chore(deps): update ghcr.io/open-webui/open-webui docker tag to v0.8.12

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
ghcr.io/open-webui/open-webui	minor	0.6.41 → v0.8.12

---

Release Notes

open-webui/open-webui (ghcr.io/open-webui/open-webui)

v0.8.12

Compare Source

Added

• 🌐 Translation updates. Translations for Simplified Chinese, Catalan, Portuguese (Brazil), Finnish, and Lithuanian were enhanced and expanded.

Fixed

• 🔒 Terminal server connection security. Terminal server verification and policy saving now proxy through the backend, preventing API key exposure and CORS errors when connecting to in-cluster services. Commit, Commit
• 🛠️ Terminal tools exception handling. Exceptions in middleware.py due to invalid return values from get_terminal_tools() have been resolved. Commit
• 📦 Missing beautifulsoup4 dependency. Users can now start Open WebUI using uvx without encountering the "bs4 module missing" error. Commit
• 🔌 API files list error. The /api/v1/files/ endpoint no longer returns a 500 error, fixing a regression that prevented file listing via the API. Commit
• 📜 License data loading. License data now loads correctly, displaying the expected color and logo in the interface. Commit
• 👑 Admin model visibility. Administrators can now see models even when no access control is configured yet, allowing them to manage all available models. Commit
• 📊 Tool call embed visibility. Rich UI embeds from tool calls (like visualizations) are now rendered outside collapsed groups and remain visible without requiring manual expansion. Commit, Commit

v0.8.12

Compare Source

Added

• 🌐 Translation updates. Translations for Simplified Chinese, Catalan, Portuguese (Brazil), Finnish, and Lithuanian were enhanced and expanded.

Fixed

• 🔒 Terminal server connection security. Terminal server verification and policy saving now proxy through the backend, preventing API key exposure and CORS errors when connecting to in-cluster services. Commit, Commit
• 🛠️ Terminal tools exception handling. Exceptions in middleware.py due to invalid return values from get_terminal_tools() have been resolved. Commit
• 📦 Missing beautifulsoup4 dependency. Users can now start Open WebUI using uvx without encountering the "bs4 module missing" error. Commit
• 🔌 API files list error. The /api/v1/files/ endpoint no longer returns a 500 error, fixing a regression that prevented file listing via the API. Commit
• 📜 License data loading. License data now loads correctly, displaying the expected color and logo in the interface. Commit
• 👑 Admin model visibility. Administrators can now see models even when no access control is configured yet, allowing them to manage all available models. Commit
• 📊 Tool call embed visibility. Rich UI embeds from tool calls (like visualizations) are now rendered outside collapsed groups and remain visible without requiring manual expansion. Commit, Commit

