When an admin took someone out of a group, a chat shared with that group with "Allow replies" stayed open on that person's screen, message box included. Changing a group drops that person's live connection, and when it came back the chat was only checked again if the server let them back in, so a refused rejoin left the page as it was. Now the chat is checked again after every answer, so someone who lost access is sent to the home page.
Fixes#32527
Status messages above a reply, such as the ones functions and tools send, were always cut to one line, so a longer message like a token usage summary could never be read in full, especially when several models answer side by side. Clicking a single status line now shows its full text, and when there are several, clicking opens the status history with every entry in full. Status lines with their own view, like web search results, are unchanged.
Fixes#30056
Opening a chat from the sidebar while the home page was still setting up a new chat let that setup finish afterwards and clear the opened chat's id. The next message then failed with "Unexpected token 'd', "data: {"id"... is not valid JSON" and the chat's tags did not load. The new chat setup now stops once another chat has been opened. Signing in to an OAuth tool still turns it on together with the model's default tools.
Follow-up to #32488
With Redis, if every tool server was unreachable when Open WebUI loaded the tool server list, it cached an empty list and served it forever. The tools stayed missing from chats and the tool list after the servers came back, until a restart, a save in the tool server settings or a manual delete of the cached Redis key. An empty cached list is now only trusted while no OpenAPI tool server is enabled, so the next request that loads tools fetches the servers again, the same way terminal servers already behave. While an enabled server stays unreachable, each such request tries it again and can wait for its timeout.
Fixes#29573
Connecting Google Drive asked every user for the drive.readonly scope, read access to their whole Drive. Google classes that scope as restricted, so each self-hosted install needed Google's restricted-scope verification and security assessment, and until then users got the "Google hasn't verified this app" warning. The picker now only requests drive.file, access to the files the user picks, which Google classes as non-sensitive and which needs no such verification. With that scope Google requires the picker to name the Cloud project, so it sends the project number again, taken from the leading digits of the Google Drive client ID. It also opens in list view, as Google recommends for this scope, since the picker gets no thumbnail access with it.
Fixes#29537
Adding a custom parameter named tools to a model, for example to turn on a provider's native web search, made Open WebUI drop all of its own tools for that model: notes, knowledge, tasks and any tools attached to the model stopped working, and attached files lost their context. Those tools now stay, and the model's custom tools are sent alongside them. API calls that pass their own tools, or an empty list to turn tools off, behave as before.
Fixes#32528
On dev, opening a folder's page showed a spinner forever and never listed its chats, because the date next to each chat could not be formatted after the search dialog rewrite. The folder page now loads the date format it needs itself, so its chat list shows again.
Fixes#32525
Files read from a URL are sent to a document parser based on their file name. An arXiv link like arxiv.org/pdf/1706.03762 has a dot in the paper ID, so the name was read as having the extension ".03762", the PDF went to the plain text reader and the model got raw PDF bytes. When the part after the dot is not a known file type, the extension now comes from the file type the server reports, so these links are read as PDFs. Files the server only labels as generic binary keep their name as before.
Before Open WebUI reads a URL for the model, it checks whether the URL is a web page or a file. That check went out without the user agent, browser headers and SSL verification setting the web loader uses, so sites that block unknown clients (Wikimedia, for example) refused it. The URL was then treated as a web page and the model got the raw PDF bytes instead of the document text. The check now sends the same request as the web loader, so it gets the same answer and files go to document extraction again.
When Open WebUI authenticates to the OAuth provider with client_secret_basic, either because OAUTH_TOKEN_ENDPOINT_AUTH_METHOD is set to it or because an MCP tool server's OAuth provider only offers that method, sign-in sent the client ID and secret in an HTTP Basic header but the token refresh always put them in the request body. Providers that only accept Basic rejected every refresh with invalid_client, so once the access token expired Open WebUI deleted the user's saved OAuth tokens, and model connections and tool servers set to forward the user's OAuth token stopped working until the user signed in again. The refresh now authenticates the same way sign-in does for client_secret_basic, with the credentials only in the Basic header. Setups using client_secret_post, or leaving the setting unset, still send the credentials in the request body exactly as before.
Fixes#32506
With an Open Terminal orchestrator connection set to Terminal Contexts > Chat = "Per chat" (Admin > Integrations > Open Terminal), the preview of an HTML file shown inside an assistant reply looked for the file in the shared terminal workspace, so it showed "File not found" even though the file sits in the chat's own workspace. The sidebar file browser already opens the same file correctly since #32418. The preview inside the reply now uses the chat's own workspace as well.
Fixes#32477
Enabling an OAuth MCP tool from the Integrations menu sends the user through the OAuth login and back to a new chat, where the tool should be on. When the selected model had tools of its own enabled by default, the tool came back switched off, so it had to be enabled a second time. Now it stays on, together with the model's own tools. For the same reason, a link like `/?tools=my_tool` opened with such a model ignored the listed tools, and now turns them on.
Fixes#32476
Opening a PDF without any text, such as a scan, in the knowledge base file viewer scrolled the whole page up. The workspace tabs, the knowledge base header and the viewer toolbar went off screen and a blank block appeared at the bottom. Scanned PDFs now open with the page in place, the same as PDFs with text.
Fixes#32481
With audit logging on, requests that used an API key in the x-api-key header (what Anthropic SDKs send) worked but never showed up in the audit log, because the audit check only looked for a Bearer token or a session cookie. These requests are now logged with the user the key belongs to, and this also covers a custom header set through CUSTOM_API_KEY_HEADER. Failed attempts with a wrong key in that header now appear in the log without a user, just like a wrong Bearer key. A malformed Authorization header with no other credential is no longer logged, since it can never authenticate.
