open-webui v0.11.4 版本更新介绍

发布日期: 2026-09-21
版本号: v0.11.4

本次 Open WebUI 版本更新内容总结如下：新增方面，slim 精简镜像体积降至约 175MB（比上个版本小约 89%），标准镜像也通过移除重复的 Python、无用字体和包减少了约 170MB；终端技能集成让连接的终端服务器提供的技能与工作区技能一同出现在各处选择菜单中，模型还可通过自动发现看到全部技能的名称与描述并自行打开；模型工作时会读取终端主目录下的 AGENTS.md 指令文件；工作区模型可设置随模型导出导入的背景图片；聊天中输入 /skills:create 可把当前流程直接写成可复用技能；终端面板为每个命令提供独立标签页，支持整个文件夹上传与双文件并排对比；新增提示词按界面语言本地化、Exa 搜索结果长度上限、欧盟境内搜索提供商 Staan、模型与工具等条目的多语言名称描述、界面文案逐语言替换、登录表单可关闭、文件自定义元数据随分块传递、笔记与自动化行按住 Shift 快速删除、回复中的差异按 diff 视图渲染、笔记格式开关、管理端模型列表筛选、设置按名称搜索、模型下架后聊天自动回退默认模型、聊天与知识搜索改为非阻塞、协作笔记编辑流量减半、知识库 ls/tree/find 命令支持排序、请求携带认证类型头、后续问题以幽灵文本预填、模型拒绝记录日志、Redis 场景下聊天请求更省开销、长对话流式读写不再整体重写、以及大量翻译更新。修复方面，本次包含安全与访问控制修复，建议生产环境尽快升级：身份提供商登录失败不再把凭据写入日志，角色映射与被封禁分组保存问题修复，登出与吊销令牌会同时切断已有连接，Mermaid 与 SVG 不再跟随跨域引用，终端会话每十秒复查权限，连接的模型列表接口校验角色，知识库文件访问与目录越权收紧，Cookie 转发需显式开关，Redis 不可达时撤销列表降级放行，首页聊天草稿可恢复，S3 图片不再破坏回复，回复分支切换增加回环保护，笔记保存、分享、粘贴与小编辑不再丢内容，附件单独发送不再被技能名覆盖，SVG 附件按源码文本处理，Tika 4 文档恢复 Markdown 格式，会话过期按实际令牌计算，工具调用步骤在回复完成后保留，流式回复自动跟随底部，工具结果与标签块在正确时机呈现，代码解释器补上 Excel 与 seaborn 支持，问题卡片提交与推荐标记修正，设置改为按字段保存并如实反馈失败，PostgreSQL 全新安装的知识搜索索引改为有足够文本后才构建且召回不足时继续检索，空结果搜索泄漏的数据库连接归还，文件夹删除会一并清理索引与文件，正则搜索改用 RE2 规则避免灾难性回溯，自动化调度的时间与重复规则解析修正，停止聊天会逐个终止所有在跑任务，停止后的回复状态正确关闭，图片编辑支持本机已持有图片，Apple 设备回复不再空白，媒体页面抓取提速，工作区导出包含全部允许项，导入聊天保留置顶归档与变量，另修复了大量权限、导出、界面显示、快捷键、渠道消息、技能与工具、模型克隆与分享、提示词版本、语音引擎、终端代理限制、流式错误上报等缺陷。变更方面，slim 镜像不再内置本地模型及其依赖库，仅支持 SQLite 与 PostgreSQL 数据库、本地文件存储，知识搜索需 PostgreSQL 加 pgvector，embedding 与重排需外部服务，文档分词不支持下载式 tokenizer，PDF、Word、演示文稿上传需配置外部抽取器，语音识别与合成需外部引擎，网页抓取没有无头浏览器，不含 DDGS 元搜索，代码解释器的 numpy 等包改由 CDN 加载，不含 git，langchain-community 不再安装，nltk、pymongo 等意外带入的包也已移除（相关工具需在自身依赖中声明），含空格或制表符的模型 ID 被拒绝保存，回复中的链接仅对网页、邮件、电话及站内地址渲染，个人设置的集成标签默认隐藏需管理员开启，图片连接测试端点地址变更。

更新内容 （中文）

新增

• 📉 slim 镜像大幅瘦身。 slim 构建现在下载体积约为 175 MB，比上一个版本小约 89%，本地模型、相关软件包以及安装它们的工具都已移除；这对实例运行方式的影响详见下文"变更"部分及文档。Commit, Commit
• 📦 标准镜像更小。 镜像不再包含第二份 Python、两套从未被加载的字体、从未被导入的包，以及安装这些包的工具，标准构建因此减小约 170 MB。#29731, #29723, #29725, #29726, #29728, Commit, Commit, Commit, Commit
• 🧑‍💻 终端提供的技能。 已连接终端服务器提供的技能，现在在所有选择技能的位置都与工作区技能并列——"$“和”/“菜单、集成菜单以及技能面板，每一项都标注为"终端”——用法也相同：选中后会把它的指令、它的文件夹以及随附文件呈现在模型面前，而仅被告知某技能存在的模型也能自行打开它。它们跟随所选终端，切换终端时即被清除。Commit
• 📔 终端指令文件。 使用终端的模型现在会收到该终端主目录下的 AGENTS.md，并在每轮对话开始时重新读取，这样你放在工作旁的指令无需粘贴即可送达模型。Commit, Commit
• 📇 技能自动发现。 你能访问的每个技能，现在都会以其名称和描述列给模型，只有模型决定使用某个技能时才加载其全文；此前，你在消息框中未选中的技能对模型是不可见的，这一点同样适用于开启了内置工具的模型。Commit
• 🌄 模型背景图。 工作区模型现在可以携带背景图，在其编辑器中上传，选中该模型时绘制在聊天内容之后，位于文件夹自身背景图之下、你的个人背景图之上，并随模型一起导出和导入。Commit
• 📓 从聊天创建技能。 在已有内容且选中了终端的聊天中输入"/skills:create"，会把你刚走过的流程写成一个可复用技能，保存到该终端根工作目录下的".agents/skills"（而非 shell 恰好所在的目录），并按 Open WebUI 的技能规范编写。Commit, Commit, Commit, Commit, Commit
• 🖥️ 按命令分标签的终端。 终端面板现在会为模型正在运行的每个命令各开一个标签页，与你自己的 shell 并列，方便你观察进度、在标签间切换或亲自接管 shell，每个标签页打开时显示产生它的命令。打开面板会让你进入一个标签页，在没有其他任务运行的地方启动你的 shell，关闭最后一个标签页后面板随之收起。Commit, Commit, Commit, Commit
• 📂 向终端上传文件夹。 终端旁的文件浏览器现在接受文件夹，可拖放进去，也可从其菜单中的"上传文件夹"项选择，并在上传过程中逐层重建其内部结构（含子文件夹）；此前拖放只会上传散放在顶层的文件。Commit, Commit, Commit
• ⚖️ 并排文件对比。 在文件浏览器中选中两个文件会点亮"对比"按钮，将它们左右并排或上下排列，标注行号，标出新增和删除的内容（精确到行内变化的部分），统计两者行数，还可以互换左右位置或排除空白差异，这一选择会被记住；终端版本过旧无法提供对比时会给出提示而非静默失败。Commit, Commit
• 🌐 建议提示词本地化。 全新安装现在会以界面所设语言提供其建议的入门提示词，而不是对所有人都给出同样四条英文提示；模型默认设置面板在自身的建议被编辑后，也提供了恢复这些默认值的途径。Commit, Commit
• 📏 Exa 结果长度上限。 通过 Exa 的网页搜索可限制每个结果的字符数，在管理端网页搜索设置中其密钥旁配置，或设置为"EXA_MAX_CONTENT_LENGTH"。Commit
• 🇪🇺 欧洲网页搜索选项。 现在可以选择 Staan 作为网页搜索提供方，为需要在欧盟境内搜索的部署提供一个无需自行托管的选项，可在管理端网页搜索设置中配置，或通过"STAAN_API_KEY"、“STAAN_MARKET"和"STAAN_MAX_SNIPPETS"配置。#30138, #26006, #30303, #30301
• 🗣️ 多语言名称与描述。 模型、工具、技能、函数、横幅或竞技场条目现在可以按语言分别保存其名称、描述、入门提示词和阀门标签，可在各自的编辑器中填写可搜索的表格，或以 JSON 文件导入；若某条译文遗漏了原文使用的占位符，该译文会被拒绝。界面显示与所设语言一致的文案，该语言没有内容时回退到纯文本。Commit, Commit, Commit, Commit
• ✏️ 可改写的界面文案。 管理员现在可以在管理设置中的面板里按语言逐条替换界面自身的文案，若替换遗漏了原文使用的占位符则会被拒绝。Commit
• 🔓 关闭登录表单。 要求输入邮箱和密码的表单现在可以从登录页移除（在认证设置中配置），此前只能在服务器启动前设置；移除后由单点登录或目录服务负责用户登录。Commit
• 🏷️ 自定义文件元数据。 附加在上传文件上的元数据现在会随该文件的分块一起传递，并随检索到的来源一起返回（超大字段和内部字段除外）；运维人员可在"RAG_SOURCE_METADATA_KEYS"中指定其中哪些字段能与文本一起呈现给模型。#29499, #29486, Commit, #29502, #29696
• 🗑️ 快速删除快捷键。 在列表或网格中的笔记上、或自动化页面的某一行上按住 Shift，其尾部控件会变成删除按钮，一次点击即可删除该条目，而不需要菜单及其确认所需的三次点击。#29635, #29633, #29640, #29637
• 🔀 差异按差异呈现。 回复中的 diff 或补丁块现在按其本来版式呈现，包含文件和区块标题、新旧行号，新增与删除的行精确高亮到行内变化的部分，并提供一个按钮可切换到纯文本再切回来。Commit
• ✒️ 笔记的格式开关。 可编辑的笔记在菜单中带有一个"格式化"开关：关闭时，你输入或粘贴的 Markdown 保持为所写字符，粘贴保留其纯文本，网址保留为文本，而笔记中已有的格式不受影响。Commit
• 🎛️ 管理端模型列表筛选。 管理设置中的模型页面现在可以按连接提供的基础模型或工作区中构建的模型进行筛选，与已启用、已禁用、可见、隐藏等筛选器并列。Commit
• 🔍 按名称搜索设置。 设置中的搜索框现在匹配每项设置自身的名称和描述，而不再使用每个页面各自维护的关键词列表；无论你使用哪种语言、是否带重音均可匹配，会排除你的权限不允许修改的项，打开搜索结果也不再清空你输入的内容。Commit, Commit, Commit
• 🆘 每个聊天都有模型可用。 打开一个其模型此后已被下架的会话，不再出现无模型可选的窘境；会先回退到你的默认模型，再回退到配置的默认模型，最后回退到第一个可用模型，而模型仍然存活的聊天会保持原样。#29757
• ⚡ 非阻塞搜索。 聊天与知识库的文本搜索，以及模型在知识库上执行的 grep，现在与服务器的其他部分并行运行而非在其前面，长时间搜索不再让其他请求排队等待。#29621, Commit
• ✴️ 更轻量的共享笔记编辑。 多人同时编辑的笔记不再按每位观察者把每次按键回传服务器一次；两人编辑时编辑器之间的流量减半，人数越多下降越多，共享笔记随房间扩大依然流畅。#28185
• 🔢 知识库列表排序。 模型在知识库上执行的"ls”、“tree"和"find"命令现在按名称排序，并支持”-t"、"-S"和"-r"，分别表示最新优先、最大优先和反序。#29840
• 🪪 认证类型请求头。 发往 OpenAI 或 Ollama 连接的请求现在带有"X-OpenWebUI-Auth-Type"，说明请求背后的用户是通过浏览器登录还是用 API 密钥调用；其名称可通过"FORWARD_USER_INFO_HEADER_AUTH_TYPE"设置，自定义请求头中可使用"{{AUTH_TYPE}}"。Commit
• 💡 后续问题幽灵文字。 回复结束后，它建议的第一个后续问题现在会以灰色显示在空消息框中，同时也显示在回复下方：按 Tab 键即可填入，输入任何自己的内容则会清除它。Commit
• 🪵 模型拒绝日志。 被"Model not found"拒绝的请求现在会写入一条警告，注明账户、模型及被拒绝的原因，而调用方看到的消息保持与之前一样模糊。Commit
• 🤲 Redis 之下更省的聊天请求。 多个服务器通过 Redis 共享 websocket 流量时，聊天请求不再为查询少数几个模型而从 Redis 拉取整个共享模型列表；每个 worker 保留自己的副本，仅在列表确实变化时重新拉取，因此开销不再随配置的模型数量增长。#28176, #28167
• 💽 长会话流式更省。 写入或读取单条消息不再加载、检查并重写整个会话来改动几百字节，因此向长聊天流式写入不再随长度增长而越来越贵，拥有数千条消息的会话上，一条消息事件的完整往返开销降至原来的一小部分。#28184, #28169
• 🧱 原地流式追加。 流式回复可以用 CPython 的原地字符串追加来拼装，通过"ENABLE_CHAT_RESPONSE_STREAM_INPLACE_APPEND"开启，在逐步推广期间默认关闭。Commit, Commit, #30066
• 📘 直连说明。 个人设置中的连接与集成页面现在明确说明：直连依赖你的浏览器会话来维持请求运行，更适合测试和临时使用，而非日常工作。Commit, Commit
• 🔄 常规改进。 应用各处实施了多项改进，以提升性能、稳定性和安全性。
• 🌐 翻译更新。 日语、繁体中文、韩语、芬兰语、俄语、乌克兰语、德语、西班牙语、葡萄牙语（巴西）、阿拉伯语、阿拉伯语（巴林）、阿塞拜疆语、保加利亚语、孟加拉语、藏语、波斯尼亚语、加泰罗尼亚语、宿务语、捷克语、丹麦语、巴斯克语、克罗地亚语、荷兰语、意大利语、土耳其语、简体中文、波斯尼亚语、加泰罗尼亚语、丹麦语、爱沙尼亚语、芬兰语、加利西亚语、克罗地亚语、卡拜尔语、挪威语（博克马尔）、葡萄牙语（葡萄牙）、罗马尼亚语和土库曼语的翻译得到增强与扩充。

