发布日期: 2026-06-01
版本号: v0.9.6

本次更新主要包含以下内容：新增功能方面，重点增强了知识库管理，包括推出官方知识库同步工具（oikb），支持智能目录同步、文件夹组织、文件系统工具、文件重命名以及可配置的页面大小等功能；新增了消息输入表情选择器、按对话启用/禁用技能、用户和组访问权限预览、管理员可配置 MinerU 处理的文件类型（扩展至 DOCX 等）及旧版 Word 文件支持；优化了性能，包括加快页面初始加载、启用工具的聊天响应速度、Web 搜索的响应性、Ollama 后端连接效率以及减少冗余的模型列表写入和 WebSocket 断开清理开销；此外，还改进了工具、函数、技能编辑器的 frontmatter 自动填充、自定义标头模板支持更多用户占位符、可配置的 MCP 连接超时、头像图片大小限制、OAuth 角色通配符映射、反馈历史分页、批量启用/禁用自动化、可选的单点登录自动重定向、对 Azure AI Foundry v1（Entra ID）和 Linkup 搜索提供商的支持、新增 Valkey 作为向量数据库选项，并更新了多语言翻译。

安全与修复方面，本次包含重要的安全更新，建议生产环境尽快升级。主要修复了工具服务器权限执行、知识库搜索访问检查、检索集合的跨用户访问、集合名称验证、未作用域集合默认拒绝、提示历史授权、旧版代码解释器权限、API 密钥端点限制绕过、系统提示绕过、终端代理路径遍历、缓存文件路径遍历、Ollama 后端选择访问检查、通过图片 URL 的跨用户文件窃取、聊天文件附件访问检查、模型知识文件所有权检查、日历事件移动授权、频道聊天访问控制、带 Playwright 的网页加载器 SSRF 防护、URL 获取的 DNS 重绑定保护、OAuth 头像重定向处理、模型头像脚本注入、图表渲染脚本注入、共享聊天文件写保护、跨源嵌入提示控制、聊天文件夹所有权检查、损坏历史记录的聊天恢复、带文件夹的导入聊天显示、MCP 工具服务器会话保持连接、MCP OAuth 范围发现、网页搜索可靠性、Firecrawl 和 Kagi 搜索、代码块中括号数字、API 聊天完成可靠性、ComfyUI 图片生成与编辑、非标准响应头的图片生成、在大型文档上进行知识搜索、聊天标题生成、消息搜索与分析一致性、聊天内任务失败的优雅处理、消息输出过滤器更改、标题和标签反映过滤输出、操作替换的消息内容持久化、消息中的技能提及、发送失败时的使用计时器清理、删除聊天时停止后台任务、响应式知识文件搜索、空嵌入的文档处理、非 UTF-8 文本和 CSV 上传、嵌套数据中的空字节不再导致保存失败、未配置嵌入模型时的清晰错误提示、记忆搜索质量、知识工具上下文溢出、终端会话稳定性、与严格提供商的工具调用连续性、管道函数的流终止、非阻塞的文本到语音转码、默认文本到语音语音设置、知识库文件可靠链接、Azure 自定义主机名连接、清除日历事件字段、高级参数设置保存、长用户名显示、模型编辑器中可选择所有技能、准确的知识上传反馈、高对比度时间戳可读性、菜单的键盘和屏幕阅读器访问、编辑器中的焦点丢失处理、对损坏本地存储的恢复力、更安静的重新连接通知、Safari 中的 PDF 处理、语音模式静音快捷键列表、频道模型回复中的文档附件、频道提及中的隐藏模型、频道线程和置顶消息稳定性、YouTube 短链接转录、默认模型和自动化选择器中的隐藏模型、语音到文本 SSL 设置生效、MCP 连接标头中的占位符、Bing 搜索 CLI 冒烟测试、数据库健康检查恢复、非 Unicode 控制台上的启动、重置后的首个管理员注册、JSON 异常日志记录、工作区技能权限、以及弹性数据库迁移。

变更方面，由于包含数据库架构更改，强烈建议在升级生产环境前备份数据库和所有相关数据；多工作进程、多服务器或负载均衡部署必须同时更新所有实例，滚动更新不受支持；工具调用迭代上限环境变量已重命名并提高上限，默认值从 30 提高到 256，并新增 -1 表示无限制；减少了未认证调用方对 “/api/config” 响应中多个功能标志的暴露；现在即使对于不支持的部署方式，设置 “WEBUI_SECRET_KEY” 也成为了硬性要求。