With tool approval set to ask, a knowledge or file tool the user approved ran and answered, but no sources were saved on the reply or shown below it. The same call without approval listed them as usual. The sources of an approved call are now saved and shown the same way.
Fixes#32436
Retrieval now matches a collection name in a normalised form, folding letter case together and treating hyphens and underscores alike, so the same collection is identified consistently however its name is written.
With websocket support turned off, the browser falls back to HTTP long polling and every poll was written to the audit log as its own entry, flooding it. The same traffic over a websocket was never audited, and AUDIT_EXCLUDED_PATHS only matches API routes, so there was no way to filter it out. Polling requests are now skipped as well, so the audit log looks the same whichever transport is in use.
Fixes#31871
Custom headers on connections and tool servers could pass the chat, message, user and task to downstream services, but not which model the request was for. Chat requests can now use {{MODEL_ID}}, which holds the ID of the model handling the request; for a workspace model that is the workspace model's own ID. In a multi-model chat each model's request carries its own ID, so downstream services can route by model or log usage per model.
Fixes#30006
The audit log only showed which model a request used inside the logged request body, which is cut off at MAX_BODY_LOG_SIZE, so the model went missing whenever a long prompt came before it. Audit entries for chat and completion requests, including the OpenAI, Ollama and Anthropic-compatible endpoints, now carry a model_id field with the model the client asked for, at every AUDIT_LOG_LEVEL and however long the request is. Other requests log it as null.
Fixes#30097
On a shared Valkey or ElastiCache, Open WebUI's vector store connections identified themselves only as the generic GLIDE Python client, the same as every other app using that library, so operators could not tell its traffic apart in server-side logs. Both connections now report the library name as GlidePySync(open-webui). The tag needs valkey-glide-sync 2.5.2 or newer, so the pinned install version moves from 2.3.1 to 2.5.2, and an older manual install fails at startup until it is upgraded.
Fixes#31654
Open WebUI could not connect to a Milvus server that uses a self-signed or company-issued TLS certificate, because there was no way to tell it which certificate to trust. The new MILVUS_SERVER_PEM_PATH setting takes the path to that certificate file and uses it for the Milvus connection, in both normal and multi-tenancy mode. Leaving it unset keeps the current behaviour.
Fixes#31632
MinerU 4.0 dropped the parsing interface its self-hosted server had in 3.x, so the local MinerU engine failed with a 404 on every document when pointed at a 4.x server. Open WebUI now detects a 4.x server and talks to it through its new interface, while 3.x servers keep working as before. On 4.x, `tier` in the MinerU parameters picks the parsing quality (flash, basic, standard or advanced) and `enable_ocr` forces OCR; 3.x-only settings such as `language` and `model_version` are not sent, since 4.x refuses them. 4.x also returns every image as base64 text inside the document, which would otherwise be indexed as text, so images are left out of the extracted content.
Fixes#31516
An identity provider could delete an admin account through SCIM, including the first admin account, for example when its sync pruned users it no longer had assigned. SCIM already ignores deactivation requests for admins so a sync cannot demote them, and the admin panel refuses to delete the first admin, but a SCIM delete request still went through and could leave the instance without anyone who has admin access. Deleting an admin through SCIM is now refused with a 403 and the account stays; admins are removed from the admin panel instead.
Fixes#27662
Voice calls and dictation on Android Chrome stopped working after about ten uses in one session: calls hung on "Listening" and spoken replies went silent until the page was reloaded. Each use left the microphone level display holding on to an audio output, and Chrome on Android allows only ten of those per page. The level display now releases it when a turn ends and when a call or recording stops.
Fixes#29969
With an orchestrator connection in Admin > Integrations > Open Terminal set to Terminal Contexts > Chat = "Per chat", several file browser actions ran in the shared terminal workspace, outside the chat's own one. Opening an HTML file showed "File not found", notebooks could not run, saving an edited file and New File wrote to the shared workspace so the change never showed up in the chat, and deleting several selected files or downloading a folder or a selection as a zip failed. All of these now use the chat's own workspace, like the rest of the file browser.
Fixes#29965
Reindexing memories (the admin "Reindex Knowledge and Memory Vectors" button, a user resetting their memory vectors, or the automatic reindex after switching to an embedding model with a different vector size) ignored the "Embedding Concurrent Requests" setting and sent one embedding request per memory at once. With a rate-limited embedding provider, most of those requests came back as 429 errors. Reindexing memories now respects that setting and the embedding batch size, like knowledge file uploads already do.
Fixes#32212
* docs: start 0.12.1 changelog
* docs: changelog for MCP connection error logging and translation fixes
* docs: changelog for plain HTTP, Redis Sentinel and external citation fixes
* docs: update 0.12.1 date
* docs: changelog for external apps in channels, call wake lock and citation and tool fixes
* docs: changelog for automation schedule fix, shared chat calls and app connection errors
* docs: changelog for chat search speedup, VRM 0.x rest pose and translations
* docs: changelog for sidebar folder links and app profile pictures
* docs: changelog for new default follow-up prompt
* docs: changelog for follow-up generation and app connection status
* docs: add translation updates to 0.12.1 changelog
* docs: update 0.12.1 date, app replies and translations
* docs: changelog for multi-model message pairs and fixes from 2026-10-13
* docs: changelog for app message cards and link buttons
* docs: changelog for large skill previews
* docs: changelog for skill search tool, admin model toggles and Ask and Explain fix
* docs: changelog for code block results and moved calendar reminders
* docs: changelog for MCP OAuth behind Cloudflare
* docs: update 0.12.1 date
* docs: changelog for revision compare, channel muting, chat participants, folder previews and avatar controls
* docs: changelog for compare text in chat and model editor and typed channel mentions
* docs: changelog for .skill export and terminal file compare
* docs: changelog for Azure Realtime calls, voice chat titles, group webhooks and temporary chat files
* docs: changelog for analytics tokens, Realtime input parameters, SCIM sign in and more fixes
Users with a notification webhook for channel messages received no webhook when someone posted in a group channel or direct message they belong to. Only regular channels they had been given access to sent it. Members of group channels and direct messages now get the webhook too, and muting one of these channels stops the webhook except for messages that mention them.