v0.8.11

Compare Source

Added

• 🔀 Responses API streaming improvements. The OpenAI proxy now properly handles tool call streaming and re-invocations in the Responses API, preventing duplicate tool calls and preserving output during model re-invocations. Commit, Commit, Commit, Commit
• 🔀 Responses API stateful sessions. Administrators can now enable experimental stateful session support via the ENABLE_RESPONSES_API_STATEFUL environment variable, allowing compatible backends to store responses server-side with previous_response_id anchoring for improved multi-turn conversations. Commit
• 📄 File viewing pagination. The view_file and view_knowledge_file tools now support pagination with offset and max_chars parameters, allowing models to read large files in chunks. Commit
• 🗺️ Knowledge search scoping. The search_knowledge_files tool now respects model-attached knowledge, searching only within attached knowledge bases and files when available. Commit
• 🛠️ Tool HTML embed context. Tools can now return custom context alongside HTML embeds by using a tuple format, providing the LLM with actionable information instead of a generic message. #​22691
• 🔒 Trusted role header configuration. Administrators can now configure the WEBUI_AUTH_TRUSTED_ROLE_HEADER environment variable to set user roles (admin, user, or pending) via a trusted header from their identity provider or reverse proxy. #​22523
• 🔑 OIDC authorization parameter injection. Administrators can now inject extra parameters into the OIDC authorization redirect URL via the OAUTH_AUTHORIZE_PARAMS environment variable, enabling IdP pre-selection for brokers like CILogon and Keycloak. #​22863, Commit
• 🔑 Google OAuth session persistence. Administrators can now configure Google OAuth to issue refresh tokens via the GOOGLE_OAUTH_AUTHORIZE_PARAMS environment variable, preventing OAuth sessions from expiring after one hour and ensuring tools and integrations that rely on OAuth tokens remain functional. #​22652
• 🔌 Embed prompt confirmation. Interactive tool embeds can now submit prompts to the chat without requiring same-origin access, showing a confirmation dialog for cross-origin requests to prevent abuse. #​22908
• 🏮 Tool binary response handling. Tool servers can now return binary data such as images, which are properly processed and displayed in chat for both multimodal and non-multimodal models. Commit, Commit
• ⚡ Svelte upgrade performance. Page and markdown rendering are now approximately 25% faster across the board, with significantly less memory usage for smoother UI interactions. #​22611
• 🧩 Model and filter lookup optimization. Model and filter membership lookups are now faster thanks to optimized data structure operations during model list loading. Commit
• 💨 Chat render throttling. Chat message rendering now uses requestAnimationFrame batching to stay smooth during rapid model responses, preventing dropped frames when fast models send many events per second. #​22947
• 🚀 Function list API optimization. The functions list API now returns only essential metadata without function source code, reducing payload sizes by over 99% and making the Functions admin page load significantly faster. #​22788
• ✨ Smoother loading animation. The loading shimmer animation now looks smoother and more natural, with softer highlight colors. #​22516
• 🧪 Terminal connection verification. Users can now verify their terminal server connection is working before saving the configuration, making setup more reliable. #​22567
• 📁 Chat folder emoji reset. Users can now reset chat folder emojis back to the default icon using a "Reset to Default" button in the emoji picker, making it easier to revert custom icons. #​22554
• 📊 Metrics export interval configuration. Administrators can now control OpenTelemetry metrics export frequency via the OTEL_METRICS_EXPORT_INTERVAL_MILLIS environment variable, enabling cost optimization for metrics services like Grafana Cloud. #​22529
• 🏥 Readiness probe endpoint. A new /ready endpoint is now available for Kubernetes deployments, returning 200 only after startup completes and database/Redis are reachable, enabling more reliable container orchestration. #​22507
• 🔩 Tool server timeout configuration. Administrators can now configure a separate HTTP timeout for tool server requests via the AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER environment variable, enabling fine-tuned control over how long tool calls are allowed to take. Commit
• 📌 Knowledge file previews. Knowledge base files can now be opened in a new tab directly from the file list, making it easier to view content without downloading. #​22629
• 🎯 Knowledge tool hybrid search support. The built-in query_knowledge_files tool now respects hybrid search and reranking settings, matching the behavior of the middleware RAG pipeline. Commit
• 🗣️ Temporary chat folder support. Temporary chats can now use folder-level system prompts and knowledge files, making them more powerful for quick explorations. Commit