更新内容 （中文）

新增内容

  • 📦 官方知识库同步工具。 Open WebUI 推出了新的配套工具 oikb，用于将知识库与本地目录、GitHub 仓库、S3 存储桶、Confluence 空间或超过 40 种其他来源保持同步，仅使用本版本新增的增量同步支持上传新增和修改的文件。oikb
  • 🂠 知识库的智能目录同步。 本地目录现在可以通过一个操作同步到知识库：将文件校验和与已存储的内容进行比较，仅上传新增或修改的文件，同时清理已删除的文件和孤立的子目录，自动镜像目录结构，并在整个过程中显示每个文件的进度。#19190、#19394、提交、提交、提交、提交、提交、提交
  • 🗂️ 知识库文件夹。 知识库中的文件现在可以组织到嵌套文件夹中，并带有面包屑导航，使得在大型集合中管理和查找内容变得更加容易。提交、提交、提交、提交、提交、提交
  • 🧰 知识库的文件系统工具。 一个新的内置工具，通过 “ENABLE_KB_EXEC” 环境变量启用，允许 AI 模型使用熟悉的文件系统命令（如 ’ls’、‘cat’、‘grep’、‘find’、‘head’、’tail’ 和 ‘sed’，包括它们之间的管道）浏览和搜索知识库内容。提交、提交、提交、提交、提交、提交、提交、提交、提交
  • ✏️ 知识库中的文件重命名。 知识库中的文件现在可以直接从工作区重命名，新名称将反映在引用该文件的所有地方。提交
  • 😀 消息输入中的表情符号选择器。 富文本格式工具栏中的新表情符号按钮允许您浏览并直接在消息中插入表情符号。#24704
  • 🪄 每个聊天的技能切换。 现在可以直接从聊天集成菜单为对话开启或关闭技能，其工作方式与工具和功能相同，而不再仅通过模型预设。#25036、#25037
  • 🔎 用户和组的访问预览。 管理员现在可以预览给定用户或组可以访问的模型、知识库和工具的确切情况，从而更容易审核和验证权限设置。提交
  • 📄 可配置的知识库文件页面大小。 管理员现在可以通过 API 列出知识库文件时请求更大的页面大小，从而减少检索大型集合所需的请求次数，而不是按固定的 30 条增量分页。#25148、提交
  • 🔃 知识文件处理的持久化指示器。 知识库中仍在处理的文件现在将在页面重新加载时继续显示处理指示器，因此在导航离开并返回后，您仍可识别出哪些内容仍在摄取中。#25031、提交
  • 📑 MinerU 文件类型配置。 管理员现在可以通过新的 “MINERU_FILE_EXTENSIONS” 设置配置 MinerU 文档加载器处理哪些文件类型，将其扩展到 PDF 之外，支持 DOCX、PPTX 和 XLSX 等格式。提交
  • 📃 旧版 Word 文档支持。 除了现代的 “.docx” 格式外，较旧的 “.doc” Word 文件现在也可以通过默认文档提取引擎提取文本。提交
  • 📁 从文件夹标题创建子文件夹。 聊天文件夹现在可以直接在聊天视图的文件夹标题中创建子文件夹，而不再仅能从侧边栏创建。提交
  • ⚡ 更快的初始页面加载。 每次页面访问时加载的配置端点不再运行不必要的用户数查询，使初始应用加载对数据库的负担减轻，尤其是在拥有众多用户的实例上。提交
  • 🚀 更快的工具启用的聊天补全。 使用多个工具的聊天补全现在启动更快，因为它们引用的工具现在从数据库中以单次批量查询的方式获取，而不是每个工具一次查询。#24808、提交
  • 🏎️ 负载下更具响应性的网络搜索。 通过 SearXNG、Google PSE、Brave、Serper 和 Serpstack 的网络搜索现在使用非阻塞网络调用，因此当搜索正在进行时，服务器可以响应其他用户，并且并发的多查询搜索完成得更快。提交
  • 🐎 更轻量的 Ollama 后端连接。 对 Ollama 后端的请求现在重用共享连接池，而不是每次打开一个新会话，从而减少了频繁轮询 Ollama 或配置了多个后端的安装的 TCP 和 TLS 握手开销。提交
  • 💽 更少的冗余模型列表写入。 在基于 Redis 的多实例部署中，当模型列表未更改时，将不再重写，从而减少了冗余写入的一个主要来源。#25469、#25474、提交
  • 📉 更快的 WebSocket 断开清理。 从协作会话断开连接不再触发对整个 Redis 键空间的扫描，而是使用每个会话索引，这使得大型部署上的断开连接操作代价更小。#25466、提交
  • 📝 工具、函数和技能的 Frontmatter 自动填充。 打开工具、函数或技能编辑器现在会自动从文件的 Frontmatter 中填充名称、id 和描述字段，从而避免重新输入源代码中已声明的元数据。#24649、提交
  • 🪪 自定义头部中更多的用户占位符。 用于直接连接和工具服务器的自定义头部模板现在支持 “{{USER_EMAIL}}” 和 “{{USER_ROLE}}"，与现有的用户和会话占位符并列。提交
  • ⏱️ 可配置的 MCP 连接超时。 与 MCP 工具服务器进行初始握手的超时时间现在可通过新的 “MCP_INITIALIZE_TIMEOUT” 设置进行配置，因此启动较慢或公开许多工具的服务器可以完成连接，而不是超时。#25011、提交
  • 📐 个人资料图片大小限制。 管理员现在可以通过新的 “PROFILE_IMAGE_MAX_DATA_URI_SIZE” 设置限制内联个人资料图片的大小，从而限定内联头像和模型图标可以占用的数据库和缓存空间。#25468、#25476
  • 🎫 通配符 OAuth 角色映射。 管理员现在可以在允许的 OAuth 角色中设置 “*"，从而向任何经过身份验证的 OAuth 用户授予用户角色，而无需列举每个接受的角色。#25062、提交
  • 📊 分页反馈历史。 反馈和评估历史记录列表现在已分页，使其实例在积累了大量反馈条目时仍能保持响应性。提交
  • 🔘 批量启用或禁用自动化。 自动化现在可以从自动化页面的操作菜单中批量启用或禁用，而不是单独切换每一个。提交
  • ➡️ 可选的单点登录自动重定向。 管理员现在可以启用 “OAUTH_AUTO_REDIRECT”，以便在具有单点登录提供商且没有其他登录方法的部署中，用户会直接发送到提供商，而不是先看到登录页面。#25067、提交
  • ☁️ 支持 Entra ID 的 Azure AI Foundry v1。 Open WebUI 现在支持 Azure AI Foundry 的 OpenAI v1 端点以及 Microsoft Entra ID 身份验证，因此这些连接无需手动变通方法即可工作。#24761、#24985、提交
  • 🌎 Linkup 网络搜索提供商。 管理员现在可以从管理员设置中选择 Linkup 作为网络搜索提供商，并可以配置 API 密钥和搜索深度。#24752、提交
  • 🧊 Valkey 向量数据库支持。 Valkey 现在可以用作向量数据库后端，可通过新的 “VALKEY_URL” 及相关设置（包括索引类型、距离度量和 HNSW 调优）进行配置。#24769、提交
  • 🔄 通用改进。 在整个应用程序中实施了多项改进，以增强性能、稳定性和安全性。
  • 🌐 翻译更新。 增强和扩展了西班牙语（西班牙）、瑞典语、德语、韩语、加泰罗尼亚语、俄语、爱尔兰语、简体中文、繁体中文、芬兰语、波兰语、土耳其语和马来语的翻译。

