. #25923
  • ✍️ Customizable autocomplete prompt. Administrators can now set a custom prompt template for autocomplete generation from the admin interface settings. Commit, #25879
  • 🔑 Configurable secret key length. The auto-generated secret key length can now be set with a new environment variable, instead of always using a fixed length. Commit, #25906
  • 🏟️ Arena evaluation models configurable via environment. Arena evaluation models can now be defined through an environment variable, which previously could not be set that way. Commit
  • ✏️ Edit prompts from the menu. The prompts list now has an Edit option in each prompt’s menu, taking you straight to its editor. #25789
  • 📋 Clone automations. Automations now have a Clone option in their menu, so you can duplicate one as a starting point. #25790
  • 🔁 Recurring calendar events. The calendar event editor now includes a repeat option, so events can recur on a schedule. #25865
  • 🧷 Separate skills import and export permissions. Administrators can now control importing and exporting skills independently, with new skills import and export permissions. #25921
  • 🏷️ Filter admin models by tag. The admin Models settings page now has a tag filter for narrowing the model list by base-model tags. Commit
  • 📊 Sortable analytics chat list. The model chat list in analytics now has sortable column headers, so you can order it by title, last updated, or user. Commit, #26168
  • 🔐 Argon2 password hashing option. Password hashing can now use Argon2 through a configurable algorithm setting, removing the 72-byte password length limit that came with the previous default. Commit, Commit, #25656
  • 🔐 Optional encryption of valve values at rest. Tool and function valve values can now be encrypted at rest through a new opt-in setting, with existing stored values migrated automatically, so sensitive settings like API keys aren’t kept in plaintext. Commit, #23721
  • 🗄️ AWS RDS IAM database authentication. The database connection can now authenticate using AWS RDS IAM tokens through a new opt-in setting, instead of only a static password. Commit, #23580
  • 🔓 Automatic auth for models with OAuth 2.1 tools. When a model uses tools that require OAuth 2.1, Open WebUI now initiates the authorization flow automatically instead of failing the request. Commit, #23325, #23272
  • 🔤 Custom tokenizer for token-based text splitting. Token-based document splitting can now use a configurable Hugging Face tokenizer model, so chunking can match the tokenizer of the model you use. Commit, #24139
  • 🔒 Restrict OAuth scopes requested from MCP servers. A new setting lets administrators limit which OAuth scopes Open WebUI requests when connecting to MCP servers. Commit, #25981, #25978
  • 🧩 Filter Outlet Hook can now run on API requests and responses. A filter function’s outlet hook now runs for direct API callers, including streaming responses, so response post-processing isn’t limited to the web interface; this is controlled by a new setting and on by default. Commit, #25650
  • 🖥️ Setting for terminal sidebar auto-open. A new interface setting controls whether the files sidebar opens automatically when you select a terminal. Commit, #25628
  • 📌 Reorder pinned notes by dragging. Pinned notes in the sidebar can now be dragged to reorder them. #25677
  • 🔎 Chat actions in search. The search dialog now offers a context menu on each result, so you can act on a chat directly from search. #25490
  • 🔎 Snippets in chat search results. Searching your chats now shows a snippet of the matching content in each result, so you can tell results apart at a glance. Commit, Commit, Commit, #25178
  • 📝 Formatted valve descriptions. Valve descriptions for tools and functions now render Markdown, so they can include formatting and links. Commit
  • 🔽 Dropdown inputs for valve options. Valve and confirmation inputs can now present a set of options as a dropdown instead of free text, making fixed-choice settings easier to configure. Commit, #26278
  • 🔌 Control the OAuth resource parameter for MCP connectors. MCP connectors can now be set to always send, never send, or automatically decide whether to include the OAuth resource parameter, so they work with providers that reject it. Commit
  • 🔎 SERPHouse web search. SERPHouse can now be used as a web search provider. Commit, Commit, #26254
  • 🔎 Microsoft Web IQ web search. Microsoft Web IQ can now be used as a web search provider, with a matching page-browse loader. #26178
  • ⚠️ Optional web search confirmation. Administrators can now require users to confirm before a web search runs, with a banner and message making it clear when search is about to be used. Commit, #24942
