Added

• 🎨 Redesigned interface. Open WebUI has been visually rebuilt from the ground up. All aspects of the User Interface, from the chat view to the admin panel. Now with a narrower conversation column, lighter typography, tidier spacing, consistent menus and dropdowns, clearly outlined text boxes, and settings rearranged. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, #27178, Commit, Commit
• 🤖 Sub-agents. Administrators can now enable sub-agents, which let a model hand parts of a task to background helper agents that run their own tool-driven conversations and report results back into the chat, tuned through new "ENABLE_SUBAGENTS", concurrency, iteration, and system-prompt settings. Commit, Commit, Commit, Commit
• 📂 Folder pages. Opening a folder now takes you to its own page, where its chats load a page at a time, can be sorted by title or last updated, and you can start a new chat straight from the folder. Commit
• ⏲️ Chat timers. The assistant can now set a timer that brings a prompt back into the conversation later, after a delay or at a set time, and can drop it automatically if you read the chat or reply before it fires. Commit
• 🔔 Notification targets. Notifications now have their own settings tab where you can send them to several webhook destinations, each picking which events it wants, from chats finishing or failing to channel messages and calendar alerts, with a test button and a choice between always notifying or only when you are away, and any webhook you already had is carried over for you. Commit, Commit, Commit, #24750
• 🗯️ Full replies in channels. A reply from the assistant in a channel is now saved and shown in full, with its reasoning, tool calls and other structured parts, where it previously came through blank. Commit, #26720, #27409, #26707, #26656
• 📣 Notifications from the assistant. The assistant can now send you a notification itself when something is worth your attention, so a long task can reach you after you have moved on to something else. Commit, Commit
• 🌎 Share a chat with anyone holding the link. A shared chat can now be set to Open so it opens without signing in, with visitors no longer bounced to the sign-in page on their way to it, which administrators must first allow through a new "Chats Open Sharing" permission that stays off by default, and such pages ask search engines not to index them. Commit, Commit
• 🔖 Chat variables. A model's system prompt can now declare fields such as text boxes and dropdown lists that you fill in for a conversation, with the values saved alongside the chat and carried over when it is forked or cloned. Commit, Commit, Commit, Commit, Commit, Commit, #26915
• 🗄️ LDAP group synchronization. Administrators can now map LDAP groups to Open WebUI groups from the authentication settings, with optional automatic creation of missing groups, so a user's group memberships are kept in step with the directory each time they sign in. #27263, #18015
• 👥 Restrict sharing with groups. Admins can now stop resources from being shared with entire groups through a new "USER_PERMISSIONS_ACCESS_GRANTS_ALLOW_GROUPS" permission, which stays enabled by default so existing group sharing keeps working untouched. Commit, Commit, Commit, Commit, #27124
• 🤝 Shared folder collaboration. People with access to a shared folder can now use its files and system prompt as knowledge in chat and, with write access, rename and manage the folder, all according to their read or write permission. Commit, Commit, Commit, Commit
• 👁️ Chat previews in the sidebar. Hovering a chat in the sidebar now shows a compact preview of its recent messages, so you can find the conversation you want without opening it. Commit, Commit, Commit, Commit
• 🕗 Local message timestamps. Message timestamps now appear on hover in your device's local date and time format, with the full weekday and date shown in a tooltip. Commit, Commit
• 📇 User variables. You can now store your own values in account settings, such as your role or how you like answers written, and a model's system prompt can insert them wherever they are needed. Commit, Commit, Commit
• 🧺 Automations that file their chats away. An automation can now be pointed at one of your folders, from the dialog, the editor or by asking the assistant, so each run lands there instead of loose in your chat list, and the folder is cleared automatically if it is later deleted. Commit, Commit, Commit
• 🔵 See what you have not read yet. Folders in the sidebar now carry a count of chats with something new in them, a folder's own page marks unread chats with a dot, shows a spinner on any still generating, clears the dot as you open one, and keeps itself up to date as replies finish elsewhere, unread chats sort to the top of a folder, and you can mark a single chat unread again mark everything in a folder read, or mark every chat read at once from the sidebar. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
• 🗜️ Compact a chat on demand. Typing a compact command in a long conversation now summarizes the earlier turns straight away, instead of waiting for it to happen automatically once the conversation grows past the threshold. Commit, Commit
• 🌿 Fork a chat. Every response now has a fork button that copies the conversation up to that point into a new chat which remembers where it branched, so you can carry on down a different path without touching the original. Commit, Commit, Commit, Commit
• 📌 Pin the conversation map. The chat overview now has a pin control that stops it recentring on the newest message, so you can keep looking at the branch you were reading while a reply comes in. #25736
• 📊 Chat status at a glance. The slash menu now shows how full the context window is, and a new status command opens a panel with context usage, queued messages, running tasks, and the chat ID. Commit, Commit
• 🎹 Customizable keyboard shortcuts. Most keyboard shortcuts can now be rebound to key combinations of your choosing in settings, which saves them to your account, warns you when two actions share a combination, and offers a reset to the defaults, with moving to the previous or next chat and opening the controls panel available to bind as well. Commit, Commit, #26624
• ⌨️ Turn keyboard shortcuts off. A new switch in the keyboard settings disables every configurable shortcut and hides its hint, so combinations that clash with your browser or operating system pass straight through. #27300, #1008
• ⌨️ Skills in slash commands. Typing a slash in the message input now lists your skills alongside your prompts, grouped under headings and with descriptions on hover, so you can attach a skill without leaving the keyboard. Commit
• 📎 Attach anything with the at menu. Typing an at sign in the message input now searches your folders, knowledge collections, and individual files as well as your models, and pasting a link offers it as a web page or YouTube attachment. Commit
• 📝 Chat with a note. Chatting with a note now gives you the full chat experience, including model choice, tools and file attachments, alongside suggested prompts, a button to insert a response straight into the note, edits that appear in the note as the assistant makes them, and as many separate conversations per note as you want to keep. Commit, Commit
• ↕️ Sort your lists. The notes, prompts, models, knowledge, skills, tools and functions lists can now be sorted by title or by when they were last updated, in either direction, by clicking the column headings. Commit, Commit, #27457, #27456
• 🗒️ Notes without stored contents. A note whose contents were never filled in now opens and saves normally instead of failing. Commit
• 📄 Note attachments. Notes now have an upload option in their menu and show attached files above the note itself, where you can open or remove them, instead of only accepting files dropped onto the page. Commit, Commit
• 🗂️ The assistant can search your attachments. A new Files capability lets the model list the files attached to the chat and search them by meaning or by exact text, and read the parts it needs, rather than having their whole contents pushed into the conversation up front, and knowledge collections or notes attached to a chat are now announced to the model so it can query those the same way. Commit, Commit, #26711, #27232, #26708
