发布日期: 2026-04-24
版本号: v0.9.2

本次更新新增了多项功能，包括支持PaddleOCR-vl文档提取、升级Firecrawl v2 API、允许自定义日历事件提醒时间、设置自定义API密钥请求头、新增OAuth会话断开连接功能、优化源引用显示与模型列表性能、提升页面加载与流式响应稳定性，并更新了多语言翻译。修复了包括MCP任务取消异常、持久化聊天技能注入、数据库驱动兼容性、Docker ARM64构建问题、富文本编辑冲突、OAuth发现回退、会话令牌处理、取消流清理、模型图像安全校验、RAG模板验证、自动化模型检测、MCP资源内容处理、浏览器消息虚拟化以及Redis通知兼容性等一系列问题。系统变更方面，将异步数据库驱动从asyncpg迁移至psycopg v3，更新了Brotli依赖以修复安全漏洞，并改进了Windows启动脚本。

更新内容 （中文）

新增功能

  • 🧠 PaddleOCR-vl文档提取功能 管理员现在可以使用PaddleOCR-vl作为文档处理的内容提取引擎，并在文档检索配置中设置可配置的API URL和令牌参数。#23945
  • 🔥 Firecrawl v2 API Firecrawl网页加载现在直接使用v2 API，并实现了适当的重试逻辑、速率限制的指数退避策略和可配置的超时处理，提升了云端和自托管Firecrawl环境的可靠性。#23934
  • ⏰ 日历事件提醒自定义 日历事件现在支持可配置的reminder_minutes参数，允许模型设置自定义提醒时长，而非默认的10分钟通知。
  • 🔑 自定义API密钥请求头 管理员现在可以通过CUSTOM_API_KEY_HEADER环境变量配置API密钥认证的自定义请求头名称，以兼容那些为自身认证使用Authorization请求头的反向代理。
  • 🔌 OAuth会话断开连接 用户现在可以通过新的API端点断开特定提供者（如MCP连接）的OAuth会话，实现更清晰的重新认证流程。
  • 📚 来源溢出指示器 当可用来源超过三个时，来源按钮现在会显示+N徽章，以便在聊天响应中清晰标示隐藏的来源。#23918
  • ⚡ 模型列表性能优化 模型列表API响应现在会从分页结果中剥离base64格式的个人资料图片数据，并通过专门的高效查询获取模型标签，而非加载所有模型。这显著减少了有效负载大小，提升了工作空间模型页面的响应速度。
  • ⚡ 模型头像缓存重用 默认模型个人资料图片现在会重定向到共享的静态路径，而非每次请求都从磁盘读取文件，减少了重复I/O，提升了多个模型使用回退图标时的加载效率。#24015
  • 🚀 更快的启动画面图片加载 启动画面图片现在通过预加载链接在页面加载时优先加载，改善了首次加载的LCP行为，减少了图片延迟发现。#24011
  • 🧵 流式Markdown处理性能稳定性 流式响应现在通过防止在Markdown更新期间重复注册清理回调来保持更高的内存效率。#24048
  • 📊 遥测仪表可靠性 OpenTelemetry用户仪表回调现在直接使用同步数据库查询，消除了可能在指标采集中导致静默失败的跨线程异步桥接问题。
  • 🔄 通用改进 在整个应用程序中实施了多项改进，以增强性能、稳定性和安全性。
  • 🌐 翻译更新 增强和扩展了芬兰语、韩语、葡萄牙语（巴西）和荷兰语的翻译。

