发布日期: 2025-11-24
版本号: v0.6.37

Open WebUI 0.6.37 版本于2025年11月24日发布。本次更新新增了多项重要功能：引入了细粒度的两层共享权限控制，允许管理员独立配置用户向组内或公开分享工作区项目；支持可配置的密码策略强制执行；为工作区项目新增了细粒度的导入和导出权限；为新用户支持默认组分配；可通过环境变量完全禁用基于密码的认证，强制使用SSO；优化了处理模型直接生成图像的流式响应；实现了对Weaviate作为向量数据库的支持，并增强了PostgreSQL pgvector对HNSW索引和高维向量的支持；新增了Azure AI Search作为网络搜索提供商；大幅提升了外部嵌入生成、聊天导入和文件批量处理的性能；支持聊天响应中Markdown内容的Base64图像转换；增强了OpenAI图像生成参数配置和图像编辑独立控制；实施了SSRF防护；工作区模型页面支持分页；混合搜索索引文件元数据；知识库上传支持文件夹拖放；新增了模型克隆功能；界面支持UI缩放；可配置新用户的默认固定模型；语音服务支持自定义系统提示词；增强了WebSocket和Redis配置选项；改进了MCP OAuth动态客户端注册；优化了多项前端与后端的性能、稳定性和安全性；并更新了多语言翻译。修复了包括模型更新功能、多图像输入处理、iOS端PWA刷新、S3向量集合检测、反馈检索性能、混合搜索重排、Azure OpenAI模型参数支持、长ID模型管理、模型级流式设置、图像编辑配置、日期格式化、RAG模板查询处理、MinerU本地模式配置、Excel文件上传、Docling参数序列化、工具用户阀门配置、工具选择提示、笔记聊天功能、笔记PDF下载安全、归档聊天文件夹关联、ElevenLabs API密钥混淆、MCP OAuth服务器元数据发现、API密钥端点限制、OAuth角色声明解析、OAuth MCP服务器令牌验证、OAuth动态客户端注册和OIDC认证等多项问题。变更方面，将组成员数据存储重构为专用关系数据库表；重构了MinerU参数处理；将API密钥创建控制细化为用户和组权限，并重命名了相关环境变量。感谢所有贡献者和赞助商的支持。