• 📡 Terminal port previews. Detected ports in the File Navigator can now be previewed inline with a browser-style view, navigation controls, and an address bar, instead of only opening in a new tab. Commit, Commit
• ✏️ File renaming. Files and folders in the File Navigator can now be renamed by double-clicking or using the context menu, with Enter to confirm and Escape to cancel. Commit
• 🧭 File Navigator navigation history. The File Navigator toolbar now includes Back and Forward buttons for navigating through folder and file history, similar to a web browser. Commit
• 🗑️ Delete connection confirmations. Users are now prompted with a confirmation dialog before deleting connections, preventing accidental deletions. Commit
• 📦 Document loader fallbacks. Excel and PowerPoint files can now be processed even when the unstructured package is not installed, using pandas and python-pptx as fallback loaders. Commit
• 🧠 Memory management search and sort. Users can now search and sort their personal memories in the Memory management modal, making it easier to find specific memories. Commit
• 📦 SBOM generation script. A new script for generating CycloneDX Software Bill of Materials is now available in the scripts directory. Commit
• ⚙️ Ruff linter and formatter. Added Ruff as the Python linter and formatter, replacing the black-based workflow for better code quality with near-instant execution. #​22576, #​22462
• 🖥️ Offline code formatting support. The black formatter for Python code editing is now bundled locally in the Docker image, enabling code formatting to work in air-gapped deployments where client browsers cannot reach PyPI. Formatting failures no longer block saves, allowing code to be preserved even when offline. #​22509, Commit
• ✏️ Markdown file editing. Users can now edit and save Markdown files directly in the file navigator, with empty files automatically switching to editor mode for immediate editing. Commit
• 🍔 Model bulk actions menu. Users can now quickly enable, disable, show, or hide multiple models at once using a new hamburger menu on the workspace Models page filter bar, with actions respecting the current search and filter settings. #​22484
• 📂 Files list pagination. The files list API now supports pagination, returning paginated results with a total count for easier navigation through large file collections. Commit
• 🖇 Web fetch content length config. Administrators can now configure the maximum characters to return from fetched URLs via WEB_FETCH_MAX_CONTENT_LENGTH environment variable or the admin settings page, instead of the previous hardcoded 50K limit. Commit, #​22774
• 🤖 Ollama Anthropic endpoint support. The Ollama proxy now supports the Anthropic-compatible /v1/messages endpoint, allowing clients using the Anthropic API format to work through Open WebUI with proper authentication and model access controls. Commit, #​22861
• 📝 Writing block rendering. Responses from OpenAI models that include :::writing blocks are now rendered as formatted content in a styled container with a copy button, instead of displaying raw marker text. #​22672, Commit
• 💡 Memory deletion confirmation. Users are now asked to confirm before deleting individual memory entries, with the memory content displayed for review. #​22888
• 📓 Multi-artifact HTML rendering. Code blocks with multiple HTML sections now render as separate artifacts instead of merging into one, allowing models to display distinct interactive components. Commit
• 🚩 Drag chats as references. Users can now drag chats from the sidebar and drop them into the message input to add them as Reference Chats. Commit
• ⌨️ Terminal system prompts. Terminal servers can now provide custom system prompts that are automatically included when their tools are used. Commit
• 💾 Terminal state persistence. The selected terminal server and its enabled state now persist across page loads, making terminal usage more seamless. Commit
• 💾 Terminal folder downloads. Users can now download folders as ZIP archives and bulk-download multiple selected files as a single ZIP directly from the File Navigator toolbar, making file exports faster and more convenient. Commit, Commit
• 🔐 MCP OAuth 2.1 static credentials. MCP servers that require static client_id and client_secret can now be connected using a new OAuth 2.1 Static auth type, enabling integration with MCP servers that don't support dynamic client registration. #​22266, Commit
• 🎪 Collapsible tool and thinking groups. Consecutive tool calls and reasoning blocks are now grouped into a single collapsible summary (e.g., "Explored tool1, tool2"), keeping chat responses clean and readable while preserving full detail on expand. #​21604, Commit
• 🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
• 🌐 Translations for Finnish, Portuguese (Portugal), Catalan, Turkish, Japanese, Simplified Chinese, Traditional Chinese, Estonian, Spanish, Azerbaijani, and German were enhanced and expanded.