  • 🪪 Client User-Agent forwarded to model backends. The browser’s User-Agent is now passed through to all model backends, so upstream services can see the originating client. #26333
  • 🖐️ Drag items from the sidebar into chat. Folders, notes, and models — including pinned notes — can now be dragged from the sidebar into the chat input. #25771, Commit, #26384
  • 🏷️ Tag suggestions in the model editor. The model editor now suggests existing tags as you type, making it easier to reuse a consistent set. Commit, #25703
  • 🗣️ Voice suggestions in the model editor. The model editor now offers a dropdown of available text-to-speech voices, making it easier to pick one. Commit, #25706
  • 🎛️ Unified model picker for workspace base model. Choosing a base model in the model editor now uses the searchable model selector instead of a plain field, making it easier to find and pick the right model. Commit, #24576
  • 🔍 Searchable pickers in the model editor. Attaching actions, filters, tools, knowledge, and skills to a model now uses type-to-search pickers instead of long checkbox lists, making large libraries easier to manage. Commit
  • 🖼️ iPhone images work with OpenAI image editing. Uploaded images are now normalized before being sent to OpenAI image editing, fixing edits that failed for certain iPhone photo formats, with a new admin toggle to control the behavior. Commit, Commit, #26252, #26249
  • 🟢 Loaded-model indicator for llama.cpp. Models served through llama.cpp now report whether they’re currently loaded in memory, including the sleeping state, so the loaded indicator works for them too. Commit
  • 🧱 Structured model output rendered on the client. Reasoning, tool calls, and server-side tool steps such as web and file search are now rendered in the browser from the model’s structured output instead of being flattened into the message text on the server, giving more accurate and editable rendering of these items. Commit, Commit
  • 📜 Custom CA bundle for outbound connections. A new environment variable lets you point Open WebUI at a custom CA certificate bundle, and the per-connection SSL settings now accept a bundle path, so deployments behind a corporate or internal CA can keep certificate verification on instead of disabling it. Commit, Commit
  • 🖥️ More terminal server orchestrator controls. Admins connecting an orchestrator terminal server can now configure session lifecycle policies and refresh or reset running terminal sessions, including targeting only idle ones, from the connection settings. Commit
  • 📁 Terminal file browser can stay within a root folder. The terminal file navigator now anchors to a defined root and home directory, so users can be kept within their workspace instead of browsing into system folders by accident. Commit
  • 🧠 Memory toggle follows the server default. When a user hasn’t set their own memory preference, it now follows the admin’s global memory setting instead of defaulting to off. #25909
  • 🧹 Unshare all shared chats at once. The Shared Chats dialog now has a button to stop sharing every shared chat in one action. #25848
  • 📈 Richer analytics with a date picker. The analytics dashboard now lets you choose a date range and shows additional columns. #25922, #25919
  • 🔢 Chat and file counts in their dialogs. The Chats and Files dialogs now show the total number of chats and files in their titles. #25872, #25873
  • ⚡ Faster math rendering. Rendered math is now cached and reused, so messages with repeated or unchanged math expressions render more efficiently. #25847
  • ⚡ Lighter Markdown setup. Markdown extension setup now runs once instead of on every render, avoiding repeated work and extension stacking. #25837
  • ⚡ Snappier read-only code blocks. Read-only code blocks now skip language auto-detection, so they render faster. #25824
  • ⚡ Non-blocking audio model loading. Loading speech models no longer blocks the server, keeping it responsive while they initialize. #25806
  • ⚡ Faster URL safety checks. The safety check on fetched URLs now resolves addresses off the main loop, so it no longer blocks other work. #25825
  • ⚡ Fewer queries for channel reactions and replies. Channel reactions and thread replies now load through batched queries, reducing database load on busy channels. #25831
  • ⚡ Lighter streaming. Streaming responses now skip re-processing message content that hasn’t changed, reducing work on every update. #26325, #26326
  • ⚡ Smoother tool-call rendering. Displaying tool calls now parses their content iteratively, avoiding slowdowns on deeply nested data. #26146
  • ⚡ Hidden tool-call details cost nothing. When tool-call arguments are collapsed, they are no longer rendered behind the scenes, noticeably speeding up chats with heavy tool use. Commit, #26147