更新内容 （中文）

[0.6.37] - 2025-11-24

新增功能

  • 🔐 新增细粒度分享权限，提供两级控制，将群组分享与公开分享分离，允许管理员独立配置用户是否可以将工作区项目分享给群组或公开访问，模型、知识库、提示词、工具和笔记分别具有独立的权限开关，可通过“USER_PERMISSIONS_WORKSPACE_MODELS_ALLOW_SHARING”、“USER_PERMISSIONS_WORKSPACE_MODELS_ALLOW_PUBLIC_SHARING”以及其他工作区项目类型的相应环境变量进行配置。同时，群组现在可以通过“允许群组分享”设置选择退出分享。提交、提交
  • 🔐 新增密码策略实施，提供可配置的验证规则，允许管理员通过“ENABLE_PASSWORD_VALIDATION”和“PASSWORD_VALIDATION_REGEX_PATTERN”环境变量要求特定的密码复杂性，默认模式要求至少8个字符，包含大写字母、小写字母、数字和特殊字符。#17794
  • 🔐 新增工作区项目的细粒度导入和导出权限，引入六个独立的权限开关，适用于模型、提示词和工具，默认为禁用状态以增强安全性。#19242
  • 👥 新增新用户的默认群组分配，允许管理员自动将新注册用户分配到指定群组，以简化模型、提示词和工具的访问控制，特别适用于具有基于群组模型访问策略的组织。#19325、#17842
  • 🔒 现在可以通过“ENABLE_PASSWORD_AUTH”环境变量完全禁用基于密码的认证，强制仅使用SSO认证，并在配置了SSO时防止密码登录回退。#19113
  • 🖼️ 实现大块流数据处理，以支持在其输出响应中直接生成图像的模型，可通过“CHAT_STREAM_RESPONSE_CHUNK_MAX_BUFFER_SIZE”环境变量配置缓冲区大小，解决了与Gemini 2.5 Flash Image等模型的兼容性问题。#18884、#17626
  • 🖼️ 流式响应中间件现在能处理delta更新中的图像，并自动进行base64转换，使得使用“choices[0].delta.images.image_url”格式（如OpenRouter上的Gemini 2.5 Flash Image Preview）的模型能正确显示图像。#19073、#19019
  • 📈 优化了模型列表API性能，通过预获取用户群组成员关系并从响应载荷中移除个人头像URL，显著减少了数据库查询和载荷大小，适用于模型列表较多的实例，个人头像现在通过专用端点动态提供。#19097、#18950
  • ⏩ 提高了批处理文件性能，将数据库查询减少了67%，同时确保向量数据库和关系型数据库之间的数据一致性。#18953
  • 🚀 大幅提升了聊天导入性能，使用批量导入端点替代单独的每聊天API请求，将大型聊天集合的导入时间减少了最多95%，并通过toast通知向用户反馈成功导入的聊天数量。#17861
  • ⚡ 优化了Socket事件广播性能，通过实现特定用户的房间，显著减少了服务器开销，特别是对于有多个并发会话的用户。#18996
  • 🗄️ 现在支持Weaviate作为向量数据库选项，除了现有的ChromaDB、Milvus、Qdrant和OpenSearch集成外，为RAG文档存储提供了额外选择。#14747
  • 🗄️ PostgreSQL pgvector现在支持HNSW索引类型，并通过自动选择halfvec类型支持超过2000维的大型嵌入，可通过“PGVECTOR_INDEX_METHOD”、“PGVECTOR_HNSW_M”、“PGVECTOR_HNSW_EF_CONSTRUCTION”和“PGVECTOR_IVFFLAT_LISTS”环境变量配置索引方法。#19158、#16890
  • 🔍 现在支持Azure AI Search作为网络搜索提供商，可通过“AZURE_AI_SEARCH_API_KEY”、“AZURE_AI_SEARCH_ENDPOINT”和“AZURE_AI_SEARCH_INDEX_NAME”配置与Azure认知搜索服务集成。#19104
  • ⚡ 外部嵌入生成现在并行处理API请求，而非顺序批处理，使用OpenAI、Azure OpenAI或Ollama嵌入提供商时，文档处理时间减少了10-50倍，大型PDF现在可在几秒钟内处理完成，而不是几分钟。#19296
  • 💨 聊天响应中的Markdown内容现在支持base64图像转换，自动上传超过1KB的嵌入图像，并将其替换为文件URL，以减少载荷大小和资源消耗，可通过“REPLACE_IMAGE_URLS_IN_CHAT_RESPONSE”环境变量进行配置。#19076
  • 🎨 OpenAI图像生成现在支持额外的API参数，包括GPT Image 1的质量设置，可通过“IMAGES_OPENAI_API_PARAMS”环境变量或通过管理员界面进行配置，提供低、中或高质量选项的经济高效图像生成。#19228