• 🔎 Search in the attachment menu. The attachment menu now lets you search your knowledge bases, notes, files, and chats instead of scrolling to find them, with matching text shown for chats. Commit
• ⚗️ Default file upload mode. You can now choose in settings how attached files are handled by default, rather than picking that on each upload. #20900, #18431
• ⬇️ Response auto-scroll toggle. A new interface setting lets you stop the view following a reply as it is written, so you can read earlier text while generation continues. Commit, #26826
• 📜 Client certificates for SearXNG. Web search can now present a client certificate to a SearXNG instance that requires one, through new "SEARXNG_CLIENT_CERT_FILE" and "SEARXNG_CLIENT_KEY_FILE" settings. Commit, #26992
• 🔭 OpenSERP web search. Web search can now run against a self-hosted OpenSERP instance, which returns results from several major search engines without any API key, configured through a new "OPENSERP_BASE_URL" setting. #27437, #27438
• 🥇 Model order as a setting. Administrators can now set the order models appear in through a new "MODEL_ORDER_LIST" variable, so the arrangement survives a restart on instances that do not persist configuration. #27420, #27206
• ⏱️ Idle cap for streamed replies. Administrators can now set an "AIOHTTP_CLIENT_STREAM_IDLE_TIMEOUT" that ends a streamed reply when the provider stops sending anything for that long, instead of holding the connection open until the overall timeout expires. Commit, Commit
• 🖼️ Media types an extraction engine may handle. Administrators can now list which image and video types the configured content extraction engine is allowed to process, instead of media being passed to it only when the engine is the external one, so an engine with its own text recognition can take images. Commit, #26940, #14768
• 🧵 Where a channel reply lands. Administrators can now choose whether a reply to a mention posts in a thread under that message or straight into the channel. Commit, #27410
• 📚 Limits for knowledge tools. Administrators can now set how much a knowledge search or file view may return, how many files one search may scan, and how many matches are reported, and a knowledge command's whole output is now capped so a single call cannot flood the conversation. Commit, #27524, #27327, #26139
• 🎛️ File streaming chunk size. Administrators can now tune how large each chunk of a streamed file transfer is through a new "AIOHTTP_FILE_STREAM_CHUNK_SIZE" setting. Commit
• 🪛 Model for summarizing long chats. Administrators can now pick a dedicated model to write context compaction summaries, separate from the task model, with the conversation's own model used when none is chosen. #26806, #27051
• 📏 Context compaction token cap. Administrators can now set a "Token Cap" that limits how high per-model context compaction thresholds are allowed to reach, giving finer control over long-conversation summarization. Commit, Commit, Commit
• ⚖️ Retained messages after compaction. Administrators can now set what share of recent messages survives when a long conversation is summarized, between a tenth and half of it. Commit, #27050
• 🧠 Memory as a per-model capability. Whether a model receives your stored memories is now a switch on the model itself, so it can be left on for everyday assistants and off for ones that should start from nothing. Commit, #26861, #18610
• ☑️ Searchable model pickers. When editing a model, the Tools, Skills, Knowledge, Voice, Filters and Actions pickers now let you search and toggle items in place, select or clear them all at once, and see what is active at a glance. Commit, Commit, Commit, Commit, Commit, Commit, #26758
• 🎚️ Switch for single sign-on. OAuth and OIDC now have their own on and off switch in the authentication settings, matching the LDAP one above it, so sign-in through a provider can be turned off without clearing the configuration. #26988
• 🖲️ One sign-in attempt at a time. The sign-in, sign-up and LDAP form now disables its buttons while a request is in flight, so a slow response no longer turns repeated clicks or Enter presses into several concurrent attempts. #27416, #27264
• 🛂 Trusted clients for token exchange. Administrators can now list which OAuth clients may have their tokens exchanged for a session, through a new "OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS" setting, so a token a person obtained by signing in to an unrelated application of the same provider can no longer be turned into a session as that person. #27546, Commit, Commit
• 🚪 Throttle for token exchange. Administrators can now cap how often the OAuth token exchange endpoint may be called from one address through new "OAUTH_TOKEN_EXCHANGE_RATE_LIMIT" and "OAUTH_TOKEN_EXCHANGE_RATE_LIMIT_WINDOW" settings, which bound automated attempts with leaked or guessed tokens and stay off until set. Commit
• 🔏 PKCE for every sign-in provider. The code challenge setting now applies to Google, Microsoft and GitHub sign-in as well as OpenID Connect, so the same protection covers every provider. Commit, #27302
• 🔤 Embeddings through the OpenAI-compatible API. Integrations built on OpenAI client libraries can now create embeddings through the Ollama proxy, so embedding requests go through the same sign-in and model access rules as chat instead of needing direct access to Ollama. #27332, Commit, #27328, Docs:#1331
• 🎚️ Passthrough parameters per connection. Administrators can now list request parameters that a connection should receive untranslated, under a new Advanced section in connection settings, so provider-specific options reach the upstream API intact. Commit
• 🅰️ Anthropic requests passed straight through. Requests to the Anthropic-compatible API aimed at an Anthropic or LiteLLM connection now reach the provider untouched rather than being translated on the way, and LiteLLM is selectable as a connection type. Commit
• 💭 Reasoning in Anthropic responses. Responses from the Anthropic-compatible API now carry the model's reasoning as thinking blocks, in both streamed and complete responses. Commit
• 🧩 Structured output through the Anthropic-compatible API. Requests can now ask for a JSON schema or JSON object response and set a reasoning effort, which are carried through to the upstream model. Commit
• 🪧 Group names in forwarded headers. Custom headers on a connection can now carry the groups a person belongs to, by name or by id, so an upstream service or gateway can apply its own rules per group. #27236, #26834
• 🪪 User identity forwarded to Mistral OCR. Document extraction through Mistral OCR now carries the requesting user's identity when user info forwarding is enabled, so a gateway in front of it can attribute requests per user like other outbound integrations already do. #27253, #27250
• 🔢 Anthropic token-counting endpoint. The Anthropic-compatible API now offers a token-counting endpoint, so integrations can check how many input tokens a request will use before sending it. Commit, Commit
• 🖲️ Terminal instructions read fresh. The instructions a terminal server provides are now fetched for each request, so changing them on the server takes effect immediately instead of after re-saving the connection or restarting. #27242
• 🖥️ Live terminal server policies. Administrators can now read an orchestrator terminal server's current policy and lifecycle settings directly in connection settings rather than relying on a locally cached copy. Commit, Commit
• 🌍 Model privacy at a glance. Admins can now make a model public or private straight from its menu in the model list, where each model is marked as public, shared, or private. Commit
• 📈 Personal usage dashboard. A new Usage tab in settings shows your own activity over time, including a token-activity heatmap, current and longest streaks, lifetime and peak token counts, your longest active chat, and your most used models and tools. Commit