  • ⚡ Leaner knowledge-file reading for agents. The built-in tools that let a model read knowledge files now return output in bounded, paginated chunks with a default and a hard cap, instead of potentially returning an entire large file at once, sharply reducing token usage. Commit, #26139
  • ⚡ Lighter, faster file search on large knowledge bases. Listing and searching files no longer returns each file’s full extracted text by default, and content matching is now length-bounded, so these requests are far lighter and searching across very large knowledge bases is dramatically faster. Commit, Commit, Commit, #25774, #25741, #26145, #25867
  • ⚡ Faster password hashing and bulk user import. Password hashing and verification no longer block the server, and importing users from a CSV is now processed in a single batch, keeping large imports and sign-ins responsive. Commit, #25804, #25805
  • ⚡ Non-blocking model downloads. Downloading large Ollama models no longer blocks the server on file reads and checksums, keeping it responsive during big downloads. #25829
  • ⚡ Non-blocking uploads and link fetches. Hashing uploaded files and fetching URLs now run off the main loop, so large uploads and link previews don’t hold up other requests. #25822
  • ⚡ More blocking work moved off the main loop. Additional blocking operations in audio, pipelines, and plugin handling now run in worker threads, keeping the server responsive under load. #26381
  • ⚡ Unreachable backends don’t stall model loading. Loading models and tool servers no longer blocks on backends that are down or slow to respond, so the model list stays responsive when one connection is unreachable. #26289
  • ⚡ Batched streaming updates. Streaming responses now group small updates of the same type before sending them, reducing overhead during fast token streams and tool-call output. Commit, #26202
  • 🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
  • 🌐 Updated translations. Catalan, Brazilian Portuguese (pt-BR), Irish, German (de-DE), and Spanish (es-ES) translations were updated.

Fixed

  • 🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section — some may be withheld for a short time to give administrators time to upgrade. Advisories
  • 🔐 Knowledge base write access enforced on upload. Attaching an uploaded file to a knowledge base now requires the same write access as the rest of the knowledge API, so users without write access can no longer add files to a collection by referencing its ID. #26001
  • 🗝️ API key permission enforced on all key endpoints. Viewing and deleting API keys now respects the API keys permission, matching the protection already applied to key creation. #25992
  • 🔊 Text-to-speech permission enforced on the speech endpoint. The OpenAI speech proxy now honors the text-to-speech permission, so it can no longer be used by people who are not allowed to use that feature. #25993
  • 🎲 Model access enforced on arena fallback. Reaching a model indirectly through an arena model on background and task requests now enforces that model’s access rules, closing a path that could otherwise bypass them. #26046
  • ⏰ Scheduled automations stop for deactivated accounts. Scheduled automations now re-check the owner’s account status and permissions before each run, so they stop when an account is deactivated or has automations access revoked. #26047
  • 🚧 Heavily encoded paths rejected behind the proxy. Request paths that remain encoded after repeated decoding are now rejected instead of forwarded, preventing a path traversal that could otherwise slip through. #26050
  • 🌐 Image URL fetches hardened against DNS rebinding. Fetching user-supplied image URLs now re-checks the destination address at connection time, closing a path that could be used to reach internal addresses behind a public hostname. #25960
  • 🛂 Web fetch blocklist matches on hostname. The web fetch filter now matches entries against the request’s hostname on domain boundaries, so blocked hosts can no longer slip through with an added path and lookalike domains are no longer mistaken for allowed ones. #25949
  • 🪪 MCP connectors request least-privilege scopes. MCP connectors that register dynamically over OAuth now request only the scopes for the specific resource rather than the authorization server’s full catalog. #25958
  • 🙈 Channel member lists no longer expose private data. Viewing a channel’s members now returns only basic profile details, instead of also exposing other members’ settings, linked-account data, and personal information. Commit
  • 🛟 SCIM sync can’t demote an admin. A SCIM provisioning sync that marks a user inactive can no longer strip an existing administrator’s role, preventing an instance from being locked out of its own administration. #25948