  • 🖼️ 现在可以通过管理员设置独立启用或禁用图像编辑，允许管理员控制连续图像提示是触发图像编辑还是新图像生成，可通过“ENABLE_IMAGE_EDIT”环境变量进行配置。#19284
  • 🔐 实现了SSRF保护，提供可配置的URL阻止列表，防止访问云元数据端点和私有网络，默认保护AWS、Google Cloud、Azure和阿里云元数据服务，可通过“WEB_FETCH_FILTER_LIST”环境变量自定义。#19201
  • ⚡ 工作区模型页面现在支持服务端分页，显著提高了具有大量工作区模型的实例的加载时间和可用性。
  • 🔍 混合搜索现在索引文件元数据（包括文件名、标题、标题、来源和摘要）以及文档内容，使关键词查询能够发现搜索词仅出现在元数据中的文档，可通过“ENABLE_RAG_HYBRID_SEARCH_ENRICHED_TEXTS”环境变量进行配置。#19095
  • 📂 知识库上传页面现在支持文件夹拖放和递归目录处理，允许批量上传整个目录结构，而无需单独选择文件。#19320
  • 🤖 管理员设置中现在提供模型克隆功能，允许管理员通过模型下拉菜单中的“克隆”选项，基于现有基础模型快速创建工作区模型。#17937
  • 🎨 界面设置中现在提供UI缩放调整功能，允许用户将整个界面大小从1.0倍增加到1.5倍，以改善无障碍性和可读性，对视力障碍用户尤其有益。#19186
  • 📌 管理员现在可以为所有新用户配置默认固定模型，其行为类似于默认模型，即管理员配置的默认值仅应用于未自定义其固定模型的用户，可通过“DEFAULT_PINNED_MODELS”环境变量进行配置。#19273
  • 🎙️ 启用“ENABLE_FORWARD_USER_INFO_HEADERS”后，文本转语音和语音转文本服务现在会接收用户信息头，允许外部TTS和STT提供商实现用户特定的个性化、速率限制和使用跟踪。#19323、#19312
  • 🎙️ 语音模式现在支持通过“VOICE_MODE_PROMPT_TEMPLATE”配置自定义系统提示词，允许管理员控制语音交互的响应风格和行为。#18607
  • 🔧 现在提供WebSocket和Redis配置选项，包括调试日志控制、自定义ping超时和间隔设置，以及通过“WEBSOCKET_SERVER_LOGGING”、“WEBSOCKET_SERVER_ENGINEIO_LOGGING”、“WEBSOCKET_SERVER_PING_TIMEOUT”、“WEBSOCKET_SERVER_PING_INTERVAL”和“WEBSOCKET_REDIS_OPTIONS”环境变量设置任意Redis连接选项。#19091
  • 🔧 MCP OAuth动态客户端注册现在会自动检测并从服务器支持的选项中使用适当的令牌端点认证方法，从而支持仅支持“client_secret_basic”而不支持“client_secret_post”的OAuth服务器。#19193
  • 🔧 现在可以为远程MCP和OpenAPI工具服务器连接配置自定义头部，以支持需要额外认证头部的服务集成。#18918
  • 🔍 Perplexity Search现在支持通过“PERPLEXITY_SEARCH_API_URL”配置自定义API端点，并自动转发用户信息头以实现个性化搜索体验。#19147
  • 🔍 启用“ENABLE_FORWARD_USER_INFO_HEADERS”后，用户信息头现在可以选择性地转发给外部网络搜索引擎。#19043
  • 📊 现在提供每日活跃用户指标进行监控，通过“webui.users.active.today”Prometheus计数器跟踪自UTC午夜以来活跃的唯一用户。#19236、#19234
  • 📊 审计日志文件路径现在可通过“AUDIT_LOGS_FILE_PATH”环境变量配置，支持存储在单独的卷或自定义位置。#19173
  • 🎨 模型列表和群组信息的侧边栏折叠状态现在在页面刷新时保持，通过基于浏览器的存储记住用户偏好。#19159
  • 🎨 背景图像显示增强，为导航栏和侧边栏添加了半透明覆盖层，在整个界面中创建无缝且视觉协调的设计。#19157
  • 📋 聊天消息中的表格现在包含悬停时出现的复制按钮，支持快速复制表格内容，与现有的CSV导出功能并存。#19162
  • 📝 现在可以通过“/notes/new”URL端点直接创建笔记，并可选地添加标题和内容查询参数，以便通过书签和快捷方式更快地创建笔记。#19195
  • 🏷️ 标签建议现在具有上下文感知能力，在创建或编辑模型与聊天对话时仅显示相关标签，避免模型和聊天标签之间的混淆。#19135
  • ✍️ 提示词自动补全现在独立于富文本输入设置，提高了该功能的可访问性。#19150
  • 🔄 在前端和后端实施了各种改进，以增强性能、稳定性和安全性。
  • 🌐 简体中文、繁体中文、葡萄牙语（巴西）、加泰罗尼亚语、西班牙语（西班牙）、芬兰语、爱尔兰语、波斯语、瑞典语、丹麦语、德语、韩语和泰语的翻译得到改进和扩展。