Fixes#32403
Pipes and tools received None instead of a list of files on messages without attachments, which does not match the docs and breaks plugins that loop over the files. Pipes and tools now get an empty list in that case.
Fixes#32379
When an app mentions a person in a channel message by account id only, without a display name, the channel showed raw text like "@U:" followed by a long id. It now shows the person's name, or "Unknown" when the account no longer exists, the same way mentions that carry a name already worked. Mentions that carry a custom name keep showing it.
Fixes#32362
Connecting an OAuth 2.1 MCP tool server such as Canva failed with "OAuth client registration is still invalid after re-registration" whenever Cloudflare answered Open WebUI's own server-side check of the provider's sign-in page with a bot challenge. The challenge page repeats the requested address, which contains the redirect URL, so Open WebUI read it as the provider rejecting its registration. Open WebUI now skips its check when it gets a bot challenge, and the browser goes on to the provider's sign-in page as usual. Real provider errors about an unknown client or redirect URL still trigger re-registration as before.
Fixes#32363
After signing in on a page without reloading it, the browser tab kept using its signed-out state whenever its live connection had to reconnect. Since 0.12.0 the server drops such a connection as soon as an open chat subscribes to live updates, and the tab reconnected immediately, so after a connection drop (sleep, network change, server restart) it reconnected several times per second until the page was reloaded, putting heavy load on the server. Reconnects now use the current sign-in, so the tab comes back signed in on the first attempt and stays connected.
Fixes#32338
Chat search checks the whole query and each word in it separately. With a single word those are the same check, so every chat got searched twice. It is now searched once, with the same results. On PostgreSQL with 2164 chats (533 MB of chat data) a one-word search is about 40% faster:
| search | before | after |
|---|---|---|
| proxy | 6.0 s | 3.6 s |
| opnsense | 6.1 s | 3.8 s |
| no match | 5.4 s | 3.0 s |
Refs #32266
Automations scheduled with the Daily, Weekly or Monthly picker ran a few seconds after the chosen time, taking the seconds from whenever the previous run was handled. Now and then that left the next run due again within the same minute, and the automation ran twice. Users whose timezone is behind the server's could also have their first run moved to the next day. These schedules now run at the exact minute chosen, in the user's own timezone.
Fixes#32263
A tool picked from the Integrations menu before the first message of a new chat stayed on only until the user left that chat. Coming back, the chat fell back to the model's default tools, so the tool was no longer offered to the model and the changed tool list broke prompt caching. The Web Search toggle was dropped the same way, and a picked skill was lost on reload. The picks are now kept for the chat from its first message on, like picks made later in the chat.
Clicking the title of a citation from an external knowledge base (Qdrant, Milvus, pgvector), or its Content link, opened a link to a file inside Open WebUI that does not exist, so the browser showed a not found error. These results are no longer treated as uploaded files, so when the citation's source is a web address both links open that page, and otherwise the title is plain text. This works whether or not the model uses native tool calling.
Fixes https://github.com/open-webui/open-webui/issues/32231
When the Redis Sentinels are protected with a password, every Redis operation failed with "No master found", because the password in REDIS_URL was used for the Redis server itself but never for the Sentinels. The Sentinels now get the same credentials, both for REDIS_URL and for WEBSOCKET_REDIS_URL. Sentinels without a password keep working, and Sentinel credentials set by hand in WEBSOCKET_REDIS_OPTIONS still take precedence.
Fixes#32240
With Redis Sentinel, Open WebUI lowercased the master name given as the host part of REDIS_URL, so a master named myMaster was looked up as mymaster and every Redis call failed with "No master found". The OT-Container-Kit redis-operator for Kubernetes names its master myMaster by default, so its users hit this out of the box. The master name is now used exactly as written in REDIS_URL, so it has to match the case configured in Sentinel.
Fixes#31918
Citations from external knowledge bases (Qdrant, Milvus, pgvector) whose source is a web address showed that full address in the source list below the answer, while the numbered citation markers in the answer text already showed the page title. The source list now shows the same title. Because of that, these citations no longer add a site icon to the sources button, which matches regular knowledge bases. Web search results keep showing their address.
Fixes https://github.com/open-webui/open-webui/issues/32231
When an MCP tool server fails to connect during a chat, the chat shows "Failed to connect to MCP server" but the reason was only logged at debug level, so it never appeared in the logs of a default install. The failure is now logged as an error with the full cause, such as a refused connection or a 401 from the server. The message in the chat is unchanged.
Fixes#32213
Rich UI tool embeds always tried to pass the arguments the model called the tool with into the embedded page, even when the browser does not allow it: with "iframe Sandbox Allow Same Origin" off (the default), or when an external tool embeds a page from another site. Each load then logged an uncaught SecurityError in the console. The arguments are now passed only where the browser allows it and skipped otherwise. The embed itself renders and behaves the same as before.