  • 👻 Collaborative notes reject unauthenticated presence events. The remaining real-time note-collaboration events now require an authenticated session, so presence and cursors can no longer be spoofed by someone who only knows a note’s ID. #25946
  • ⏱️ Login timing no longer reveals which accounts exist. Sign-in now takes the same amount of time whether or not an account exists, removing a timing difference that could be used to discover valid accounts. Commit, Commit
  • 🔌 Terminal connections can’t be redirected to another user. Terminal session identifiers are now safely encoded before being passed upstream, closing a way to tamper with the connection’s user identity. #26042
  • 📡 Real-time events only reach your own session. The server now verifies that a real-time event is delivered only to the requesting user’s own active session, instead of trusting a client-supplied session identifier. #25763
  • 🔓 Revoked sessions are rejected on real-time connections. Real-time and terminal WebSocket connections now honor token revocation and expiry, so a signed-out or expired session can no longer keep a live connection open. Commit, #25764, #25686
  • 🕳️ Another DNS-rebinding gap closed in URL fetching. Fetching a URL’s content now re-checks the destination address at connection time, closing another path that could reach internal addresses behind a public hostname. #25775
  • 🗣️ Azure speech input is escaped. Voice and language values are now escaped when building Azure text-to-speech requests, preventing malformed or injected markup. #25776
  • ⚙️ Interface settings update respects its permission. Saving interface settings now enforces the interface permission, so users without it can no longer change those settings through the API. #25996
  • 🗄️ Unknown knowledge collections are denied by default. Retrieval now rejects unknown or unscoped collection names by default, closing a legacy path that could be used to reach collections outside the normal access checks. Commit
  • 🙈 Error responses no longer leak internals. Server error responses now return sanitized messages instead of raw exception text, so internal details aren’t exposed to signed-in users. Commit, Commit, Commit, Commit, #26375, #26374
  • 📏 Upload size limit enforced on the server. The maximum upload size is now enforced server-side, so it can’t be bypassed by a client that ignores the limit. Commit, Commit, #25869
  • 🖼️ OAuth profile pictures are validated. Profile picture URLs from OAuth providers are now validated and their type checked when stored, preventing unsafe image sources. Commit, #24548
  • 📦 Security updates to frontend dependencies. Several frontend dependencies were updated to patch known security vulnerabilities. #26281
  • 🤝 Chat sharing respects the user-sharing permission. The share-chat dialog now hides the option to share with specific users from people who lack that permission, matching the access rules enforced elsewhere. #25915
  • 📤 Chat export respects its permission everywhere. Every chat export menu now checks the export permission, so users without it can no longer export chats through one of the dropdown menus. #25914
  • 📂 File write access requires real ownership. Editing or deleting a file through a knowledge base or workspace model now requires that the object’s owner actually owns the file, so a read-only file can no longer gain write access by being referenced from an object you control. #26032
  • 🖌️ Image edit endpoint enforces permission. The image-edit endpoint now checks the image-edit switch and the image-generation permission, matching image generation, so it can’t be called by users who lack access. #26009
  • 📁 Folder permission enforced on all folder actions. Every folder operation now checks the folders permission, so the setting is respected consistently instead of only when listing folders. Commit
  • 🧩 Code Execution settings collapse when off. The Code Execution settings section now collapses when the toggle is disabled, keeping the settings page tidy. #25970
  • 📅 German date format in Notes. Dates in the Notes view now display correctly for German, where they previously failed to render. #25985
  • 🎙️ ElevenLabs speech keeps working when voices can’t load. Text-to-speech through ElevenLabs no longer fails when the available-voice list can’t be fetched, instead of rejecting every voice. Commit, #26075
  • 🪟 Default Permissions modal resets on close. Closing the Default Permissions dialog without saving now discards unsaved edits instead of keeping them around the next time you open it. Commit