• 🧠 Memories in settings. Your memories are now listed directly in personalization settings where you can search, add, edit, and remove them, instead of being tucked behind a separate manage dialog. Commit
• 💾 Import notes and automations. Notes can now be brought in from text and markdown files, and automations can be exported and imported as files, so you can move them between instances. Commit, Commit
• 🧮 Counts in the tabs. The workspace tabs now show how many models, knowledge bases, prompts, skills, and tools you have, and the admin tabs do the same for users, groups, leaderboard entries, and feedback, so you can see the size of each section without opening it. Commit, Commit, Commit
• 🧾 Group permissions at a glance. The groups list now shows whether each group uses custom or default permissions, without opening it. Commit, Commit
• 📤 Streamed file transfers. Uploading a model, pipeline or audio file now sends it in chunks instead of holding the whole thing in memory, and reading and writing files no longer blocks other requests, so large transfers no longer spike memory or stall the server. Commit, #27351, #27349
• 🧰 Built-in tool descriptions built once. The descriptions handed to the model for the built-in tools are now worked out once at startup rather than rebuilt on every message. Commit, Commit, #27374, #27396
• 🪺 Records read without a double pass. Loading a model, tool, prompt, skill, note, knowledge base, channel or calendar no longer converts the record twice on the way out. Commit, #27377
• 🔧 Faster tool and knowledge base listings. Listing tools no longer loads each one's full source, and working out which tools and knowledge bases you can see takes a single check rather than one per item. #27387
• 🧊 Quicker collection checks on Chroma. Checking whether a collection exists now asks for that one collection instead of listing them all, which grew slower with every knowledge base and file. Commit, #27394
• 🔠 Tokenizer loaded once. The tokenizer used to split documents is now kept after first use rather than being loaded again for every file. Commit, #27394
• 📗 Faster knowledge base file lists. Opening a knowledge base now loads just the file names and details instead of the entire extracted text of every document, so large collections appear almost instantly. #27386, #26144
• 🗝️ Faster file access checks. Working out whether you can open a file no longer scales with how many workspace models and knowledge bases exist, so opening files and listing folder contents stays quick on large instances. #27383
• 🕰️ Faster automation scheduling. Working out when an automation that repeats every few minutes or hours runs next is now near instant, instead of taking twenty seconds or more and slowing further each year. Commit, #26954
• 📁 Faster folder loading. Your folder list no longer runs a separate lookup for every folder to check where it sits, so it loads in a single pass. Commit
• 🎯 One round of requests per folder click. Selecting a folder in the sidebar now fetches the folder, the folder tree, and each expanded folder's chats once instead of two to four times. #27540, #27539
• 🎧 No wasted work when nobody is listening. Updates for a chat whose tab has been closed, or for requests made through the API, are no longer packaged up only to be discarded, which matters most on long streamed replies. #27366, Commit
• 📑 Cheaper audit logging. With audit logging on, each request is no longer authenticated a second time just to record the log entry, so audited instances carry noticeably less overhead. #27373
• 🪧 Cheaper tagging after each reply. Saving the tags generated for a conversation now updates just that field instead of loading, rewriting and re-reading the whole conversation, which cost more the longer the chat. #27382
• ✍️ Faster saves across the app. Saving a chat, note, prompt, tool or user setting no longer re-reads the record it just wrote, so writes finish sooner, most noticeably on long conversations. #27381, #27379, Commit, Commit
• 🛢️ Less database overhead per request. SQLite installations no longer run a connection check before every database call, and requests that never touch the database skip the bookkeeping that used to run regardless. #27385
• ⚡ Faster memory lookups. Stored memories are now indexed so retrieving them stays quick as the number you have grows. Commit, #26957
• 🪪 Fewer checks before a reply starts. Working out whether you may use a model now looks up the model and your group memberships once instead of repeating both, including for every model a workspace model is built on. #27378
• 👤 Lighter user activity checks. Checking whether someone is currently active now reads only that timestamp rather than their whole profile, including their profile image. Commit, #27224
• 📨 Fewer settings lookups when sending a message. Sending a chat message now reads the settings behind tools, file retrieval, voice, skills and the code interpreter in fewer trips to the database, so replies start sooner. #27223
• 🪄 Lighter conversion for Ollama requests. Preparing a request for an Ollama model no longer copies the entire conversation before sending it, which cost more with every message and repeated on each tool-call round. #27371
• 🦙 Fewer settings lookups on Ollama requests. Ollama chat, generation and embedding requests now read their connection settings once instead of up to four times, so each request reaches the server sooner. #27226
• 🧹 Less repeated work on every response. Security headers are now worked out once at startup rather than rebuilt for each response, and ordinary page requests skip the redirect handling they never needed, so responses carry less overhead. #27229
• 🚀 Lower per-request overhead. Requests no longer each perform a settings lookup before they are handled, trimming a little latency from everything the app does. Commit, #27395, Commit, Commit, #27227
• 💨 Leaner filter handling while streaming. Filters applied to a streaming reply no longer re-read their settings and each plugin's full source from the database for every chunk, so responses with filters enabled cost the server far less work. #27228, #27372, Commit, Commit, Commit, #27392
• 🚦 No filter bookkeeping without filters. Streamed API responses only build up the full reply for outlet filters when the model actually has one configured, instead of doing it for every request. Commit, #27391
• ✂️ Cheaper tag detection while streaming. Watching a reply for reasoning and code blocks now examines only the newly arrived text rather than rescanning the whole answer on every chunk, so a long answer no longer costs progressively more as it grows. #27360
• 🌊 Steadier long responses. Building up a streamed reply no longer costs more work as it grows, so long answers keep pace instead of slowing down toward the end. #27231, #27359, Commit, #27390
• 📦 Faster JSON handling as an option. Administrators can now switch the whole application to a faster encoder through a new "ENABLE_ORJSON" setting, covering request bodies, responses, upstream provider payloads and live updates, where the encoding of live updates was the largest single cost on the workers handling them in clustered deployments; it stays off by default because the faster encoder is stricter about what it accepts. #27583
• ⚙️ Faster Redis handling. The compiled "hiredis" parser now ships as a dependency and is used automatically, so deployments backed by Redis spend noticeably less processor time reading responses. #27282
• 🔗 Fewer Redis round trips per chat. Deployments backed by Redis now look up the model and connected sessions once per request instead of twice, and fetch the model list in a single call. #27225
• 🛰️ Fewer Sentinel lookups. Redis Sentinel deployments no longer ask which server is the primary and open a fresh connection before every single command, which had caused heavy connection churn and stalls under load. Commit, #27213, #27210
• 📡 Lighter live connection handling. Typing indicators, shared document edits and reconnections no longer re-read your account or copy the full participant list each time, and idle sessions are no longer rewritten every few seconds. Commit, #27393