Fixes#32222
The Top K Reranker description under Admin Panel > Settings > Documents said it is the number of hybrid results sent to the reranker, but it is the number of chunks the reranker keeps per query and passes to the model. The Top K description did not say that with hybrid search it is also the number of candidates retrieved for the reranker. Admins following the old text set something like 15 / 3 and gave the model only 3 chunks per query. Both descriptions now say what the settings do, in English and German.
Fixes#32221
After an OAuth sign-in, the cookies tying the browser to the user's OAuth session were dropped when the browser closed, while the login itself stayed valid for the full JWT lifetime. After a restart the user was still signed in, but model connections and terminal servers using system OAuth got no token, and signing out no longer ended the session at the identity provider. These cookies now last as long as the login again, with and without MFA, as they did in 0.11.
* docs: 0.11.5 changelog
Changelog for 0.11.5: Redis per-room delivery, revoked channel and note access, Docling file names, the 0.11.4 interface language regression and the other fixes since v0.11.4, plus a Changed entry asking Redis-backed fleets to update all instances together.
* docs: voice call speech failure entry
* docs: OAuth refresh race, Windows automations and analytics scroll entries
* docs: 0.11.5 entries for voice, queue, MCP OAuth, automations and other fixes
* docs: account copy buttons and read-only prompt controls entries
* docs: token exchange groups, personal terminal skills, share link and hourly analytics entries
* docs: link issues fixed by direct commits and split the send now entry
* docs: chat title with title generation off entry
* docs: 0.11.5 date
* docs: Windows terminal AGENTS.md, CJK text uploads, folder names and direct connection removal entries
* docs: note PDF images, blocked OAuth groups, per-chat streaming, channel Ctrl+Enter, CSV import and auth settings entries
* docs: model sync on SQLite entry
* docs: 0.11.5 date
* docs: tool history, Responses API errors, reasoning spacing, Ollama max_tokens, skills, clipboard, calendar and other entries
* docs: 0.11.5 date
* docs: failed timers, Qdrant strict mode and German translation entries
* docs: sub-agent tools, share dialog, HTML uploads, PostgreSQL search, Anthropic endpoint and translation entries
* docs: Tavily search depth, multi-call tool approval, menu outside clicks and arena model entries
* docs: artifacts pane after deleting a message entry
* docs: failed Anthropic Messages streams entry
* docs: relevance scores on knowledge tool citations entry
* docs: exploring status entry
* docs: link the thinking indicator issue
* docs: Ollama connection headers and authentication entry
* docs: Manage Ollama headers and Share/Delete dialog first click entries
* docs: attached files after compaction entry and dropdown commit link
* docs: admin chat access, menu first click, Ollama model transfer entries and date
* docs: changelog entries for model selector menu actions, Enter after a smiley and early chat titles
* docs: changelog entries for tool approval fixes and Code Interpreter on chat switch
* docs: update 0.11.5 changelog date
* docs: changelog entry for repeating calendar events and Malay translation
* docs: update 0.11.5 changelog date
* docs: changelog entries for channel permissions, direct message members, temporary chat sub-agents, MCP timeout and more
* docs: changelog entries for 30 upstream fixes, ENABLE_ORJSON default and Simplified Chinese translation
* docs: list the security fixes previously left out of the 0.11.5 changelog
* docs: changelog entries for Milvus native hybrid search with migration warning and seven fixes
* docs: add performance entry for orjson by default
* docs: expand the Milvus migration warning
* docs: clarify Milvus 2.5 requirement for hybrid search
* docs: changelog entry for Playwright pages with several main elements
* docs: update 0.11.5 changelog date
* docs: update Milvus hybrid search and migration warning for the single-collection design, mobile keyboard fix
* docs: changelog entries for separate Tools, Functions and tool server switches
* docs: changelog entries for 11 upstream fixes, audit log masking and Hindi translation
* docs: changelog entries for channel message queue, provider error passthrough, chat memory and code block dollar signs
* docs: simplify the Milvus migration warning
* docs: tighten the Milvus migration warning
* docs: shorten the Milvus migration warning
* docs: add long MCP tool names, Voice mode call link checks and Kokoro setup to changelog
* docs: add cancelled Ollama downloads fix to changelog
* docs: update 0.11.5 changelog date
* docs: add Responses API chat freeze, model JSON Preview and user menu pin fixes to changelog
* docs: add note paste, MCP OAuth scope and stuck loading response fixes to changelog
* docs: add empty reply chat fix to changelog
* docs: update 0.11.5 changelog date
* docs: add arena default, build channel, model ID suggestions and twelve fixes to changelog
* docs: add MCP Connection ID from name to changelog
* docs: add deleted group access grants, latest reply on open and function sharing fixes to changelog
* docs: move function menu sharing entry to fixes
* docs: add MCP tools list, model unload refresh, voice, speech speed and file browser fixes to changelog
* docs: add slim S3 storage, reused tool call ids and unarchive fixes to changelog
* docs: add two-factor sign-in, session revocation hardening, folder default model and model list changes to changelog
* docs: correct automation and sub-agent session entry
* docs: add nested groups to changelog
* docs: add default models per group to changelog
* docs: use a unique emoji for group default models
* docs: add Read Aloud after Voice mode fix to changelog
* docs: correct Read Aloud entry wording
* docs: drop the group database entry
* docs: bump 0.11.5 date
* docs: add OpenAI Realtime speech engine
* docs: quote realtime prompt env var
* docs: clarify realtime tts entry
* docs: add model controls
* docs: expand model controls example