修复问题

  • 🤖 模型更新功能现在可正常工作，解决了数据库参数绑定错误，该错误导致无法通过“保存并更新”按钮保存模型配置更改。#19335
  • 🖼️ 图像编辑和生成的多输入图像现在通过“image[]”参数语法正确作为数组传递，使得与GPT Image 1等模型能实现正确的多图像参考功能。#19339
  • 📱 iOS上的PWA安装现在在服务器容器重启后能正确刷新，通过在检测到版本或部署变更时自动注销服务工作者来解决卡住的问题。#19316
  • 🗄️ S3 Vectors集合检测现在通过使用直接索引查找而非分页列表扫描，正确处理具有超过2000个索引的桶，性能提升约8倍，使RAG查询在大规模场景下可靠工作。#19238、#19233
  • 📈 反馈检索性能得到优化，通过数据库连接消除了N+1查询模式，并添加了服务端分页和排序，显著减少了具有大型反馈数据集的实例的数据库负载。#17976
  • 🔍 当聊天数据包含空字节时，PostgreSQL的聊天搜索现在可正常工作，通过全面的数据清理，在数据写入时防止空字节，在读取时清理现有数据，并在搜索查询时剥离空字节，以确保搜索功能可靠。#15616
  • 🔍 带重排序的混合搜索现在能正确处理属性验证，防止当集合结果缺乏预期结构时出错。#19025、#17046
  • 🔎 重排序功能在最近重构后现在能正常工作，解决了由错误的函数参数处理引起的崩溃。#19270
  • 🤖 Azure OpenAI模型现在支持“reasoning_effort”参数，为GPT-5.1等模型启用了正确的推理能力配置（这些模型在不设置此参数时默认无推理）。#19290
  • 🤖 具有非常长ID的模型现在可以正确删除，解决了以前阻止对这些模型进行管理操作的URL长度限制问题。#18230
  • 🤖 模型级别的流式设置现在能正确应用于API请求，确保“流式聊天响应”开关正确控制流式参数。#19154
  • 🖼️ 图像编辑配置现在能正确保留独立的OpenAI API端点和密钥，防止它们被图像生成设置覆盖。#19003
  • 🎨 Gemini图像编辑设置现在能在管理员面板中正确显示，修复了错误的配置键引用导致编辑选项无法正确渲染的问题。#19200
  • 🖌️ 图像生成设置菜单现在能正确加载，解决了AUTOMATIC1111 API认证参数的验证错误。#19187、#19246
  • 📅 聊天搜索和管理员用户聊天搜索中的日期格式现在能正确遵循“DEFAULT_LOCALE”环境变量，根据配置的区域设置显示日期，而非始终使用MM/DD/YYYY格式。#19305、#19020
  • 📝 修正了RAG模板查询占位符转义逻辑，防止当查询占位符出现在检索内容中时意外替换上下文值。#19102、#19101
  • 📄 通过从默认模板中移除冗余的用户查询部分，消除了RAG模板提示词重复。#19099、#19098
  • 📋 MinerU本地模式配置不再错误地要求API密钥，允许正确使用本地内容提取，无需外部API凭据。#19258
  • 📊 Excel文件上传现在可正常工作，添加了缺失的msoffcrypto-tool依赖项，解决了由unstructured包升级引起的导入错误。#19153
  • 📑 Docling参数现在能正确处理JSON序列化，防止异常并确保配置更改被正确保存。#19072
  • 🛠️ UserValves配置现在能正确隔离每个工具的设置，防止同时使用多个带有UserValves的工具时配置污染。#19185、#15569
  • 🔧 工具选择提示词现在能正确处理用户消息，不会重复，移除了冗余的查询前缀并提高了提示词清晰度。#19122、#19121
  • 📝 笔记聊天功能现在能正确向补全端点提交消息，解决了阻止AI模型交互的错误。#19079
  • 📝 笔记PDF下载现在在渲染前使用DOMPurify清理HTML内容，防止笔记中恶意内容可能导致的DOM型XSS攻击。提交
  • 📁 归档的聊天现在会自动移除其文件夹关联，以防止在删除其先前文件夹时意外删除。#14578
  • 🔐 ElevenLabs API密钥现在在管理员设置页面中被正确混淆，防止敏感凭据以明文暴露。#19262、#19260
  • 🔧 MCP OAuth服务器元数据发现现在遵循正确的规范顺序，确保认证流程合规。#19244
  • 🔒 API密钥端点限制现在对所有端点（包括SCIM）正确实施访问控制，防止配置了“API_KEY_ALLOWED_ENDPOINTS”时意外访问。#19168
  • 🔓 OAuth角色声明解析现在支持扁平和嵌套的声明结构，与将声明作为用户对象直接属性而非嵌套结构传递的OAuth提供商兼容。#19286
  • 🔑 OAuth MCP服务器验证现在能正确提取访问令牌值用于授权头，而不是发送整个令牌字典。#19149、#19148
  • ⚙️ OAuth动态客户端注册现在能将空字符串正确转换为None用于可选字段，防止MCP包集成中的验证失败。#19144、#19129
  • 🔐 OIDC认证现在在访问令牌请求中正确传递客户端凭据，确保与根据RFC 6749要求这些参数的提供商兼容。#19132、#19131
  • 🔗 OAuth客户端创建现在遵循配置的令牌端点认证方法，而不是默认使用基本认证，防止与不支持基本认证的服务器发生故障。#19165
  • 📋 从Chrome聊天响应中复制的文本现在粘贴时不带背景格式，提高了粘贴到文字处理器时的可读性。#19083

变更内容

  • 🗄️ 群组成员数据存储从JSON数组重构为专用的关系数据库表，显著提高了具有大量用户和群组的实例的查询性能和可扩展性，同时API响应现在返回成员计数而不是完整的用户ID数组。#19239
  • 📄 MinerU参数处理被重构为直接传递参数给API，提高了灵活性并修复了VLM后端配置。#19105、#18446
  • 🔐 API密钥创建现在由细粒度的用户和群组权限控制，“ENABLE_API_KEY”环境变量重命名为“ENABLE_API_KEYS”并默认禁用，需要在全局和用户权限级别进行明确配置，同时相关的环境变量“ENABLE_API_KEY_ENDPOINT_RESTRICTIONS”和“API_KEY_ALLOWED_ENDPOINTS”分别重命名为“ENABLE_API_KEYS_ENDPOINT_RESTRICTIONS”和“API_KEYS_ALLOWED_ENDPOINTS”。#18336