修复

• 🛡️ 安全公告：本版本包含安全与访问控制修复。建议你尽快更新生产部署。本版本中的安全修复未必全部列在修复部分，部分可能暂缓公布，以便管理员有时间升级。Advisories
• 🔑 令牌不进日志。 通过身份提供商登录中途失败时，不再将其收到的凭据写入应用日志，改为记录该提供商及其报告的错误。#29709
• 🔐 登录角色映射。 某些配置下身份提供商发送的角色未被应用，账户停留在默认角色；现在无法读取角色的登录会被拒绝，而不是放行。Commit
• 🚫 被屏蔽的登录分组得以保存。 在屏蔽分组字段中输入的逗号分隔分组名，保存后现在能生效——此前保存时按原文存储文本，登录检查随后将其读为空；本身含逗号的分组名也能在保存后存活。Commit
• 🚪 登出结束会话。 登出或撤销所有令牌后，该账户已建立的任何存活连接仍然保留，现在这些连接会在同一时刻被切断；已被撤销的令牌不能再被重放去切断他人更新的会话。Commit
• 🛡 图表与 SVG 留在本源。 附加或上传的 Mermaid 图表和 SVG 预览不再跟随指向其他源的引用（包括图片、样式或配置行），向外伸手的图表会被拒绝并报错；依赖外部 sprite 的文件其相应部分显示为空白。#30271
• 📲 终端会话跟随访问变更。 终端连接在其打开期间每十秒重新检查一次你对它的访问权限，因此移除某人权限或停用其账户后，会在下一次检查时结束其活动终端，且在所有 worker 上生效，而不仅是其登录所经的那一个。Commit, Commit
• 🔒 连接模型列表访问控制。 列出单个 Ollama 或 OpenAI 连接上模型的端点，此前任意角色的已登录账户都能访问，现在会检查调用者的角色。#29619
• 🔏 知识库文件访问。 文件通过知识库的访问现在只依据其真实的附件关系，而不再依据文件记录上遗留的集合名称。#29937
• 🌳 知识库目录留在其基目录内。 传给知识文件路由的目录 id，若属于另一个知识库则被拒绝——此前调用方提供的 id 可以越出被访问的目录树之外。Commit, #29887
• 🍪 Cookie 转发范围。 以已登录用户身份认证的连接，只有在其新的"转发 Cookie"开关打开时才会收到本实例的浏览器 Cookie，依赖该行为的实例升级后需要手动打开。Commit, Commit, Commit
• 🗝️ 吊销列表回退。 吊销列表存于 Redis 而 Redis 不可达时，现在会接受令牌而不是让请求失败，因此登出可能要等 Redis 恢复后才生效。Commit, Commit
• 🗒 主页聊天草稿。 从主页发起的聊天中输入的消息，现在在重新加载后能恢复，文本、上传内容一应俱全——此前草稿存放在一个页面再也不读取的键下。#29762, #29760
• 🏞️ S3 托管的聊天图片。 若聊天图片的主机回显了一个没人请求的 Content-Encoding（带该元数据上传的 S3 或 MinIO 对象即属此类），不再破坏它所在的回复；它会像原本无法到达的图片一样以链接形式发送。#29623
• 🪆 分支下行保护。 在回复分支之间跳转时遍历聊天的子节点却没有记录已访问位置，因此指向自身的循环历史会永远旋转并锁死标签页，而没有对应消息的子 id 会抛异常；现在遍历的全部十一处共用同一个带保护的辅助函数。#30070
• 🗒️ 退出时的笔记保存。 笔记的标题和附件在变更后稍后保存，若在此期间离开笔记，保存会被丢弃，笔记列表一直显示旧标题直到页面重新加载；现在待完成的保存会在下一页打开前完成。#29745, #29744
• 📷 无文本也能发送附件。 向挂载了技能的模型发送图片或文件而不输入任何文字时，空消息会被技能名称列表替换，模型于是回答自己的目录而不是查看你发送的内容。#30045, #30040
• 🖍️ SVG 附件按文本读取。 附加到聊天的 SVG 此前作为图片上传，每个尝试解码它的模型都拒绝了它，现在改为读取其源文本，这需要一个支持文件上传的模型。#30102, #30100
• 🩹 小幅编辑不再毁掉笔记。 被要求添加一节或改动几行时，模型会把整篇笔记发回来，其余内容随之丢失且无从撤销，因为编辑工具从未说明何时应编辑某个范围；现在它明确写出了处理程序本就执行的范围规则。#30048
• 📋 笔记粘贴位置。 纯文本粘贴替换的范围超出了选中内容，粘贴到代码块中会跳出块外而不是进入块内；现在两者都精确落在放置的位置。Commit
• 🧿 只读笔记不再出现"插入到笔记"。 “插入到笔记"操作不再出现在你只有只读权限的笔记上，此前它会在无法落地的地方提供该操作。#30223, #30174
• 🤝 笔记共享在保存后得以保留。 保存你被授权访问的笔记会取消那份共享，笔记于是变为私有，其他人全部失去访问。#30175
• 🌍 协作时的链接处理。 在两人同时编辑的笔记中，对方编辑器传来的纯网页地址在你这边会变成链接而对方那边不会；现在它保持原样不作转换。Commit
• 📑 Tika 4 文档格式。 文档抽取走 4 版 Tika 服务器时，文本现在以 Markdown 返回而非一串扁平字符，标题、列表和表格因此得以保留在模型读到的内容里。Commit
• ⏳ 会话过期准确性。 使用身份提供商的会话现在随其实际用于调用的令牌过期，而不再看两个令牌中先到期的那个——此前那会提前续期并在续期失败时随时丢弃会话。Commit
• 🧩 完成后的回复保留工具步骤。 调用了工具的回复在执行时逐步显示各步骤，回复一完成这些步骤就消失了，因为提供方的收尾消息替换了屏幕上的全部内容而非合并进去；现在收尾消息会并入已有内容，工具调用也不会再被误当成其自身的结果。Commit, Commit
• 🧭 流式回复自动跟随。 经响应事件送达的回复在书写过程中现在也会让视图保持在底部，与旧路径上的回复一致，除非你自己向上滚动过。Commit, Commit
• 🚿 工具完成时结果即达。 模型工具调用的结果现在在产生它们的那一轮结束时立即送达回复，而不再与其余流式内容一起被节流扣住；频道回复或续写也不再携带工具交给模型的图片数据。Commit
• 🧗 流式中的标签块。 使用推理、solution 或代码解释器标签的回复，到达时曾短暂显示原始标签文本，因为携带它的分块先于清理后的输出到达浏览器；现在标签一经剥除，清理后的输出立即发送，解释器块写入的代码填充该块而不是消息正文。Commit
• 📗 代码解释器中的 Excel。 在浏览器运行的代码中读写电子表格此前彻底失败，因为处理它们的库从未送达浏览器，现在随其余部分一起发布。#30140, #30130
• 📀 内置的图表与格式化。 在浏览器运行的代码中用 seaborn 绘图此前会在那一刻从互联网抓取库而不是取自随附内容，代码编辑器的"格式化"按钮对非管理员则彻底失败；现在两者都基于应用自带内容工作，含离线环境。#30148, #30145
• 🙋 输入答案的提交。 在模型弹出的提问卡片中，选择最后一个提问的某个选项会立即发送你的答案，但在"其他"框中自行输入会让"提交答案"保持灰色且无法发送，现在只要该框有内容它就会亮起。#29494, #29311
• 🥇 名副其实的"推荐"徽标。 模型弹出的提问卡片会把第一个选项标为"推荐”，但没有任何提示告诉模型这一点，于是徽标落在碰巧排在第一位的选项上；现在会要求模型把它推荐的选项放在那里。#30196, #30195
• 🎚️ 部分设置权限。 被禁止修改界面设置的账户，现在可以保存其系统提示词、通知、音频、键盘快捷键和置顶模型——这些此前会连同界面设置一起被拒绝。Commit
• 🎧 语音文件类型得以保留。 保存音频设置会清空语音识别接受的文件类型列表，于是转录随后拒绝了它此前接受过的录音。#30208
• 🚻 无权限者的分组选择器。 用于把聊天、笔记或知识库分享给分组的选择器，被提供给了不允许按分组分享的账户，现在对他们隐藏。#30189
• 🗜️ 按字段保存设置。 现在只存储实际更改过的设置，而非整个对象，因此另一个标签页的旧副本不再覆盖它们，管理员更改的默认值也能送达所有人；在设置窗口之外置顶模型、重排列表或选择默认值，现在也以同样的方式保存。Commit, #30183
• ⚠️ 保存失败的反馈。 无法保存的设置此前在页面重新加载前一直显示为已保存，因为界面未等服务器响应就本地存储了它们；现在失败会抛出错误并保持面板原样。Commit
• 🔠 菜单文字缩放。 界面各处下拉菜单中的条目现在随其余部分一起缩放，而不再在菜单本身变大的同时保持固定字号。#29493, #29488
• 🪞 账户菜单高亮。 带有置顶按钮的账户菜单条目现在整行以共享颜色点亮，较长的标签也不再把置顶按钮挤出菜单。Commit
• 🔲 Shift 点击选择文件。 在终端文件浏览器中 Shift 点击文件，现在会把该范围加入已有选择，点击已选文件则移除其范围。Commit, Commit, Commit
• 🛟 附件重名冲突。 在把附件放入终端工作目录的实例上，向消息附加文件此前会覆盖那里的同名文件；上传现在会取下一个可用名称（“report.pdf"旁是"report (1).pdf”），附件显示保存时使用的名称，不过不同浏览器同时到达的两次上传仍可能落到同一名称。Commit
• 📛 上传失败的反馈。 无法写入终端的文件现在会给出说明，而非静默通过、让浏览器刷新得仿佛已送达。Commit, Commit, Commit
• ☑️ 复选框默认不勾选。 写成复选框且默认值为 false 的提示词变量，打开表单时已处于勾选状态，False、“false”、0 和"0"亦然，因为任何非空默认值都被算作已勾选；现在只有值确实为 true 时才勾选。#30037, #30036
• 🎯 预填问题的时机。 从带问题的链接打开聊天时，问题在输入框获得内容前就已发出，含变量的问题于是发出时变量未填充；现在发送会等文本就位并填充完成。Commit, Commit
• 📜 任务列表高度。 模型逐步完成的步骤列表会按需要无限延伸，把回复其余部分推到页面下方；现在它止于窗口高度的四分之一，超出部分在其内部滚动。Commit
• ⎋ Escape 键的目标。 关闭对话框的快捷键此前总是关闭设置窗口，无论实际位于最前的是哪个对话框，于是从设置内部打开的对话框会把两者一并关掉；现在每个对话框各自响应此快捷键，正如它对 Escape 键早已如此。#29830, #29817
• 🎹 消息对快捷键。 向聊天添加一空一答消息对的快捷键，也会把消息框中已输入的内容一并发出去，于是这对消息之外还附带了一条你尚未打算发送的消息。#30167
• 🥁 收起任务列表。 折叠回复下方的任务列表同样会发出你在消息框中输入的内容。#30202
• 🕰️ 临时聊天链接。 带临时聊天标记的链接打开的是普通聊天，因为标记写进了地址却从未在页面加载时读回，现在此类链接会打开它承诺的临时聊天。Commit
• ⌨️ 录制新快捷键。 按下组合键将其录为快捷键时，也会执行该组合已绑定的功能，于是设置快捷键反而做了你想重新绑定的那件事。#30160
• 🔃 过期标签页的重载。 仍在运行上一构建的标签页在服务器更新后遇到的是错误页而不是新页面，因为由 Docker 构建的每个镜像都带同一个版本戳；现在版本戳跟随构建，过期标签页能按预期重新加载。#29832, #29831
• 📌 频道代码标题栏。 在频道讨论串或其置顶消息中标示代码片段的标题条，现在齐平贴在面板顶部并裁剪到代码块，而不再在代码滚动时悬浮其上。#29836, #29835
• 📨 重复的代理请求头。 经终端服务器或 OpenAI、Ollama 连接代理的回复，不再携带该服务器自身的"Server"和"Date"请求头——此前位于其前的反向代理会为每一条各记一行重复日志。#29841, #29824, #29843
• 🎣 测试图片连接。 图片生成连接旁的"验证"按钮此前先保存整个图片配置，再测试当时激活的引擎而非旁边的连接；现在它精确测试该连接且不做任何更改。Commit
• 🪝 Responses API 工具严格性。 通过 Responses API 触达模型的工作区工具、MCP 服务器或 OpenAPI 服务器，被转成了它从未要求的严格 schema，于是模型给每个可选字段都填上空字符串、0 和空数组，搜索与筛选工具本应留空之处却被填了值。#30046, #27750
• 🪃 Responses API 工具调用。 发往 Responses API 连接的强制工具选择以错误的形态发出，被校验它的提供方拒绝；非流式回复中的工具调用返回为空文本，读取该 API 的任何东西都看不到它。#30095, #30085
• ⛓️ 链接中缺失的工具。 从链接打开聊天时，若其"tools"或"tool-ids"参数点名的工具已不存在或该账户不可见，此前该 id 会留在选择中并随消息发出；现在与该账户任何工具都不匹配的 id 会被丢弃，链接的其余部分照常工作。#29803
• 🚫 模型编辑器的错误信息。 无法加载以编辑的工作区模型现在会给出说明，而不是无论真实原因一律返回"You do not have permission to edit this model"。#29694, #29629
• 👥 被丢弃的目录更新。 身份提供商以新增或删除形式发送的变更，或未指明所改属性的变更，此前被接受后又被悄悄丢弃，于是重命名或停用从未送达账户；现在这些变更会生效。Commit