Fixed

• 🔒 Model access control bypass. Fixed a security vulnerability where external clients could bypass model access controls by setting a URL parameter, preventing unauthorized access to restricted models. Commit
• 🛡️ Terminal proxy path sanitization. The terminal server proxy now properly sanitizes paths to prevent directory traversal and SSRF attacks, protecting against security vulnerabilities. Commit
• 🛡️ Tool configuration access control. Tool configuration endpoints now properly verify user permissions, preventing unauthorized access to tool settings. Commit
• 🗝️ Tool valves access control. The tool user valves endpoints now properly verify ownership and access grants before returning or updating configuration, with appropriate 404 responses for missing tools and 401 for unauthorized access. Commit
• 🔐 Collaborative document authorization. Fixed a security vulnerability in collaborative documents where authorization could be bypassed using alternative document ID formats, preventing unauthorized access to notes. Commit
• 🔏 OAuth session persistence. Users logging in via OAuth or OIDC providers now stay logged in for the configured JWT expiry duration instead of being logged out when closing the browser. #​22809
• 🚪 OAuth sub claim configuration crash. Using the OAUTH_SUB_CLAIM environment variable no longer causes crashes during token exchange requests, fixing a missing configuration registration. #​22865
• 🔍 OAuth discovery header parsing. The OAuth protected resource discovery now correctly handles both quoted and unquoted values in the WWW-Authenticate header, fixing compatibility with MCP servers that return unquoted metadata. #​22646, Commit
• 👤 Admin OAuth group sync. Admin user group memberships from OAuth and LDAP providers are now properly synced to Open WebUI, fixing a limitation where admin role excluded users from group updates. #​22537, Commit
• 🎫 Password change complexity validation. Password complexity rules are now properly enforced when users change their password, closing a security gap where new passwords could bypass configured complexity requirements. Commit
• 🔏 OAuth role enforcement. OAuth role management now properly denies access when a user's roles don't match any configured OAUTH_ALLOWED_ROLES or OAUTH_ADMIN_ROLES, instead of silently bypassing the restriction. #​13676, #​15551, Commit
• 🔑 Microsoft Entra ID role claim preservation. Role claims from Microsoft Entra ID tokens are now preserved during OAuth login, fixing ENABLE_OAUTH_ROLE_MANAGEMENT for Microsoft OAuth which was previously ignored because the userinfo endpoint stripped the roles claim. #​20518, Commit
• 🔍 SCIM group filtering. The SCIM endpoint now properly handles displayName and externalId filters when provisioning groups from identity providers like Microsoft Entra ID, preventing all groups from being returned instead of the filtered subset. #​21543
• 🔐 Forwarded allow IPs configuration. The FORWARDED_ALLOW_IPS environment variable is now properly respected by the startup scripts instead of being hardcoded to '*', allowing administrators to restrict which proxies are trusted for request forwarding. #​22539, Commit
• 🍪 Model list auth cookie forwarding. Model list requests to backends that require cookie-based authentication now properly forward auth headers and cookies, preventing "Unauthorized" errors when loading models. Commit
• 🔱 Model lookup race condition. Fixed a race condition in Redis model storage that caused intermittent "model not found" errors in multi-replica deployments under heavy load, by eliminating the window between hash deletion and updates. Commit
• 🎚️ Bulk model action reliability. Bulk enable, disable, show, and hide operations in the admin Models settings now properly refresh the model list after completion, ensuring changes are reflected immediately and correct toast notifications are shown. #​22962, Commit, Commit
• 🔄 Paginated list duplicates. Fixed duplicate items appearing in paginated lists when loading more items in chats, knowledge, notes, and search across the UI. Commit
• 🧽 Duplicate chat list refresh. Sending messages no longer triggers duplicate sidebar chat list refreshes, eliminating an unnecessary database query that was already handled by the save and completion handlers. #​22982
• 🧹 Chat history save optimization. The chat list is no longer refreshed on every chat history save, branch navigation, or edit — only on meaningful state changes like new chat creation, title generation, and response completion. #​22983