[!TIP] 需要企业计划？ – 立即联系我们的销售团队！

获取增强功能，包括自定义主题和品牌、服务等级协议 (SLA) 支持等！

👏 衷心感谢我们杰出的贡献者为使此版本成为可能所做的辛勤工作和奉献： @Davixk、@podden、@ShirasawaSama、@jekuaitk、@sanglt、@shargyle、@aindriu80、@krishna-medapati、@lazariv、@FlorentMair80、@mikkeschiren、@joaoback、@Cyp9715、@aleixdorca、@silentoplayz、@gerhardj-b、@siwadon-jay、@jmleksan、@dannyl1u、@rgaricano、@Kylapaallikko、@Classic298、@expruc、@tomhaynes、@diwakar-s-maurya、@xqqp、@logan-hcg、@BlakeTnr、@siavashvj、@Oleg52、@sihyeonn、@davecrab、@matiboux、@adam-skalicky

赞助商 🙌

🚀 我们衷心感谢我们优秀的赞助商的慷慨支持（注：我们已从此列表中排除了私人赞助商。如果您希望在此处展示，请随时联系我们！）

@amd、@roosi-gmbh、@rndmcnlly、@feddersen-group、@SRKConsulting、@mushmax、@icanbwell、@agency-agency、@Classic298、@loitragg、@haka4githu6、@silenceroom、@GenieDev101、@CubicleGangster、@TOWaB、@comet-ml、@FominVO、@catalyst-net-nz、@JrdnHans、@hkosm、@VeroFess、@joaoback、@walsermedia、@LuxTronic