  • 👯 Side-by-side chat with the same model. Running two panes with the same model no longer leaves one pane stuck waiting or showing the other pane’s reply after a reload, since each pane’s messages are now tracked separately. Commit, #25982
  • 💾 Model edits no longer lost when changing access. Adjusting a model’s access no longer auto-saves on its own and discards your other unsaved changes to that model. #26004
  • 🔧 Parallel tool calls over the Anthropic-compatible API. External Anthropic-compatible clients calling Open WebUI’s messages endpoint now receive tool calls reliably when a model issues several at once or returns them in its final message. Commit, #25963, #25964
  • 🗃️ Prompt caching preserved over the Anthropic-compatible API. Requests through the Anthropic-compatible API now keep their prompt-caching markers instead of having them stripped, so clients that rely on caching work as intended. Commit, #25998, #25964
  • 🔁 Fewer redundant data loads. Several views no longer fire duplicate background fetches at once, avoiding occasional glitches from overlapping requests. #25943, #25942, #25934, #25935, #25838, Commit
  • 🔎 Steadier search boxes across admin and workspace. Search fields for users, knowledge, prompts, tools, and similar lists now run only as you type and reset to the first page correctly, instead of occasionally re-searching on their own. Commit, #25938
  • 📊 Admin feedback list loads again on PostgreSQL. The admin feedback list no longer fails to load on PostgreSQL setups, where it previously returned a server error. Commit, #25953
  • 🗂️ Deleting nested folders checks chats correctly. Deleting a folder that contains subfolders now accounts for the chats inside those subfolders when applying the delete-permission check, instead of only the top-level folder’s chats. Commit, #25920
  • 🖱️ Dragging chats into folders is more reliable. Dragging a chat into a folder no longer throws an error in cases where the chat couldn’t be resolved. #25928
  • 🛠️ Workspace menu shows for the skills permission. Users who only have the skills permission now see the Workspace entry in their menu, which previously appeared only for other workspace permissions. #25925
  • 🧠 Admins can always reach memories. Administrators can now use the memories endpoints regardless of the memories permission toggle, matching how admin access works for other features. #25924
  • 🖼️ Image settings page survives a config load failure. The admin image settings page no longer crashes when its configuration fails to load, showing the page instead. #25933
  • 🧵 Code blocks render in channel threads. Code blocks now display correctly in a channel’s thread view, where duplicated message identifiers previously broke their rendering. Commit, #25917
  • 🔵 No more false unread badges on chats. Chats no longer show an unread indicator after automatic changes like title generation or pinning, archiving, and moving them between folders, and newly created chats are marked read correctly so they don’t appear unread after a refresh. #25912, #25782, #25108
  • 📌 Pinned notes stay in sync. Pinning, unpinning, or deleting a note now updates the sidebar’s pinned list consistently, instead of showing a stale pin state. #25918, #25640
  • 📅 All-day calendar events keep their date. Saving an all-day calendar event no longer shifts it by a day for users in certain time zones. #25864
  • 🧷 Damaged chat history recovers more reliably. When a chat’s current position is missing or points at a malformed message, Open WebUI now repairs it from the latest valid message — on both the client and the server — instead of risking a broken history view. Commit, Commit, #26298, #26258, #26257
  • 💾 Saving a chat no longer drops messages. Chat updates are now merged with the existing history on the server, with explicit tracking of deleted messages, instead of overwriting it, preventing message loss from concurrent or partial saves. Commit, Commit, Commit, #25657
  • 📺 Channel message updates stay in their channel. Streaming updates to a channel message are now skipped if the message no longer exists or belongs to a different channel, preventing stray updates. Commit
  • 📌 Pinned channel messages update for everyone. Pinning or unpinning a channel message now updates live for all members and works from thread views, instead of only changing for the person who pinned it. Commit
  • 📄 Mistral OCR uploads work again. Document OCR through Mistral has been repaired after an upstream library change broke its file uploads. #25779
  • 🗂️ Chroma collection detection fixed. Open WebUI now correctly detects existing Chroma collections, fixing a case where it always reported them as missing. #25780
  • 📊 Vega-Lite charts render reliably. Vega-Lite charts in chat are now detected by their code block language tag, so they render correctly. #25843