• 💬 Message queue responsiveness. The message queue no longer waits for background tasks like title generation and follow-up suggestions to complete, allowing users to send new messages immediately after a response finishes without unnecessary delays. Commit, #​22565
• 🗄️ Migration reliability. Database migrations no longer fail when chat data has unexpected format, making upgrades more reliable. #​22588, #​22568
• 🫧 Memory modal event bubbling. Fixed an issue where clicking the Delete button in the Memory management modal would also open the Edit Memory modal due to event bubbling. #​22783
• 🧩 Memory tool registration. Models with capabilities.memory: true now correctly have memory tools available for execution, fixing a retry loop where add_memory appeared in the tool schema but was not registered for backend execution. #​22666, #​22675, Commit
• 📝 Input variables modal crash. Fixed a crash that occurred when selecting custom prompts with prompt variables, causing the Input Variables modal to display an infinite loading spinner instead of the variable input fields. #​22748, Commit
• 🪛 Function list API crash fix. Fixed a 500 error on the functions list API endpoint that was introduced by the recent optimization, by adding proper model configuration for SQLAlchemy ORM objects. #​22924
• 🗂️ Sidebar chat menu closure. Sidebar chat dropdown menus now close properly after clicking "Clone", "Share", "Download", "Rename", "Pin", "Move", "Archive", or "Delete", instead of remaining visible. #​22884, #​22784
• 🧭 Chat deletion and archive redirection. Users are now redirected to the chat list when deleting or archiving the currently active chat, instead of being left on a stale chat page. #​22755
• 🚩 User menu navigation fix. Clicking Playground or Admin Panel from the user menu now uses client-side routing instead of causing full page reloads, restoring smooth SPA navigation. Commit
• 🔧 Tool server connection persistence. Fixed a bug where tool server connection updates were not being saved to persistent storage, ensuring OAuth client information is now properly preserved. Commit
• 🔩 Tool server index bounds checking. Tool servers with invalid indices no longer crash the application with IndexError after upgrades, preventing tool server configuration loss. #​22490, Commit
• 🔌 Tool server frontend timeout. Fetch requests to external tool servers now time out after 10 seconds, preventing the UI from hanging indefinitely when a configured tool server is unreachable. #​22543, Commit
• 🔌 MCP OAuth tool auto-selection. MCP tools requiring OAuth authentication are now automatically re-selected after completing the auth flow, instead of leaving users to manually re-enable the tool on return to the chat. #​22994, #​22995, Commit
• 🏷️ Channel @​mentions. Direct connection models no longer appear in channel @​mention suggestions, preventing confusion since they don't work in channels. #​22553, Commit
• 📎 Channel message attachments. Users can now press Enter to send messages with only file or image attachments in channels, direct messages, and threads, aligning with the behavior of the Send button. #​22752
• 🗣️ Image-only message handling. Models like Gemini and Claude no longer fail when receiving messages with only file or image attachments and no text, by stripping empty text content blocks before sending to the API. Commit, #​22880
• 🧹 Channel thread sidebar cleanup. The thread sidebar in channels and direct messages now automatically closes when the parent message is deleted, preventing orphaned threads. #​22890
• 💡 Chat input suggestion modal. The suggestion modal for tags, mentions, and commands now correctly reappears when backspacing into a trigger character after it was dismissed. #​22899
• ⏱️ Chat action button timing. Action buttons under assistant messages no longer appear prematurely when switching chats while a response is still streaming. Commit, #​22891
• 💬 Skill and model mention persistence. Skills selected via $ and models selected via @​ in the chat input are now properly restored after a page refresh, instead of reverting to plain text while losing their interactive state. #​22913, Commit
• 🧹 Webhook profile image errors. Fixed 404 errors appearing in the browser console when scrolling through channel messages sent by webhooks, by skipping the user profile preview for webhook senders. #​22893
• 🧮 Logit bias parameter handling. Using logit_bias parameters no longer causes errors when the input is already in dictionary format. #​22597, Commit