• 🗃️ 目录请求校验。 携带错误类型值或 Open WebUI 不支持的属性的预配请求，现在会返回错误而非静默通过，没有任何变化的同步也不再把账户标记为已变更。Commit
• 🔘 模型编辑器保存按钮。 保存工作区模型后若模型列表无法刷新，现在会报告错误并释放保存按钮，而不再让它保持禁用并转圈、仿佛模型已经保存。Commit, Commit
• 🫱 再次评价回复。 在回复上从一个赞切换到另一个赞，此前会保留第一次的评分和理由，而对反馈已被删除的回复评分则彻底失败；现在两者都记录你刚给出的评价。#30075, #30077
• 📶 按用户排序反馈。 管理端反馈历史中的"用户"列点击无效，现在按留下反馈的人排序。#30191
• 🪂 关闭"编辑用户"对话框。 在管理端"编辑用户"对话框中输入后又放弃的更改，此前会显示在用户列表的行上直到页面重新加载，现在关闭对话框即丢弃它们。#30193
• 🪙 模型默认值保存。 在管理设置中保存模型默认值，此前会把已选、置顶和排序的模型恢复为页面打开时的状态，撤销其间的一切更改。#30206
• 👤 自定义性别得以显示。 性别填写自有措辞的账户，此前账户表单返回空白下拉框，现在表单会显示"自定义"并在旁标出该措辞。#30215
• 📗 清空日历事件字段。 清空日历事件的重复、描述或位置此前不生效、旧文案会回来，现在这些字段可以再次清空。#30204
• 📕 提示词必填下拉框。 提示词的表单此前可以带着未选择的必填下拉框提交，现在会要求你先选一项。#30078
• 🎫 账户表单必填项。 账户表单现在会拒绝在必填项为空时保存，与管理端用户对话框一致，且对从未设置过出生日期的账户不再强制要求出生日期。#30296, #30295
• 🐑 模型克隆保留其基础模型。 从管理端模型设置克隆模型现在会带上它所基于的模型——此前克隆与之脱钩；竞技场模型则完全不再提供"克隆"。#30080, #30079
• 🧤 模型共享在保存后得以保留。 保存你无法完全共享的模型，不再剥除你无法重建的访问条目——此前编辑器会重发每一条已存条目，每条都按其作者可授予的范围重新校验，权限受限者的保存会悄悄把模型变为对其他人私有。Commit, #30093, #30087
• 📠 提示词版本保存。 保存新版本提示词而不点"设为生产"，线上提示词保持原样——此前草稿会悄然取而代之；版本一经设置，编辑器立即显示生产文本。#30231, #30230, #30233, #30232
• 💬 模型描述往返无损。 工作区模型的描述从默认切回自定义后可以再次保存——此前该切换把字段读为空，保存时描述被丢弃。#30249, #30247
• 🎚 压缩阈值得以保存。 在常规设置中设定的上下文压缩阈值现在能送达模型参数——此前该值从未离开页面。#30270, #30269
• 📢 语音引擎默认值。 切换文本转语音引擎现在会应用该引擎自身的默认声音和模型——此前更改保留了上一引擎的设置。#30289, #30288
• 🗞 本地模式下的 MinerU 密钥。 本地模式下 MinerU 密钥留空时文档设置也能再次保存——此前表单强要一个它并不需要的密钥。#30299, #30298
• 🫂 新建分组对话框重置。 创建分组后，新建分组对话框以空状态打开——此前下一个对话框带着刚创建的分组出现。#30280, #30279
• 🧵 讨论串回复通知。 点击讨论串内回复的通知，此前会把你丢到频道底部、讨论串仍关闭、回复不见踪影；现在它会打开该回复所在的讨论串。#29856, #29855
• 🔽 下拉箭头间距。 绘制宽度不超过其内容的下拉框（新连接上的提供方即属此类），其箭头不再与最长选项的末尾字符重叠。#29866, #29865
• 🧊 小写请求头处理。 上游以小写书写的请求头（uvicorn 提供的一切皆如此）现在被不区分大小写地匹配，“Content-Encoding"因此被剥离，客户端不再对服务器已解压的响应体解压失败。#29843
• 🛑 彻底停止聊天。 当一个聊天有多个任务在途时，停止它、删除它或关闭正在处理的笔记，可能只停掉第一个而让其余跑到结束——原因有二：已结束的任务提前结束了这一轮，以及被处理的列表在每清除一项时就被重写；现在每个任务依次停止，于是调用工具的回复会停止调用而不是跑到自身上限，不过通过 Redis 共享状态的实例本就不受影响。Commit, #29844, #29816
• 🖊️ 频道代码块。 模型在频道中以结构化输出作答时，其中的代码此前被画成普通高亮文本，而不是其他所有消息使用的编辑器，因此无法就地编辑，其中的 diff 也无法打开编辑；现在它与别处渲染方式一致。#29861
• 📐 折叠时的代码块编辑。 代码块内未保存的编辑在块被折叠再展开后仍留在屏幕上——此前折叠会显示已保存的文本，尽管编辑仍待保存。#30284, #30283
• 🚨 代码运行错误随输出显示。 以错误结束的代码运行现在把错误与其打印内容并列显示——此前只要打印过任何内容，错误就无处可见。#30286, #30285
• 🔕 只读频道的表情回应。 对你仅有查看权限的频道不再出现表情回应选择器，与那里本已隐藏的回复和菜单选项一致。#30241, #30240
• 🎯 PostgreSQL 上的知识搜索准确性。 使用 PostgreSQL 的全新安装，在尚无任何文本可供组织之前就构建了搜索索引，索引因此从未适配此后到来的内容，每次搜索都悄悄返回错误段落；现在索引会等到有足够文本再构建，在此之前搜索精确读取全部内容。已有此类索引的安装可通过重建该索引来修复。#30143, #30134
• 🗂 知识文件筛选首次点击即生效。 知识库中的"文件内容"筛选现在首次点击即缩小列表——此前首次点击只是激活复选框，所有内容保持列出直到再次点击。#30211, #30210
• 🔭 知识库搜索召回。 当许多知识库共存于一处时，搜索其中一个（其内容只占存储总量的一小部分）只能找回一小部分匹配，且存储越多缺口越大；现在搜索会持续查找，直到从你指定的知识库拿到足够结果，“PGVECTOR_ITERATIVE_SCAN"可关闭此行为或改为严格模式。#30142, #30135
• 🪣 空结果的搜索。 返回空结果的知识搜索从未归还其数据库连接，积累足够多后知识搜索会彻底失效直到重启服务器；现在 PostgreSQL 和 openGauss 上都会归还连接。#30142, #30133, #30144
• 🧽 知识文件夹删除。 删除文件夹而不把其中内容上移一层，会把文件从列表中移除，但其文本仍留在搜索索引、文件本身仍在存储里，于是模型继续检索并引用一个已不存在的文件夹中的页面；现在文本随文件夹一并删除，不被其他知识库持有的文件也一并删除（除非开启了文件保留）。Commit
• 🦀 聊天与知识文件的正则搜索。 模式搜索现在耗时与文本量成正比、无论模式如何——此前一个恶意表达式可能让搜索永久卡死；接受的模式遵循 RE2 规则，不支持环视与反向引用，字符类仅匹配 ASCII。Commit
• ⏰ 自动化计划解析。 规则把时间写在"DTSTART"中的自动化现在按该小时执行，而不再列在午夜、打开时是九点——此前一保存就改变执行时间。Commit
• ⏲️ 重复次数与开始日期。 限定重复次数（十次或一百次）的规则现在按其本来的有限重复解读——此前任何以"1"开头的次数都被当作单次执行；重复文本同行携带开始日期的规则现在遵循你选定的开始时间，计划与日历事件皆然。#29262
• ⌛ 卡住的计划与任务。 规则计算过久的计划不再阻塞评估它的这一轮，会被跳过并附带警告；通过 Redis 共享的后台任务在其 worker 沉默后，经过"REDIS_TASK_TTL"秒过期。Commit
• 📣 模型提及小标签。 ID 含字母、数字和少量标点以外字符的提及（某些工作区模型 ID 中的括号即属此类），此前在输入框中和发送后的消息里都显示为原始”<@…>“文本；任何不含空格的 ID 现在都画成小标签。#29864
• 😀 多码位表情符号。 短代码由多个码位组成的表情符号（国旗即属此类）现在整体插入——此前只有第一部分进入消息。#30213, #30212
• 🔔 自定义 Webhook 名称。 含空格或斜杠的 Webhook 目标现在会像自动名称一样被规整，此后仍可编辑、删除、设为默认或测试。#29947
• 🪛 分页的 MCP 工具列表。 一次只返回一页工具的服务器此前只被读取第一页，其余从不提供给模型；现在在构建工具前收集完整列表。Commit
• 💭 Anthropic 思考块。 Open WebUI 自身的思考块不再转发给 OpenAI 兼容后端——自 0.11.0 起这会使 NVIDIA Dynamo 这类严格服务器拒绝 Anthropic 客户端的第二轮；带签名的块仍会通过。#29849, #29799
• 🗨️ 频道中的模型终端。 在工作区选定终端的模型，此前在聊天中尊重该选择，但在频道中作答或作为频道自动化运行时会丢弃它，于是在没有终端的情况下工作；现在它在任何地方都携带同样的终端，与其已有的工具、筛选器和特性并列。Commit
• 🧺 删除的频道消息不留引用。 删除频道消息现在会清除每条回复上对它的引用，并从回复框中移除——此前回复仍显示已删除的消息，且仍可发送给它。#30314, #30313
• 🔌 终端工具需要终端。 无论聊天是否在你的浏览器中开启并连接了终端，模型此前都会被提供读取和写入你终端的工具，于是可能去够一个并不存在的终端；现在只为聊天已打开的那个终端提供这些工具。Commit, Commit
• 🔤 自定义请求头编码。 连接发送的自定义请求头在值填好后即被编码，于是人名或分组中超出纯 ASCII 的内容（含换行符）不再破坏请求或以别的形态到达对端。Commit
• 🆎 Chromium 拼写检查纠正。 在消息框中从浏览器自带拼写菜单选择建议此前毫无效果，或把错字原样放回——本为笔记编辑器准备的高亮被画在选区之上并重建其下的文本，连带抹掉浏览器的拼写标记；该高亮现在被排除在消息框之外，只在编辑器未使用之处绘制。#29952, #29944
• 🈁 重命名时的输入法组合。 用输入法打字到一半时按 Enter 或 Escape 确认聊天重命名，现在会先完成组合而不保存或取消重命名——此前按键立即生效。Commit
• 🐳 无点号的主机地址。 开启本地网页抓取后，指向同一网络上容器名的地址（如"http://apprise:8000”）现在被接受，而不再被判为无效。#29945, #28161
• 🪧 虚假的技能提及。 消息中写成”<$fh>“的内容（Perl 等语言即如此书写）被当作技能提及，在模型看到之前被悄悄移除，并在屏幕上画成标签；现在只有点名一个确实存在且已启用的技能的提及才被当作提及。Commit
• 🎒 技能设置在保存后得以保留。 从编辑器保存技能会清空其携带的标签和翻译，并把它从禁用状态重新启用；现在这一切都在保存后保留。#30185
• 🫥 Webhook 头像转发。 关闭"ENABLE_PROFILE_IMAGE_URL_FORWARDING"会阻止浏览器被送往外部图片地址，但频道 Webhook 的图片此前仍照发不误；现在它与其余部分一样使用内置图片，webhook 对话框与消息列表皆然——此前该对话框会把每位查看者的浏览器直接送到外部地址。#29889, #29892
• 🪟 统计窗口来源。 向社区分享聊天统计的窗口此前接受任何打开它的页面的请求并向任何地方响应；现在只在对端是社区网站时读取和响应。#29918
• 🖼️ 工具图片渲染。 工具返回的图片若嵌在对象或列表中而非独立返回，此前会被作为原始文本写入对话，一张截图耗费数十万 token 并挤掉其他内容；现在此类图片无论藏在哪里都会被取出并附加到回复，模型拿到图片、你也能看到。一个让每隔一张图片原样通过的旧缺陷一并去除；在已保存的聊天中，此类图片现在作为文件保存并被引用，而不写入对话本身，聊天因此保持精简。#29665, #29208, Commit
• ⏱️ 停止后的回复状态。 按下停止会把回复存为已完成，而其内部各部分仍标记为运行中，于是某个块继续显示"思考中……“或"执行中……"，每次重新加载后依旧如此；现在回复停止时这些部分一并关闭，已打开的标签页立即安定而非等重新加载，仍等待你批准的工具调用保留其提示。#29495, #29281
• 🩺 知识同步错误。 失败的知识库同步现在会指名出错的文件和浏览器报告的内容，而不再只报一句"Error accessing directory”。#29507
• 🚧 终端代理限制。 转发到终端服务器的请求，若指向该服务器的管理端点则被拒绝，不会被继续转发到别处，路径含会被解析器改写的字符时也会被拒绝。Commit
• ⛔ 格式错误的工具调用。 模型请求工具时参数根本不是对象（一个裸列表或字符串），此前回复到此为止；现在会告知模型该调用错在哪里，它可以重试。Commit
• 📡 流中断的报告。 从”/api/chat/completions"流式输出答案途中失败时，此前流就此停止，客户端一直等待一个永远不会完成的答案；现在它会以错误和规范的流结束来关闭。Commit
• 🧷 出错后聊天解除阻塞。 因内容过滤或配额耗尽而失败的回复，此前会让聊天拒绝你此后输入的一切并阻塞消息队列。现在只有失败的那条回复结束，聊天继续，多模型回答中的其他回复继续书写。Commit
• 🫙 历史中的空失败回复。 以错误结束且未写出任何内容的助手轮次，在你发送下一条消息时不再作为对话的一部分交回模型。Commit