  • 🏷️ Long chat tag lists scroll. The tags section in the chat menu now scrolls instead of overflowing when a chat has many tags. #26031
  • ⌨️ Enter key shows correctly on iOS. The Enter key symbol in the keyboard shortcuts list no longer renders as an emoji on iOS. #26173
  • 🔗 Whitespace in names no longer breaks MCP connections. User name and info headers are now trimmed before being forwarded, fixing MCP connection failures when a display name contained leading or trailing whitespace. #26182, #26181
  • 🈳 Search no longer fires mid-composition. Typing in search with an input method editor (such as Japanese, Chinese, or Korean) no longer triggers a search when you press Enter to confirm a composition. #26238, #26285, #26172
  • 🧰 Valves icon stays visible. The icon for configuring valves no longer disappears, so user-configurable tool and function settings remain reachable. #26256
  • 🎛️ Chat controls persist across navigation. Edits to chat controls are now kept when navigating between chats, and reverting a control to the chat’s saved value persists correctly, instead of being lost. #26336, #25793
  • 🔍 Chat search tool handles empty queries. The built-in chat search tool no longer crashes when called with an empty query. Commit, #26310
  • 📑 More robust MinerU document processing. Document processing through MinerU now handles its ZIP results more safely, including very large outputs. Commit, #26263
  • ⏰ Scheduled automations with session-auth tools work. Automations that use session-authenticated tools or terminals now authenticate correctly when running on a schedule, instead of failing. Commit, #26247, #26137
  • 📝 Model system prompt preserved with knowledge. A model’s system prompt is no longer dropped when knowledge retrieval runs with native tool calling. Commit, #26217
  • 🔑 Expired sessions return you to sign-in. When a request fails because your session has expired, Open WebUI now redirects you to the sign-in page instead of leaving you on a broken view. Commit, #26237
  • 🎯 Ejecting a workspace model unloads the right model. Unloading a workspace model now resolves to its underlying base model, so the correct model is freed from memory. Commit, #26269
  • 🔄 Edited models refresh in the admin list. After editing a model in the admin settings, the models list now updates right away instead of needing a manual reload. Commit
  • 🗂️ Workspace model bulk actions and search work across pages. Bulk actions on workspace models now apply across all of them, and search results paginate correctly. #26274
  • 🧩 MCP resource results come through. Tool results that return resource content — including binary blobs and URI references — are no longer silently dropped, and image results are attached as files. #25260, #24038, Commit
  • 🔗 Broader MCP server compatibility for OAuth. Open WebUI now discovers an MCP server’s protected resource metadata even when the server doesn’t advertise it, and recognizes more OAuth preflight variations, so more MCP servers connect. #25980, #25954, Commit, #26068
  • 📤 Clearer upload error messages. Failed uploads now show a readable explanation instead of an opaque error stub. #25961
  • 📋 Cloned prompts get a proper title. Cloning a prompt now adds the clone suffix to the correct field, so the duplicate is named as expected. #25800
  • 📐 Long default group names don’t overflow. A long default group name no longer overflows its row in the admin authentication settings. #25685
  • 🖐️ Sidebar drags don’t trigger uploads. Dragging a chat item in the sidebar no longer shows the file-upload overlay. #25675
  • 🔁 Recovers from a stuck streaming response. If the signal that a response finished is missed — for example after a mobile app is backgrounded mid-stream — Open WebUI now recovers the chat instead of leaving it stuck in a streaming state. Commit, Commit, Commit, #26320, #26315
  • 🧠 Model skills load on demand instead of filling the prompt. A model’s attached skills are now presented to the model as a manifest it can load when needed, rather than having their full content inserted into the system prompt; skills you mention inline still get their content included directly. Commit, Commit, #25592, #25599
  • 🗂️ Empty metadata no longer breaks Chroma indexing. Document metadata with empty values is now filtered out before indexing, fixing a case that could fail on Chroma. Commit, #26342, #26339
  • 🔁 Updating a knowledge file won’t break the knowledge base. When a file’s content is updated, its new embeddings are now added before the old ones are removed, so a failed reindex leaves the knowledge base intact and usable instead of empty. Commit, #23789, #23787