* docs: link closed issues and json copy fix
* docs: rename 0.11.5 to 0.12.0
* docs: add realtime voice calls and slider controls
* docs: remove stray blank line
* docs: bump 0.12.0 date
* docs: add realtime call avatars
* docs: add tool call, milvus, citation and schema fixes
* docs: lead added with realtime voice calls
* docs: add image storage and workspace search fixes
* docs: add qdrant, sidebar date, web search popup and mcp status entries
* docs: add skills builtin tool toggle
* docs: note skills switch default
* docs: add Tamil to translation updates
* docs: add read-only chat cloning and shared note files
* docs: add filter order for approved tool calls
* docs: add Spanish, Vietnamese and Norwegian Bokmål to translation updates
* docs: link file context issue to approved tool call entry
* docs: add folder sharing restriction and model availability views
* docs: add replying in shared chats and private owner settings
* docs: add shared chat authors, typing indicator and admin read-only chat access
* docs: add delete and reset to admin model menu
* docs: add streamed image, reranker header and plain link fixes
* docs: link orphaned model permissions issue
* docs: add MCP OAuth discovery fallback and Greek translation
* docs: add deleted chat folder refresh
* docs: add outlet finish reason, shared folder chat owners and Lithuanian
* docs: add tool server OAuth token refresh fix
* docs: add non-streamed tool reply and Redis reconnect fixes
* docs: add Korean, Canadian French and Swedish to translation updates
* docs: add rich text paste freeze fix
* docs: add notes API switch, thinking tag answers and streaming cursor
* docs: add Thai to translation updates
* docs: add Estonian to translation updates
* docs: add URL prompt auto-send opt-in
* docs: update link parameter entry to confirmation prompts
* docs: note voice link parameter
* docs: restore blank line after Added heading
* docs: move streaming cursor entry near top of added
* docs: move admin model views entry near top of added
* docs: move new features from changed to added
* docs: add MCP structured results, localized dates, calendar month loading and Russian
* docs: add terminal prompt cache settings and nested chat variable fix
* docs: update 0.12.0 date
* docs: changelog sub-agent and timer instructions, Bosnian and Ukrainian
* docs: link sub-agent prompt issue
* docs: changelog translation updates
* docs: changelog translation updates
* docs: changelog profile card local time and last seen
* docs: changelog OpenCV duplicate, Traditional Chinese and Polish
* docs: changelog DEFAULT_LOCALE starting language
* docs: changelog multi-file skills with version history
* docs: changelog skill creation permission note
* docs: move OpenCV change out of the 0.11.4 section
* docs: changelog knowledge file browser, prompt version compare, knowledge file fixes
* docs: changelog skill versions and SKILL.md header parsing
* docs: changelog model version history and access from lists
* docs: changelog tool and function version history, Georgian and Galician
* docs: changelog Exa web loader and folder page navigation
* docs: clarify folder page navigation entry
* docs: changelog long translated menu labels
* docs: changelog switched-off MCP servers, link closed issues
* docs: changelog date 2026-10-10
* docs: changelog for create menu reload and select list placement fixes
* docs: changelog for forking shared chats and custom parameter suggestions
* docs: changelog for skill import from link and reworked model editor
* docs: expand and move up the model editor redesign entry
* docs: changelog for model editor follow-ups and admin-only skill import from URL
* docs: changelog for sharing skills with the community
* docs: changelog for eight fixes and the skill Share menu item
* docs: changelog for two security fixes and eighteen fixes from the latest dev batch
* docs: changelog for temporary chat tool approval, collaborative editing limits, seven fixes and model controls for editors
* docs: changelog for Tool Search and three fixes
* docs: changelog for compaction during tool runs and fork button removal
* docs: move major Added entries to the top
* docs: move context compaction entry into the top of Added
* docs: remove serial comma in interface language entry
* docs: distinct emojis for sidebar and reload loop entries
* docs: review fixes for orjson, Tool Search, Builtin Tools label, audit log and OAuth placement
* docs: clearer wording for unfinished responses and sub-agent instructions entries
* docs: changelog for PostgreSQL pending files index and compaction issue link
* docs: move PostgreSQL knowledge index entry to Added
When the server restarted while a reply was streaming, the page reconnected but kept showing the cut-off reply as still generating. The Stop button stayed and the next message got no answer until the page was reloaded. After reconnecting, the page now checks whether the reply is still being generated and, if not, shows it as finished, which is how it behaved before the shared chats change.
Fixes#32204
With the Docling engine, a blank page in a PDF threw off the page number of everything after it, so citations showed the wrong page and opened the file at the wrong place. Page numbers now come from the page Docling reports for each piece of text. Files that were already uploaded keep their old page numbers until they are reindexed or uploaded again.
Fixes#32201
After a server upgrade, browsers could keep reusing their cached copy of the old app page for days, since it was sent with no caching instructions. That old page points at files the new version no longer has, so the app reloads into the same cached page and loops until a hard refresh. The app page now tells the browser to check for a newer version on every visit, which is a tiny request when nothing changed. Other files are cached as before, and an admin-set CACHE_CONTROL still takes precedence.
Fixes#31630
Collaborative document buffers now keep a size budget per document and a limit on open documents per connection, only store well-formed updates and are keyed by the document id unchanged.
