onyx-cherry-pick[bot]
f368da3324
Cherry-pick of commit7b32394c18to release/v4.8 branch. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Pins `certifi` to `2026.10.19` across all backend requirements files and `uv.lock` so v4.8 can be released with a consistent, secure certificate bundle. <sup>Written for commitc121252b3d. Summary will update on new commits.</sup> <a href="https://cubic.dev/pr/onyx-dot-app/onyx/pull/16339?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="View guided diff" src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a> <a href="https://www.cubic.dev/action/auto-fix/pr/onyx-dot-app/onyx/16339?returnTo=https%3A%2F%2Fgithub.com%2Fonyx-dot-app%2Fonyx%2Fpull%2F16339&source=description" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"><img alt="Turn on auto-fix" src="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"></picture></a> <!-- End of auto-generated description by cubic. --> Closes #16365 I changed no files because PR #16337 on main already pins certifi to 2026.10.19, and the workflow applies that fix to this branch. The advisory (PYSEC-2026-4320 / GHSA-6q48-6c7w-9gw2) is about certifi before 2026.10.19 still trusting the `emSign ECC Root CA - G3` root, whose intermediate CA keys were compromised. Anyone holding one of those keys who can also intercept the network traffic could read or change TLS connections made by clients that trust the certifi bundle. The root `pyproject.toml` has no certifi pin; certifi 2025.11.12 is in `uv.lock` only because other packages need it, among them `requests==2.33.0`, `httpx==0.28.1`, `urllib3==2.8.0`, the OpenAI, LiteLLM, Cohere and Google clients, and many connector SDKs. These libraries use certifi's CA bundle by default for every outbound HTTPS call, such as connector syncs, LLM provider calls and web fetches. That means the weak trust store is used in production. I only had a file-read tool, so I could not search the whole tree for an override of `REQUESTS_CA_BUNDLE`/`SSL_CERT_FILE`, but nothing I read suggests one, so I'm treating Onyx as affected. Exploiting it is hard, since the attacker needs both a compromised key and a position on the network path. Co-authored-by: onyx-cherry-pick[bot] <285052878+onyx-cherry-pick[bot]@users.noreply.github.com>
Onyx - The Open Source AI Platform
Onyx is the application layer for LLMs - bringing a feature-rich interface that can be easily hosted by anyone. Onyx enables LLMs through advanced capabilities like RAG, web search, code execution, file creation, deep research and more.
Connect your applications with over 50+ indexing based connectors provided out of the box or via MCP.
Tip
Deploy with a single command:
curl -fsSL https://onyx.app/install_onyx.sh | bash
⭐ Features
- 🔍 Agentic RAG: Get best in class search and answer quality based on hybrid index + AI Agents for information retrieval
- Benchmark to release soon!
- 🔬 Deep Research: Get in depth reports with a multi-step research flow.
- Top of leaderboard as of Feb 2026.
- 🤖 Custom Agents: Build AI Agents with unique instructions, knowledge, and actions.
- 🌍 Web Search: Browse the web to get up to date information.
- Supports Serper, Google PSE, Brave, SearXNG, and others.
- Comes with an in house web crawler and support for Firecrawl/Exa.
- 📄 Artifacts: Generate documents, graphics, and other downloadable artifacts.
- ▶️ Actions & MCP: Let Onyx agents interact with external applications, comes with flexible Auth options.
- 💻 Code Execution: Execute code in a sandbox to analyze data, render graphs, or modify files.
- 🎙️ Voice Mode: Chat with Onyx via text-to-speech and speech-to-text.
- 🎨 Image Generation: Generate images based on user prompts.
Onyx supports all major LLM providers, both self-hosted (like Ollama, LiteLLM, vLLM, etc.) and proprietary (like Anthropic, OpenAI, Gemini, etc.).
To learn more - check out our docs!
🚀 Deployment Modes
Onyx supports deployments in Docker, Kubernetes, Helm/Terraform and provides guides for major cloud providers. Detailed deployment guides found here.
Onyx supports two separate deployment options: standard and lite.
Onyx Lite
The Lite mode can be thought of as a lightweight Chat UI. It requires less resources (under 1GB memory) and runs a less complex stack. It is great for users who want to test out Onyx quickly or for teams who are only interested in the Chat UI and Agents functionalities.
Standard Onyx
The complete feature set of Onyx which is recommended for serious users and larger teams. Additional components not included in Lite mode:
- Vector + Keyword index for RAG.
- Background containers to run job queues and workers for syncing knowledge from connectors.
- AI model inference servers to run deep learning models used during indexing and inference.
- Performance optimizations for large scale use via in memory cache (Redis) and blob store (MinIO).
Tip
To try Onyx for free without deploying, visit Onyx Cloud.
🏢 Onyx for Enterprise
Onyx is built for teams of all sizes, from individual users to the largest global enterprises:
- 👥 Collaboration: Share chats and agents with other members of your organization.
- 🔐 Single Sign On: SSO via Google OAuth, OIDC, or SAML. Group syncing and user provisioning via SCIM.
- 🛡️ Role Based Access Control: RBAC for sensitive resources like access to agents, actions, etc.
- 📊 Analytics: Usage graphs broken down by teams, LLMs, or agents.
- 🕵️ Query History: Audit usage to ensure safe adoption of AI in your organization.
- 💻 Custom code: Run custom code to remove PII, reject sensitive queries, or to run custom analysis.
- 🎨 Whitelabeling: Customize the look and feel of Onyx with custom naming, icons, banners, and more.
📚 Licensing
There are two editions of Onyx:
- Onyx Community Edition (CE) is available freely under the MIT license and covers all of the core features for Chat, RAG, Agents, and Actions.
- Onyx Enterprise Edition (EE) includes extra features that are primarily useful for larger organizations.
For feature details, check out our website.
👪 Community
Join our open source community on Discord!
💡 Contributing
Looking to contribute? Please check out the Contribution Guide for more details.