• 📭 空页面上传。 向知识库添加网页地址却未取回任何文本时，此前只报一句光秃秃的"Error uploading file"，若上传本身被拒绝，该行还留在列表里；现在原因会按原样送达你，该行也会被移除。Commit
• 🎞️ 工具嵌入范围。 工具调用可请求展示的、运行自身脚本的框架，此前会被画在任何渲染消息之处（含频道）；现在只画在你所在聊天的回复中，绝不画在频道里。#29985
• 🚰 被拒绝的图片地址。 携带服务器拒绝的图片地址的模型条目，不再让该地址滞留内存——任何已登录用户都能将其堆积。#29971
• 🖌 编辑已存储的图片。 要求模型编辑本实例已持有的图片，现在无论其地址指向什么主机都能工作——此前容器名、默认端口或自组主机会让编辑以笼统的加载错误失败。#29691, #29220
• 🧪 记忆回复更轻。 记忆工具不再把每条记忆的存储元数据交给模型，记忆现在记录模型的 id 而非整个模型条目。Commit
• 🔇 记忆彻底关闭。 关闭记忆后，已存记忆不再折入回复上下文，记忆工具也不再提供给模型——此前两者在开关关闭后仍会送达模型。#30228, #30227
• 🧠 开关之下的记忆回顾。 从对话草拟新记忆的后台回顾，在记忆被关闭或账户被禁用时不再运行——此前它每隔一轮仍消耗一次任务模型调用并在写入时失败。#30309
• 🏗️ 终端服务器保存按钮。 保存终端服务器现在会等保存完成再关闭对话框，且第二次点击不会重复触发。Commit
• 🗺️ 终端文件面板路径。 终端旁的文件面板现在能打开模型刚写入的文件，即使它以相对路径命名——此前面板无法匹配该名称，跳到根目录并拖走了会话的工作目录。#30282, #30051
• 🍴 分叉聊天的文件夹。 分叉聊天会把副本放进原聊天的文件夹，即使你对该文件夹没有写权限；现在除非你有权限，副本会创建在任何文件夹之外。#30069
• 🪢 原地放下文件夹。 把文件夹拖到它已所在的文件夹上会报"Folder already exists"失败，现在被当作它本来就是的无操作。#30169
• 🗝️ 只读文件夹处处只读。 以查看者身份共享给你的文件夹，不再在空聊天页面上显示其编辑控件——此前它们会出现，保存会依页面从未检查的权限或成功或失败。Commit
• 🚿 删除文件夹但保留聊天。 删除文件夹同时保留其中聊天，此前会被不允许删除聊天的账户拒绝，尽管什么都没被删除，现在可以通过。#30163
• 🏷️ 删除后的标签清理。 管理员删除他人的聊天时，从自己的账户而非拥有者的账户清理未使用标签，给拥有者留下无人指向的标签。#30171
• 🌱 越过未完成回复的分叉。 只要聊天中任何位置有一个被打断的回复，此后它拒绝一切分叉且永不恢复；现在分叉只等待确有回复在生成的轮次，暂停等待工具批准的一轮仍可分叉且其提示可见。#30131, #30128
• 💾 已删除工具的内存。 删除工具或函数后，其全部代码在服务器运行期间一直留在内存里；现在它随其余部分一并释放。#29983
• 🐌 登录速率限制。 通过 Redis 统计登录尝试不再在 Redis 回答前阻塞整个 worker，缓慢的 Redis 不再连带冻结其他所有请求。#29977
• ♻️ 会话池清理。 清理被遗弃 websocket 会话的任务现在遇到 Redis 错误会继续而非就此终止，并在关闭时正常停止。#29976, #29979
• 🛰️ 跨 worker 的直连。 当多个服务器通过 Redis 共享 websocket 流量时，经直连流式输出的回复不再中途静默；它依赖的事件现在像其余事件一样在 worker 之间传递。Commit
• 🫧 空文档 id。 为完全无 id 的文档送达的保存被归档到那个空 id 下且从未清除，任何已登录用户都能将其堆积；现在不再为其归档。#29980
• 🔬 页面抓取的 CPU 空转。 经浏览器驱动加载器抓取页面，若该页面打开了 WebSocket 则永不返回，让一个 worker 线程在整个进程生命周期内满 CPU 运行，此后每次抓取再赔上一个核，整个实例因此变慢。#30050, #30024
• 🔁 重复的搜索堆栈。 向量数据库故障为每一对集合与查询各写两遍完整堆栈，一次故障在每个副本上变成每条消息数百份相同的堆栈轨迹；现在一条记录点名所有失败的集合。#29981
• 🧯 页面抓取日志。 经浏览器驱动加载器抓取页面，若页面在仍拉取自身片段时关闭（Cloudflare 等站点背后常见如此），日志会被堆栈填满；现在这些请求在页面关闭前即被放走。#29325, #28869
• 📤 工具导出范围。 一次导出全部工具此前返回账户可见的每个工具，包括被开放阅读的工具的源码；现在只返回你可编辑的工具，与单个工具导出及模型既有的导出方式一致。#29310
• 🗳️ 不完整的工作区导出。 从工作区导出提示词或模型，此前只写出你恰好在看的那一页，大多数条目被悄悄漏掉；现在两者都导出你有权访问的全部。#30187
• 🧳 导入的聊天保留更多。 从导出文件带回的聊天，到达时未置顶、未归档、也没有保存时的变量，现在三者都在往返后保留。#30155, #30151
• 🗂️ 从搜索结果取消归档。 搜索结果上的菜单会提供归档一个已归档的聊天，并在聊天被恢复后仍称其已归档；现在它会指明并报告它实际做了两者中的哪一个。#30177
• 🙈 无匹配的文件夹筛选。 由不匹配任何文件夹的文件夹名收窄的聊天搜索，现在找不到任何结果——此前文件夹筛选被悄悄丢弃，所有聊天都回来了。#30273, #29959
• 🧹 批量操作后的侧边栏。 一次性归档、删除或取消归档所有聊天，或导入一批聊天，会让侧边栏中的文件夹和置顶聊天显示已不存在的内容直到页面重新加载；失败的批量操作不再报告成功。Commit
• 🔐 模型图片随模型访问权限。 模型的图片现在只向能看到该模型的人显示——此前任何已登录用户都能取到它，并凭返回的图片分辨已知模型与未知模型。#29700
• 🚪 Webhook 图片随频道访问权限。 频道 Webhook 的图片现在只向有该频道访问权的人显示——此前任何已登录用户都能取到它或被送往它指向的地址；频道功能关闭时则直接拒绝。#29703
• 📎 更安全的 Word 文档预览。 预览 Word 文档不再渲染其内嵌的 HTML 子文档，其中的链接只在指向网页地址、邮件地址或电话号码时才可打开。#29699
• 🚦 引用链接协议。 附加到回复的来源现在只在指向网页地址时打开，否则回退到显示该来源的面板，而不跟随其他任何内容。#29701
• 🈚 格式化文本中的引用标签。 加粗、斜体或链接文本中的引用现在会渲染其小标签——此前格式化会吞掉它，引用从句子里消失。#30278, #30277
• 🐍 保存工具或函数。 在管理页面保存工具或函数不再因内置代码格式化器的缺模块错误而失败——它没有安装其所需的全部依赖。#29503
• 🛠️ 工具请求重复。 通过携带部分输入的地址写入的工具，其那部分不再同时在请求体中重复——严格校验输入的服务器会拒绝它，此类调用现在可以通过。#29717, #29716
• 🍎 Apple Silicon 上的答案得以存活。 提出涉及知识库搜索并使用本地运行重排模型的问题，不再让整台服务器在 Mac 上崩溃，连同答案和连接一起丢失。#29735, #29722
• 📚 网页结果不再被引用。 网页搜索仅列出的页面不再作为可引用对象提供给模型——此前它会给某个结果的文本挂上另一个结果的 id，引用面板还会把那解析成一个看起来对的标题。#29631, #29627
• 🔎 SearchApi 的错误、新闻与链接。 经 searchapi.io 的网页搜索现在会报告无效密钥而非返回空，会读取其返回的新闻结果（与普通结果并列），并把解析后的目标链接交给网页加载器，引用因此不再指向重定向页面。#30308, #30305
• 🔼 诚实的版本检查。 无法访问发布列表的实例现在会说明检查失败，而不再把自己正在运行的版本报告为最新版本且对此不留记录。#29626, #29580
• 🏟️ 竞技场模型报告其错误。 发给竞技场模型的消息若其提供方返回错误，现在会在聊天中显示该错误——此前它会因不相干的事情失败且不吐露真实原因，标题和标签也不再以同样方式出错。#29662, #29658
• 🏳️ 无名工具调用一次失败。 模型端点发送完全无名的工具调用时，该调用现在当场失败，而不再保留缺失的名称、随消息存储，并在下一轮发回让端点拒绝。#29690, #29686
• 🧹 直连不再泄漏监听器。 与直连通信的服务器，对于任何以非干净结束方式收场的请求，不再每次都留下一个监听器——连接持续失败时它们会无限增长。#29509
• 🚀 更省的模型刷新。 通过 Redis 共享的模型注册表现在只在模型本身变化时写入，而不再因 Ollama 给内存中模型附带的倒计时而在每次刷新时写入。Commit
• ✍️ 续写的回复文本。 在临时聊天中要求补全被截断的回复，此前会用仅有的新文本替换屏幕上的内容，因为被续写的那条消息是从它并不存在的已保存聊天里读取的。现在它在调用模型前从请求中取得，续写并入同一条消息而非作为第二条到达；在提供方设为 llama.cpp 的连接上，模型被告知从交给它的文本继续而非复述；在消息编辑器中打开结果不再显示两半相接处的换行；开启触感反馈时，续写会像任何其他回复一样在流式过程中震动。Commit, Commit, Commit, Commit, Commit, Commit, Commit
• 🔗 取消编辑保留附件。 取消消息编辑不再剥除其附件——此前放弃编辑会把附件一并带走。#30281, #30192
• 🏎️ 更快的媒体页面读取。 浏览器驱动加载器此前会在提取任何文本之前，把页面引用的每张图片、视频和字体都经服务器拉下来，于是带几十个音频播放器的页面要十秒或超时。这些请求现在在发出前即被丢弃，同一页面在三秒内返回，拉取 4 MB 而此前是 55 MB。#29742, #29741
• 📝 从搜索框新建笔记。 已在笔记页面时从搜索框新建笔记现在可以工作，会保留你输入的全部内容（含&和#等字符），且每次按浏览器后退按钮不再多建一篇笔记。#29645, #29642
• 📱 Apple 设备上的回复。 助手回复在 Apple 设备上的主屏应用、应用内浏览器或桌面级窗口中不再一片空白——此前规避该绘制缺陷的检查只认 Safari 本身。#29734, #29688, #26712
• 📊 单一来源的相关度。 只依据单个来源的回复现在会显示该来源的相关程度——此前该数字要等第二个来源加入才出现，因而显得忽有忽无。#29647, #29646
• 🔧 Arduino 草图可上传至知识库。 草图文件现在与其旁的 C++ 和头文件一样进入纯文本读取器，而不再交给一个对它无能为力的文档抽取服务器并导致上传失败。#29673, #29670
• 📰 Docling 转换失败。 Docling 拒绝或转换失败的文件，现在以 Docling 给出的原因结束上传，而不再报一个原始错误，或悄悄归档一个占位符——后者会被索引并代替原文件交给模型。#30107, #29808
• 📄 上传的文本保持原样。 文本含转义序列（如表示不换行空格的那个）的文件，现在按其书写原样存储并供模型读取，而不再依其在文件中的位置改写其中一部分。#29736, #29732
• 🔦 可读的斜杠命令标签。 斜杠命令菜单中的条目在浅色主题下不再显示为白底白字。#29512, #29510
• ⌨️ 字面箭头序列。 如小于号后跟三个连字符的序列，现在显示为其组成的字符，而不再画成箭头——此前文本看起来变了其实从未变过。#29595, #29594
• 🖌️ 编辑你上传的图片。 Open WebUI 已持有的图片现在可用于图像编辑——此前经网络取回它自己的链接，在私有网络或未登录时可能失败。Commit
• 🖼 Playground 图片编辑。 在 Images Playground 中编辑图片现在可以工作——此前每次尝试都被拒绝，因为请求把字段放在端点从不读取的标题下。Commit
• 🎨 更整洁的"附加网页"对话框。 放置"添加"按钮的那一行不再在地址框和按钮之间自带一条灰色带，与其他对话框一致。#29664, #29663
• 🖱️ 普通的笔记日期。 笔记标题下的日期不再显示手型指针或宣布自己可按——点击它从未有任何效果。#29708
• 🌇 创建时的文件夹背景。 在"创建文件夹"对话框中选择的背景图，现在从侧边栏创建文件夹时也会生效——此前除非对话框从已有文件夹打开，否则图片会被丢弃。#30218, #30217
• 🖇 Delete Chat 快捷键处处可用。 删除当前聊天的键盘快捷键现在无论从哪里打开聊天都有效——此前除非该聊天的行恰好当时显示在侧边栏中，否则毫无作用。#30165, #30164
• 🚮 已退役的聊天变量。 当模型的系统提示词不再声明上一个提示词声明过的变量时，它会停止索要该值——此前每个新聊天都会弹出对话框并拒绝发送直到填入一个值。#30173, #30172
• 👁️ Safari 中的紧凑悬停预览。 在侧边栏悬停聊天时显示与其他浏览器一样的小预览，而不再显示一个按完整会话宽度和间距排版的预览。#29734
• 🔖 可见的标题生成故障。 当新聊天的自动标题无法生成时，原因现在以默认级别进入日志，而不再只在调试日志里——此前出问题的功能与被关闭的功能看起来一模一样。#30106, #29533