Notification targets subscribed to Chat failed stayed silent when the provider answered a chat with an error status, such as a 500, or could not be reached at all. Those failures show up as an error in the chat, but only a few uncommon failures were announced to the targets. Now these failures notify Chat failed targets too, with the error text and a link to the chat.
Fixes#32003
Creating a calendar event after 23:00 saved it ending on the day after the date picked, so it showed on two days. The new event form pre-fills an end time one hour from now, which falls on the next day, and that next-day end date was kept even when the event was set to other times. The end date now stays on the start date when the end time is later in the day than the start time. An event that ends after midnight or spans several days keeps its end date.
Fixes#31994
When a parameter like Temperature was switched to Custom in Chat Controls and then back to Default, the value saved in Settings > General was dropped and the model used its built-in default instead. Default now uses the Settings value again, also in chats where this already happened.
Fixes#32013
When Ollama rejected a new model in the Manage Ollama dialog, for example a model definition with no base model, the form cleared and showed no error, so the admin could not tell the model was never created or why. The dialog now shows Ollama's error and keeps the entered name and definition, so the admin can correct them and try again.
Fixes#32002
When an admin removed a model control (such as Thinking) after a user had chosen one of its options in the chat input, every message that user sent to that model failed with "the selected option is no longer available" and never reached the model. The control is gone from the chat input, so the user had no way to undo the choice. A choice for a control that no longer exists is now ignored and the message goes through. When only one option of a control is removed, the error stays, because the control is still in the chat input and the user can pick another option there.
Fixes#31996
The Once schedule in the automation dialog filled in today's date in UTC but the browser's local time. When the browser's date differs from UTC's, the default was a day off: east of UTC it was yesterday, so Create failed with "RRULE has no future occurrences", and west of UTC it was tomorrow, so the automation ran a day late. The earliest selectable date had the same mix-up, so west of UTC today could not be picked. The default date and the earliest selectable date now both use the browser's local date.
Fixes#31999
A user who had picked an option in a model control (the per-model selector in the chat input, for example High on a Thinking control) could not chat any more once the admin switched off Allow Chat Controls or Allow Chat Params for them. Every message failed with "You cannot change model parameters.", and the user could not clear the saved selection because the selector is hidden for them. When either permission is off, the saved selection is now skipped when sending, so messages go through with the model's default options, and it applies again if the permission comes back.
Fixes#31995
An automation whose schedule stops after a number of runs or on a date lost that end the first time it was edited and saved, even when only the title changed, so it kept running forever. The Edit dialog showed such a schedule as a plain Daily, Weekly or Monthly one, and those options have no setting for an end, so saving wrote the schedule back without it. These schedules now open as Custom with the stored rule in its text field and are saved exactly as they were.
Fixes#32000
Creating a model in Admin Settings > Models > Manage Ollama from a base model that Ollama has not downloaded yet showed no download progress at all. The progress display hit an error in the browser the moment the download began, so the admin saw nothing until the model was created. The model name and a percentage bar that fills up as the download goes now show the whole time.
Fixes#32001
Automation runs, timers and sub-agents stopped getting a reply after the shared chats rework: the chat shows an empty answer and the run fails with `409 Message already exists or has an invalid ID.` Each of them creates the empty answer before asking the model, and the backend began refusing to fill an answer that is already in the chat; the server-side API flow in the docs and API calls without a user message broke the same way. Such an empty answer is now filled in again when it belongs to the same user and answers the same message, and API calls without a user message work as before, saving the reply on its own as the docs describe. A firing timer or sub-agent also no longer cancels the chat's other timers that are set to stop when the user writes next. Answers that are already finished, or that belong to another user in a shared chat, are still refused.
Fixes#32066
Account creation times are stored in whole seconds. On Postgres, a user created in the same second as the first admin, which is normal when a script sets up an instance, could be picked as the primary admin. Other admins could then demote or delete the real first admin, nobody could edit, lock or delete that user, and pending users were shown that user as the admin contact. An admin account now wins a same-second tie against a regular one.
Picking Settings from the user menu with the keyboard left the focus on the menu item, which disappears as the menu closes. When Settings closed, the focus went back to that removed item, so it was lost and the next Tab started over at the top of the page. The menu now gives the focus back to the user menu button when it closes after an item is picked, the same as when it is closed with Escape, so closing Settings returns there.
Fixes#32017
When an OpenAI-compatible speech-to-text engine or Deepgram rejected a recording, the error shown after dictating only gave the HTTP status, such as "429 Too Many Requests", and the engine's own reason, such as "Quota exceeded" or "Invalid credentials.", was lost. The error now shows that reason. When the engine sends no reason, the HTTP status is shown as before.
Fixes#32009
With Datalab Marker as the content extraction engine, every file upload it processed failed on pip and source installs with `Permission denied: '/app'`, because Open WebUI saved a copy of the extracted text under `/app`, a folder that only exists inside the Docker image. That copy now goes to the uploads folder inside `DATA_DIR`, so extraction works on any install. Docker installs with the default data directory keep the same location.
Fixes#32025
Since the recent change that keeps a history of function and tool edits, saving a new function or tool whose Valves (its admin settings, such as an API key) have a required field with no default was refused with "Current Valves are incompatible with this code: ... Field required", because a new one has no Valves set yet. Editing the code to add a new required field failed the same way. Missing required fields no longer block saving, so the function or tool can be installed first and its Valves filled in afterwards, as before that change. Saved Valves that have the wrong type for the new code are still rejected.