修复问题

  • 🔧 MCP任务取消稳定性 被中断的MCP工具调用不再导致CPU峰值或失控的清理行为。MCP客户端断开连接现在在与连接相同的asyncio任务中运行，遵守取消作用域限制，并且在取消期间妥善屏蔽了聊天活动事件。
  • 🧠 持久化聊天技能注入 持久化聊天中提到的技能现在能可靠地注入系统提示。从<$skillId|label>消息标签中提取技能ID现在在服务端处理，并在消息到达模型前剥离这些标签。
  • 🗄️ 异步数据库驱动程序迁移 异步数据库后端现在使用psycopg (v3) 而非asyncpg，消除了脆弱的SSL参数转换，并支持包含sslmode、options和target_session_attrs的原生libpq连接字符串，无需任何剥离或转换。
  • 🐳 Docker ARM64可靠性 通过QEMU交叉编译构建的arm64 Docker镜像不再生成0字节的损坏Python依赖项。现在在Dockerfile中设置了UV_LINK_MODE=copy以强制可靠的文件安装。
  • 🛠️ 限流请求处理 当用户活动状态更新因非零间隔被限流时，请求处理不再失败。#23979
  • ✍️ 富文本扩展冲突 富文本编辑不再为列表和代码块触发重复的扩展冲突，提升了编辑器稳定性。#24009
  • 🔇 获取URL空内容保护 fetch_url内置工具现在可以安全处理网页加载器返回的None内容，而不是因TypeError而崩溃。
  • 🌐 OAuth发现回退机制 当WWW-Authenticate请求头不包含resource_metadata链接时，OAuth受保护资源发现现在会回退到标准的RFC 9728 URI，提高了与更多MCP服务器实现的兼容性。
  • 🔐 会话令牌解析 会话用户端点现在通过回退到Cookie和请求状态令牌来优雅处理缺失的Authorization请求头，防止在正向认证代理后使用时出错。
  • 🚫 直接API错误响应 没有WebSocket通道的聊天补全请求（直接API调用）现在返回正确的HTTP错误响应，而非在失败时静默返回null。
  • 📡 取消的响应流清理 取消的聊天生成现在显式关闭上游响应体迭代器，防止孤立的async生成器在anyio内部运行。
  • 🔒 模型个人资料图片路径安全 模型个人资料图片端点现在验证和清理静态资产重定向路径，防止通过编码点或恶意URL模式进行路径遍历。
  • 📊 RAG模板验证界面 文档设置页面现在在RAG模板包含多个[context]或{{CONTEXT}}占位符时显示警告，帮助管理员避免意外的冗余上下文注入。
  • 🧩 自动化模型检测 即使元数据中尚未设置model_id，create_automation工具现在也能正确检测当前模型ID，并回退到模型字典。
  • 🔄 MCP资源内容处理 具有resource内容类型的MCP工具结果现在被正确检测，并提取其resource.text有效负载，而非被静默忽略。
  • 🔄 Ollama和OpenAI元数据转发 Ollama和OpenAI代理路由现在将请求元数据转发给下游处理器，确保一致的上下文传播。
  • 🧹 浏览器原生消息虚拟化 基于自定义JavaScript的消息裁剪系统（间距符、高度缓存、滚动监听器）已被CSS content-visibility: auto取代，让浏览器原生跳过渲染屏幕外的消息，而不销毁组件树。这消除了滚动跳跃伪影和组件的挂载/销毁抖动，同时在长对话中保持内存效率。
  • 📻 Redis通知兼容性 Redis发布/订阅现在更优雅地处理缺失或不兼容的client_name支持，防止某些Redis配置下的连接错误。

变更内容

  • ⚙️ psycopg v3异步驱动程序 异步数据库驱动程序已从asyncpg迁移至psycopg (v3)。对大多数部署而言这是透明更改，但包含asyncpg特定参数的自定义连接字符串可能需要调整。
  • 🔑 Brotli依赖项更新 Brotli已更新以修复CVE-2025-6176。
  • 🖥️ Windows启动脚本 Windows启动批处理脚本已更新以提高兼容性。

更新内容 （原始）

Added

  • 🧠 PaddleOCR-vl document extraction. Administrators can now use PaddleOCR-vl as a content extraction engine for document processing, with configurable API URL and token settings in document retrieval configuration. #23945
  • 🔥 Firecrawl v2 API. Firecrawl web loading now uses the v2 API directly with proper retry logic, exponential backoff on rate limits, and configurable timeout handling, improving reliability for both cloud and self-hosted Firecrawl setups. #23934
  • ⏰ Calendar event reminder customization. Calendar events now support a configurable reminder_minutes parameter, allowing models to set custom reminder durations instead of the default 10-minute notification.
  • 🔑 Custom API key header. Administrators can now configure a custom header name for API key authentication via the CUSTOM_API_KEY_HEADER environment variable, enabling compatibility with reverse proxies that use the Authorization header for their own authentication.
  • 🔌 OAuth session disconnection. Users can now disconnect OAuth sessions for specific providers (e.g., MCP connections) through a new API endpoint, enabling cleaner re-authentication workflows.
  • 📚 Source overflow indicator. The Sources button now shows a +N badge when more than three sources are available, so hidden sources are clearly indicated in chat responses. #23918
  • ⚡ Model list performance. Model list API responses now strip base64 profile image data from paginated results, and model tags are fetched via a dedicated efficient query instead of loading all models. This significantly reduces payload sizes and improves workspace Models page responsiveness.
  • ⚡ Model avatar cache reuse. Default model profile images now redirect to a shared static path instead of reading files from disk per-request, reducing repeated I/O and improving loading efficiency when multiple models use the fallback icon. #24015
  • 🚀 Faster splash image loading. Splash screen images are now prioritized earlier during page load with preload links, improving first-load LCP behavior and reducing delayed image discovery. #24011
  • 🧵 Streaming markdown performance stability. Streaming responses now stay more memory-efficient by preventing repeated cleanup callback registration during markdown updates. #24048
  • 📊 Telemetry gauge reliability. OpenTelemetry user gauge callbacks now use synchronous database queries directly, eliminating cross-thread async bridging issues that could cause silent failures in metric collection.
  • 🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
  • 🌐 Translation updates. Translations for Finnish, Korean, Portuguese (Brazil), and Dutch were enhanced and expanded.