已修复

  • 🛡️ 安全公告：此版本包含安全和访问控制修复。我们建议尽快更新生产部署。此版本中的所有安全修复可能并未全部列在修复部分——部分修复可能被暂时保留，以便管理员有时间升级。公告
  • 🛡️ 工具服务器权限强制执行。 内联工具服务器的每个用户权限现在在聊天补全请求时强制执行，因此没有该权限的用户无法再通过直接在请求中提供工具服务器来绕过管理员设置。提交
  • 🔒 搜索工具中的知识库访问检查。 内置的知识搜索工具现在在通过 id 搜索知识库之前验证调用者是否有权访问该知识库，从而防止用户读取其未被授权访问的知识库的内容。#25113
  • 🗄️ 检索集合的跨用户访问。 解析用于检索的文档现在会验证调用者对每个引用文件的访问权限，并拒绝客户端提供的集合名称，从而防止精心构造的请求将其他用户的文件或向量集合拉入其上下文。提交
  • 🔣 集合名称验证。 除非向量集合名称仅包含安全字符，否则将被拒绝，从而防止格式错误的名称到达向量存储或破坏数据库查询表达式。#24982
  • 🚫 默认拒绝未指定范围的检索集合。 对于名称不对应于已知文件、记忆、网络搜索或知识库的集合的检索请求，非管理员现在默认被拒绝，并提供新的 “ENABLE_RETRIEVAL_UNSCOPED_COLLECTIONS” 设置以在需要时恢复之前的行为。提交
  • 📜 提示历史授权。 比较、删除和恢复提示版本现在会验证历史记录条目是否属于您有权访问的提示，从而防止访问或修改其他提示的版本历史。#25056
  • 🚦 旧版路径上的代码解释器权限。 旧版代码执行路径现在强制执行与当前路径相同的权限和能力检查，因此没有代码解释器权限的用户无法再通过它触发代码执行。#24724
  • 🧱 API 密钥端点限制绕过。 限制 API 密钥可以到达哪些路径的端点允许列表现在直接针对路由的请求路径进行匹配，从而防止精心构造的请求绕过限制。#25123
  • 🚧 通过请求参数绕过系统提示。 跳过模型配置的系统提示的标志现在无法再由外部客户端通过请求参数设置，因此管理员配置的系统提示无法从 API 绕过。#25156
  • 🚪 终端代理路径遍历。 终端代理现在在验证之前完全解码请求路径，从而阻止可能逃离预期路径的多编码有效负载。#25157
  • 🪤 缓存文件路径遍历。 缓存文件服务器现在要求精确的目录边界匹配，从而关闭了同级目录（其名称以缓存目录名称开头）可用于提供其外部文件的漏洞。#25086
  • 🔀 Ollama 后端选择访问检查。 请求现在无法再通过索引针对任意 Ollama 后端；现在会根据实际提供请求模型的后端来验证调用者提供的后端选择器。提交
  • 🔓 通过图像 URL 的跨用户文件泄露。 当聊天消息通过 “image_url” 字段中的 id 引用文件时，服务器现在仅为该文件的所有者、管理员或具有显式读取授权的用户解析该文件，从而防止其他经过身份验证的用户通过模型路由来提取文件内容。#24625、提交
  • 📌 聊天文件附件访问检查。 将文件附加到聊天现在仅链接调用者可以读取的文件，从而防止用户将其他用户的文件与其聊天关联以访问其内容。#25054
  • 🧾 模型知识文件所有权检查。 创建或更新模型现在会验证附加到其上的任何知识文件都是编辑者可以访问的文件，从而防止将其他用户的文件附加到模型。#25055、提交
  • 📅 日历事件移动授权。 更新日历事件以将其移至不同的日历现在需要对目标日历具有写入权限，从而防止用户将事件注入其无法写入的日历。#24764
  • 📣 频道聊天访问控制。 在频道上下文中生成响应现在会验证调用者对该频道的访问权限，并限定包含的消息范围，从而防止用户访问其无权查看的频道或消息。#24725
  • 🕸️ 基于 Playwright 的 Web 加载器的 SSRF 防护。 当使用基于 Playwright 的 Web 加载器时，页面导航和重定向现在以与默认加载器相同的方式进行验证，从而关闭了 Playwright 路径可能访问内部或其他被阻止的 URL 的漏洞。#24756
  • 🛂 URL 抓取的 DNS 重绑定保护。 为出站 URL 抓取验证的 IP 地址现在与实际连接使用的 IP 地址相同，从而关闭了攻击者控制的主机名可能在安全检查期间解析为公共 IP，而在连接打开时解析为私有 IP 的 DNS 重绑定窗口。#24759
  • 🪞 OAuth 个人资料图片重定向处理。 OAuth 个人资料图片抓取现在仅在管理员明确允许时才遵循重定向，从而关闭了来自外部验证的 URL 的重定向可能被用于访问内部地址的窗口。#24809
  • 🧼 模型个人资料图片脚本注入。 模型个人资料图片现在在保存时进行验证，仅在已知安全的图像类型时以内联方式提供，从而防止精心构造的 SVG 个人资料图片在其他用户的浏览器中运行脚本，同时未通过验证的现有旧版图片会被优雅清除，而不是破坏模型列表。#25060、#25173
  • 🧯 图表渲染脚本注入。 聊天中渲染的 Mermaid 图表现在在显示前经过净化，从而防止精心构造的图表在查看者的浏览器中运行脚本。#25219
  • 🔐 共享聊天的文件写保护。 通过共享聊天访问文件现在仅授予读取权限，因此可以读取共享聊天的用户无法再修改或删除附加到该聊天的文件。#24755
  • 🔏 跨域嵌入提示控制。 当 Open WebUI 嵌入在不同源的 iframe 中时，嵌入页面现在只能在用户通过 “iframe Sandbox Allow Same Origin” 设置明确选择加入的情况下驱动聊天输入或提交提示，从而防止不受信任的主机页面触发确认对话框或控制聊天。#24767、提交
  • 🗂️ 聊天文件夹所有权检查。 创建聊天或更新聊天的文件夹现在会验证引用的文件夹是否属于当前用户，从而防止聊天与属于其他人的文件夹关联。#24588
  • 🧩 从损坏历史恢复聊天。 由于失败的重新生成而导致内部消息图处于格式错误状态的聊天现在可以正确打开和加载，缺失的角色、父引用和当前消息指针会自动重建，而不是破坏聊天。#24424、#24157、#20474、#24799、提交
  • 📨 导入的带文件夹的聊天正确显示。 导入分组的聊天不再因引用的文件夹缺失而不可见；此类聊天现在会出现在聊天列表中，而不是被静默孤立。#24910、提交
  • 🎟️ MCP 工具服务器会话保持连接。 OAuth 身份验证的 MCP 工具服务器会话不再被单点登录会话处理程序错误地刷新和删除，因此这些连接保持活动状态。#24618、提交
  • 🤝 MCP OAuth 范围发现。 MCP 工具服务器的 OAuth 流程现在读取服务器通过其受保护资源元数据宣布的范围，因此连接到声明自己范围的服务器会成功。#24730、#24690
  • 🔍 网络搜索可靠性。 使用默认的 Web 加载器引擎，网络搜索再次可靠地获取页面内容；新的 “USER_AGENT” 环境变量允许管理员设置真实的浏览器用户代理，这样抓取就不会被 Cloudflare、Wikipedia 和其他机器人检测系统阻止；并且当这些新环境变量未设置时，启动脚本不再启动失败。#24560、#24793、#24683、提交
  • 🔥 Firecrawl 网络搜索结果。 使用 Firecrawl 的网络搜索现在无论 Firecrawl 版本使用哪种响应格式都能正确返回结果。#24712
  • 🦅 Kagi 网络搜索。 在将其 API 端点和请求方法更新为匹配 Kagi 当前 API 后，使用 Kagi 的网络搜索再次工作。#25015
  • 🔢 代码块中的带括号数字。 代码块中（如 “[0]"）的方括号数字不再像源引用一样被剥离，因此代码可以正确显示和复制。#24948、提交
  • 🔌 API 聊天补全可靠性。 直接调用聊天补全 API 在未提供聊天会话标识符时不再因内部错误而失败。#24553、#25235、提交、提交
  • 🖼️ ComfyUI 图像生成和编辑。 通过 ComfyUI 后端生成和编辑图像现在再次工作，包括 ComfyUI 托管在私有或内部网络上的情况，之前 URL 验证会阻止管理员配置的端点。#24565、提交、提交
  • 🖌️ 具有非标准响应头的图像生成。 图像生成现在可以与返回有效 JSON 但没有标准 content-type 头的后端一起工作，而不是拒绝响应。#24838
  • 🐘 在大型文档上进行知识搜索。 在 PostgreSQL 上搜索知识库在扫描具有非常大提取文本内容的文档时不再失败。#24670、提交
  • 💬 聊天标题生成。 自动生成的聊天标题现在使用活动聊天的下拉菜单中当前选择的模型，否则使用活动消息分支的模型；如果没有可用的模型，将显示清晰的消息，而不是无用的错误。#24604、#24745、提交、提交
  • 🧮 消息搜索和分析一致性。 在聊天中进行的编辑、删除和分支更改现在会反映在消息搜索结果和分析计数中，而不是留下过时的条目。#25205、提交
  • 🩹 优雅处理聊天中的任务失败。 当网络搜索查询生成、图像提示生成或工具调用失败或引用缺失的工具时，聊天现在会回退或显示清晰的错误，而不是在响应中途中断。#25038、#25144、提交
  • 🎛️ 对消息输出的筛选器更改。 在生成后修改消息结构化输出的筛选器函数现在会保存并显示这些更改，而不是在仅更改输出而非文本内容时将其丢弃。#24884