• 🏎️ Faster chat search on PostgreSQL. Searching chats on PostgreSQL now reads from the message table instead of unpacking each conversation's stored data row by row, so results stay quick as your history grows. Commit, #27221
• ⚡ Lighter model lists. Model lists no longer carry embedded profile images in their data, so they load faster. Commit, Commit
• 🏗️ Fewer queries when building the model list. Assembling the model list now makes fewer database round trips and no longer fetches every plugin's source code along the way, so it comes together faster. Commit, #27389
• 🪶 Model lists without knowledge text. Model lists no longer include the extracted text of files attached to a model as knowledge, so they stay small regardless of how large those knowledge bases are. Commit, #27287
• 🔛 Functions can react to being switched on or off. Two new events fire just before a function is enabled or disabled, and the function being enabled receives its own event even though it is not active yet, so it can run whatever setup or teardown it needs. Commit, #26754, #26748
• 🔛 Multiple choice settings in plugins. A tool or function can now offer a setting where you tick several options from a list, fixed or worked out at the time it is shown, instead of asking you to type a comma-separated list of allowed values. #26884, #26848
• 🔌 Disable plugins entirely. Administrators can now completely turn off the built-in Tools and Functions plugin surfaces through a new "ENABLE_PLUGINS" setting, which hides them across the workspace and admin areas and removes their execution paths. Commit, Commit, Commit, Commit
• 🧵 Lighter chat listings and search. Building a page of chat search results or a folder listing no longer copies each full conversation to read its title and dates, so those pages come together faster and use far less memory while they are built. #27388
• 📮 Name lookups off the thread pool. Looking up a hostname no longer occupies one of the limited threads shared by every other piece of blocking work, so model calls, searches, page fetches and tool calls stop queueing behind each other once a few lookups are slow. #27440
• 🥬 Faster web page parsing. Pages pulled in by web search and web retrieval are now read with a faster parser, cutting roughly a tenth off the time spent on a ten result search. #27439
• 🧭 No pointless lookups when filtering search results. Filtering web search results against a domain list no longer resolves every result to an address first, which had turned a three second search into half a minute wherever the resolver was slow or a name did not resolve. Commit, #26920
• 🚄 Leaner passthrough streaming. Responses the server only relays now go straight through in whole network reads instead of being split line by line, roughly halving the work spent shuttling a streamed reply on those routes. #27384
• 🧶 Web page parsing off the critical path. Reading those pages no longer holds up everything else on the server, so other people's replies, live updates and health checks keep flowing during a search instead of stalling for a second or more. #27446
• 🈶 Faster uploads of non-English text files. Working out the encoding of an uploaded text file now samples the part that needs it rather than scanning the whole file, taking a four megabyte Japanese or Chinese document from several seconds down to well under one. #27445
• ♿ Improved UI accessibility. Keyboard and screen reader users can now tell which chat in the sidebar is the one being viewed, open reasoning and detail blocks in a response, expand sidebar sections and open a folder without a mouse, sort the admin user list from the keyboard and hear which column it is sorted by, open a dropdown and its submenus with the keyboard, close them again with Escape and land back where they started, hear which value a dropdown is set to rather than only its label, hear what each admin settings switch, group permission toggle, checkbox, API key field and advanced model parameter slider controls, have the message box announced by its placeholder instead of as an unnamed field, press Enter on Cancel in a confirmation dialog without triggering the delete, reach the regenerate control, jump straight past the sidebar to the conversation with a skip link, hear what an icon-only button does across chat, calls, file previews, modals and the admin pages rather than an unlabelled button, placeholder text, section headings, field descriptions, inactive tab labels, timestamps, counters and icons are now readable against their background when High Contrast Mode is on, and sidebar buttons across notes, automations, the playground, and admin pages announce whether they open or close the sidebar. #27510, #27513, #27503, #27494, #27491, #27490, #27489, #27488, #27555, #27556, #27554, #27558, #27501, #27492, #27509, #27502, #26769, Commit, Commit, #26768, #26770, Commit, Commit, Commit, #27508
• 🔄 General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
• 🌐 Translation updates. Slovenian is now available, and translations for English (UK), Finnish, German, Japanese, Portuguese (Brazil) and Portuguese (Portugal) were enhanced and expanded.

Fixed

• 🛡️ Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories
• 🔒 Terminal file preview isolation. Previewing an HTML file in the system terminal now runs it in an isolated context by default, closing a cross-site scripting hole that could expose your login session or, for privileged accounts, run code on the server. #26907
• ➗ Malformed maths in a message. Maths that fails to render is now shown as plain text rather than being placed into the page as markup, closing a way for a crafted formula in a chat, channel or shared conversation to run code in the browser of anyone reading it. #26718
• 🔩 Updated file upload parsing library. The library that parses file uploads and form submissions has been updated to a release that addresses a security advisory affecting that parsing path. #26991
• 🛑 Deactivated accounts lose live access. Real-time connections now apply the same role check as the rest of the application, so an account moved out of the user or admin role can no longer keep its channels and shared notes open on an existing token. #27537
• 🛅 Writing into someone else's chat. Completion and action requests now confirm you own the chat they name before anything is written to it, so a filter or action can no longer be pointed at another person's conversation. #27486
• 🎟️ Ollama version no longer readable anonymously. Reading the configured Ollama backend's version now requires signing in, closing a route that let anyone learn the version in use and count how many backends are configured. #27199
• 🔐 Folder sharing permission. The folder sharing setting in default and group permissions now saves instead of being silently discarded, so allowing or restricting folder sharing actually takes effect. #27296, #27120
• 🔕 Webhook permission enforcement. People without permission to use webhooks can no longer save webhook notification destinations to their settings, so the permission is enforced when settings are saved rather than only reflected in the interface. #27297, Commit
• 🛎️ Stopping someone else's generation. Deleting a chat now checks who you are before anything is cancelled, so knowing another person's chat id no longer lets you cut off their reply or title generation on a request that is refused anyway. #27006
• 🚥 Automation limits in chat. Automations that the assistant creates or reschedules on your behalf now respect the same maximum count and minimum interval as the ones you set up yourself, instead of being able to exceed both. #27523, #27121
• ⏲️ Cancelling someone else's timers. Marking a chat as read now only clears your own pending timers on it, instead of clearing everyone's, which had let another person's scheduled prompt be silently cancelled without them being told. #27472
• 🗑️ Deleting a shared folder's subfolders. Deleting a folder is now limited to its owner or an administrator at every level, so someone with write access to a shared folder can no longer delete a subfolder and take the owner's chats with it. #27003