变更

• 🪶 slim 启动时未配置任何东西。 slim 镜像不含本地模型及其周边库，仍能以其默认配置启动并维持对话；依赖这些模型的各项特性各自都需要一个外部服务。Commit
• 🗄️ slim 的数据库支持。 slim 镜像运行于 SQLite（默认）或 PostgreSQL；若指向 MySQL、MariaDB 或其他引擎，或启用了 AWS RDS IAM 登录启动，它会报错停止而非启动，此类部署需要标准镜像。Commit
• 📁 slim 的文件存储。 slim 镜像把文件存在本地存储（默认）；若配置为 S3、Google Cloud 或 Azure 存储桶，它会报错停止而非启动，此类部署需要标准镜像。Commit
• 🧮 slim 仅通过 pgvector 搜索。 slim 镜像上的知识搜索需要带 pgvector 的 PostgreSQL；若配置为其他向量存储，实例仍会启动，失败在第一次执行搜索时到来而非启动时。Commit, Commit
• 🧠 slim 的嵌入要求。 slim 镜像不带任何嵌入或重排模型，因此知识功能需要 OpenAI、Ollama 或 Azure OpenAI 嵌入以及一个外部重排器，未配置时回退到纯余弦打分。Commit
• ✂️ slim 的文档切分。 沿下载的分词器切分文档在 slim 镜像上不可用，只保留按字符或按 token 数切分。Commit
• 📃 slim 的文档读取器。 slim 镜像按原样读取文本、Markdown、CSV、HTML 和 XML 文件；除非配置了外部文档抽取器之一，上传 PDF、Word 文件或演示文稿会失败。Commit
• 🎙️ slim 的语音要求。 slim 镜像既不带本地 Whisper 也不带本地语音，语音转文字和文字转语音需要外部引擎才能工作。Commit
• 🕸️ slim 的网页抓取。 slim 镜像不带无头浏览器，网页通过普通 HTTP 或外部加载器抓取；用 JavaScript 绘制自身的页面，取回的内容比标准镜像上少。Commit, Commit
• 🔎 slim 不含 DDGS。 DDGS 这个无需自带密钥的元搜索提供方未包含在 slim 镜像中，因此其上的网页搜索需要带密钥的提供方。Commit
• 📥 slim 的代码解释器包。 slim 镜像不含代码解释器的包，因此浏览器从"cdn.jsdelivr.net"获取 numpy、pandas、matplotlib、scikit-learn 等，该地址被封锁时解释器停止工作。Commit
• 🧰 slim 的 git 要求。 slim 镜像不再带 git，因此依赖指向"git+https://“地址的工具或函数会安装失败，需要标准镜像或已发布的包。Commit
• 🧺 移除 langchain-community。 文本、HTML、Word、CSV、PDF 和 Azure Document Intelligence 的读取器现在写在本仓库而非取自已不再安装的"langchain-community”；导入它的工具或函数从今往后必须在自身需求中声明它。Commit
• 🧾 未声明的包导入。 此前只是偶然出现在镜像中的包（nltk、pymongo、Google Drive 客户端和 Gemini SDK 等）不再安装，导入其中某个的工具或函数必须在自身需求中声明它。#29725, #29726, Commit
• 🆔 模型 ID 空白字符。 ID 含空格或制表符的工作区模型，现在在编辑器、API 和导入时都会被拒绝；已存储的仍可继续响应，但需重建后才能再次保存。Commit
• 🖇️ 链接协议渲染。 回复、引用或网页搜索结果中的链接，现在只在指向网页地址、邮件地址、电话号码或本实例内部时才渲染；其他一切（“ftp://“地址，以及"obsidian://"、“vscode://“等应用链接）显示为它本来的文本。两个旧怪癖随之而去：写成"HTTP://“的来源现在会变成链接，仅含 http 几个字母的文件名不再变成一个无处可去的链接。#29890
• 🧲 集成标签页默认隐藏。 个人设置中的"集成"标签页（管理你自己的工具和终端连接）现在隐藏，直到管理员在"集成"下打开"直连集成"或设置"ENABLE_DIRECT_INTEGRATIONS”；隐藏它不影响现有连接继续工作。Commit, Commit
• 📡 图片连接检查端点。 检查图片生成连接的端点已迁移，现在在请求本身中接收要测试的连接，因此调用旧地址的任何代码都需要更新。Commit

更新内容 （原始）

Added

• 📉 Far smaller slim image. A slim build now comes down at around 175 MB, near enough 89% smaller than the last release, the local models, the packages around them and the tools that installed them all gone from it; what that changes about the way an instance behaves is set out under Changed below and in the documentation. Commit, Commit
• 📦 Smaller standard image. The image no longer carries a second copy of Python, two sets of fonts nothing ever loaded, packages nothing imports, or the tool that installed them, taking about 170 MB off a standard build. #29731, #29723, #29725, #29726, #29728, Commit, Commit, Commit, Commit
• 🧑‍💻 Skills from a terminal. Skills a connected terminal server offers now sit beside workspace skills everywhere skills are picked — the “$” and “/” menus, the integrations menu and the skills panel, each marked Terminal — and are used the same way: picking one puts its instructions, its folder and the files it ships with in front of the model, and a model that was only told a skill exists can open it itself. They follow whichever terminal is selected and clear when that changes. Commit
• 📔 Terminal instructions file. A model working with a terminal is now handed the AGENTS.md sitting in that terminal’s home directory, read afresh at the start of every turn, so the instructions you keep beside your work reach the model without being pasted in. Commit, Commit
• 📇 Automatic skill discovery. Every skill you can reach is now listed to the model by name and description, and the full text of one is loaded only when it decides to use it; before, a skill you had not selected in the message box was invisible to it, and this applies to models with built-in tools on. Commit
• 🌄 Model background images. A workspace model can now carry a background image, uploaded in its editor and drawn behind the chat whenever that model is selected, sitting below a folder’s own background and above your personal one, and it travels with the model through export and import. Commit
• 📓 Skill creation from a chat. Typing “/skills:create” in a chat that already has content, with a terminal selected, turns the workflow you just went through into a reusable skill written to “.agents/skills” under that terminal’s root working directory rather than whatever folder the shell happens to sit in, and authored to Open WebUI’s skill standards. Commit, Commit, Commit, Commit, Commit
• 🖥️ Terminal tabs per command. The terminal pane now carries a tab for each command a model is running alongside your own shell, so you can watch them as they go, move between them and take the shell yourself, each tab opening with the command that produced it. Opening the pane puts you in a tab, starting your shell where nothing else is running, and closing the last tab folds the pane away again. Commit, Commit, Commit, Commit
• 📂 Folder uploads to terminals. The file browser beside a terminal takes a folder now, dropped onto it or picked from the Upload Folder entry in its menus, and rebuilds what is inside it as it goes, subfolders and all, where before a drop uploaded only the files sitting loose at the top. Commit, Commit, Commit
• ⚖️ Side-by-side file comparison. Picking two files in the file browser lights up a Compare button that lays them side by side or one above the other, numbering the lines, marking what was added and removed down to the part of the line that changed, counting both, and letting you swap which is which or leave whitespace out of it, a choice it remembers; a terminal too old to offer the comparison says so rather than failing quietly. Commit, Commit
• 🌐 Suggested prompts in your language. A fresh install now offers its suggested starter prompts in the language the interface is set to, rather than the same four in English for everyone, and the model defaults panel carries a way back to those defaults once its own suggestions have been edited. Commit, Commit
• 📏 Exa result length cap. Web search through Exa can be held to a number of characters per result, set beside its key in the admin web search settings or as “EXA_MAX_CONTENT_LENGTH”. Commit
• 🇪🇺 European web search option. Staan can now be picked as the web search provider, giving deployments that need search inside the EU an option they do not have to host themselves, configured from the admin web search settings or through “STAAN_API_KEY”, “STAAN_MARKET” and “STAAN_MAX_SNIPPETS”. #30138, #26006, #30303, #30301
• 🗣️ Per-language names and descriptions. A model, tool, skill, function, banner or arena entry can now hold its name, description, starter prompts and valve labels once per language, written in a searchable table in its own editor or brought in as a JSON file, which is refused where a translation drops one of the placeholders the original fills in. The interface shows the wording for the language it is set to, and falls back to the plain text where that language has none. Commit, Commit, Commit, Commit
• ✏️ Interface text you can reword. An administrator can now replace the interface’s own wording language by language from a panel in the admin settings, with a replacement refused where it drops one of the placeholders the original fills in. Commit
• 🔓 Turning off the sign-in form. The box asking for an email address and a password can now be taken off the sign-in page from the authentication settings, where until now it could only be set before the server started, leaving single sign-on or a directory to sign people in. Commit
• 🏷️ Custom file metadata. Metadata attached to an uploaded file now travels with the pieces that file is split into and arrives with the retrieved sources, the oversized and internal fields left out, and an operator can name in “RAG_SOURCE_METADATA_KEYS” which of those fields the model itself gets to see alongside the text. #29499, #29486, Commit, #29502, #29696
• 🗑️ Quick delete shortcut. Holding Shift over a note in the list or grid, or over a row on the automations page, turns its trailing controls into a delete button, removing the entry in one click rather than the three the menu and its confirmation ask for. #29635, #29633, #29640, #29637
• 🔀 Diffs are drawn as diffs. A diff or patch block in a reply is now laid out as one, with the file and hunk headings, the old and new line numbers, and the added and removed lines picked out down to the part of the line that changed, and a button to switch to the plain text and back. Commit
• ✒️ A formatting switch for notes. A note you can edit carries a Formatting switch in its menu: turned off, Markdown you type or paste stays as the characters you wrote, a paste keeps its plain text, and a web address is left as text, while formatting already in the note is untouched. Commit
• 🎛️ Admin model list filters. The models page in the admin settings can now be narrowed to the base models a connection offers or to the ones built in the workspace, alongside the filters for enabled, disabled, visible and hidden. Commit
• 🔍 Settings search by name. The search box in settings now matches each setting’s own name and description rather than a keyword list kept per page, in whichever language you are using and regardless of accents, it leaves out anything your permissions do not let you change, and opening a result no longer clears what you typed. Commit, Commit, Commit
• 🆘 A model for every chat. Opening a conversation whose model has since been retired no longer leaves it stranded with nothing selected; it falls back to your default model, then the configured default, then the first one available, and a chat that still has a live model keeps it. #29757
• ⚡ Non-blocking search. Searching the text of chats and knowledge, and the grep a model runs over a knowledge base, now run beside the rest of the server rather than in front of it, so a long search no longer keeps other requests waiting. #29621, Commit
• ✴️ Lighter shared note editing. Notes written by several people at once no longer echo every keystroke back to the server once per watcher; the traffic between editors falls by half with two of them and keeps falling as more join, so shared notes stay smooth as the room grows. #28185
• 🔢 Sorted knowledge listings. The “ls”, “tree” and “find” commands a model runs over a knowledge base now sort by name and take “-t”, “-S” and “-r” for newest first, largest first and reversed. #29840
• 🪪 Authentication type header. A request to an OpenAI or Ollama connection now carries “X-OpenWebUI-Auth-Type”, saying whether the person behind it signed in through the browser or called with an API key; its name is set with “FORWARD_USER_INFO_HEADER_AUTH_TYPE” and “{{AUTH_TYPE}}” works in custom headers. Commit
• 💡 Follow-up ghost text. Once a reply has finished, the first of the follow-up questions it suggests now sits greyed inside the empty message box as well as under the reply: Tab writes it out, and typing anything of your own clears it away. Commit
• 🪵 Model refusal logging. A request turned away with “Model not found” now writes a warning naming the account, the model and why it was refused, while the message the caller sees stays as vague as before. Commit
• 🤲 Cheaper chat requests behind Redis. Where several servers share their websocket traffic through Redis, a chat request no longer pulls the whole shared model list from Redis to ask about a couple of models; each worker keeps its own copy and refetches only when the list actually changed, so the cost stops growing with the number of models configured. #28176, #28167
• 💽 Long conversations stream cheaper. Writing or reading a single message no longer loads, checks and rewrites the entire conversation to change a few hundred bytes, so streaming into a long chat stops getting more expensive as it grows, and the whole round trip a message event costs falls to a fraction on conversations of thousands of messages. #28184, #28169
• 🧱 In-place streaming appends. Streamed replies can be assembled with CPython’s in-place string append, turned on with “ENABLE_CHAT_RESPONSE_STREAM_INPLACE_APPEND” and left off by default while it is rolled out gradually. Commit, Commit, #30066
• 📘 Direct connection guidance. The connections and integrations pages in the personal settings now say plainly that a direct connection leans on your browser session to keep requests running, which suits testing and temporary use rather than everyday work. Commit, Commit
• 🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
• 🌐 Translation updates. Translations for Japanese, Traditional Chinese, Korean, Finnish, Russian, Ukrainian, German, Spanish, Portuguese (Brazil), Arabic, Arabic (Bahrain), Azerbaijani, Bulgarian, Bengali, Tibetan, Bosnian, Catalan, Cebuano, Czech, Danish, Basque, Croatian, Dutch, Italian, Turkish, Simplified Chinese, Bosnian, Catalan, Danish, Estonian, Finnish, Galician, Croatian, Kabyle, Norwegian Bokmål, Portuguese (Portugal), Romanian and Turkmen were enhanced and expanded.