更新内容 （原始）

[0.6.37] - 2025-11-24

Added

  • 🔐 Granular sharing permissions are now available with two-tiered control separating group sharing from public sharing, allowing administrators to independently configure whether users can share workspace items with groups or make them publicly accessible, with separate permission toggles for models, knowledge bases, prompts, tools, and notes, configurable via “USER_PERMISSIONS_WORKSPACE_MODELS_ALLOW_SHARING”, “USER_PERMISSIONS_WORKSPACE_MODELS_ALLOW_PUBLIC_SHARING”, and corresponding environment variables for other workspace item types, while groups can now be configured to opt-out of sharing via the “Allow Group Sharing” setting. Commit, Commit
  • 🔐 Password policy enforcement is now available with configurable validation rules, allowing administrators to require specific password complexity requirements via “ENABLE_PASSWORD_VALIDATION” and “PASSWORD_VALIDATION_REGEX_PATTERN” environment variables, with default pattern requiring minimum 8 characters including uppercase, lowercase, digit, and special character. #17794
  • 🔐 Granular import and export permissions are now available for workspace items, introducing six separate permission toggles for models, prompts, and tools that are disabled by default for enhanced security. #19242
  • 👥 Default group assignment is now available for new users, allowing administrators to automatically assign newly registered users to a specified group for streamlined access control to models, prompts, and tools, particularly useful for organizations with group-based model access policies. #19325, #17842
  • 🔒 Password-based authentication can now be fully disabled via “ENABLE_PASSWORD_AUTH” environment variable, enforcing SSO-only authentication and preventing password login fallback when SSO is configured. #19113
  • 🖼️ Large stream chunk handling was implemented to support models that generate images directly in their output responses, with configurable buffer size via “CHAT_STREAM_RESPONSE_CHUNK_MAX_BUFFER_SIZE” environment variable, resolving compatibility issues with models like Gemini 2.5 Flash Image. #18884, #17626
  • 🖼️ Streaming response middleware now handles images in delta updates with automatic base64 conversion, enabling proper display of images from models using the “choices[0].delta.images.image_url” format such as Gemini 2.5 Flash Image Preview on OpenRouter. #19073, #19019
  • 📈 Model list API performance was optimized by pre-fetching user group memberships and removing profile image URLs from response payloads, significantly reducing both database queries and payload size for instances with large model lists, with profile images now served dynamically via dedicated endpoints. #19097, #18950
  • ⏩ Batch file processing performance was improved by reducing database queries by 67% while ensuring data consistency between vector and relational databases. #18953
  • 🚀 Chat import performance was dramatically improved by replacing individual per-chat API requests with a bulk import endpoint, reducing import time by up to 95% for large chat collections and providing user feedback via toast notifications displaying the number of successfully imported chats. #17861
  • ⚡ Socket event broadcasting performance was optimized by implementing user-specific rooms, significantly reducing server overhead particularly for users with multiple concurrent sessions. #18996
  • 🗄️ Weaviate is now supported as a vector database option, providing an additional choice for RAG document storage alongside existing ChromaDB, Milvus, Qdrant, and OpenSearch integrations. #14747
  • 🗄️ PostgreSQL pgvector now supports HNSW index types and large dimensional embeddings exceeding 2000 dimensions through automatic halfvec type selection, with configurable index methods via “PGVECTOR_INDEX_METHOD”, “PGVECTOR_HNSW_M”, “PGVECTOR_HNSW_EF_CONSTRUCTION”, and “PGVECTOR_IVFFLAT_LISTS” environment variables. #19158, #16890
  • 🔍 Azure AI Search is now supported as a web search provider, enabling integration with Azure’s cognitive search services via “AZURE_AI_SEARCH_API_KEY”, “AZURE_AI_SEARCH_ENDPOINT”, and “AZURE_AI_SEARCH_INDEX_NAME” configuration. #19104
  • ⚡ External embedding generation now processes API requests in parallel instead of sequential batches, reducing document processing time by 10-50x when using OpenAI, Azure OpenAI, or Ollama embedding providers, with large PDFs now processing in seconds instead of minutes. #19296
  • 💨 Base64 image conversion is now available for markdown content in chat responses, automatically uploading embedded images exceeding 1KB and replacing them with file URLs to reduce payload size and resource consumption, configurable via “REPLACE_IMAGE_URLS_IN_CHAT_RESPONSE” environment variable. #19076
  • 🎨 OpenAI image generation now supports additional API parameters including quality settings for GPT Image 1, configurable via “IMAGES_OPENAI_API_PARAMS” environment variable or through the admin interface, enabling cost-effective image generation with low, medium, or high quality options. #19228
  • 🖼️ Image editing can now be independently enabled or disabled via admin settings, allowing administrators to control whether sequential image prompts trigger image editing or new image generation, configurable via “ENABLE_IMAGE_EDIT” environment variable. #19284
  • 🔐 SSRF protection was implemented with a configurable URL blocklist that prevents access to cloud metadata endpoints and private networks, with default protections for AWS, Google Cloud, Azure, and Alibaba Cloud metadata services, customizable via “WEB_FETCH_FILTER_LIST” environment variable. #19201
  • ⚡ Workspace models page now supports server-side pagination dramatically improving load times and usability for instances with large numbers of workspace models.
  • 🔍 Hybrid search now indexes file metadata including filenames, titles, headings, sources, and snippets alongside document content, enabling keyword queries to surface documents where search terms appear only in metadata, configurable via “ENABLE_RAG_HYBRID_SEARCH_ENRICHED_TEXTS” environment variable. #19095
  • 📂 Knowledge base upload page now supports folder drag-and-drop with recursive directory handling, enabling batch uploads of entire directory structures instead of requiring individual file selection. #19320
  • 🤖 Model cloning is now available in admin settings, allowing administrators to quickly create workspace models based on existing base models through a “Clone” option in the model dropdown menu. #17937
  • 🎨 UI scale adjustment is now available in interface settings, allowing users to increase the size of the entire interface from 1.0x to 1.5x for improved accessibility and readability, particularly beneficial for users with visual impairments. #19186
  • 📌 Default pinned models can now be configured by administrators for all new users, mirroring the behavior of default models where admin-configured defaults apply only to users who haven’t customized their pinned models, configurable via “DEFAULT_PINNED_MODELS” environment variable. #19273
  • 🎙️ Text-to-Speech and Speech-to-Text services now receive user information headers when “ENABLE_FORWARD_USER_INFO_HEADERS” is enabled, allowing external TTS and STT providers to implement user-specific personalization, rate limiting, and usage tracking. #19323, #19312
  • 🎙️ Voice mode now supports custom system prompts via “VOICE_MODE_PROMPT_TEMPLATE” configuration, allowing administrators to control response style and behavior for voice interactions. #18607
  • 🔧 WebSocket and Redis configuration options are now available including debug logging controls, custom ping timeout and interval settings, and arbitrary Redis connection options via “WEBSOCKET_SERVER_LOGGING”, “WEBSOCKET_SERVER_ENGINEIO_LOGGING”, “WEBSOCKET_SERVER_PING_TIMEOUT”, “WEBSOCKET_SERVER_PING_INTERVAL”, and “WEBSOCKET_REDIS_OPTIONS” environment variables. #19091
  • 🔧 MCP OAuth dynamic client registration now automatically detects and uses the appropriate token endpoint authentication method from server-supported options, enabling compatibility with OAuth servers that only support “client_secret_basic” instead of “client_secret_post”. #19193
  • 🔧 Custom headers can now be configured for remote MCP and OpenAPI tool server connections, enabling integration with services that require additional authentication headers. #18918
  • 🔍 Perplexity Search now supports custom API endpoints via “PERPLEXITY_SEARCH_API_URL” configuration and automatically forwards user information headers to enable personalized search experiences. #19147
  • 🔍 User information headers can now be optionally forwarded to external web search engines when “ENABLE_FORWARD_USER_INFO_HEADERS” is enabled. #19043
  • 📊 Daily active user metric is now available for monitoring, tracking unique users active since midnight UTC via the “webui.users.active.today” Prometheus gauge. #19236, #19234
  • 📊 Audit log file path is now configurable via “AUDIT_LOGS_FILE_PATH” environment variable, enabling storage in separate volumes or custom locations. #19173
  • 🎨 Sidebar collapse states for model lists and group information are now persistent across page refreshes, remembering user preferences through browser-based storage. #19159
  • 🎨 Background image display was enhanced with semi-transparent overlays for navbar and sidebar, creating a seamless and visually cohesive design across the entire interface. #19157
  • 📋 Tables in chat messages now include a copy button that appears on hover, enabling quick copying of table content alongside the existing CSV export functionality. #19162
  • 📝 Notes can now be created directly via the “/notes/new” URL endpoint with optional title and content query parameters, enabling faster note creation through bookmarks and shortcuts. #19195
  • 🏷️ Tag suggestions are now context-aware, displaying only relevant tags when creating or editing models versus chat conversations, preventing confusion between model and chat tags. #19135
  • ✍️ Prompt autocompletion is now available independently of the rich text input setting, improving accessibility to the feature. #19150
  • 🔄 Various improvements were implemented across the frontend and backend to enhance performance, stability, and security.
  • 🌐 Translations for Simplified Chinese, Traditional Chinese, Portuguese (Brazil), Catalan, Spanish (Spain), Finnish, Irish, Farsi, Swedish, Danish, German, Korean, and Thai were improved and expanded.