• 📕 Tool source shown to people who can only use it. Opening a tool you were given read access to no longer returns its source code, which read access was never meant to include. #27005
• 🎯 Model settings in the list endpoint. Listing models no longer includes each one's parameters and system prompt for people with read access only, matching what opening a single model already returned. #27004
• 🖌️ Image generation and web search without permission. Turning on image generation or web search through the older request format now checks your permission first, so someone denied those features can no longer trigger them, and the billing that comes with them, by asking for that format. #26703
• 🎗️ Terminal single sign-on tokens. The token forwarded to a terminal server for single sign-on is now taken from your own session on the server rather than from a header the browser supplied, so a caller can no longer send someone else's token in its place. #26719
• 🫗 Web search results scoped to you. The temporary collections holding a web search's pages are now tied to the person who ran the search, closing the one place where that scoping was not applied. #26706
• 🧺 Knowledge base cleanup reaching other collections. Tidying up a knowledge base now acts only on files and folders that belong to it, so someone with write access to one knowledge base can no longer delete folders or search data belonging to another. #26722
• ⌛ Searches that could stall the server. A search pattern inside knowledge base commands now runs under a time budget, so a pattern that would take minutes to evaluate can no longer hold up everyone else on the instance. #27471
• 🚫 Disabled terminal servers are refused. A terminal connection an administrator has turned off can no longer be reached by browsing its files, opening a session, or calling its tools, rather than only disappearing from the interface. Commit
• 🧫 Files attached to a shared folder. Adding files to a folder is now refused unless the folder's owner can read them, and a folder's files are checked against what its owner can still read before they are used as knowledge in chat, so a collaborator can no longer place files into someone else's folder or keep serving files the owner has since lost access to. #27464, Commit
• 🧷 Knowledge claimed by a direct connection. Files listed as knowledge on a model supplied by the browser for a direct connection are now filtered against your own access before anything is retrieved, so a crafted request can no longer pull in documents you cannot otherwise open. Commit, #26723
• 🪜 Reaching a restricted model through a shared one. A shared workspace model can no longer be used to reach an underlying model the person could not otherwise use, which previously slipped through when that model had no entry of its own. #26905, #26900
• 🖌️ Shared image checkpoint changes. Only administrators can now change the instance-wide Automatic1111 checkpoint, so an ordinary image generation request no longer switches the image model for everyone. #27244
• 💬 Channel message ownership. Only the author of a channel message, or an administrator, can now edit or delete it, instead of anyone able to post in that channel. #27197
• 🗄️ Chats shared with an administrator. An administrator can now open a chat that was deliberately shared with them even when broad admin access to other people's chats is turned off, instead of being refused a chat any other recipient could read. #27127
• 📓 Notes in folder knowledge are access checked. Notes attached to a folder are now filtered against your own access before the list reaches the assistant, rather than relying on later checks further along. #26739
• 🧱 Code interpreter module blocking. Modules an administrator has blocked for the code interpreter are now actually blocked, and other imports inside interpreter code work again. #27245
• 📉 Charts in the code interpreter. Code that draws a chart now runs in the default code interpreter setup, instead of failing with a syntax error unless file persistence was turned on. #26800, #26660
• 🎬 Chat action availability. Chat actions can no longer be triggered when they are disabled, not assigned to the model in use, or on a model the caller cannot access, matching the actions the interface actually offers. #27243
• 🗨️ Response text where it was missing. Assistant replies are no longer stored without their text, so copying, exporting, searching and reusing a conversation return the reply instead of nothing. Commit, #26799, #26436
• 🧪 Filter edits that survive a reload. A change a filter makes to a finished response is now saved with the conversation, instead of showing on screen and reverting the next time the chat is opened. #27414, #27017
• 📃 Action functions receive the response text. Running an action on a response now passes the assistant's text to the function, instead of handing it an empty message. #26798, #26672
• 🍎 Blank messages on Safari. Assistant responses no longer render as empty in Safari and on iPhone and iPad, where a browser painting bug left on-screen messages unpainted. #26805, #26712, #26844
• ➡️ Prompts opened from a link. A prompt passed in through a link that sends automatically now waits for tool servers to finish loading, so external tools are available on that first message instead of the model reporting it has none. Commit, #24176
• 🪟 Tool result prompt submission. Interactive tool result embeds that send a prompt back to the chat work again, showing the confirmation dialog before submitting instead of silently doing nothing. #26914, #26912
• 📻 Live updates in a second tab. Opening Open WebUI again while already connected now joins the new tab to your event stream, so notifications and chat updates reach every open tab instead of only the first one. Commit
• 🔁 Connection recovery on new chats. Chats started from the home page now recover automatically after a dropped connection, such as from mobile backgrounding, a VPN or IP change, or waking from sleep, instead of getting stuck loading until a manual refresh. #26913, #26844
• 🪫 Terminal choice cleared on load. Your selected terminal is no longer dropped while the list of terminals is still loading, so it survives a page refresh. Commit, Commit, Commit, #26775, #26677
• 🔌 Dropped sessions during keepalive. Live connections no longer break on a routine keepalive check, which had cut the session so that anything the server needed to run in your browser failed afterwards, most visibly the code execution tool reporting the client as disconnected on every run. #27553, #27550
• ✂️ Context compaction turn boundaries. Long-conversation compaction now summarizes only completed earlier turns instead of sometimes cutting through the middle of a single turn, keeping the current turn's tool calls and results intact. #27035, Commit, Commit
• 🪆 Summaries on a direct connection. Summarizing a long conversation on a direct connection can now use the configured summary model rather than being limited to the connection's own model. #26806
• 🪟 System prompt through compaction. The system message now stays at the front of the conversation when a long chat is summarized, instead of being folded into the summary and lost from that point on. Commit, Commit, Commit, #26713, #26710
• 🧷 Context compaction continuity. After a compaction, the retained recent messages now stay in the prompt on every following turn instead of disappearing after the first, preserving conversational continuity and prompt caching. #27037, Commit, Commit
• 🔟 Context size after tool calls. The context meter and long-conversation compaction now read the size of the latest request rather than adding up every call in a tool loop, and understand the counts reported by Ollama and llama.cpp as well as the OpenAI-style ones, so compaction no longer fires far below its threshold, or never at all, and the usage shown is no longer inflated. Commit, Commit, #27031, #26752, #24410