Fixed

• 🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories
• 🔑 Tokens stay out of logs. A failure part way through signing in with an identity provider no longer writes the credentials it was handed into the application log, recording the provider and the error it reported instead. #29709
• 🔐 Sign-in role mapping. Roles sent by an identity provider were in some setups not applied, leaving an account at the default role, and a sign-in whose roles cannot be read is now refused rather than let through. Commit
• 🚫 Blocked sign-in groups saved. Comma-separated group names typed into the blocked groups field now take effect once saved, where the save stored the text as written and the sign-in check then read it as nothing; a group name carrying a comma of its own survives a save too. Commit
• 🚪 Signing out ends the session. Signing out or having every token revoked left any live connection that account already had in place, and those are now cut at the same moment; a token already revoked can no longer be replayed to cut someone else’s newer session. Commit
• 🛡 Diagrams and SVG stay on this origin. Mermaid diagrams and SVG previews, attached or uploaded, no longer follow references pointing at another origin, a picture, style or configuration line among them, and a diagram that reaches outside is refused with an error; a file whose drawing leans on an external sprite now shows that part blank. #30271
• 📲 Terminal sessions follow access changes. A terminal connection now re-checks your access to it every ten seconds for as long as it stays open, so removing someone’s permission or deactivating their account ends their live terminal on the next check, on every worker and not only the one they signed in through. Commit, Commit
• 🔒 Connection model listing access. The endpoints that list the models on a single Ollama or OpenAI connection could be reached by a signed-in account of any role, and now check the caller’s role. #29619
• 🔏 Knowledge file access. A file’s access through a knowledge base now follows its actual attachment alone, rather than also a collection name left behind on the file record. #29937
• 🌳 Knowledge directories stay inside their base. A directory id supplied to the knowledge file routes is now refused where it belongs to a different knowledge base, where a caller-supplied id could reach into a directory tree outside the one being addressed. Commit, #29887
• 🍪 Cookie forwarding scope. A connection authenticating as the signed-in person is handed this instance’s browser cookies only where its new Forward cookies switch is on, which an instance relying on it has to turn on after upgrading. Commit, Commit, Commit
• 🗝️ Revocation list fallback. Where the revocation list is kept in Redis and Redis cannot be reached, a token is now accepted rather than the request failing, so signing out may not take effect until Redis is back. Commit, Commit
• 🗒 Home page chat drafts. A message typed into a chat started from the home page now comes back after a reload, text, uploads and all, where the draft was stored under a key the page never read again. #29762, #29760
• 🏞️ S3-hosted chat images. A chat image whose host echoes a Content-Encoding nothing asked for, an S3 or MinIO object uploaded with that metadata among them, no longer breaks the reply it sits in; it is sent as its link the way an unreachable image already was. #29623
• 🪆 Branch descent guard. Stepping between reply branches walked a chat’s children without tracking where it had already been, so a history that pointed back at itself spun forever and locked the tab, and a child id with no message behind it threw; every one of the eleven places that walk now shares a single guarded helper. #30070
• 🗒️ Note save on exit. A note’s title and its attachments save a moment after they change, and leaving the note inside that moment dropped the save, so the notes list kept showing the old title until the page was reloaded; the pending save now finishes before the next page opens. #29745, #29744
• 📷 Attachments sent without text. Sending an image or a file with nothing typed to a model that has skills attached replaced the empty message with the list of skill names, so the model answered with its own catalogue instead of looking at what you sent. #30045, #30040
• 🖍️ SVG attachments read as text. An SVG attached to a chat went up as a picture and came back rejected by every model that tried to decode it, and is now read as its source text instead, which needs a model that accepts file uploads. #30102, #30100
• 🩹 Notes survive a small edit. Asked to add a section or change a few lines, a model would send the whole note back and lose the rest of it with nothing to undo, because the editing tool never said when to edit a range instead; it now spells out the range rules the handler already enforced. #30048
• 📋 Note paste placement. A plain paste replaced more of the note than was selected, and a paste into a code block broke out of the block instead of going inside it; both now land exactly where they were dropped. Commit
• 🧿 Insert into note on read-only notes. The Insert into note action no longer appears on a note you may only read, which offered it where it could not land. #30223, #30174
• 🤝 Note sharing survives a save. Saving a note you had been given access to took that sharing away, so the note went private and everyone else lost it. #30175
• 🌍 Collaborative link handling. In a note two people are writing at once, a plain web address arriving from the other editor was turned into a link on your screen but not on theirs; it is now left as written. Commit
• 📑 Tika 4 document formatting. Where document extraction runs against a Tika server on version 4, the text now comes back as Markdown rather than a flat run of characters, so headings, lists and tables survive into what the model reads. Commit
• ⏳ Session expiry accuracy. A session with an identity provider now expires with the token it actually calls with, rather than whichever of its two tokens ran out first, which renewed it early and dropped it whenever that failed. Commit
• 🧩 Tool steps in finished replies. A reply that called tools showed each step as it ran, then lost them the moment the reply completed, because the provider’s closing message replaced everything on screen rather than joining it; the closing message is now merged into what is already there, and a tool call is no longer mistaken for its own result. Commit, Commit
• 🧭 Streamed replies follow along. A reply arriving over the response events now keeps the view at the bottom as it is written, as replies on the older path already did, unless you have scrolled up yourself. Commit, Commit
• 🚿 Tool results arrive when the tools are done. The results of a model’s tool calls now reach the reply as soon as the round that produced them finishes, instead of being held back with the rest of the streaming until the throttle let them through, and a channel reply or a continuation no longer carries the picture data a tool handed the model. Commit
• 🧗 Tagged blocks while streaming. A reply using reasoning, solution or code interpreter tags briefly showed the raw tag text in the message as it arrived, because the chunk carrying it reached the browser before the cleaned output did; the cleaned output is now sent the moment a tag is taken out, and the code an interpreter block writes fills that block rather than the message body. Commit
• 📗 Excel in the code interpreter. Reading or writing a spreadsheet in code the browser runs failed outright because the library that handles them never reached the browser, and it is now shipped alongside the rest. #30140, #30130
• 📀 Bundled charts and formatting. Drawing a chart with seaborn in code the browser runs fetched the library over the internet at that moment rather than taking it from what ships, and the code editor’s Format button failed outright for anyone who is not an administrator; both now work from what comes with the application, offline included. #30148, #30145
• 🙋 Typed answer submission. In the card a model puts up to ask you a question, choosing one of its options on the last question sends your answers straight away, but typing your own into the Other box left Submit answers greyed out with no way to send it, and it now turns on as soon as that box has text. #29494, #29311
• 🥇 A truthful Recommended badge. The card a model puts up to ask you a question marks its first option Recommended, but nothing told the model that, so the badge fell on whichever option happened to be listed first; models are now asked to put the option they recommend there. #30196, #30195
• 🎚️ Partial settings permissions. An account barred from changing the interface settings can now save its system prompt, notifications, audio, keyboard shortcuts and pinned models, which were refused along with them. Commit
• 🎧 Speech file types kept. Saving the audio settings emptied the list of file types accepted for speech recognition, so transcription then turned away the recordings it had taken before. #30208
• 🚻 Group picker without permission. The picker for sharing a chat, a note or a knowledge base with a group was offered to accounts not allowed to share with groups, and is now hidden from them. #30189
• 🗜️ Per-field settings saves. Only the settings actually changed are now stored, rather than the whole object, so another tab’s older copy no longer overwrites them and a default an administrator changes still reaches everyone, and pinning a model, reordering the list or picking a default from outside the settings window now saves the same way. Commit, #30183
• ⚠️ Failed settings feedback. Settings that could not be saved were shown as saved anyway until the page was reloaded, because the interface stored them locally without waiting on the server; a failure now raises an error and leaves the panel as it was. Commit
• 🔠 Menu text scaling. The entries in the menus that drop down across the interface now scale with the rest of it, rather than staying at a fixed size while the menu around them grew. #29493, #29488
• 🪞 Account menu highlighting. An account menu entry carrying a pin button beside it now lights up across the whole row in the shared colour, and a long label no longer pushes the pin out of the menu. Commit
• 🔲 Shift-click file selection. Shift-clicking a file in the terminal’s file browser now adds that range to what is already selected, and clicking through a selected file removes its range. Commit, Commit, Commit
• 🛟 Attachment name collisions. Attaching a file to a message on an instance that puts attachments in a terminal’s working directory replaced whatever file of that name was sitting there; the upload now takes the next free name, “report (1).pdf” beside “report.pdf”, and the attachment shows the name it was saved under, though two uploads arriving at the same moment from different browsers can still land on the same name. Commit
• 📛 Failed upload feedback. A file that could not be written to the terminal now says so, rather than passing in silence while the browser refreshed as though it had arrived. Commit, Commit, Commit
• ☑️ Unchecked checkbox defaults. A prompt variable written as a checkbox with a default of false opened the form already ticked, as did False, “false”, 0 and “0”, because any non-empty default counted as ticked; it is now ticked only where the value really is true. #30037, #30036
• 🎯 Prefilled question timing. Opening a chat from a link holding a question sent it before the box had it, so a question naming a variable went off with the variable unfilled; the send now waits for the text to be in place and filled in. Commit, Commit
• 📜 Task list height. The list of steps a model works through ran as long as it needed and pushed the rest of the reply down the page; it now stops at a quarter of the window’s height and scrolls within itself. Commit
• ⎋ Escape key targeting. The shortcut for closing a dialog always shut the settings window, whichever dialog was actually in front, so a dialog opened from within settings took both away at once; each dialog now answers the shortcut for itself, as it already did for the escape key. #29830, #29817
• 🎹 Message pair shortcut. The shortcut that adds an empty question and answer to a chat also sent whatever was typed in the message box, so the pair arrived alongside a message you had not meant to send yet. #30167
• 🥁 Collapsing the task list. Folding away the list of tasks under a reply also sent whatever you had typed in the message box. #30202
• 🕰️ Temporary chat links. A link carrying the temporary chat marker opened an ordinary chat, because the marker was written into the address but never read back when the page loaded, and such a link now opens the temporary chat it promises. Commit
• ⌨️ Recording a new shortcut. Pressing a key combination to record it as a shortcut also ran whatever that combination was already bound to, so setting one up did the thing you were trying to rebind. #30160
• 🔃 Stale tab reload. A tab still running the previous build met an error page after the server was updated instead of loading the new one, because every image built from Docker carried the same version stamp; the stamp now follows the build, and a stale tab reloads as it was meant to. #29832, #29831
• 📌 Channel code headers. The bar naming a piece of code in a channel thread or its pinned messages now sits flush at the top of the panel, clipped to the block, rather than floating over the code as it scrolls. #29836, #29835
• 📨 Duplicated proxy headers. A reply proxied from a terminal server or an OpenAI or Ollama connection no longer carries that server’s own “Server” and “Date” headers, which had a reverse proxy in front logging a duplicate line for every one. #29841, #29824, #29843
• 🎣 Testing an image connection. The Verify button beside an image generation connection saved the whole image configuration first and then tested whichever engine was active rather than the connection beside it, and it now tests exactly that connection and changes nothing. Commit
• 🪝 Responses API tool strictness. A workspace tool, MCP server or OpenAPI server reaching a model on the Responses API was turned into a strict schema where it had never asked to be, so the model filled every optional field with empty strings, zeros and empty arrays, and search and filter tools were handed values where leaving them out was meant. #30046, #27750
• 🪃 Responses API tool calling. A forced tool choice sent to a connection on the Responses API went out in the wrong shape and was refused by providers that check it, and a tool call in a reply that was not streamed came back as empty text, so nothing reading the API ever saw it. #30095, #30085
• ⛓️ Missing tools in links. Opening a chat from a link whose “tools” or “tool-ids” parameter names a tool that no longer exists, or that the account cannot see, kept that id in the selection and sent it with the message; ids matching no tool the account has are now dropped and the rest of the link works as before. #29803
• 🚫 Model editor error messages. A workspace model that cannot be loaded for editing now says so, instead of sending you back with “You do not have permission to edit this model” whatever the real reason. #29694, #29629
• 👥 Directory updates that were dropped. A change your identity provider sent as an add or a remove, or without naming the attribute it was changing, was accepted and then quietly discarded, so a rename or a deactivation never reached the account; those now take effect. Commit
• 🗃️ Directory request validation. A provisioning request carrying the wrong kind of value, or an attribute Open WebUI does not support, now comes back as an error instead of passing in silence, and a sync that changes nothing no longer marks the account as touched. Commit
• 🔘 Model editor save button. Saving a workspace model whose model list could not be refreshed afterwards now reports the error and frees the Save button, rather than leaving it disabled and spinning though the model had been saved. Commit, Commit
• 🫱 Rating a reply again. Switching a reply’s rating from one thumb to the other kept the score and the reason given the first time, and rating a reply whose feedback had since been deleted failed outright; both now record the rating you just gave. #30075, #30077
• 📶 Sorting feedback by user. The User column in the admin feedback history did nothing when clicked, and now sorts by who left the feedback. #30191
• 🪂 Closing the Edit User dialog. Changes typed into the admin Edit User dialog and then abandoned showed on the row in the user list until the page was reloaded, and closing the dialog now drops them. #30193
• 🪙 Model defaults save. Saving the model defaults in the admin settings put the selected, pinned and ordered models back as they stood when the page was opened, undoing anything changed in between. #30206
• 👤 A custom gender shown back. An account whose gender is a wording of its own came back to an empty dropdown in the account form, and the form now shows Custom with that wording beside it. #30215
• 🗓️ Clearing a calendar event. Emptying the repeat, the description or the location of a calendar event did not take and the old wording came back, and those fields can be cleared again. #30204
• 📕 Required prompt dropdowns. A prompt’s form could be sent with a required dropdown left unchosen, and now asks you to pick something first. #30078
• 🎫 Account form required fields. The account form now refuses to save with a required field left empty, the way the admin user dialog does, and a date of birth is no longer demanded of accounts that never set one. #30296, #30295
• 🐑 Model clones keep their base. Cloning a model from the admin Models settings now carries the model it was built on, where the clone came out detached from it, and an arena model no longer offers Clone at all. #30080, #30079
• 🧤 Model sharing survives a save. Saving a model you cannot fully share no longer strips the access entries you cannot re-create, where an editor resending every stored entry had each one re-checked against what its author may grant, and a save from someone with narrow rights quietly took the model private for everyone else. Commit, #30093, #30087
• 📠 Prompt version saves. Saving a new version of a prompt without Set as Production leaves the live prompt exactly as it was, where the draft quietly took its place, and the editor now shows the production text the moment a version is set. #30231, #30230, #30233, #30232
• 💬 Model description round trips. A workspace model whose description is switched from the default back to custom saves again, where the switch read the field as empty and the description was dropped on save. #30249, #30247
• 🎚 Compaction threshold saves. The context compaction threshold set in general settings now reaches the model parameters, where the value never left the page. #30270, #30269
• 📢 Speech engine defaults. Switching the text to speech engine now applies that engine’s own default voice and model, where the change kept the previous engine’s settings in place. #30289, #30288
• 🗞 MinerU key in local mode. The document settings save again in local mode with the MinerU key left empty, where the form demanded a key it did not need. #30299, #30298
• 🫂 Group dialog reset. The new-group dialog opens empty after a group is created, where the next one came up holding the group just made. #30280, #30279
• 🧵 Thread reply notifications. Clicking the notification for a reply written inside a thread dropped you at the bottom of the channel with the thread still shut and the reply nowhere in sight; it now opens the thread the reply belongs to. #29856, #29855
• 🔽 Dropdown arrow spacing. The arrow in the dropdowns drawn no wider than their contents, among them the provider on a new connection, no longer overlaps the last characters of the longest choice. #29866, #29865
• 🧊 Lowercase header handling. Headers from an upstream that writes them in lower case, as anything served by uvicorn does, are now matched without regard to case, so “Content-Encoding” is stripped and clients stop failing to decompress a body the server had already decoded. #29843
• 🛑 Complete chat stop. Where a chat had more than one task in flight, stopping it, deleting it, or closing a note being worked on could stop the first and leave the rest running to the end, both because a task that had already finished ended the round early and because the list being worked through was rewritten underneath it as each one was cleared away; every task is now stopped in turn, so a reply that was calling tools stops calling them rather than running on to its own limit, though instances sharing their state through Redis were not affected. Commit, #29844, #29816
• 🖊️ Channel code blocks. Where a model answers in a channel with structured output, the code inside it was drawn as plain highlighted text rather than in the editor every other message uses, so it could not be edited in place and a diff in it could not be opened for editing; it now renders the same way as everywhere else. #29861
• 📐 Code block edits on collapse. An unsaved edit inside a code block stays on screen when the block is folded away and opened again, where collapsing it showed the saved text though the edit was still pending. #30284, #30283
• 🚨 Code run errors with output. A code run that ends with an error now shows the error alongside what it printed, where a run that printed anything at all showed its error nowhere. #30286, #30285
• 🔕 Reactions on read-only channels. The reaction picker no longer appears on a channel open to you as a viewer alone, matching the reply and menu options already hidden there. #30241, #30240
• 🎯 Knowledge search accuracy on PostgreSQL. A fresh install using PostgreSQL built its search index before a single piece of text existed to organise it around, so the index was never fit for the content that arrived afterwards and every search quietly returned the wrong passages; the index now waits until there is enough text to build on, and until then searches read everything exactly. An install already carrying such an index can restore it by rebuilding that one index. #30143, #30134
• 🗂 Knowledge file filter on first click. The File content filter in a knowledge base now narrows the listing the first time it is clicked, where the first click only armed the checkbox and everything stayed listed until it was clicked again. #30211, #30210
• 🔭 Knowledge base search recall. Where many knowledge bases are stored together, a search of one holding a small share of what is stored found only a small share of its matches, and the shortfall grew as the store did; the search now keeps looking until it has enough from the knowledge base you asked for, and “PGVECTOR_ITERATIVE_SCAN” switches that off or makes it strict. #30142, #30135
• 🪣 Searches that found nothing. A knowledge search that came back empty never handed its database connection back, so enough of them left knowledge search failing outright until the server was restarted; connections are returned now on PostgreSQL and on openGauss alike. #30142, #30133, #30144
• 🧽 Knowledge folder deletion. Deleting a folder without moving what was in it up a level dropped the files from the listing but left their text in the search index and the files themselves in storage, so a model went on retrieving and citing pages from a folder that was no longer there; the text is now removed with the folder, and a file no other knowledge base holds is deleted with it unless file retention is switched on. Commit
• 🦀 Regex searches over chat and knowledge files. A pattern search now runs in time proportional to the text whatever the pattern, where a nasty expression could stall the search for good, and the patterns it accepts follow RE2’s rules, with no lookarounds or backreferences and character classes matching ASCII only. Commit