• 🪛 Temp chat tool calling. Temporary chats now properly preserve tool call information, fixing native tool calling with JSON schema that was previously broken. #​22475, Commit
• 🔗 Multi-system message merging. Models with strict chat templates like Qwen no longer fail when multiple pipeline stages inject separate system messages, as all system messages are now merged into one at the start. #​22505, Commit
• 📜 Public note access. Opening public notes via direct share link no longer returns a 500 error caused by a missing function import. #​22680, Commit
• 👤 Terminal access user visibility. The terminal connection access dialog now shows the currently logged-in user when searching for users to grant access, fixing an issue where users with identical display names were filtered incorrectly. #​22491, Commit
• 👥 User groups display. User groups in the admin panel profile preview now wrap properly instead of overflowing horizontally, with a scrollbar when the list is long. #​22547
• 🔧 Model list drag-and-drop. Fixed drag-and-drop reordering of models in admin settings, preventing UI glitches and state synchronization issues. Commit
• 🖼️ Model profile image fallbacks. Model profile images now display a fallback icon when they fail to load, and model icons no longer disappear on paginated Models pages in admin and workspace settings. #​22485
• 🖼️ Profile image fallbacks. Added fallback handlers for model and user profile images throughout the chat interface, preventing broken image icons when avatars fail to load. #​22486
• 🧲 RAG thinking model support. Knowledge base queries now correctly parse JSON responses from thinking models like GLM-5 and DeepSeek-R1 by stripping their reasoning blocks before JSON extraction. #​22400
• 🔍 RAG query generation robustness. The RAG query generation, web search, and image generation handlers now correctly extract JSON from model responses containing thinking tags by finding the last JSON block instead of the first, preventing "No sources found" errors with thinking models. #​21888, Commit
• 🔍 Ollama embedding robustness. Ollama embedding requests now include the truncate parameter to handle inputs exceeding the context window, preventing 500 errors when processing long documents. Error messages from failed embedding requests are also now properly surfaced instead of being silently swallowed. #​22671, Commit
• 🔄 Ollama embedding retry logic. Embedding requests to Ollama now retry with exponential backoff when encountering 503 errors (such as when the model reloads mid-processing), preventing files from being silently dropped from knowledge bases. #​22571, Commit
• 🗄️ Oracle 23AI hybrid search. Fixed an UnboundLocalError that occurred when using hybrid search with Oracle 23AI as the vector store, preventing knowledge base queries from failing. Commit, #​22616
• 🧩 MCP integration visibility. MCP (Streamable HTTP) integrations are now hidden from user-level settings, matching the intended behavior where only administrators can configure MCP connections through the admin panel. User-level connections now show the connection type as read-only. #​22615, Commit
• 🌐 Dynamic HTML language attribute. The HTML lang attribute now dynamically updates when users change their interface language, preventing browsers from triggering unwanted translation popups. Commit
• 📐 File upload deduplication. Attaching files that are already in the chat no longer triggers duplicate uploads. Commit
• 🕵️ Serper.dev search results. Fixed web search results not displaying properly when using the Serper.dev provider by using the correct API response field. #​22869
• 🔲 Markdown task list checkbox styling. Fixed task list checkboxes in markdown rendering to display consistently without shrinking in narrow layouts. #​22886
• 🎨 Artifacts sidebar tab background fix. The Artifacts sidebar now correctly updates and displays when switching back to a browser tab that was in the background, ensuring artifacts are visible without requiring a manual refresh. #​22889
• 🔃 Chat input URL indexing fix. Fixed an issue where URLs could be indexed twice when using multiple triggers followed by backspace and re-entering a URL. #​22749
• 🔎 Search modal chat preview avatars. Fixed assistant profile images not displaying in the chat preview pane of the Search Modal. #​22782
• 📋 Prompts search pagination fix. Fixed a bug where searching prompts from a paginated page would incorrectly use the current page number, resulting in "No prompts found" even when matching results existed. #​22912