  • ⏩ 标题和标签反映筛选后的输出。 输出筛选器现在在自动标题、标签和后续生成之前运行，因此这些基于最终筛选后的消息，而不是未筛选的版本。#24717
  • 💾 操作替换的消息内容持久化。 通过操作函数的事件发射器替换的消息内容现在在聊天保存时被保留，而不是在页面重新加载后恢复为原始内容。#24585、#25485
  • 🏷️ 消息中的技能提及。 在消息中提及技能现在会保留技能的名称作为可读文本，而不是将其移除；选择技能而不输入任何内容在拒绝空消息的提供商上不再导致错误。#24929、提交
  • 🧹 发送失败时的使用计时器清理。 消息生成期间启动的后台使用统计计时器现在始终被清除，即使在消息发送失败时也是如此，从而防止泄漏的计时器在会话中累积。#25478
  • 🗑️ 聊天被移除时后台任务停止。 删除或归档聊天现在会取消其任何进行中的生成或标题和标签任务，而不是留下孤立的后台工作运行。#25050、提交
  • ⌨️ 响应式知识文件搜索。 在聊天选择器和模型知识选择器中搜索知识文件现在默认按文件名匹配，而不是每次按键时扫描每个文档的全部提取文本，从而使搜索在大型部署上保持响应，同时内容搜索可作为显式选择加入功能使用。#25082、#25119、提交
  • 📥 具有空嵌入的文档处理。 将文档保存到向量数据库时，如果嵌入步骤返回空向量，现在不再崩溃，从而允许流程继续，而不是导致整个上传失败。#25166
  • 🔤 非 UTF-8 文本和 CSV 上传。 以旧编码（包括 Latin-1、Windows-1252 和中文编码如 GB18030）保存的文本和 CSV 文件现在可以被正确检测和加载，而不是被拒绝为二进制或因空内容错误而失败。#25172、#24973、提交、提交
  • 🧽 嵌套数据中的空字节不再破坏保存。 包含在结构化字段中嵌套的空字节的数据现在在写入之前被正确净化，从而防止之前的检查未能捕获的数据库错误。#25018、提交
  • 🧠 未配置嵌入模型时的清晰错误。 在没有加载嵌入模型的情况下使用知识或检索功能现在返回清晰的设置错误，解释需要配置什么，而不是因神秘的崩溃而失败。提交
  • 🧲 记忆搜索质量。 记忆搜索现在应用配置的嵌入查询前缀，因此检索可以与需要前缀进行查询的嵌入模型正常工作。#24921、提交
  • 📚 知识工具上下文溢出。 列出模型知识的内置工具不再将每个知识库中的每个文件都转储到模型的上下文中；它现在默认返回摘要，并仅为请求的知识库分页显示文件列表。#25105、提交
  • ⏳ 终端会话稳定性。 当连接的一端在另一端之前关闭时，终端代理不再挂起，因此终端会话会干净地关闭，而不是停滞不前。#25464、#25479
  • 🧷 与严格提供商的工具调用连续性。 包含不完整工具调用或孤立工具结果的聊天在发送到严格验证工具配对的提供商（如 Anthropic 和 AWS Bedrock Converse）时，不再无法继续。#24758、#24940、#24798、提交
  • 🛑 管道函数的流终止。 管道函数的流式响应现在总是发送标准的流结束标记，因此聊天客户端和外部集成可以可靠地检测响应何时完成，而不是等待已经完成的流。#24763
  • 🔊 非阻塞文本到语音转码。 将文本到语音音频转换为 MP3 不再阻塞服务器的事件循环，因此即使在转码 TTS 响应时，其他请求也能保持响应。#24876
  • 🎚️ 默认文本到语音声音。 文本到语音请求现在遵循请求中指定的声音，仅在未提供时回退到配置的默认值，而不是始终使用管理员默认值或失败。#15143、#25035、提交、提交
  • 🪝 可靠的知识库文件链接。 上传到知识集合的文件现在作为上传本身的一部分在服务器上链接，因此即使您在处理完成前导航离开或关闭页面，它们仍会附加到该集合。#24807、提交
  • ☁️ 自定义主机名上的 Azure 连接。 标记为 Azure 提供商的连接现在即使端点的主机名中不包含 “azure” 也会使用 Azure 代码路径，从而修复了从非标准域提供的自定义 Azure 部署。#24882、提交
  • 🗓️ 清除日历事件字段。 从日历事件中移除描述或位置现在可以正确保存，而不是静默地保留以前的值。#25026、提交、提交
  • 💭 高级参数设置。 自定义推理标签和自定义模型参数现在可以正确保存，而不是被丢弃；存在惩罚和重复惩罚现在不再保存频率惩罚的值。#25183、#25200、#25204
  • 📏 长用户名显示。 长用户名在管理员用户列表、用户模态框和侧边栏中不再溢出其容器。#25185
  • 🎯 模型编辑器中所有技能可选。 模型编辑器的技能选择器现在列出您可以访问的所有技能，并带有用于大型列表的搜索框，而不是仅显示前 30 个且无法访问其余部分。#24873、提交
  • 🔔 准确的知识上传反馈。 将文件拖放到知识库中不再在实际处理上传之前显示上传通知。#25484
  • ♿ 高对比度时间戳可读性。 用户消息时间戳现在在高对比度模式下使用正确的颜色而不是反转颜色，从而保持可读性。#25461
  • ♿ 键盘和屏幕阅读器访问菜单。 集成菜单、更多选项菜单和用户菜单现在是带有标签和键盘支持的真实按钮，因此可以使用键盘打开并由屏幕阅读器朗读。提交
  • 🖱️ 编辑器中的焦点丢失处理。 模型、工具、函数和技能的工作区和管理员编辑器现在再次在浏览器窗口失去焦点时正确响应，此前监听了错误的事件名称。#25459
  • 🛟 对损坏本地存储的弹性。 浏览器本地存储中损坏的数据不再导致界面崩溃；受影响的设置和已关闭横幅状态现在回退到安全默认值。#25481
  • 📶 更安静的重新连接通知。 简短的连接中断（如后台移动标签页）不再闪烁 “连接丢失” 警告，并且 “已重新连接” 消息仅在确实显示了断开连接时出现。提交
  • 🍎 Safari PDF 处理。 PDF 处理现在在 Safari 中工作，Safari 不支持之前代码依赖的流迭代。#25151、#25473
  • 🎙️ 语音模式静音快捷方式列表。 静音语音模式的键盘快捷方式现在出现在键盘快捷方式帮助模态框中。#25193
  • 📎 频道模型回复中的文档附件。 在频道线程中标记模型现在会将上传的非图像文档（如 PDF 和 DOCX 文件）转发到模型的上下文中，因此已经在直接聊天中工作的文档摘要和比较工作流现在也可以在频道中工作。#24896、#24898、提交
  • 🙈 频道提及中的隐藏模型。 标记为隐藏的模型不再出现在频道消息输入模型提及选择器中，这与界面其他地方排除隐藏模型的方式一致。#24892
  • 🧵 频道线程和置顶消息的稳定性。 打开频道线程或置顶消息视图在消息或其数据缺失时不再渲染失败。#25209
  • 📺 YouTube 短链接转录。 将 “youtu.be” 短链接粘贴到聊天中现在会正确加载视频转录，而不是因空内容错误而失败。#24856、提交
  • 🙉 默认模型和自动化选择器中的隐藏模型。 管理员的默认模型和默认置顶模型选择器，以及自动化模型下拉菜单，现在会过滤掉隐藏模型，这与界面其他地方处理隐藏模型的方式一致。#24869、提交、提交
  • 🔊 语音到文本 SSL 设置生效。 语音到文本请求现在遵循 “AIOHTTP_CLIENT_SESSION_SSL” 设置，因此使用自签名证书或自定义 SSL 配置的管理员可以使用之前因 TLS 验证失败的 STT 引擎。#24568、#24857、提交、提交
  • 🔗 MCP 连接头部中的占位符。 在 MCP 服务器连接上配置的自定义头部模板现在会在请求时插入 “{{USER_ID}}"、”{{USER_NAME}}"、”{{USER_EMAIL}}"、”{{USER_ROLE}}"、”{{CHAT_ID}}" 和 “{{MESSAGE_ID}}” 占位符，这与自定义头部在直接连接和工具服务器中的工作方式一致。#24822
  • 🪟 Bing 搜索 CLI 冒烟测试。 从命令行运行 Bing Web 搜索模块以进行快速连接检查不再引发缺少参数的错误。#24765、#24768
  • 🩺 数据库健康检查恢复。 在瞬态数据库连接错误后，健康检查端点现在会自动恢复，而不是在受影响的工作程序上永久损坏。提交
  • 🥾 在非 Unicode 控制台上启动。 Open WebUI 在启动时，如果控制台无法编码横幅的制表符（如在 Windows 上或重定向/无头输出时），不再崩溃，而是回退到纯文本横幅。#24965、#25482
  • 🆕 重置后的第一个管理员注册。 创建第一个管理员帐户不再被以前存储的注册设置阻止，因此全新或重置的实例始终可以引导。#24821
  • 🪵 JSON 异常日志记录。 启用 JSON 日志格式后，异常现在使用结构化类型、消息和堆栈跟踪正确记录，而不是被丢弃；并且日志记录失败不再导致应用程序崩溃。#25135、提交
  • 🧭 工作区技能权限。 仅获得 “workspace.skills” 权限的用户现在可以在侧边栏中看到工作区条目，并且可以正确地从工作区索引路由到技能页面。#24729
  • 🔁 弹性的数据库迁移。 数据库迁移现在跳过已存在的表、索引和列，并向旧表添加缺失的主键，因此即使部分模式是手动或部分创建的，升级也能成功。提交、提交、提交、提交、提交、提交、提交、提交、提交、提交、提交、提交、提交、提交、提交、提交、提交、提交、提交、#24722