• ⏰ Automation schedule parsing. An automation whose rule puts the time in “DTSTART” is now read at that hour, rather than listed at midnight and opened at nine, which moved when it ran as soon as it was saved again. Commit
• ⏲️ Recurrence counts and start dates. A rule repeating a set number of times, ten or a hundred, is read as the limited repeat it is, where any count beginning with a one was treated as one-shot, and a rule carrying its start date on the same line as its repeat text now follows the start you picked, on schedules and calendar events alike. #29262
• ⌛ Stalled schedules and stuck tasks. A schedule whose rule takes too long to work out no longer holds up the round that evaluates it and is skipped with a warning, and background tasks shared through Redis now expire once their worker falls silent, after “REDIS_TASK_TTL” seconds. Commit
• 📣 Model mention chips. A mention whose ID carried anything beyond letters, digits and a little punctuation, such as the brackets in some workspace model IDs, stayed on screen as the raw “<@…>” text both in the box you type in and in the message once sent; any ID without a space in it is now drawn as a chip. #29864
• 😀 Multi-codepoint emoji. An emoji whose shortcode is several codepoints, the flags among them, is inserted whole, where only its first part reached the message. #30213, #30212
• 🔔 Custom webhook names. A webhook target named with a space or a slash is now tidied the way an automatic name always was, so it can still be edited, deleted, made the default or tested afterwards. #29947
• 🪛 Paginated MCP tool lists. A server that hands its tools back a page at a time had only the first page read, so the rest were never offered to a model; the whole list is now collected before the tools are built. Commit
• 💭 Anthropic thinking blocks. Open WebUI’s own thinking blocks are no longer forwarded to an OpenAI-compatible backend, which since 0.11.0 made a strict server such as NVIDIA Dynamo refuse an Anthropic client’s second turn; signed blocks still pass through. #29849, #29799
• 🗨️ Channel model terminals. A model with a terminal chosen in the workspace had that choice honoured in a chat but dropped where it answered in a channel or ran as a channel automation, so it worked without one; it now carries the same terminal everywhere, alongside the tools, filters and features it already carried. Commit
• 🧺 Deleted channel messages leave no quotes. Deleting a channel message now clears the quote of it sitting on every reply and drops it from the reply box, where a reply kept showing the deleted message and could still be sent addressed to it. #30314, #30313
• 🔌 Terminal tools need a terminal. A model was offered the tools that read your terminal and type into it whether or not the chat had a terminal switched on and connected in your browser, so it could reach for one that was not there; those tools are now handed over only for the terminal the chat has open. Commit, Commit
• 🔤 Custom header encoding. The custom headers a connection sends are encoded once the values are filled in, so a person’s name or group carrying anything beyond plain ASCII, a line break included, no longer breaks the request or reaches the other end as something else. Commit
• 🆎 Chromium spellcheck corrections. Picking a suggestion from the browser’s own spelling menu in the message box did nothing, or put the misspelling straight back, because a highlight meant for the notes editor was being drawn over the selection and rebuilding the text underneath it, taking the browser’s spelling marks with it; that highlight is now kept out of the message box and only drawn where the editor is not in use. #29952, #29944
• 🈁 IME composition while renaming. Confirming a chat rename with Enter or Escape part way through typing with an input method editor now finishes the composition without saving or cancelling the rename, where the key press acted at once. Commit
• 🐳 Dotless host addresses. With local web fetching turned on, an address pointing at a container name on the same network, “http://apprise:8000” and the like, is now accepted rather than refused as invalid. #29945, #28161
• 🪧 False skill mentions. Something written as “<$fh>” in a message, as Perl and other languages do, was taken for a mention of a skill and quietly removed before the model saw it, and drawn on screen as a chip; only mentions naming a skill that exists and is turned on are treated as mentions now. Commit
• 🎒 Skill settings survive saving. Saving a skill from its editor cleared the tags and translations it carried and switched it back on where it had been disabled, and all of that now survives the save. #30185
• 🫥 Webhook avatar forwarding. Turning “ENABLE_PROFILE_IMAGE_URL_FORWARDING” off stops browsers being sent on to outside picture addresses, and a channel webhook’s picture was sent on regardless; it now serves the built-in picture like the rest, in the webhooks dialog as well as the message list, where the dialog had been sending every viewer’s browser straight to the outside address. #29889, #29892
• 🪟 Statistics window origin. The window that shares chat statistics with the community accepted requests from any page that opened it and answered to anywhere; it now reads and replies only where the community site is at the other end. #29918
• 🖼️ Tool image rendering. Where a tool answered with an image tucked inside an object or a list rather than on its own, the image was written into the conversation as its raw text, a single screenshot costing hundreds of thousands of tokens and crowding out everything else; such an image is now taken out wherever it sits and attached to the reply, so the model is handed the picture and you see it. An older fault that let every second image through untouched goes with it, and in a saved chat such an image is now kept as a file and referred to rather than written into the conversation itself, so the chat stays small. #29665, #29208, Commit
• ⏱️ Stopped reply state. Pressing stop saved the reply as finished while the parts inside it were still marked as running, so a block went on reading “Thinking…” or “Executing…” and came back that way after every reload; those parts are now closed off as the reply is stopped, and an open tab settles at once rather than only after a reload, while a tool call still waiting for your approval keeps its prompt. #29495, #29281
• 🩺 Knowledge sync errors. A knowledge base sync that fails now names the file it happened on and what the browser said, rather than reporting nothing beyond “Error accessing directory”. #29507
• 🚧 Terminal proxy restrictions. Requests passed through to a terminal server are now refused where they aim at that server’s administrative endpoints, are not followed on to somewhere else, and are turned away where the path carries characters a parser would rewrite. Commit
• ⛔ Malformed tool calls. Where a model asked for a tool with arguments that were not an object at all, a bare list or string, the reply stopped there; the model is now told what was wrong with the call and can try again. Commit
• 📡 Broken stream reporting. Where something failed part way through streaming an answer out of “/api/chat/completions”, the stream simply stopped, leaving a client waiting on an answer that would never finish; it now closes with an error and a proper end of stream. Commit
• 🧷 Chat unblocked after an error. A reply that failed, on a content filter or an exhausted quota, left the chat turning away everything you typed after it and stopped the message queue. Only the failed reply now ends, so the chat carries on and the other replies in a multi-model answer keep writing. Commit
• 🫙 Empty failed replies in history. An assistant turn that ended in an error with nothing written is no longer handed back to the model as part of the conversation when you send your next message. Commit
• 📭 Empty page uploads. Adding a web address to a knowledge base that came back without any text failed with a bare “Error uploading file” and, where the upload itself was refused, left the row sitting in the list; the reason now reaches you as it was given, and the row is taken away. Commit
• 🎞️ Tool embed scope. The frames a tool call can ask to have shown, which run scripts of their own, were drawn wherever a message was rendered, a channel among them; they are now drawn only in the replies of the chat you are in, and never in a channel. #29985
• 🚰 Rejected picture addresses. A model entry carrying a picture address the server refuses no longer leaves that address in memory, where anyone signed in could pile them up. #29971
• 🖌 Editing a stored image. Asking a model to edit an image this instance already holds now works whatever host its address names, where a container name, a default port or a self-composed host made the edit fail with a generic loading error. #29691, #29220
• 🧪 Memory replies carry less. The memory tool no longer hands the model each memory’s stored metadata, and a memory now records the model’s id rather than the whole model entry. Commit
• 🔇 Memory fully off. With memory switched off, stored memories are no longer folded into a reply’s context and the memory tools are no longer offered to the model, where both went on reaching it behind the switch. #30228, #30227
• 🧠 Memory review behind the switch. The background review that drafts new memories from a conversation no longer runs when memories are switched off or the account is barred from them, where it went on spending a task-model call every interval turn and failing at the write. #30309
• 🏗️ Terminal server save button. Saving a terminal server now waits for the save to finish before the dialog closes and cannot be set off twice by a second click. Commit
• 🗺️ Terminal file panel paths. The file panel beside a terminal now opens the file a model just wrote even when it is named with a relative path, where the panel could not match the name, jumped to the root and dragged the session’s working directory with it. #30282, #30051
• 🍴 Forked chat folder. Forking a chat put the copy in the original’s folder even where you cannot write to that folder; it is now created outside any folder unless you can. #30069
• 🪢 Dropping a folder in place. Dragging a folder onto the folder it already sits in failed with “Folder already exists”, and is now taken for the no-op it is. #30169
• 🗝️ Read-only folders read-only everywhere. A folder shared with you as a viewer no longer shows its edit controls on the empty-chat page, where they appeared and a save went through or failed depending on rights the page never checked. Commit
• 🚿 Deleting a folder, keeping chats. Removing a folder while keeping the chats inside it was refused for an account not allowed to delete chats, even though nothing was being deleted, and it now goes through. #30163
• 🏷️ Tag cleanup after deletion. An administrator deleting someone else’s chat tidied unused tags out of their own account rather than the owner’s, leaving the owner with tags nothing points at. #30171
• 🌱 Forking past an unfinished reply. A chat that held an interrupted reply anywhere in it refused every fork from then on and never recovered; forking now waits only on a reply actually being generated, and a turn paused for tool approval still forks with its prompt showing. #30131, #30128
• 💾 Deleted tool memory. Deleting a tool or a function left the whole of its code in memory for as long as the server ran; it is now let go of along with the rest. #29983
• 🐌 Sign-in rate limiting. Counting sign-in attempts through Redis no longer stops the whole worker until Redis answers, so a slow Redis stops freezing every other request with it. #29977
• ♻️ Session pool cleanup. The task that clears out abandoned websocket sessions now carries on through an error from Redis instead of ending for good, and stops properly at shutdown. #29976, #29979
• 🛰️ Direct connections across workers. A reply streamed over a direct connection no longer goes quiet part way through where several servers share their websocket traffic through Redis; the events it lives on now travel between workers the way the rest already did. Commit
• 🫧 Empty document ids. A save arriving for a document with no id at all was filed against that empty id and never cleared, so anyone signed in could pile them up; nothing is filed for it now. #29980
• 🔬 Page fetch CPU spin. Fetching a page through the browser-driven loader never returned where that page opened a WebSocket, holding a worker thread at full CPU for the life of the process and costing another core on every further fetch, which left the whole instance slow. #30050, #30024
• 🔁 Duplicate search tracebacks. A vector database outage wrote a full traceback twice for every collection and query pair, turning one outage into hundreds of identical stack traces per message on every replica; a single record now names every collection that failed. #29981
• 🧯 Page fetch logging. Fetching a page through the browser-driven loader filled the log with tracebacks where the page closed while it was still pulling pieces of itself, as sites behind Cloudflare and similar do; those requests are now let go of before the page closes. #29325, #28869
• 📤 Tool export scope. Exporting all tools at once returned every tool the account could see, the source of a tool shared for reading included; it now returns only the tools it may edit, matching the single-tool export and the way models already export. #29310
• 🗳️ Partial workspace exports. Exporting the prompts or the models from the workspace wrote out only the page you happened to be looking at, so most of them were quietly left out of the file; both now export everything you are allowed to. #30187
• 🧳 Imported chats keep more. A chat brought back from an export arrived unpinned and unarchived and without the variables it was saved with, and all three now survive the round trip. #30155, #30151
• 🗂️ Unarchiving from search. The menu on a search result offered to archive a chat that was already archived and said it had been archived when it had been brought back, and it now names and reports whichever of the two it did. #30177
• 🙈 Folder filters with no match. A chat search narrowed by a folder name that matches no folder now finds nothing, where the folder filter was quietly dropped and every chat came back. #30273, #29959
• 🧹 Sidebar after bulk actions. Archiving, deleting or unarchiving every chat at once, or importing a batch of them, left the folders and the pinned chats in the sidebar showing what was no longer there until the page was reloaded, and a bulk action that failed no longer reports success. Commit
• 🔐 Model pictures follow model access. The picture belonging to a model is now shown only to people who can see that model, where anyone signed in could fetch it and tell an existing model from an unknown one by which picture came back. #29700
• 🚪 Webhook pictures follow channel access. The picture belonging to a channel webhook is now shown only to people with access to that channel, where anyone signed in could fetch it or be sent on to wherever it pointed, and it is refused outright where channels are turned off. #29703
• 📎 Safer Word document previews. Previewing a Word document no longer renders an HTML sub-document embedded inside it, and a link in one opens only where it points at a web address, a mail address or a telephone number. #29699
• 🚦 Citation link schemes. A source attached to a reply now opens only where it points at a web address, falling back to the panel that shows the source rather than following anything else. #29701
• 🈚 Citation chips inside formatted text. A citation inside bold, italic or linked text now renders its chip, where the formatting took it and the citation vanished from the sentence. #30278, #30277
• 🐍 Saving a tool or function. Saving a tool or function in the admin pages no longer fails with a missing module error from the built-in code formatter, which was not installing everything it needed. #29503
• 🛠️ Tool request duplication. A tool that writes through an address carrying part of its input no longer has that part repeated in the body of the request as well, which servers checking their input strictly turned away, so those calls now go through. #29717, #29716
• 🍎 Answers survive on Apple Silicon. Asking a question that searches a knowledge base with a locally run reranking model no longer takes the whole server down on a Mac, losing the answer and the connection with it. #29735, #29722
• 📚 Web results stop being cited. Pages a web search only listed are no longer offered to the model as things to cite, which had it attaching a result id to text from a different result and the citations panel resolving that to a title that looked right. #29631, #29627
• 🔎 SearchApi errors, news and links. Web search through searchapi.io now reports a bad key instead of coming back empty, reads the news results it returns alongside its ordinary ones, and hands the web loader the resolved destination link, so citations stop pointing at a redirect page. #30308, #30305
• 🔼 Honest version checks. An instance that cannot reach the release listing now says the check failed, instead of reporting whatever it is running as the newest version and recording nothing about it. #29626, #29580
• 🏟️ Arena models report their errors. A message to an arena model whose provider answers with an error now shows that error in the chat, where it used to fail on something unrelated and leave the real reason unsaid, and titles and tags no longer break the same way. #29662, #29658
• 🏳️ Nameless tool calls fail once. A model endpoint that sends a tool call with no name at all now has that call fail on the spot, rather than the missing name being kept, stored with the message and sent back on the next turn for the endpoint to reject. #29690, #29686
• 🧹 Direct connections stop leaking listeners. A server talking to a direct connection no longer leaves a listener behind for every request that ends any way but a clean finish, which grew without limit while a connection kept failing. #29509
• 🚀 Cheaper model refreshes. The model registry shared through Redis is now written only when the models themselves change, rather than on every refresh because of the countdown Ollama attaches to a model it holds in memory. Commit
• ✍️ Continued reply text. Asking for the rest of a cut-off reply in a temporary chat replaced what was on screen with only the new text, because the message being continued was read back from the saved chat it did not have. It is now taken from the request before the model is called, the continuation joins the same message instead of arriving as a second one, on a connection whose provider is set to llama.cpp the model is told to carry on from the text it is handed rather than repeat it back, opening the result in the message editor no longer shows a line break where the two halves meet, and, where haptic feedback is switched on, a continuation buzzes as it streams like any other reply. Commit, Commit, Commit, Commit, Commit, Commit, Commit
• 🔗 Cancelled edits keep attachments. Cancelling the edit of a message no longer strips the files attached to it, where dropping the edit took the attachments down with it. #30281, #30192
• 🏎️ Faster media page reads. The browser-driven loader pulled every image, video and font a page referenced down through the server before any text was extracted, so a page carrying a few dozen audio players took ten seconds or timed out. Those requests are now dropped before they are made, and the same page comes back in under three seconds, having pulled 4 MB where it used to pull 55. #29742, #29741
• 📝 Starting a note from search. Starting a note from the search box now works when you are already on the notes page, keeps the whole of what you typed including characters such as ampersands and hashes, and no longer makes a further note each time the browser back button is pressed. #29645, #29642
• 📱 Apple device replies. An assistant reply no longer comes up blank in a home screen app, an in-app browser or a desktop-class window on Apple devices, where the check that avoided the drawing fault only recognised Safari itself. #29734, #29688, #26712
• 📊 Single source relevance. A reply drawing on a single source now shows how relevant that source is, where the figure appeared only once a second source joined it and so looked as though it came and went. #29647, #29646
• 🔧 Arduino sketches upload to knowledge. A sketch file now reaches the plain text reader like the C++ and header files beside it, rather than being handed to a document extraction server that could make nothing of it and failing the upload. #29673, #29670
• 📰 Docling conversion failures. A file that Docling refuses or fails to convert now fails the upload with the reason Docling gave, rather than breaking with a raw error or quietly filing a placeholder that was then indexed and handed to the model in place of the file. #30107, #29808
• 📄 Uploaded text kept as written. A file whose text contains escape sequences such as the one standing for a non-breaking space is now stored and read by the model exactly as it was written, rather than having some of them rewritten depending on where in the file they sat. #29736, #29732
• 🔦 Readable slash command labels. The entries in the slash command menu no longer show as white text on a white background in the light theme. #29512, #29510
• ⌨️ Literal arrow sequences. A sequence such as three hyphens after a less-than sign is now shown as the characters it is made of rather than drawn as an arrow, which had text look changed when it never was. #29595, #29594
• 🖌️ Editing an image you uploaded. An image already held by Open WebUI can now be used with image editing, where fetching its own link back over the network could fail on a private network or without a sign-in. Commit
• 🖼 Playground image edits. Editing an image in the Images playground now works, where every attempt came back rejected since the request carried its fields under a heading the endpoint never read. Commit
• 🎨 A tidier attach webpage dialog. The row holding the Add button no longer carries a grey band of its own between the address box and the button, matching every other dialog. #29664, #29663
• 🖱️ A plain note date. The date under a note title no longer shows a pointing hand or announces itself as something to press, having never done anything when clicked. #29708
• 🌇 Folder backgrounds on creation. The background image picked in the Create Folder dialog now arrives on the folder when it is created from the sidebar, where the image was discarded unless the dialog was opened from an existing folder. #30218, #30217
• 🖇 Delete Chat shortcut everywhere. The keyboard shortcut that deletes the open chat now works wherever the chat was opened from, where it did nothing unless the chat’s row happened to be on screen in the sidebar at that moment. #30165, #30164
• 🚮 Retired chat variables. A model whose system prompt no longer declares a variable a previous prompt did stops asking for it, where every new chat kept opening the dialog and refusing to send until a value was entered. #30173, #30172
• 👁️ Compact hover previews in Safari. Holding over a chat in the sidebar shows the small preview every other browser shows, rather than one laid out at the width and spacing of a full conversation. #29734
• 🔖 Visible title generation faults. When a new chat’s automatic title cannot be generated, the reason now reaches the log at the default level, rather than only under debug logging where a broken feature looked the same as a switched-off one. #30106, #29533