• 🗂️ Reasoning block copy cleanup. Copied chat responses no longer include reasoning block content or excess whitespace, ensuring only the intended message text is captured. #​22786, Commit
• 🔤 Emoji removal for text normalization. Fixed the emoji removal function used in search and title generation to correctly handle all emoji types, including those with variation selectors (❤️, ☀️, ✅), keycap sequences (1️⃣), and ZWJ family sequences (👨‍👩‍👧‍👦). #​22915
• ⏹️ Task cancellation status tracking. Cancelled tasks now correctly mark only the affected messages as done instead of clearing all task statuses for the chat, ensuring proper status tracking when multiple messages have pending tasks. #​22743
• 🎨 Filter icon display fix. Fixed filter icons showing the wrong icon after removing one of multiple active filters below the chat input. #​22862
• 📊 Channel message data loading. Fixed redundant 404 API calls that occurred when rendering channel messages, preventing unnecessary requests and console errors. #​22894
• 👻 Response message skeleton display. Fixed an issue where the skeleton loader would incorrectly show or hide based on complex status history conditions, by extracting the visibility logic into a cleaner reactive variable. Commit
• 🐛 Shared chat viewing crash. Shared chats can now be viewed by unauthenticated users without crashing, with proper fallback handling for missing user profile information. #​22751, #​22742
• 🛠️ Plugin ID sanitization. Creating Functions or Tools with emojis or special characters in their names now generates valid IDs that pass backend validation, instead of failing with an error. #​22695
• 📋 Chat title preservation. Regenerating responses or using branches no longer overwrites user-specified chat titles when auto-naming is disabled, by checking the full chat message count instead of just the current branch. #​22754
• 🎧 Read Aloud in chat preview. The Read Aloud button in the Search Chats modal preview no longer causes crashes, and TTS functionality is now properly hidden in read-only chat contexts. Commit
• 📡 Heartbeat event loop blocking. The WebSocket heartbeat handler no longer blocks the event loop when updating user activity, improving responsiveness under heavy load with many concurrent connections. #​22980
• 🗝️ Message upsert API reliability. The message upsert API endpoint no longer crashes when called, fixing an error where a database session was incorrectly passed to a function that doesn't accept it. #​22959, Commit
• 🔓 Forward auth proxy compatibility. Fixed error pages that could appear when using authenticating reverse-proxies by properly handling 401 responses from background API requests, allowing the browser to re-authenticate with the identity provider. #​22942
• 🔃 Tool call streaming display. Sequential tool calls are now properly accumulated during streaming, fixing an issue where completed tool calls could disappear from the display before the next tool call finished streaming. Commit
• 🧠 Reasoning spinner content preservation. Prior assistant content and tool call blocks no longer disappear during the reasoning spinner when responding after tool execution. #​23001
• 🖥️ Pyodide file list refresh. Files created or modified during manual code execution now appear immediately in the pyodide files list without requiring a browser tab refresh. Commit
• 🖱️ Dropdown submenu hover stability. Secondary hover menus like Download and Move now remain open while navigating into them, fixing an issue where an 8px gap between the trigger and submenu would cause the menu to disappear before a selection could be made. #​22744, Commit
• 📊 Model tag normalization. Model tags from backends that return them as string arrays are now properly normalized to object format, preventing crashes when filtering models by tag in the admin and workspace models pages. #​20819, Commit
• 🎯 Arena model sub-model settings. Arena models now properly use the selected sub-model's settings — including RAG knowledge bases, web access, code interpreter, and tool capabilities — instead of the arena wrapper's empty defaults. #​16950, Commit
• 🧩 Model editor default metadata. The Model Editor now loads admin-configured default model metadata instead of hardcoded values, preventing admin defaults from being silently overwritten when users save models without realizing they were overriding system-wide settings. #​22996, Commit
• ✏️ Rich text paste sanitization. Copying and pasting text with HTML characters (like < or >) no longer corrupts the editor content, as the paste handler now properly escapes HTML entities before processing mentions and special syntax. Commit