已更改

  • ⚠️ 数据库迁移：此版本包含数据库模式更改；我们强烈建议在生产环境升级之前备份数据库和所有关联数据。如果您运行的是多工作程序、多服务器或负载平衡部署，则必须同时更新所有实例，滚动更新不被支持，并将由于模式不兼容而导致应用程序失败。
  • ⚙️ 工具调用迭代上限重命名并提高。 限制单个聊天响应可能进行多少次工具调用的环境变量现在为 “CHAT_RESPONSE_MAX_TOOL_CALL_ITERATIONS”，其默认值从 30 提高到 256，并且新的 “-1” 值表示无限制；之前的 “CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES” 名称继续作为后备工作，并且达到上限的聊天现在在聊天中显示清晰的错误，而不是静默停止。#24918、提交
  • 🔐 减少公共 “/api/config” 暴露。 “/api/config” 响应不再包含多个功能标志（“enable_api_keys”、“enable_password_change_form”、“enable_version_update_check”、“enable_public_active_users_count”、“enable_easter_eggs”），从而减少了向匿名访客的信息泄露。提交、提交
  • 🔑 “WEBUI_SECRET_KEY” 现在是必需项，即使对于不受支持的部署。 以显式不受支持的方式（如直接调用 uvicorn）启动后端而未设置 “WEBUI_SECRET_KEY” 的部署现在将拒绝启动，而不是回退到空键；支持的启动方法（start.sh、start_windows.bat 和 “open-webui serve”）仍然会自动设置或生成它，因此标准部署不受影响。直接 Uvicorn 启动不受支持。#25218

更新内容 （原始）

Added

  • 📦 Official knowledge base sync tool. A new companion tool from Open WebUI, oikb, keeps a knowledge base in sync with a local directory, GitHub repo, S3 bucket, Confluence space, or any of more than 40 other sources, uploading only new and changed files using the incremental sync support added in this release. oikb
  • 📂 Smart directory sync for knowledge bases. Local directories can now be synced into a knowledge base in one action: file checksums are compared against what’s already stored, and only added or modified files are uploaded while removed files and orphaned subdirectories are cleaned up, with the directory structure mirrored automatically and per-file progress shown throughout. #19190, #19394, Commit, Commit, Commit, Commit, Commit, Commit
  • 🗂️ Knowledge base folders. Files inside a knowledge base can now be organized into nested folders, with breadcrumb navigation that makes it much easier to manage and find content in large collections. Commit, Commit, Commit, Commit, Commit, Commit
  • 🧰 Filesystem tool for knowledge bases. A new built-in tool, enabled via the “ENABLE_KB_EXEC” environment variable, lets AI models browse and search knowledge base contents using familiar filesystem commands such as ’ls’, ‘cat’, ‘grep’, ‘find’, ‘head’, ’tail’, and ‘sed’, including pipes between them. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
  • ✏️ File renaming in knowledge bases. Files inside a knowledge base can now be renamed directly from the workspace, with the new name reflected wherever the file is referenced. Commit
  • 😀 Emoji picker in message input. A new emoji button in the rich text formatting toolbar lets you browse and insert emojis directly into your messages. #24704
  • 🪄 Per-chat skills toggle. Skills can now be turned on or off for a conversation directly from the chat Integrations menu, the same way tools and capabilities already work, instead of only through the model preset. #25036, #25037
  • 🔎 Access preview for users and groups. Administrators can now preview exactly which models, knowledge bases, and tools a given user or group can access, making it easier to audit and verify permission setups. Commit
  • 📄 Configurable knowledge base file page size. Administrators can now request a larger page size when listing a knowledge base’s files through the API, reducing the number of requests needed to retrieve large collections instead of paging through fixed increments of 30. #25148, Commit
  • 🔃 Persistent processing indicator for knowledge files. Files still being processed in a knowledge base now keep showing a processing indicator across page reloads, so you can tell what’s still ingesting after navigating away and back. #25031, Commit
  • 📑 MinerU file type configuration. Administrators can now configure which file types are processed by the MinerU document loader, via the new “MINERU_FILE_EXTENSIONS” setting, extending it beyond PDF to formats like DOCX, PPTX, and XLSX. Commit
  • 📃 Legacy Word document support. Older “.doc” Word files can now have their text extracted by the default document extraction engine, in addition to the modern “.docx” format. Commit
  • 📁 Create subfolders from the folder header. Chat folders can now have subfolders created directly from the folder header in the chat view, not just from the sidebar. Commit
  • ⚡ Faster initial page loads. The configuration endpoint that loads on every page visit no longer runs an unnecessary user-count query, making the initial application load lighter on the database, especially on instances with many users. Commit
  • 🚀 Faster tool-enabled chat completions. Chat completions that use multiple tools now start faster because the tools they reference are fetched from the database in a single batch query instead of one query per tool. #24808, Commit
  • 🏎️ More responsive web search under load. Web search through SearXNG, Google PSE, Brave, Serper, and Serpstack now uses non-blocking network calls, so the server stays responsive to other users while a search is in flight, and concurrent multi-query searches complete faster. Commit
  • 🐎 Lighter Ollama backend connections. Requests to Ollama backends now reuse a shared connection pool instead of opening a fresh session each time, reducing TCP and TLS handshake overhead for installs that poll Ollama frequently or have multiple backends configured. Commit
  • 💽 Fewer redundant model-list writes. On multi-instance deployments backed by Redis, the model list is no longer rewritten when it hasn’t changed, cutting a major source of redundant writes. #25469, #25474, Commit
  • 📉 Faster websocket disconnect cleanup. Disconnecting from a collaborative session no longer triggers a scan across the entire Redis keyspace, using a per-session index instead, which keeps disconnects cheap on large deployments. #25466, Commit
  • 📝 Frontmatter auto-fill for tools, functions, and skills. Opening a tool, function, or skill editor now auto-fills the name, id, and description fields from the file’s frontmatter, saving you from re-entering metadata already declared in the source. #24649, Commit
  • 🪪 More user placeholders in custom headers. Custom-header templates for direct connections and tool servers now support “{{USER_EMAIL}}” and “{{USER_ROLE}}” alongside the existing user and session placeholders. Commit
  • ⏱️ Configurable MCP connection timeout. The timeout for the initial handshake with an MCP tool server is now configurable via the new “MCP_INITIALIZE_TIMEOUT” setting, so servers that are slow to start or expose many tools can finish connecting instead of timing out. #25011, Commit
  • 📐 Profile image size limit. Administrators can now cap the size of inline profile images via the new “PROFILE_IMAGE_MAX_DATA_URI_SIZE” setting, bounding how much database and cache space inline avatars and model icons can consume. #25468, #25476
  • 🎫 Wildcard OAuth role mapping. Administrators can now set “*” in the allowed OAuth roles to grant the user role to any authenticated OAuth user, instead of having to enumerate every accepted role. #25062, Commit
  • 📊 Paginated feedback history. The feedback and evaluation history list is now paginated, keeping it responsive for instances that have accumulated large numbers of feedback entries. Commit
  • 🔘 Bulk enable or disable automations. Automations can now be enabled or disabled in bulk from an actions menu on the automations page, instead of toggling each one individually. Commit
  • ➡️ Optional auto-redirect to single sign-on. Administrators can now enable “OAUTH_AUTO_REDIRECT” so that, on deployments with a single sign-on provider and no other login methods, users are sent straight to the provider instead of seeing a login page first. #25067, Commit
  • ☁️ Azure AI Foundry v1 with Entra ID. Open WebUI now supports Azure AI Foundry’s OpenAI v1 endpoint together with Microsoft Entra ID authentication, so these connections work without manual workarounds. #24761, #24985, Commit
  • 🌎 Linkup web search provider. Administrators can now select Linkup as the web search provider from the admin settings, with options to configure the API key and search depth. #24752, Commit
  • 🧊 Valkey vector database support. Valkey can now be used as the vector database backend, configurable through new “VALKEY_URL” and related settings including index type, distance metric, and HNSW tuning. #24769, Commit
  • 🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
  • 🌐 Translation updates. Translations for Spanish (Spain), Swedish, German, Korean, Catalan, Russian, Irish, Simplified Chinese, Traditional Chinese, Finnish, Polish, Turkish, and Malay were enhanced and expanded.