• 💭 Reasoning that arrives late or empty. Reasoning sent by a provider after the answer has started is now shown in its proper place above the answer rather than appended after it, and reasoning notes carrying nothing no longer open an empty thinking block. Commit, #26687, #26645
• 📐 System prompt lost during tool calls. A model's system prompt now stays in place through every round of tool calls, instead of being dropped after the first one and, with memories enabled, replaced by the memory block alone. #26857, #26836
• 🪶 Memories from structured replies. A reply delivered as structured output is now read when memories are reviewed after a turn, so nothing worth remembering is skipped just because of how the answer arrived. Commit, #26705, #26651
• 🎲 Stable skill ordering. Skills available to a model are now listed in the same order on every request, instead of shuffling between requests and quietly defeating prompt caching. Commit, #26986
• 🛑 Stopping an answer the moment it starts. Each answer in a chat now carries its own task identifier from the first event onward, so stopping one immediately after sending no longer misses. Commit
• ⏸️ Deleting while a reply is being written. The delete control is now hidden on messages while a response is generating or a task is running, so a conversation can no longer be left with the finished reply detached from the messages before it. Commit, #26668
• 🎁 Feedback while a download is prepared. Downloading a file or folder from the terminal now tells you it is being prepared, will not start the same archive twice if you click again, and reports a failure instead of quietly giving up or leaving a preview spinning. #27421, #27055
• 📥 Moving an archived chat into a folder. Moving an archived chat into a folder now takes it out of the archive so it appears there, and the folder's contents refresh straight away after a move from the menu. #27485, #27484
• 📜 Chats past the first sixty in a folder. Folder listings now page through every chat instead of stopping at a fixed limit, so older chats no longer appear to vanish from a folder once it grows past sixty. #26786, Commit
• 📌 Sidebar highlight follows the open chat. The sidebar no longer keeps a chat highlighted after you move to another page, so deleting or archiving it there no longer throws you back to a new chat, and cloning no longer leaves two chats looking selected. #26977
• 🔀 Sidebar ordering during replies. Background updates such as follow-up suggestions, sources, and status no longer bump a chat to the top of the sidebar or change its last-updated time, and neither does saving a chat's variables or settings, nor the automatic title generation on a new chat. Commit, Commit
• 🖱️ One hover preview at a time. Moving between chats in the sidebar, or between avatars in the admin user list, channel messages and member lists, no longer leaves an earlier preview open behind the new one. #27549, #27548, #27578, #27577
• ✨ Folder lists no longer flash. Clicking a folder title in the sidebar no longer empties the chat lists of your expanded folders for a moment before they reappear. #27535, #27533
• 🫧 Flickering sidebar rows. Moving the pointer across a chat in the sidebar no longer makes its title and timestamp flicker in and out, or draw the timestamp underneath the action buttons. #27474, #27473
• ⭐ Rating scale in multi-model replies. The rating scale in the feedback panel is no longer cut off when several models answer side by side, so every score can be picked. #26846
• 🧑‍🤝‍🧑 Duplicate models side by side. Adding the same model twice in a side-by-side chat now keeps each column's own answer after a reload, instead of every column collapsing onto the first one. #26980
• ⬅️ Back button after opening admin or workspace. Going back in the browser now returns you to the page you came from, instead of being pushed forward again to where you just were. #27478, #27477
• 🎛️ Typing a top_k value. The top_k box in advanced parameters now accepts whole numbers up to its limit and rejects anything else, instead of letting the slider and the box disagree over what is allowed. Commit, #26669
• 🌙 Date pickers in dark mode. The calendar and clock icons on date and time fields are now visible in dark mode, across the calendar, automation schedules, account settings and analytics. #27275, #27274
• 🪞 Settings content stays inside the window. Long chat titles in Archived Chats now shorten with the full title on hover, and the admin analytics tables and chart no longer stretch past the edge of the settings window. #27306, #27305, #27329
• 🔗 Settings links that open in place. A link to a settings tab now opens it without a page refresh, and the Add Terminal button in the terminal menu goes straight to the Integrations tab instead of flashing the admin panel and doing nothing. #27552, #27551
• 🎰 Model choice on a fresh chat. Starting a new chat now falls back to your default model when the previous selection is no longer available, instead of leaving the picker empty, while a model named in the link still wins. Commit, #26697
• 📱 Model selector on small screens. The model list now stays fully on screen and sizes itself to the space available, instead of running past the edge or hiding behind the on-screen keyboard on phones. Commit, Commit, Commit
• 📲 Sidebar stays open over the calendar. Opening the calendar from the account menu on a phone now closes the sidebar, as every other entry in that menu already did. #26979
• 🗓️ Automation dialog on narrow screens. The buttons along the bottom of the automation dialog now sit on their own row on a phone, instead of the schedule and model pickers wrapping and pushing Cancel into the middle. #27027
• 📐 Input menu with keyboard open. The message input's attachment menu now stays on screen and resizes to fit when the on-screen keyboard is open on mobile, instead of running off the edge. Commit
• 🎈 Dropdowns that follow their content. A menu now stays in place as its contents grow or shrink, instead of running past the edge of the screen when a submenu swaps in taller content, and no longer bounces as it opens. #27460, #27458
• 🧾 Attachment menus load once. Opening a submenu of the attachment menu now requests its list a single time instead of twice. #27461, #27459
• 🔦 Chat search on PostgreSQL. Searching your chats now finds matches in current conversations on PostgreSQL setups, instead of only matching chats still stored in the older format. Commit
• 🧲 Search quality with prefix-based embedding models. Memories, knowledge base descriptions and searches against an external vector database now carry the query and content markers your embedding model expects, so results are no longer quietly worse than they should be on models that rely on them. Commit, #26958, #26353
• 🥄 Counting matches in knowledge base commands. Piping text into a search inside knowledge base commands now honours the count and filenames-only flags, instead of returning the matching lines regardless. #26721, #26715
• 🔍 Knowledge base file search. Searching inside knowledge base files now returns matching lines with correct line numbers, and patterns that list alternatives separated by a pipe find matches instead of silently returning none. #27249, Commit, Commit, #26795, #26781, #26744
• 🖨️ PDF text recognition. The text recognition package is now included again, so the application starts and PDFs with image text extraction enabled upload correctly instead of failing. #26851, #26646, #26994
• 🧿 Mistral OCR on a stock install. Extracting documents with Mistral OCR now works out of the box, instead of failing on a missing name resolution library that the code assumed was present. #27440
• 📧 Outlook message uploads. Uploading a .msg email now works, where it previously failed because the package it relied on could not be installed alongside the rest of the application at all. #26704, #26690
• 🖇️ Uploads with PaddleOCR-VL selected. With PaddleOCR-VL chosen as the document loader, only PDFs and images now go to it and everything else falls back to the usual handling, so text, markdown, spreadsheet and Word files index instead of being rejected. #27529, #24988, #26759