Fixed

  • 🔧 MCP task cancellation stability. Interrupted MCP tool calls no longer cause CPU spikes or runaway cleanup behavior. MCP client disconnection now runs in the same asyncio task as connection, respecting cancel scope constraints, and chat-active events are properly shielded during cancellation.
  • 🧠 Persistent chat skill injection. Skills mentioned in persisted chats now inject into the system prompt reliably. Skill ID extraction from <$skillId|label> message tags is now handled server-side, and tags are stripped before messages reach the model.
  • 🗄️ Async database driver migration. The async database backend now uses psycopg (v3) instead of asyncpg, eliminating brittle SSL parameter translation and supporting native libpq connection strings including sslmode, options, and target_session_attrs without any stripping or conversion.
  • 🐳 Docker ARM64 reliability. Docker images built for arm64 via QEMU cross-compilation no longer produce 0-byte corrupted Python dependencies. UV_LINK_MODE=copy is now set in the Dockerfile to force reliable file installation.
  • 🛠️ Throttle request handling. Request handling no longer fails when user activity status updates are throttled with a non-zero interval. #23979
  • ✍️ Rich text extension conflicts. Rich text editing no longer triggers duplicate extension conflicts for lists and code blocks, improving editor stability. #24009
  • 🔇 Fetch URL null content guard. The fetch_url built-in tool now safely handles None content returned by web loaders instead of crashing with a TypeError.
  • 🌐 OAuth discovery fallback. OAuth protected resource discovery now falls back to well-known RFC 9728 URIs when the WWW-Authenticate header doesn’t contain a resource_metadata link, improving compatibility with more MCP server implementations.
  • 🔐 Session token resolution. Session user endpoints now gracefully handle missing Authorization headers by falling back to cookie and request state tokens, preventing errors when used behind forward-auth proxies.
  • 🚫 Direct API error responses. Chat completion requests without a WebSocket channel (direct API calls) now return proper HTTP error responses instead of silently returning null on failure.
  • 📡 Cancelled response stream cleanup. Cancelled chat generation now explicitly closes the upstream response body iterator, preventing orphaned async generators from spinning in anyio internals.
  • 🔒 Model profile image path safety. Model profile image endpoints now validate and sanitize static asset redirect paths, preventing path traversal through encoded dots or malicious URL patterns.
  • 📊 RAG template validation UI. The Documents settings page now displays a warning when RAG templates contain multiple [context] or {{CONTEXT}} placeholders, helping administrators avoid accidental redundant context injection.
  • 🧩 Automation model detection. The create_automation tool now correctly detects the current model ID even when model_id is not yet set in metadata, falling back to the model dict.
  • 🔄 MCP resource content handling. MCP tool results with the resource content type are now correctly detected and their resource.text payload is extracted, instead of being silently ignored.
  • 🔄 Ollama and OpenAI metadata forwarding. Ollama and OpenAI proxy routes now forward request metadata to downstream handlers, ensuring consistent context propagation.
  • 🧹 Browser-native message virtualization. The custom JavaScript-based message culling system (spacers, height caching, scroll listeners) was replaced with CSS content-visibility: auto, letting the browser natively skip rendering of off-screen messages without destroying component trees. This eliminates scroll jump artifacts and mount/destroy thrashing while preserving memory efficiency in long conversations.
  • 📻 Redis notification compatibility. Redis pub/sub now handles missing or incompatible client_name support more gracefully, preventing connection errors with certain Redis configurations.

Changed

  • ⚙️ psycopg v3 async driver. The async database driver has been migrated from asyncpg to psycopg (v3). This is a transparent change for most deployments, but custom connection strings with asyncpg-specific parameters may need adjustment.
  • 🔑 Brotli dependency update. Brotli has been updated to address CVE-2025-6176.
  • 🖥️ Windows startup script. The Windows startup batch script has been updated for improved compatibility.

下载链接