Fixed

  • 🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section — some may be withheld for a short time to give administrators time to upgrade. Advisories
  • 🛡️ Tool server permission enforcement. The per-user permission for inline tool servers is now enforced on chat-completion requests, so users without that permission can no longer bypass the admin setting by supplying tool servers directly in their requests. Commit
  • 🔒 Knowledge base access check in search tool. The built-in knowledge search tool now verifies that the caller can access a knowledge base before searching it by id, preventing users from reading the contents of knowledge bases they have not been granted access to. #25113
  • 🗄️ Cross-user access to retrieval collections. Resolving the documents used for retrieval now verifies the caller’s access to each referenced file and rejects client-supplied collection names, preventing a crafted request from pulling another user’s files or vector collections into its context. Commit
  • 🔣 Collection name validation. Vector collection names are now rejected unless they contain only safe characters, preventing malformed names from reaching the vector store or breaking out of a database query expression. #24982
  • 🚫 Unscoped retrieval collections denied by default. Retrieval requests for collection names that don’t correspond to a known file, memory, web-search, or knowledge base are now denied for non-admins by default, with a new “ENABLE_RETRIEVAL_UNSCOPED_COLLECTIONS” setting to restore the previous behavior if needed. Commit
  • 📜 Prompt history authorization. Comparing, deleting, and restoring prompt versions now verify the history entry belongs to the prompt you’re authorized for, preventing access to or modification of another prompt’s version history. #25056
  • 🚦 Code interpreter permission on the legacy path. The legacy code-execution path now enforces the same permission and capability checks as the current one, so users without the code interpreter permission can no longer trigger code execution through it. #24724
  • 🧱 API key endpoint restriction bypass. The endpoint allow-list that limits which paths an API key may reach is now matched against the routed request path directly, preventing a crafted request from slipping past the restriction. #25123
  • 🚧 System prompt bypass via request parameter. The flag that skips a model’s configured system prompt can no longer be set by external clients through a request parameter, so admin-configured system prompts can’t be bypassed from the API. #25156
  • 🚪 Terminal proxy path traversal. The terminal proxy now fully decodes request paths before validating them, blocking multi-encoded payloads that could otherwise escape the intended path. #25157
  • 🪤 Cache file path traversal. The cache file server now requires an exact directory boundary match, closing a gap where a sibling directory whose name began with the cache directory’s name could be used to serve files from outside it. #25086
  • 🔀 Ollama backend selection access check. Requests can no longer target an arbitrary Ollama backend by index; a caller-supplied backend selector is now verified against the backends that actually serve the requested model. Commit
  • 🔓 Cross-user file exfiltration via image URLs. When a chat message references a file by id in an “image_url” field, the server now resolves that file only for its owner, an administrator, or a user with an explicit read grant, preventing other authenticated users from extracting a file’s contents by routing it through the model. #24625, Commit
  • 📌 Chat file attachment access checks. Attaching files to a chat now links only files the caller can read, preventing a user from associating another user’s file with their chat to access its contents. #25054
  • 🧾 Model knowledge file ownership checks. Creating or updating a model now verifies that any knowledge files attached to it are files the editor can access, preventing another user’s files from being attached to a model. #25055, Commit
  • 📅 Calendar event move authorization. Updating a calendar event to move it into a different calendar now requires write access on the destination calendar, preventing users from injecting events into calendars they cannot write to. #24764
  • 📣 Channel chat access control. Generating a response in a channel context now verifies the caller’s access to that channel and scopes the included messages, preventing access to channels or messages the user isn’t permitted to see. #24725
  • 🕸️ Web loader SSRF gating with Playwright. When the Playwright-based web loader is in use, page navigations and redirects are now validated the same way as the default loader, closing a gap where the Playwright path could reach internal or otherwise blocked URLs. #24756
  • 🛂 DNS rebinding protection for URL fetches. The IP address validated for an outbound URL fetch is now the same one used for the actual connection, closing a DNS rebinding window where an attacker-controlled hostname could resolve to a public IP during the safety check and then to a private IP when the connection was opened. #24759
  • 🪞 OAuth profile picture redirect handling. The OAuth profile picture fetch now follows redirects only when administrators have explicitly allowed it, closing a window where a redirect from an externally validated URL could be used to reach internal addresses. #24809
  • 🧼 Model profile image script injection. Model profile images are now validated on save and only served inline when they are a known-safe image type, preventing a crafted SVG profile image from running scripts in other users’ browsers, while existing legacy images that fail validation are cleared gracefully instead of breaking the model list. #25060, #25173
  • 🧯 Diagram rendering script injection. Mermaid diagrams rendered in chat are now sanitized before display, preventing a crafted diagram from running scripts in the viewer’s browser. #25219
  • 🔐 Shared-chat file write protection. Access to a file through a shared chat now only grants read access, so users who can read a shared chat can no longer modify or delete files attached to it. #24755
  • 🔏 Cross-origin embed prompt control. When Open WebUI is embedded in an iframe on a different origin, the embedding page can now only drive the chat input or submit prompts if the user has explicitly opted in via the “iframe Sandbox Allow Same Origin” setting, preventing untrusted host pages from triggering confirmation dialogs or controlling the chat. #24767, Commit
  • 🗂️ Chat folder ownership checks. Creating a chat or updating a chat’s folder now verifies the referenced folder belongs to the current user, preventing chats from being associated with folders owned by other people. #24588
  • 🧩 Chat recovery from corrupted history. Chats whose internal message graph was left in a malformed state by a failed regeneration now open and load correctly, with missing roles, parent references, and current-message pointers reconstructed automatically instead of breaking the chat. #24424, #24157, #20474, #24799, Commit
  • 📨 Imported chats with folders appear correctly. Importing grouped chats no longer leaves them invisible when a referenced folder is missing; such chats now appear in the chat list instead of being silently orphaned. #24910, Commit
  • 🎟️ MCP tool server sessions stay connected. OAuth-authenticated MCP tool server sessions are no longer mistakenly refreshed and deleted by the single sign-on session handler, so those connections stay active. #24618, Commit
  • 🤝 MCP OAuth scope discovery. The OAuth flow for MCP tool servers now reads the scopes a server advertises through its Protected Resource Metadata, so connecting to servers that declare their own scopes succeeds. #24730, #24690
  • 🔍 Web search reliability. Web search again fetches page content reliably with the default web loader engine, a new “USER_AGENT” environment variable lets administrators set a real browser user-agent so fetches aren’t blocked by Cloudflare, Wikipedia, and other bot-detection systems, and the startup script no longer fails to launch when these new environment variables are unset. #24560, #24793, #24683, Commit
  • 🔥 Firecrawl web search results. Web search using Firecrawl now returns results correctly regardless of which response format the Firecrawl version uses. #24712
  • 🦅 Kagi web search. Web search using Kagi works again after its API endpoint and request method were updated to match Kagi’s current API. #25015
  • 🔢 Bracketed numbers in code blocks. Numbers in square brackets such as “[0]” inside code blocks are no longer stripped out as if they were source citations, so code displays and copies correctly. #24948, Commit
  • 🔌 API chat completions reliability. Direct calls to the chat completions API no longer fail with an internal error when no chat session identifier is supplied. #24553, #25235, Commit, Commit
  • 🖼️ ComfyUI image generation and editing. Generating and editing images via a ComfyUI backend now works again, including when ComfyUI is hosted on a private or internal network where URL validation was previously blocking the admin-configured endpoint. #24565, Commit, Commit
  • 🖌️ Image generation with non-standard response headers. Image generation now works with backends that return valid JSON without a standard content-type header, instead of rejecting the response. #24838
  • 🐘 Knowledge search on large documents. Searching knowledge bases on PostgreSQL no longer fails when scanning across documents with very large extracted text content. #24670, Commit
  • 💬 Chat title generation. Automatically generated chat titles now use the model currently selected in the dropdown for the active chat and fall back to the model from the active message branch otherwise, and a clear message is shown if no model is available instead of an unhelpful error. #24604, #24745, Commit, Commit
  • 🧮 Message search and analytics consistency. Edits, deletions, and branch changes made in a chat are now reflected in message search results and analytics counts instead of leaving stale entries behind. #25205, Commit
  • 🩹 Graceful handling of in-chat task failures. When web search query generation, image prompt generation, or a tool call fails or references a missing tool, the chat now falls back or surfaces a clear error instead of breaking partway through the response. #25038, #25144, Commit
  • 🎛️ Filter changes to message output. Filter functions that modify a message’s structured output after generation now have those changes saved and displayed, instead of being discarded when only the output, not the text content, was changed. #24884