  • 🔤 Documents with special tokens index correctly. Measuring chunk sizes no longer fails when a document contains text that looks like a special token. #26210
  • 📝 Note file attachments stay in sync. Updating the files attached to a note now keeps the editor and saved note in sync. Commit
  • 📱 Better banner layout on mobile. Notification banners now lay out correctly on small screens. Commit, #24912
  • 📂 Knowledge file listing includes attached files. Listing files through the knowledge tools now also shows files attached directly to a model, not only those inside a knowledge base, fixing cases where listing returned no results for a model with a single attached file. Commit, #26301
  • 🏷️ Chat titles generate after long first responses. A new chat now gets its title even when the first response takes a long time, such as one with extensive reasoning or many tool calls, instead of staying “New Chat”. Commit, #26240
  • 🔌 Cancelling an MCP request no longer errors. Stopping a response that was using MCP tools now shuts the connection down cleanly instead of surfacing a server error. Commit
  • 🧠 Reasoning details preserved across turns. Models that return structured or encrypted reasoning data, such as Gemini, no longer have their assistant message split mid-stream, keeping reasoning continuity across turns. Commit, #23852
  • 📡 Error messages show for non-standard streaming responses. Providers that send errors over non-standard server-sent events now surface a readable error instead of nothing. #23228
  • 🔑 Whitespace in terminal server keys no longer breaks auth. Terminal server API keys are now trimmed before use, so a key with stray leading or trailing whitespace still authenticates. Commit, Commit
  • 🔥 One bad URL no longer fails Firecrawl scraping. When fetching multiple pages through Firecrawl, a single failing URL is now skipped instead of aborting the whole batch, and rate limits are respected between requests. Commit, #24183
  • 📱 Usable chat input on mobile with many tools. When skills, tools, terminal, web search, and image generation buttons fill the chat input, the row of buttons now scrolls horizontally while the menu, voice, and send controls stay reachable, instead of pushing them off-screen. Commit, #26142
  • 👤 Owner avatars only show on shared folders. Chat owner avatars in a folder’s chat list now appear only when the folder is actually shared, instead of showing whenever owner information happened to be present. Commit
  • 📜 No stray scrollbar on the About page. Extra spacing that caused an unnecessary scrollbar on the About settings page has been removed. #25802
  • 🚪 Sign out works from the Account Pending page. Signing out while your account is pending now goes through the proper sign-out flow, so single sign-on sessions are ended and you are no longer left stuck on the pending screen. #25681, #25644
  • 🔢 Built-in tools accept numeric arguments. Built-in tools no longer crash when a model passes a number or a string where a specific scalar type is expected; values are now coerced to the declared type. Commit, #25638, #25731, #25641
  • ⏱️ MinerU timeout saves. The MinerU API timeout can now be saved from the admin settings, accepting a numeric value. Commit, #25604, #25603
  • 🔧 Background completion no longer clears active tasks. Finishing a chat in the background no longer wipes the set of active tasks, fixing a case where ongoing task indicators could be lost. Commit, #25217
  • 👁️ Workspace base model selector respects visibility. The base model selector in the workspace now hides models you don’t have access to, matching their visibility settings. #25668
  • 🧵 Channel threads bind to the right channel. A channel thread’s parent and replies are now tied to the channel in the URL, preventing mismatches when switching channels. #25766
  • 🗑️ Unsharing cleans up orphaned rows. Unsharing a chat now handles leftover shared-chat records, avoiding stale entries. #25632
  • 🔎 Web search results reach the model with retrieval on. Web search results are now passed to the model even when embedding and retrieval are enabled, instead of being left out. #25600
  • 🔢 Group count follows search. The groups count now reflects the filtered search results instead of the full list. #25689
  • ␣ Space key works when renaming. Pressing space while renaming a file or folder no longer opens it, so spaces can be typed in names. #25627
  • 🩹 Missing local embedding model no longer blocks startup. A missing local embedding model now surfaces as a deferred error instead of preventing the server from starting. #25683
  • 🔤 Consistent settings label capitalization. Toggle labels in settings now use consistent title casing. #25765