Fixes#32145
Pasting an image into a note a moment after another change to that note was saved could lose the image. The note page got the result of the earlier save back after the paste and took over its older, empty list of attached files, so the image was saved without its file. After a reload it showed as a grey placeholder and was missing from the PDF export. The note page now keeps its own attached files while it still has a change waiting to be saved.
Fixes#32123
Stopping a reply did stop it, but the page kept showing it as still generating: the Stop button stayed and the next message was never answered. The same happened when sending a queued message right away with Send now. After the reply was marked finished, the page put back an older copy of it that was still marked as generating. Stopped replies now show as finished again, the Send button returns and the next message gets an answer.
Fixes#32081
In a new chat the reply sometimes stayed blank and looked like it was still generating, with the loading animation and the Stop button, even though the answer was complete on the server. Reloading the page showed it. It happened when the chat's new title arrived while the reply was still coming in: refreshing the chat list with the new title replaced the finished answer with a blank one. A title or tag update no longer overwrites the reply, so the finished answer shows as soon as it is done.
Fixes#32091
With Kagi as the web search engine, any entry in the Domain Filter List made every search fail with "'SearchResult' object has no attribute 'get'", so the model got no search results. The Domain Filter List now works with Kagi the same way it does with the other search engines, and the remaining results reach the model.
Fixes#32004
Screen readers announced the Response Splitting dropdown in Admin Settings > Audio without a name. It is now announced as "Select how to split message text for TTS requests". Nothing changes visually.
Fixes#32010
With Perplexity Search as the web search engine, the Domain Filter List had no effect: blocked domains still showed up in the results the model got, and an allowlist let every result through. The filter now applies to Perplexity Search results as it does for the other search engines.
Fixes#32005
When a skill was saved several times within one second, its version history in the skill editor listed those versions in a shuffled order. This happens when a model edits a skill several times in one reply, or when an import replaces a skill right after it was created. Each new version now gets a save time at least one second later than the one before it, so the history keeps the order the versions were saved in. During such a burst, the shown save time runs ahead by about one second per extra save.
Fixes#32134
Exporting feedback as CSV from Admin Settings > Evaluations > Feedback left the chat_id column empty on every row. Each row now holds the ID of the chat the feedback was given in, the same ID that appears in the chat's URL.
Fixes#32021
Turning on Browser Notifications in a browser that blocks them showed an error, but the switch stayed on even though nothing was saved. The switch now turns back off when the browser denies permission.
Fixes#32024
When an admin changed a group's permissions, members who had the app open saw Workspace show up or vanish in their user menu right away, but the sidebar kept its Workspace entry as it was until they reloaded the page. The Notes, Calendar and Automations entries in the sidebar had the same problem. The sidebar now follows the change right away, like the user menu.
Fixes#32020
Pressing an action button whose function rewrites the reply, as the action docs describe, stored the new text with the chat but the chat kept showing the old reply, right away and after a reload. The reply now shows the new text, and its thinking and tool call sections stay visible. The action gets the reply as one text, so when the reply had text both before and after a tool call, all of it is replaced by the new text, shown after the tool calls.
Fixes#32023
Searching Workspace > Skills only matched a skill's original name, description and id, so typing the German name given to a skill in its editor found nothing, even with the interface in German. The search now also matches the names and descriptions translated in the skill editor, in any language, so both the translated and the original name find the skill, as the Translations page in the docs says.
Fixes#32018
When a chat is named after its first message (title generation off, or the automatic title is blank), a message that starts with a skill picked by typing $ in the message box gave the chat a title like `<$tides-1234|Tides> when is high tide`. The title now shows each picked skill by its name, so the sidebar reads "Tides when is high tide".
Fixes#32019
On a phone, swiping right on a channel message to reply to it also opened the sidebar, which slid over the channel and covered the message. A swipe on a message now only starts the reply. On messages that cannot be replied to, for example in a read-only channel, the same swipe still opens the sidebar.
Fixes#32016
On a narrow phone screen, the Download choices in the chat header menu, in a chat's menu in the sidebar and in the note menu opened to the left of the menu, past the edge of the screen, with their labels cut off. When there is no room for them on either side of the menu, they now open over the menu, fully on screen. Where there is room beside the menu, they open as before.
Fixes#32015
rapidocr 3.9.2 required the GUI build of OpenCV, so every install carried it next to the headless build Open WebUI already pins. Both builds install the same Python package, so which one you got depended on install order, and the GUI build added about 115 MB of installed files on x86_64 that a server never uses. rapidocr 3.10.0 depends on the headless build instead, so installs now carry only that one. Text extracted from images inside PDFs is unchanged.
Part of #29721.
After Redis restarted or closed Open WebUI's connections, the first few requests that needed Redis failed. Chat requests answered with a 500 error, and a browser tab connecting at that moment got no live updates, such as streamed replies, until it was reloaded. Open WebUI now reconnects and retries the failed Redis call once when Redis has closed the connection, so requests go through as soon as Redis is back. While Redis is down, requests still fail as before.
With Stream Chat Response turned off, a reply where the model called a tool was never saved or marked as finished, so the chat kept showing it as still generating until the page was reloaded. The reply is now saved and finished like any other non-streamed reply. Tools themselves still only run with streaming on, as the docs describe.
Outlet filters see the finished reply with its content and token usage, but had no way to tell whether the model ended on its own, ran into the token limit or stopped to call a tool, short of reading every chunk in a stream filter. For OpenAI-compatible and Ollama models, the assistant message handed to outlet now carries finish_reason with the value the provider reported on the last model call of the turn, for streaming and non-streaming replies. Ollama replies cut off by the token limit now report length as well, where they always said stop before.