Fixed

  • 🤖 Model update functionality now works correctly, resolving a database parameter binding error that prevented saving changes to model configurations via the Save & Update button. #19335
  • 🖼️ Multiple input images for image editing and generation are now correctly passed as an array using the “image[]” parameter syntax, enabling proper multi-image reference functionality with models like GPT Image 1. #19339
  • 📱 PWA installations on iOS now properly refresh after server container restarts, resolving freezing issues by automatically unregistering service workers when version or deployment changes are detected. #19316
  • 🗄️ S3 Vectors collection detection now correctly handles buckets with more than 2000 indexes by using direct index lookup instead of paginated list scanning, improving performance by approximately 8x and enabling RAG queries to work reliably at scale. #19238, #19233
  • 📈 Feedback retrieval performance was optimized by eliminating N+1 query patterns through database joins, adding server-side pagination and sorting, significantly reducing database load for instances with large feedback datasets. #17976
  • 🔍 Chat search now works correctly with PostgreSQL when chat data contains null bytes, with comprehensive sanitization preventing null bytes during data writes, cleaning existing data on read, and stripping null bytes during search queries to ensure reliable search functionality. #15616
  • 🔍 Hybrid search with reranking now correctly handles attribute validation, preventing errors when collection results lack expected structure. #19025, #17046
  • 🔎 Reranking functionality now works correctly after recent refactoring, resolving crashes caused by incorrect function argument handling. #19270
  • 🤖 Azure OpenAI models now support the “reasoning_effort” parameter, enabling proper configuration of reasoning capabilities for models like GPT-5.1 which default to no reasoning without this setting. #19290
  • 🤖 Models with very long IDs can now be deleted correctly, resolving URL length limitations that previously prevented management operations on such models. #18230
  • 🤖 Model-level streaming settings now correctly apply to API requests, ensuring “Stream Chat Response” toggle properly controls the streaming parameter. #19154
  • 🖼️ Image editing configuration now correctly preserves independent OpenAI API endpoints and keys, preventing them from being overwritten by image generation settings. #19003
  • 🎨 Gemini image edit settings now display correctly in the admin panel, fixing an incorrect configuration key reference that prevented proper rendering of edit options. #19200
  • 🖌️ Image generation settings menu now loads correctly, resolving validation errors with AUTOMATIC1111 API authentication parameters. #19187, #19246
  • 📅 Date formatting in chat search and admin user chat search now correctly respects the “DEFAULT_LOCALE” environment variable, displaying dates according to the configured locale instead of always using MM/DD/YYYY format. #19305, #19020
  • 📝 RAG template query placeholder escaping logic was corrected to prevent unintended replacements of context values when query placeholders appear in retrieved content. #19102, #19101
  • 📄 RAG template prompt duplication was eliminated by removing redundant user query section from the default template. #19099, #19098
  • 📋 MinerU local mode configuration no longer incorrectly requires an API key, allowing proper use of local content extraction without external API credentials. #19258
  • 📊 Excel file uploads now work correctly with the addition of the missing msoffcrypto-tool dependency, resolving import errors introduced by the unstructured package upgrade. #19153
  • 📑 Docling parameters now properly handle JSON serialization, preventing exceptions and ensuring configuration changes are saved correctly. #19072
  • 🛠️ UserValves configuration now correctly isolates settings per tool, preventing configuration contamination when multiple tools with UserValves are used simultaneously. #19185, #15569
  • 🔧 Tool selection prompt now correctly handles user messages without duplication, removing redundant query prefixes and improving prompt clarity. #19122, #19121
  • 📝 Notes chat feature now correctly submits messages to the completions endpoint, resolving errors that prevented AI model interactions. #19079
  • 📝 Note PDF downloads now sanitize HTML content using DOMPurify before rendering, preventing potential DOM-based XSS attacks from malicious content in notes. Commit
  • 📁 Archived chats now have their folder associations automatically removed to prevent unintended deletion when their previous folder is deleted. #14578
  • 🔐 ElevenLabs API key is now properly obfuscated in the admin settings page, preventing plain text exposure of sensitive credentials. #19262, #19260
  • 🔧 MCP OAuth server metadata discovery now follows the correct specification order, ensuring proper authentication flow compliance. #19244
  • 🔒 API key endpoint restrictions now properly enforce access controls for all endpoints including SCIM, preventing unintended access when “API_KEY_ALLOWED_ENDPOINTS” is configured. #19168
  • 🔓 OAuth role claim parsing now supports both flat and nested claim structures, enabling compatibility with OAuth providers that deliver claims as direct properties on the user object rather than nested structures. #19286
  • 🔑 OAuth MCP server verification now correctly extracts the access token value for authorization headers instead of sending the entire token dictionary. #19149, #19148
  • ⚙️ OAuth dynamic client registration now correctly converts empty strings to None for optional fields, preventing validation failures in MCP package integration. #19144, #19129
  • 🔐 OIDC authentication now correctly passes client credentials in access token requests, ensuring compatibility with providers that require these parameters per RFC 6749. #19132, #19131
  • 🔗 OAuth client creation now respects configured token endpoint authentication methods instead of defaulting to basic authentication, preventing failures with servers that don’t support basic auth. #19165
  • 📋 Text copied from chat responses in Chrome now pastes without background formatting, improving readability when pasting into word processors. #19083