Changed

• 🪶 Slim starts with nothing configured. The slim image leaves out the local models and the libraries around them, and still starts and holds a conversation on its defaults; the features that leaned on those models each need an external service of their own. Commit
• 🗄️ Slim database support. The slim image runs on SQLite, its default, or on PostgreSQL; pointed at MySQL, MariaDB or another engine, or started with AWS RDS IAM logins switched on, it stops with an error instead of starting, and those deployments need the standard image. Commit
• 📁 Slim file storage. The slim image keeps files on local storage, its default; configured for an S3, Google Cloud or Azure bucket, it stops with an error instead of starting, and those deployments need the standard image. Commit
• 🧮 Slim searches only through pgvector. Knowledge search on the slim image needs PostgreSQL with pgvector, and configured for another vector store the instance still starts, and the failure arrives the first time something is searched rather than at startup. Commit, Commit
• 🧠 Slim embedding requirements. The slim image carries no embedding or reranking model, so knowledge needs OpenAI, Ollama or Azure OpenAI embeddings and an external reranker, falling back to plain cosine scoring where none is set. Commit
• ✂️ Slim document splitting. Splitting a document along a downloaded tokenizer is unavailable on the slim image, which leaves splitting by character or by token count. Commit
• 📃 Slim document readers. The slim image reads text, Markdown, CSV, HTML and XML files as they are; uploading a PDF, a Word file or a presentation fails unless one of the external document extractors is configured. Commit
• 🎙️ Slim speech requirements. The slim image carries neither local Whisper nor local voices, so speech to text and text to speech need an external engine before they will work. Commit
• 🕸️ Slim web page fetching. The slim image carries no headless browser, so a web page is fetched over plain HTTP or through an external loader, and a page that draws itself with JavaScript comes back with less of its content than on the standard image. Commit, Commit
• 🔎 Slim leaves out DDGS. DDGS, the metasearch provider that needs no key of its own, is not carried in the slim image, so web search there needs a provider with a key. Commit
• 📥 Slim code interpreter packages. The slim image leaves out the code interpreter’s packages, so the browser fetches numpy, pandas, matplotlib, scikit-learn and the rest from “cdn.jsdelivr.net” and the interpreter stops working where that is blocked. Commit
• 🧰 Slim git requirements. The slim image no longer carries git, so a tool or function whose requirements point at a “git+https://” address fails to install and needs the standard image or a published package. Commit
• 🧺 LangChain community removal. The readers for text, HTML, Word, CSV, PDF and Azure Document Intelligence are now written here rather than taken from “langchain-community”, which is no longer installed; a tool or function importing it has to name it in its own requirements from now on. Commit
• 🧾 Undeclared package imports. Packages that sat in the image only by accident, among them nltk, pymongo, the Google Drive client and the Gemini SDK, are no longer installed, so a tool or function importing one must name it in its own requirements. #29725, #29726, Commit
• 🆔 Model ID whitespace. A workspace model whose ID contains a space or a tab is now refused in the editor, through the API and on import; one already stored goes on answering but cannot be saved again until it is recreated. Commit
• 🖇️ Link scheme rendering. A link in a reply, a citation or a web search result is now rendered only where it points at a web address, a mail address, a telephone number or somewhere inside this instance; anything else, an “ftp://” address or an application link such as “obsidian://” or “vscode://” among them, is shown as the text it is. Two old oddities go with it: a source written as “HTTP://” now becomes a link, and a filename merely containing the letters http no longer becomes one that leads nowhere. #29890
• 🧲 Integrations tab is opt-in. The Integrations tab in personal settings, where tool and terminal connections of your own are managed, is now hidden until an administrator turns on Direct Integrations under Integrations or sets “ENABLE_DIRECT_INTEGRATIONS”, and hiding it leaves existing connections working. Commit, Commit
• 📡 Image connection check endpoint. The endpoint that checks an image generation connection has moved and now takes the connection to test in the request itself, so anything calling the old address needs updating. Commit

下载链接