  • ♿ Better screen-reader labels on toggles. Integration and switch toggles now expose proper accessibility labels and pressed state for screen readers. #25258, #25230
  • 📜 Long dropdowns scroll. Dropdown selects now scroll when their list is long, so all options stay reachable. Commit, #25608
  • 🔽 Collapsible sections don’t misfire on load. Collapsible sections no longer trigger their change action when first rendered, avoiding unintended toggles on page load. Commit, #25229
  • ➗ Large math expressions no longer crash rendering. Parsing math delimiters no longer overflows on very large or deeply nested input, so messages with heavy math render instead of failing. #25845
  • 🗄️ Oversized chunks no longer break Milvus indexing. Overly long text chunks are now trimmed before being sent to Milvus, so a single large chunk can no longer fail the whole batch and leave a file with no embeddings. #25857, #25858
  • 📝 Code editor stays open when empty. The code editor drawer no longer collapses when its content is empty. #25855
  • 💽 Settings no longer lost after a restart. Admin configuration is now stored more reliably, fixing cases where external connections and model parameters could be lost after restarting the server. Commit, Commit, Commit, #24743, #25911, #25959
  • 📜 Visible chat scrollbar. The chat area now shows a scrollbar, making it easier to scroll through long responses. Commit, #25833
  • 🎚️ Default model parameters apply to requests. Default model parameters are now applied to outbound requests, so settings like temperature and the context window take effect as configured. Commit, Commit, #24930, #26209
  • 🟢 Ollama loaded-model indicator restored. The indicator showing which Ollama model is loaded in VRAM works again after recent changes. #25586, #25732
  • 🪪 Static MCP connectors recover missing OAuth details. MCP connectors configured with static OAuth credentials now fill in a missing scope or resource from the server’s published metadata, so they connect correctly instead of failing when those values were left out. Commit, #25898
  • 📊 Token usage and cost stats no longer wiped by background tasks. A response’s token usage and cost are now preserved when background tasks like title, tag, and follow-up generation run on the same chat, instead of being overwritten. Commit
  • 🔗 Model share link updated. Sharing a model now opens the current community post page, fixing the link that pointed at the old endpoint. #25801

Changed

  • ⚠️ Database Migrations: This update contains database migrations. Please be sure to back up your database before updating, as downgrading after the migration is not supported.
  • 🔔 System events now fire automatically. With the new event system, Open WebUI emits events for activity like startup, sign-ins, and configuration changes, so any webhook you already have configured may begin receiving calls for these newly emitted events after upgrading. Review your event and webhook settings after updating so you only receive the events you want. Commit
  • 🔀 Native tool calling is now the default. Every chat and model that had not explicitly chosen a tool-calling mode now runs Native, which relies on a model’s built-in tool support, while the old behavior has been renamed “Legacy” and made the explicit opt-out; if your models depend on the previous approach you must switch them back to “Legacy” per chat, per model, or globally in your default model parameters to preserve their behavior. Commit
  • 🗂️ Authentication settings moved to their own page. LDAP, OAuth, and related authentication settings have moved out of the General settings page into a dedicated Authentication page in the admin panel. Commit
  • 🎓 Several features are no longer beta. Memories, Notes, Channels, and High Contrast Mode have graduated out of beta and no longer carry a beta label. Commit
  • 🔧 Local web fetch setting renamed. The “ENABLE_RAG_LOCAL_WEB_FETCH” environment variable is now “ENABLE_LOCAL_WEB_FETCH”, reflecting that it applies beyond retrieval; the old name still works as a deprecated alias. Commit
  • 🔧 You.com search key renamed. You.com web search now prefers the “YDC_API_KEY” environment variable, with the previous “YOUCOM_API_KEY” still accepted as a fallback. Commit, #26316
  • 🧪 Client-side Python now runs sandboxed. Client-side Python (Pyodide) now runs in a sandboxed, opaque-origin iframe by default, isolating executed code from your session, cookies, local storage, and the app’s own endpoints, while full Python, JavaScript, and external network access keep working. Code that relied on reaching same-origin Open WebUI endpoints from Pyodide will no longer be able to, and Pyodide is now marked legacy in the admin Code Execution settings. Commit, Commit, Commit, Commit, Commit

下载链接