Changed

  • 🗄️ Group membership data storage was refactored from JSON arrays to a dedicated relational database table, significantly improving query performance and scalability for instances with large numbers of users and groups, while API responses now return member counts instead of full user ID arrays. #19239
  • 📄 MinerU parameter handling was refactored to pass parameters directly to the API, improving flexibility and fixing VLM backend configuration. #19105, #18446
  • 🔐 API key creation is now controlled by granular user and group permissions, with the “ENABLE_API_KEY” environment variable renamed to “ENABLE_API_KEYS” and disabled by default, requiring explicit configuration at both the global and user permission levels, while related environment variables “ENABLE_API_KEY_ENDPOINT_RESTRICTIONS” and “API_KEY_ALLOWED_ENDPOINTS” were renamed to “ENABLE_API_KEYS_ENDPOINT_RESTRICTIONS” and “API_KEYS_ALLOWED_ENDPOINTS” respectively. #18336

[!TIP]
Looking for an Enterprise Plan? – Speak with Our Sales Team Today!

Get enhanced capabilities, including custom theming and branding, Service Level Agreement (SLA) support, and more!

👏 Massive thanks to our incredible contributors for their hard work and dedication to making this release possible: @Davixk, @podden, @ShirasawaSama, @jekuaitk, @sanglt, @shargyle, @aindriu80, @krishna-medapati, @lazariv, @FlorentMair80, @mikkeschiren, @joaoback, @Cyp9715, @aleixdorca, @silentoplayz, @gerhardj-b, @siwadon-jay, @jmleksan, @dannyl1u, @rgaricano, @Kylapaallikko, @Classic298, @expruc, @tomhaynes, @diwakar-s-maurya, @xqqp, @logan-hcg, @BlakeTnr, @siavashvj, @Oleg52, @sihyeonn, @davecrab, @matiboux, @adam-skalicky

Sponsors 🙌

🚀 We’d like to extend a heartfelt thank you to our amazing sponsors for their generous support (Note: We’ve excluded private sponsors from this list. If you’d like to get featured here, feel free to reach out to us!)

@amd, @roosi-gmbh, @rndmcnlly, @feddersen-group, @SRKConsulting, @mushmax, @icanbwell, @agency-agency, @Classic298, @loitragg, @haka4githu6, @silenceroom, @GenieDev101, @CubicleGangster, @TOWaB, @comet-ml, @FominVO, @catalyst-net-nz, @JrdnHans, @hkosm, @VeroFess, @joaoback, @walsermedia, @LuxTronic

下载链接