  • ⏩ Titles and tags reflect filtered output. Outlet filters now run before automatic title, tag, and follow-up generation, so those are based on the final filtered message instead of the unfiltered version. #24717
  • 💾 Action-replaced message content persists. Message content replaced by an action function through its event emitter is now kept when the chat is saved, instead of reverting to the original after a page reload. #24585, #25485
  • 🏷️ Skill mentions in messages. Mentioning a skill in a message now keeps the skill’s name as readable text instead of removing it, and selecting a skill without typing anything no longer causes an error on providers that reject empty messages. #24929, Commit
  • 🧹 Usage timer cleanup on send failure. The background usage-stats timer started during message generation is now always cleared, even when sending a message fails, preventing leaked timers from accumulating over a session. #25478
  • 🗑️ Background tasks stop when a chat is removed. Deleting or archiving a chat now cancels any in-flight generation or title and tag tasks for it, instead of leaving orphaned background work running. #25050, Commit
  • ⌨️ Responsive knowledge file search. Searching for knowledge files in the chat picker and model knowledge selector now matches on file names by default instead of scanning the full extracted text of every document on each keystroke, keeping the search responsive on large deployments, with content search available as an explicit opt-in. #25082, #25119, Commit
  • 📥 Document processing with empty embeddings. Saving documents to the vector database no longer crashes when an embedding step returns no vectors, allowing the process to continue instead of failing the whole upload. #25166
  • 🔤 Non-UTF-8 text and CSV uploads. Text and CSV files saved in legacy encodings, including Latin-1, Windows-1252, and Chinese encodings such as GB18030, are now detected and loaded correctly instead of being rejected as binary or failing with an empty-content error. #25172, #24973, Commit, Commit
  • 🧽 Null bytes in nested data no longer break saves. Data containing null bytes nested inside structured fields is now sanitized correctly before being written, preventing database errors that the previous check failed to catch. #25018, Commit
  • 🧠 Clear error when no embedding model is configured. Using knowledge or retrieval features without a loaded embedding model now returns a clear setup error explaining what to configure, instead of failing with a cryptic crash. Commit
  • 🧲 Memory search quality. Memory searches now apply the configured embedding query prefix, so retrieval works correctly with embedding models that require one for queries. #24921, Commit
  • 📚 Knowledge tool context overflow. The built-in tool that lists a model’s knowledge no longer dumps every file in every knowledge base into the model’s context; it now returns summaries by default and paginates file listings only for a requested knowledge base. #25105, Commit
  • ⏳ Terminal session stability. The terminal proxy no longer hangs when one direction of the connection closes before the other, so terminal sessions shut down cleanly instead of stalling. #25464, #25479
  • 🧷 Tool call continuity with strict providers. Chats that contain incomplete tool calls or orphaned tool results no longer fail to continue when sent to providers that strictly validate tool pairings, such as Anthropic and AWS Bedrock Converse. #24758, #24940, #24798, Commit
  • 🛑 Stream termination for pipe functions. Streamed responses from pipe functions now always send the standard end-of-stream marker, so chat clients and external integrations reliably detect when a response is complete instead of waiting on streams that already finished. #24763
  • 🔊 Non-blocking text-to-speech transcoding. Converting text-to-speech audio to MP3 no longer blocks the server’s event loop, so other requests stay responsive even while a TTS response is being transcoded. #24876
  • 🎚️ Default text-to-speech voice. Text-to-speech requests now honor the voice specified in the request and fall back to the configured default only when none is given, instead of always using the admin default or failing. #15143, #25035, Commit, Commit
  • 🪝 Reliable knowledge base file linking. Files uploaded to a knowledge collection are now linked on the server as part of the upload itself, so they remain attached to the collection even if you navigate away or close the page before processing finishes. #24807, Commit
  • ☁️ Azure connections on custom hostnames. Connections marked as the Azure provider now use the Azure code path even when the endpoint does not contain “azure” in its hostname, fixing custom Azure deployments served from non-standard domains. #24882, Commit
  • 🗓️ Clearing calendar event fields. Removing the description or location from a calendar event now saves correctly instead of silently keeping the previous value. #25026, Commit, Commit
  • 💭 Advanced parameter settings. Custom reasoning tags and custom model parameters are now saved correctly instead of being dropped, and the presence penalty and repeat penalty no longer save the frequency penalty’s value instead of their own. #25183, #25200, #25204
  • 📏 Long username display. Long usernames no longer overflow their containers in the admin user list, user modals, and sidebar. #25185
  • 🎯 All skills selectable in the model editor. The model editor’s skills selector now lists every skill you have access to, with a search box for large lists, instead of showing only the first 30 with no way to reach the rest. #24873, Commit
  • 🔔 Accurate knowledge upload feedback. Dragging files into a knowledge base no longer shows an upload notification before the upload has actually been processed. #25484
  • ♿ High-contrast timestamp readability. The user message timestamp now uses the correct colors in high-contrast mode instead of inverted ones, keeping it readable. #25461
  • ♿ Keyboard and screen reader access to menus. The integrations, more-options, and user menus are now real buttons with labels and keyboard support, so they can be opened with the keyboard and announced by screen readers. Commit
  • 🖱️ Focus-loss handling in editors. Workspace and admin editors for models, tools, functions, and skills again respond correctly when the browser window loses focus, after the wrong event name was being listened for. #25459
  • 🛟 Resilience to corrupted local storage. Corrupted data in the browser’s local storage no longer crashes the interface; affected settings and dismissed-banner state now fall back to safe defaults. #25481
  • 📶 Quieter reconnection notifications. Brief connection interruptions, such as backgrounding a mobile tab, no longer flash a “connection lost” warning, and the “reconnected” message only appears if a disconnect was actually shown. Commit
  • 🍎 Safari PDF handling. PDF processing now works in Safari, which doesn’t support the stream iteration the previous code relied on. #25151, #25473
  • 🎙️ Voice mode mute shortcut listing. The keyboard shortcut for muting voice mode now appears in the keyboard shortcuts help modal. #25193
  • 📎 Document attachments in channel model replies. Tagging a model in a channel thread now forwards uploaded non-image documents such as PDFs and DOCX files into the model’s context, so document summarization and comparison workflows that already worked in direct chat now work in channels too. #24896, #24898, Commit
  • 🙈 Hidden models in channel mentions. Models marked as hidden no longer appear in the channel message-input model mention selector, matching how hidden models are excluded elsewhere in the interface. #24892
  • 🧵 Channel thread and pinned message stability. Opening a channel thread or the pinned messages view no longer fails to render when a message or its data is missing. #25209
  • 📺 YouTube short link transcripts. Pasting a “youtu.be” short link into a chat now loads the video transcript correctly instead of failing with an empty-content error. #24856, Commit
  • 🙉 Hidden models in default-model and automation pickers. The admin pickers for default models and default pinned models, and the automation model dropdown, now filter out hidden models, consistent with how hidden models are treated elsewhere. #24869, Commit, Commit
  • 🔊 Speech-to-text SSL setting honored. Speech-to-text requests now respect the “AIOHTTP_CLIENT_SESSION_SSL” setting, so administrators using self-signed certificates or custom SSL configurations can use STT engines that were previously failing TLS verification. #24568, #24857, Commit, Commit
  • 🔗 Placeholders in MCP connection headers. Custom header templates configured on MCP server connections now have their “{{USER_ID}}”, “{{USER_NAME}}”, “{{USER_EMAIL}}”, “{{USER_ROLE}}”, “{{CHAT_ID}}”, and “{{MESSAGE_ID}}” placeholders interpolated at request time, matching how custom headers already work for direct connections and tool servers. #24822
  • 🪟 Bing search CLI smoke test. Running the Bing web-search module from the command line for a quick connectivity check no longer raises an error about missing arguments. #24765, #24768
  • 🩺 Database health check recovery. After a transient database connection error, the health check endpoint now recovers automatically instead of staying permanently broken on the affected worker. Commit
  • 🥾 Startup on non-Unicode consoles. Open WebUI no longer crashes at startup when the console can’t encode the banner’s box-drawing characters, such as on Windows or with redirected or headless output, falling back to a plain-text banner instead. #24965, #25482
  • 🆕 First admin signup after a reset. Creating the first administrator account is no longer blocked by a previously stored signup setting, so a fresh or reset instance can always be bootstrapped. #24821
  • 🪵 JSON exception logging. With JSON log formatting enabled, exceptions are now recorded correctly with a structured type, message, and stacktrace instead of being dropped, and a logging failure can no longer crash the application. #25135, Commit
  • 🧭 Workspace skills permission. Users granted only the “workspace.skills” permission can now see the workspace entry in the sidebar and are correctly routed to the skills page from the workspace index. #24729
  • 🔁 Resilient database migrations. Database migrations now skip tables, indexes, and columns that already exist and add missing primary keys to legacy tables, so upgrades succeed even when parts of the schema were manually or partially created beforehand. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, #24722