With ENABLE_FORWARD_USER_INFO_HEADERS on and hybrid search enabled, rerank requests went out without the user headers when a chat searched attached knowledge, when a model used the built-in knowledge search tool, and when the collection query API was called with hybrid turned off for that one request. The embedding requests of the same search did carry them, so external rerankers that use these headers for per-user auth, rate limits or auditing saw anonymous calls. Rerank requests now carry the signed-in user, the same as embedding requests.
Fixes#32060
When a model streams its images in separate chunks, each new chunk saved all earlier images again, so the copies doubled with every image: four images were stored as fifteen and the chat showed duplicates. New replies now keep each image once. Chats that already hold duplicates stay as they are.
Fixes#32053
The full security policy now lives on the documentation site, so it only has to be kept up to date in one place. This file keeps a link to it and the one reporting channel we accept, since GitHub shows this file to reporters on the Security tab.
Good-faith reports that turn out not to be vulnerabilities are now explicitly welcomed, and the line about barring reporters is softened so it only targets repeated or deliberate rule breaking. The section on foreign CNAs moves near the end, dashes are gone, a few redundant sentences are cut and the last-updated date is today.
* fix: Direct Connection replies are saved scrambled or empty
With a Direct Connection the browser tab forwards the model's reply to the server piece by piece. Since the server started checking the tab's session again for every one of those pieces, the pieces could overtake each other while the checks ran, so the saved reply came out in the wrong order, or empty when the end of the stream arrived first. Pieces from one tab are now handled one after another in the order they arrived, and each one is still checked.
Fixes#31953
* fix: check Direct Connection reply pieces side by side while keeping them in order
Handling one tab's reply pieces strictly one after another also made each piece wait for the previous piece's session check, so a fast 2000-piece reply took 12 to 22% longer to save than without the ordering. Each piece's check now starts as soon as it arrives and only the hand-over waits its turn, so replies save as fast as before and still in order. Once a check fails, for example after a sign-out, no later piece from that tab gets through either.
On Qdrant, uploading a file into a knowledge base or editing a file's content could leave the knowledge base with only part of the file, often exactly 64 chunks, while the file showed as completed and nothing was logged. The file's chunks were saved without waiting for Qdrant to make them searchable, and the knowledge base copied them straight after, so it only got the ones Qdrant had finished storing. Saving now waits until Qdrant has finished storing the chunks, so the knowledge base always gets the whole file. On a busy Qdrant this makes file processing somewhat slower, since each save now waits for the server.
Fixes#31959
* i18n: fill in missing Hungarian translations
392 labels and messages had no Hungarian text, so Hungarian users saw them in English, for example on the user groups, two-factor sign-in, terminal and file compare screens. They are now all translated, keeping the vocabulary and informal tone of the existing Hungarian strings.
* i18n: translate the new authenticator sign-in strings for Hungarian (hu-HU)
* i18n: fill missing Dutch (nl-NL) translations
About 160 strings showed up in English for Dutch users, mostly on the new authenticator and recovery code screens, group inheritance in the admin panel, the file compare view and the starter prompt cards. All of them are translated now, using the words the Dutch file already uses for the same things, like "inloggen" for signing in and "beheerd" for managed. Counters such as remaining recovery codes and group member counts are worded so they still read correctly when the number is 1.
* i18n: translate the new authenticator sign-in strings for Dutch (nl-NL)
* i18n: fill missing sk-SK translations
About 2,800 interface texts had no Slovak translation, so Slovak users saw English across much of the app, including most of the newer settings pages. All of them are now translated, and variables like {{name}} and the Slovak plural variants are kept. Terminology follows the words the existing Slovak translation already uses, and no existing Slovak translation or other language was changed.
* i18n: translate the new authenticator sign-in strings for Slovak (sk-SK)
On the first day of a month, chats from the day before were listed under "Previous 7 days" in the sidebar instead of "Yesterday". The same happened on January 1st for chats from December 31st. Any chat from the previous calendar day is now listed under "Yesterday", whatever the month or year.
Fixes#31964
With the admin setting Web Search Confirmation on, switching on Web Search from the Integrations menu opened the confirmation popup while the menu stayed open behind it. The first click on Cancel or Continue only closed the menu, so the buttons looked broken until clicked a second time. The menu now closes when the popup opens, so one click confirms or cancels.
Fixes#31963
* i18n: fill missing Croatian translations
166 strings in the Croatian interface were still empty and showed up in English, among them the new multi-factor sign-in screens, the group hierarchy settings, file comparison and the default prompt suggestions on the chat start screen. They are now translated with the words the Croatian translation already uses elsewhere, for example "povezivanje" for connections and "vještina" for skills. Model parameter names such as top_k stay unchanged, same as in English.
* i18n: translate the new authenticator sign-in strings for Croatian (hr-HR)
When a model file was downloaded by URL in Manage Ollama, the end of the file could still be on its way to disk when Open WebUI sent it to Ollama, so Ollama got a cut-off copy. The download is now fully on disk before it is sent, so Ollama gets the whole file.
Fixes#31956
* i18n: fill missing Slovenian (sl-SI) translations
About 400 texts showed up in English for Slovenian users, mostly in newer areas like the file browser, terminal, group settings, multi-factor sign-in and the chat slash commands. All of them now have Slovenian text, using the same terms the rest of the Slovenian translation already uses. Texts that show a number without separate plural forms put the number after a colon, for example "Orodja: 5", so they read correctly whatever the count.
* i18n: translate the new authenticator sign-in strings for Slovenian (sl-SI)
Classic298