• 🪙 Documents containing special tokens. Splitting text by tokens no longer fails when the content contains reserved marker sequences, so those pages and files can be fetched and added to a knowledge base. Commit, #27094
• 📚 Knowledge base upload reliability. Adding a file directly to a knowledge base now finishes processing and linking the file before reporting success, so uploaded files are reliably searchable. Commit
• 🛠️ Web loader settings from the admin panel. The web loader picked in admin settings is now actually used, along with its certificate checking, request pacing and proxy settings, so instances that fetch pages through an external loader work again instead of trying to reach the internet directly with whatever was configured at startup. #26749, #26747, Commit, #27083, #27025, #27061
• 🚧 Quoted entries in the web fetch filter list. Stray quote marks around a filter entry, which Docker Compose passes through literally, no longer turn the list into one that blocks every web address. #26910, #26908
• 🌐 Web fetching with certain plugins installed. Fetching a web page and loading web search results work again on instances where a tool or function pulls in a replacement networking library, which previously made every fetch fail and return nothing. #26796, #26791
• 📢 Web search failures explained. When a search finds pages but cannot store them, the chat now says what went wrong and points at the document settings, instead of reporting sites searched and then no sources found. #26883
• 🕸️ Mixed web page extraction. Fetching several web pages at once now reads each one according to its own format, instead of applying the first page's format to the whole batch and garbling the rest. #27367
• 🧯 Leftover browser sessions on web fetches. Fetching pages through a remote Playwright server now closes each page and the browser even when a page times out or the search is abandoned partway, instead of leaving sessions open and slowing every later search until that server was restarted. #27526, #25880
• 🖇️ Sign-in profile pictures fetched safely. The profile picture pulled in when someone signs in through a provider is now fetched through the same protected path as other outbound requests, so a host that changes its address between the check and the fetch can no longer point it at an internal service, taking the forwarded sign-in token with it. #26699
• 🪃 Backslashes in terminal proxy paths. A request to the terminal proxy containing a backslash is now refused, closing a way to smuggle directory traversal past the path check to an upstream that treats it as a separator. #27198
• 🧱 Internal addresses disguised as public ones. A web address that hides an internal target inside an IPv6 address, through the mapped, 6to4, Teredo or NAT64 forms, is now recognised and refused like any other internal address. Commit
• 🪤 Tighter checks when a page is fetched. Every request a fetched page makes is now checked against the address rules rather than only the page itself, each hop of a redirect is checked in turn, and background workers and socket connections the page tries to open are refused. Commit, #27042, #27008
• 🐢 Dropped pages when fetches are paced. Pages fetched through Firecrawl, Tavily, Microsoft Web IQ or Playwright are no longer discarded whenever the loader has to pause between requests, which quietly lost any page following close behind another and sometimes blamed it on a failed security check. #27528, #26079
• 🎙️ Dictation repeating earlier speech. Dictating into the message box no longer re-inserts everything you said in previous recordings, and cancelling a recording no longer inserts the text anyway. #26793, #26784
• 🧩 Order of long transcriptions. A long recording split into pieces for transcription is now reassembled in the order it was spoken, instead of sections sometimes appearing out of sequence in the transcript and everything read from it. #27417, #27143
• 🔊 Text-to-speech reliability. Text-to-speech playback and other streamed responses no longer intermittently cut out partway through when several requests run at once. #26924, #26922
• 🧮 Anthropic usage reporting. Responses from the Anthropic-compatible API now report accurate input and output token counts, pass through cache and server tool figures where the provider gives them, and leave the input count out entirely rather than reporting zero when it is unknown. Commit, Commit, Commit, Commit, Commit, Commit, #26790, #27293, Docs:#1328
• 📨 Non-streaming requests to strict providers. A request that is not streaming no longer carries the streaming-only usage option, which some providers reject outright.
• 🪝 Tool calls with structured arguments. A provider that sends a tool call's arguments as an object, or as nothing at all, no longer breaks the reply partway through. #27195
• 🧬 Shared pipe model tool calls. Non-admin users of a shared model built on a pipe or manifold model no longer see the response silently stop right after a tool call. #26906, #26900
• 🧑‍🔧 Startup as an arbitrary user. Running the image as a non-root account, as OpenShift and similar setups do, no longer fills the boot log with permission errors while it writes its own icons and manifest. #26664, #26662
• 🩹 Startup with an ownerless tool or function. A tool or function left without an owner no longer prevents the application from starting, which had blocked all chat responses until it was removed. #26850, #26843
• 🏷️ Model names containing a connection prefix. A prefix set on a connection is now removed only from the front of the model name, so a model whose own name contains that text is no longer mangled before the request is sent. Commit
• 🦙 Newly pulled Ollama models. Sending a message to a model that was pulled after the list was last built now refreshes the list and proceeds, instead of reporting the model as not found. Commit, #27353
• 🗑️ Deleting a model from the selector. Removing a workspace model from the model selector menu now deletes just that model and leaves the underlying one in place, instead of failing with a not found error. #26819
• 🔑 Connecting a remote MCP server over OAuth. Setting up a remote MCP server now reports plainly when its sign-in details cannot be discovered, rather than saving an unusable connection that failed with a server error the moment you tried to authorise it. #26654, #26647
• 🪢 Tool servers with cross-referencing types. A tool server whose description defines types that refer to each other now loads its tools instead of failing outright, so the integration appears in model and tool selection again. #27413, #27239
• 👥 Previewing what someone can use. The preview of a person's access now includes the models, knowledge bases and tools they own, not just the ones shared with them. Commit, #27423, #27407
• 🧰 Model editor loading. The model editor no longer fails to open when its tool list can't be loaded, falling back gracefully instead. Commit
• 🗃️ Milvus Lite collection creation. Setting up collections now succeeds on embedded Milvus Lite, which previously could fail while creating the resource index. #26911
• 🧽 Milvus log noise. Instances backed by Milvus no longer fill their logs with deprecation warnings while indexing and retrieving, and keep working with future PyMilvus releases that drop the old interface entirely. #27521, #26978
• 🚏 Stray terminal containers. Terminal orchestrator connections that use a policy now send every request through that policy, so each person no longer ends up with a second unintended container alongside the intended one. #26945, Commit
• 🔦 Connections on hardened instances. With the admin access bypass turned off, a connection that has no access grants yet is now reachable by administrators again, instead of being hidden from everyone including the admin who created it. #27581, #27580, #27064
• ♻️ Connection changes take effect immediately. Saving connection settings now refreshes the model list straight away, instead of leaving the previous models in place until the server was restarted.
• 🚫 Disabled OpenAI connections are enforced. Turning off the OpenAI API now blocks chat requests to it and clears its models, rather than only hiding it from the interface.