Changed

  • ⚠️ Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.
  • ⚙️ Tool-call iteration cap renamed and raised. The environment variable that limits how many tool calls a single chat response may make is now “CHAT_RESPONSE_MAX_TOOL_CALL_ITERATIONS”, with its default raised from 30 to 256 and a new “-1” value for unlimited; the previous “CHAT_RESPONSE_MAX_TOOL_CALL_RETRIES” name continues to work as a fallback, and chats that hit the cap now show a clear error in-chat instead of stopping silently. #24918, Commit
  • 🔐 Reduced public “/api/config” exposure. The “/api/config” response no longer includes several feature flags (“enable_api_keys”, “enable_password_change_form”, “enable_version_update_check”, “enable_public_active_users_count”, “enable_easter_eggs”) for unauthenticated callers, reducing information disclosure to anonymous visitors. Commit, Commit
  • 🔑 “WEBUI_SECRET_KEY” is now a hard requirement even for unsupported deployments. Deployments that start the backend in an explicitly unsupported way (such as invoking uvicorn directly) without setting “WEBUI_SECRET_KEY” will now refuse to start instead of falling back to an empty key; the supported start methods (start.sh, start_windows.bat, and “open-webui serve”) still set or auto-generate it automatically, so standard deployments are unaffected. Direct Uvicorn startup is not supported. #25218

下载链接