Changed

• 🪝 User webhooks disabled by default. User webhook notifications are now disabled by default and properly gated by the ENABLE_USER_WEBHOOKS configuration, ensuring webhooks only fire when explicitly enabled. Commit
• 🧲 Web search result limit. The configured web search result count now acts as a maximum limit, preventing models from requesting more results than administrators allow. #​22577

v0.8.11

Compare Source

Added

• 🔀 Responses API streaming improvements. The OpenAI proxy now properly handles tool call streaming and re-invocations in the Responses API, preventing duplicate tool calls and preserving output during model re-invocations. Commit, Commit, Commit, Commit
• 🔀 Responses API stateful sessions. Administrators can now enable experimental stateful session support via the ENABLE_RESPONSES_API_STATEFUL environment variable, allowing compatible backends to store responses server-side with previous_response_id anchoring for improved multi-turn conversations. Commit
• 📄 File viewing pagination. The view_file and view_knowledge_file tools now support pagination with offset and max_chars parameters, allowing models to read large files in chunks. Commit
• 🗺️ Knowledge search scoping. The search_knowledge_files tool now respects model-attached knowledge, searching only within attached knowledge bases and files when available. Commit
• 🛠️ Tool HTML embed context. Tools can now return custom context alongside HTML embeds by using a tuple format, providing the LLM with actionable information instead of a generic message. #​22691
• 🔒 Trusted role header configuration. Administrators can now configure the WEBUI_AUTH_TRUSTED_ROLE_HEADER environment variable to set user roles (admin, user, or pending) via a trusted header from their identity provider or reverse proxy. #​22523
• 🔑 OIDC authorization parameter injection. Administrators can now inject extra parameters into the OIDC authorization redirect URL via the OAUTH_AUTHORIZE_PARAMS environment variable, enabling IdP pre-selection for brokers like CILogon and Keycloak. #​22863, Commit
• 🔑 Google OAuth session persistence. Administrators can now configure Google OAuth to issue refresh tokens via the GOOGLE_OAUTH_AUTHORIZE_PARAMS environment variable, preventing OAuth sessions from expiring after one hour and ensuring tools and integrations that rely on OAuth tokens remain functional. #​22652
• 🔌 Embed prompt confirmation. Interactive tool embeds can now submit prompts to the chat without requiring same-origin access, showing a confirmation dialog for cross-origin requests to prevent abuse. #​22908
• 🏮 Tool binary response handling. Tool servers can now return binary data such as images, which are properly processed and displayed in chat for both multimodal and non-multimodal models. Commit, Commit
• ⚡ Svelte upgrade performance. Page and markdown rendering are now approximately 25% faster across the board, with significantly less memory usage for smoother UI interactions. #​22611
• 🧩 Model and filter lookup optimization. Model and filter membership lookups are now faster thanks to optimized data structure operations during model list loading. Commit
• 💨 Chat render throttling. Chat message rendering now uses requestAnimationFrame batching to stay smooth during rapid model responses, preventing dropped frames when fast models send many events per second. #​22947
• 🚀 Function list API optimization. The functions list API now returns only essential metadata without function source code, reducing payload sizes by over 99% and making the Functions admin page load significantly faster. #​22788
• ✨ Smoother loading animation. The loading shimmer animation now looks smoother and more natural, with softer highlight colors. #​22516
• 🧪 Terminal connection verification. Users can now verify their terminal server connection is working before saving the configuration, making setup more reliable. #​22567
• 📁 Chat folder emoji reset. Users can now reset chat folder emojis back to the default icon using a "Reset to Default" button in the emoji picker, making it easier to revert custom icons. #​22554
• 📊 Metrics export interval configuration. Administrators can now control OpenTelemetry metrics export frequency via the OTEL_METRICS_EXPORT_INTERVAL_MILLIS environment variable, enabling cost optimization for metrics services like Grafana Cloud. #​22529
• 🏥 Readiness probe endpoint. A new /ready endpoint is now available for Kubernetes deployments, returning 200 only after startup completes and data

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - "after 2am,before 5am" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.