• 🪛 Deleting an Ollama connection. Removing an Ollama connection now saves straight away, instead of reappearing until the Ollama API switch was toggled afterwards. #27483, #27482
• 🧹 Orphaned sessions get cleaned up. The instance that reaps sessions left behind by a crashed worker now keeps trying if another instance holds the job, rather than one instance giving up for good and leaving stale sessions to accumulate, and the lock it uses can no longer be released or renewed by an instance that does not hold it. Commit, Commit
• 🧊 Redis cluster connections. A deployment using Redis in cluster mode is no longer handed a connection built for a single server, or the reverse, when both point at the same address. Commit
• 🚏 Stopping a reply when Redis is configured. The stop button now actually halts generation on Redis-backed deployments, where the listener that carries stop requests between instances quietly died after a few idle seconds and left tokens streaming on, and a new "REDIS_SOCKET_TIMEOUT" setting controls that timeout. #27104, #26779
• 🛟 Redis failover on timeouts. A Redis connection that times out now retries against a freshly resolved primary instead of failing, so Sentinel setups recover from a failover rather than erroring out. Commit, #27210
• 👣 First sign-in through a trusted header. Two requests arriving together for someone signing in for the first time through a trusted header no longer create two accounts for the same person, and the database now refuses a second account for an address that already exists, whatever its capitalisation. Commit, Commit, #27571, #27117
• 🔧 Sign-on settings from environment variables. Single sign-on settings supplied through environment variables are no longer overridden by stale values saved at first startup, so changing them takes effect. #26928, #26917
• 🎫 Expired identity tokens sent to tools. A sign-in session is now refreshed before the earliest of its tokens expires, so tools and pipes that forward your identity no longer hand a downstream service a token it rejects. #27520, #27066
• 🎫 Sign-in tokens that never expire. A provider that returns no expiry and no way to refresh is now taken at its word, instead of being given an invented one-hour lifetime that left the session unusable afterwards. Commit, #26802, #26141
• 🔓 Single sign-on after a key rotation. Signing in with OIDC now recovers when the provider rotates its signing key, refreshing the cached keys and retrying instead of failing with an invalid credentials error. #27310, #26407
• 🔑 Signing in after a session expires. An expired session now cleanly returns you to the sign-in page and back to where you were afterwards, instead of bouncing you away from the sign-in page or leaving a stale session behind. Commit, Commit, #26751, #26731
• 🫥 Temporary chats and channels write nothing. Generating or editing an image and status updates in a temporary chat or a channel message no longer try to save themselves against a conversation that was never stored, and the task list tools are no longer offered there at all rather than being offered and then failing. Commit, Commit, Commit, Commit, #27432
• 🎞️ Artifacts panel reopening itself. The artifacts panel now opens once when a finished block is detected, so closing it partway through a reply no longer sees it forced back open on every word that follows. Commit, #27399
• 🏞️ Images returned by a tool. Images a tool produces are now passed to the model in a form the OpenAI-compatible providers accept, so it can actually look at them instead of receiving a result it cannot read. Commit
• 🖼️ External message images. Images hosted on other sites and referenced in a message now display inline instead of being replaced with a placeholder. Commit
• 🔣 Names containing a vertical bar. What you insert with the at sign or a slash is now recorded by the key you typed rather than guessed from its name, so a prompt or model whose name contains a vertical bar is no longer mistaken for a skill. Commit
• 〰️ Text above a collapsible block. A line written directly above a collapsible section is no longer turned into a large heading, and the section itself still renders as a collapsible widget rather than leaking its markup. Commit, #27148, #27001
• ✳️ Asterisks in the message input. Wrapping a word in asterisks no longer silently turns it italic and swallows the asterisks, so your prompt reaches the model exactly as you typed it. Commit
• 📶 Reconnect warnings on mobile. Switching back to Open WebUI after using another app no longer flashes a connection lost warning while the tab wakes up and reconnects on its own. Commit
• 🧭 Sidebar access from the automation editor. Opening an automation on a phone no longer hides the sidebar button, so you can move around without leaving the editor first.
• 🔣 Chats containing unusual characters. Broken character sequences are now cleaned out of text before it is stored, so a conversation that picked one up still saves and still opens instead of failing to load. Commit, #27201, #27081
• 📛 Failures after a tool call. A reply that fails while continuing after a tool call or a code interpreter run now says so, instead of stopping mid-answer with nothing to explain why. Commit, #27426, #27411
• 💾 Errors kept after reloading. An error that ends a streamed reply is now saved to the conversation, so it is still there when you reload instead of disappearing. #27365, #27074
• 💬 Readable error messages. Errors in a conversation now always show readable text that wraps instead of running off the edge, including errors that arrive wrapped inside another error.
• 🪝 Blocked webhook targets look like failures. A webhook pointing at an address that is not publicly reachable is now skipped with a short warning, instead of an error and a full traceback that read like the server crashing on startup. Commit, #26975
• 🕵️ Values printed in error logs. A failure no longer prints the contents of nearby variables alongside its traceback, which could put keys and message content into the logs, and a new "LOGURU_DIAGNOSE" setting turns that detail back on for debugging. Commit, #26814
• 🪵 Empty audit exclusion list. Clearing the list of paths excluded from audit logging no longer switches off auditing altogether, so requests are recorded as intended. #27370, Commit
• 🗒️ Readable audit log bodies. Audit logs that record response bodies now store them as readable text instead of compressed data, so entries are legible whenever a browser requested compression. #27369
• 👍 Rating in feedback events. Events sent when someone rates a response now carry the rating that was given, instead of reporting it as empty. Commit, #26840
• ⏱️ Accurate request timing header. The processing time reported on each response now includes fractions of a second instead of rounding everything under a second down to zero. #27368
• 📋 Provider rejection logging. When a model provider rejects a request, the reason it gave is now recorded in the server logs, so administrators can diagnose failures without querying the provider directly. #27238, #27237, #26253
• ⏳ Faster licensed startup. Instances with a license key no longer wait on the license server during startup, so the app becomes ready to serve traffic without that delay. Commit, Commit
• 📅 Calendar invitation responses. Whether you have accepted an invitation is now decided by your own response rather than by whoever created the event, and invitations you decline disappear from your calendar. #27007
• 🗓️ Schedules written by hand. A recurrence rule is now read the same way whether it is written in upper or lower case, a start date in the rule is respected, second-by-second rules are understood, and a rule that cannot be supported is refused with a clear message instead of behaving unpredictably. Commit, Commit, #27470
• 📅 One calendar event stalling the server. Working out when a repeating event happens next now walks its rule once rather than re-counting from the beginning for every occurrence, so an event repeating every minute from an old start date can no longer occupy the server for everyone. #27468
• ⏰ Recurring automation scheduling. Automations that repeat every few minutes or hours now align to the clock and are no longer wrongly rejected as having no upcoming runs when the server clock is ahead of your timezone. Commit, #26954

Changed

• ⚠️ Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.
• 🛠️ Admin settings moved into settings. Admin settings and the analytics dashboard are no longer separate pages and now open alongside your personal settings in the settings window, under their own Admin section, with the old links redirecting there. Commit, Commit, Commit
• 📁 Workspace actions in one menu. Creating, importing, and exporting workspace items no longer have their own buttons on each page and are now reached from a single Create menu in the workspace header, with creating a prompt or knowledge base opening a dialog rather than a separate page. Commit, Commit, Commit, Commit
• 🔐 Administrators no longer reach other people's automations. Viewing, editing, running and deleting an automation is now limited to the person who created it, so an administrator with a link to someone else's automation is refused rather than allowed through. Commit
• 🏷️ Shorter titles without emojis. Automatically generated titles for chats and notes are now two to four words and no longer include an emoji, and anyone who prefers the old style can restore it by editing the title generation prompt in admin settings. Commit, Commit
• 🗂️ Archived chats moved to settings. The Archived Chats shortcut is no longer in the user menu, and your archived conversations are now reached through Settings, where they can also be searched and sorted. Commit, Commit
• 🔢 Usage now reports the latest call separately. In a response's usage block, "prompt_tokens" and "completion_tokens" now carry the counts from the most recent model call rather than the running total, while "input_tokens", "output_tokens" and "total_tokens" stay cumulative, so anything reading the first pair for billing should read the second set instead. Commit, #27031
• 🧳 The "python-jose" library is no longer installed. Nothing in Open WebUI imports it anymore, so it and the two packages it pulled in have been dropped from the image, and any tool or function that imports it directly now needs to install it itself. #27444
• 📦 Storage emulator no longer bundled. The optional Google Cloud Storage emulator is no longer installed as part of the full package, so anyone who relied on it for local storage testing now needs to install "gcp-storage-emulator" themselves. Commit