OpenWebUI - Package Updates

[Package Updates]

[3.5.1]

• Update open-webui to 0.11.1
• Full Changelog
• Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories
• Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.
• Saving replies as they stream. The "ENABLE_REALTIME_CHAT_SAVE" setting no longer has any effect, because a reply in progress is now held outside the database and written once when it finishes. Commit
• Human in the loop tool approval. Where an administrator has turned it on, you can switch a conversation from letting tools run freely to being asked first, so a model that wants to use a tool stops and waits for you to allow or deny it, one call at a time in a saved conversation, by button or by keyboard shortcut, with your choice remembered for this conversation and for future ones, switching back to running freely releasing anything already waiting, and automations, channel replies, and temporary chats unaffected. Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit, Commit
• Streaming rebuilt from the ground up. A reply now streams as small pieces of new text instead of resending the whole message so far with every update, so the data sent over a reply grows with its length rather than with its length squared, which on a server with many people chatting at once means far less processor time spent encoding, passing, and decoding those updates, far less load and memory on the shared cache that carries them between instances, and far less work in your browser, which no longer takes in the whole reply again and redraws the parts of it that have not changed on every update, cutting the data sent and the server work spent appending to a message by up to 1000x on a very long reply, and a reply still in progress is now kept aside on the server, so reopening the conversation after a refresh picks it up where it is rather than showing a blank message, on deployments backed by Redis. Commit, Commit, Commit, Commit
• Knowledge search reaching past what you may read. Searching knowledge bases now applies the list of collections you are allowed to open, where that restriction was handed to the vector store and silently discarded, so results could include material from knowledge bases you have no access to. Commit
• Long replies cut off partway. A single oversized piece of a streamed reply, such as a long reasoning trace or a turn carrying many tool calls, no longer ends the answer early with a misleading error about byte counts, which affected every default installation. #28114, #25664
• Losing all your settings. Your interface settings are no longer wiped by a session that failed to load them, which could happen with no action on your part and cleared everything from your theme to your model parameters; saving now changes only the settings you actually changed, and a session that cannot load them tells you instead of carrying on as though you had none. #27766, Commit
• Knowledge search and shared files in chat. A model searching your knowledge bases or reading a file shared with you through a group now works, where it had failed since 0.11.0 and quietly answered as though the knowledge were empty, affecting instances that forward user details to their embedding service and, for shared files, every instance regardless of settings. #27642, #27641
• Signing in where the provider uses a numeric account id. Signing in through GitHub, or any other provider that identifies people by a number, works again on PostgreSQL, where every attempt failed outright since 0.10.2, and on SQLite the existing account was not matched; accounts stored the old way are corrected on the next sign-in. Commit, #28954, #27760
• Connection prefixes now show in model names. A connection's prefix appears in the name shown in the model picker, not only in its identifier, where whether it did depended on the shape of the provider's reply and so worked on some connections and not others; models on prefixed connections will now read differently than before. #28950, #28929

[Package Updates]

[3.5.2]

• Update open-webui to 0.11.3
• Full Changelog
• Accessibility mode reaches the menus. Accessibility mode now marks the menu entry you are pointing at and the model already chosen with a stronger background, across the dropdown menus, their submenus, and the model picker together with its filter and compare controls, so those cues carry the contrast the accessibility guidelines ask for in both themes. Commit, Commit
• General improvements. Various improvements were implemented across the application to enhance performance, stability, and security.
• Translation updates. Translations for Indonesian were enhanced and expanded.
• Chat branches stay connected after reloads. A reply saved under an earlier message now stays listed under that message, so branch arrows, exports, reloads, and later edits keep the whole conversation in view, and chats already saved with that link missing are repaired when opened. #29299
• Upgrades fail clearly instead of starting half updated. A failed database upgrade now stops at the migration error that caused it, instead of starting anyway and reporting a missing table or column such as 'chat.timer_at' later, which is the upgrade failure seen after moving from 0.11.0, 0.11.1, or 0.11.2. #29280
• Custom interface fonts reach more of the app. The font chosen in interface settings now applies to dropdowns and other interface text that previously fell back to the standard font. Commit
• Disconnect OAuth only where there is OAuth. The disconnect control on a tool server reached over MCP now appears only where that server signs in through OAuth and an account is connected, rather than on servers that use no sign-in at all. #29296

[Package Updates]

[3.5.3]

• Update open-webui to 0.11.4
• Full Changelog
• Far smaller slim image. A slim build now comes down at around 175 MB, near enough 89% smaller than the last release, the local models, the packages around them and the tools that installed them all gone from it; what that changes about the way an instance behaves is set out under Changed below and in the documentation. Commit, Commit
• Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories
• Tokens stay out of logs. A failure part way through signing in with an identity provider no longer writes the credentials it was handed into the application log, recording the provider and the error it reported instead. #29709
• Signing out ends the session. Signing out or having every token revoked left any live connection that account already had in place, and those are now cut at the same moment; a token already revoked can no longer be replayed to cut someone else's newer session. Commit
• Cookie forwarding scope. A connection authenticating as the signed-in person is handed this instance's browser cookies only where its new Forward cookies switch is on, which an instance relying on it has to turn on after upgrading. Commit, Commit, Commit
• LangChain community removal. The readers for text, HTML, Word, CSV, PDF and Azure Document Intelligence are now written here rather than taken from "langchain-community", which is no longer installed; a tool or function importing it has to name it in its own requirements from now on. Commit
• Undeclared package imports. Packages that sat in the image only by accident, among them nltk, pymongo, the Google Drive client and the Gemini SDK, are no longer installed, so a tool or function importing one must name it in its own requirements. #29725, #29726, Commit
• Model ID whitespace. A workspace model whose ID contains a space or a tab is now refused in the editor, through the API and on import; one already stored goes on answering but cannot be saved again until it is recreated. Commit
• Image connection check endpoint. The endpoint that checks an image generation connection has moved and now takes the connection to test in the request itself, so anything calling the old address needs updating. Commit
• Knowledge search accuracy on PostgreSQL. A fresh install using PostgreSQL built its search index before a single piece of text existed to organise it around, so the index was never fit for the content that arrived afterwards and every search quietly returned the wrong passages; the index now waits until there is enough text to build on, and until then searches read everything exactly. An install already carrying such an index can restore it by rebuilding that one index. #30143, #30134

[Package Updates]

[3.5.4]

• Update uv to 0.12.18
• Full Changelog

[Package Updates]

[3.5.5]

• Update uv to 0.12.19
• Full Changelog
• Add PyPy 3.11.16 and 3.12.14 (#21847)
• Update GraalPy 3.13.0 to build 25.4.4 (#21847)
• Format upload URLs with backticks in uv publish errors (#21934)
• Run build-backend hooks with lazy imports on CPython 3.15 and later using the build-lazy-imports preview feature (#21967)
• Omit unused resolution settings from uv.lock and ignore changes to them when checking lockfile freshness with the resolution-inputs preview feature (#21913)
• Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (#21971)
• Recognize 1.0.0 as satisfying ===1 during installed-package checks, matching resolution (#21931)
• Avoid collisions between Git checkout readiness markers and .ok files in dependencies (#21891)
• Preserve always-false python_version markers when parsing their serialized form (#21939)
• Restore the public FlatDistributions export and its BTreeMap conversion for downstream resolvers (#21965)

[Package Updates]

[3.5.6]

• Update uv to 0.12.20
• Full Changelog
• Reuse lockfiles when dependency declarations are semantically equivalent (#21951)
• Preserve second-line encoding declarations when installing wheel scripts with CRLF shebangs (#21990)
• Continue searching XDG_CONFIG_DIRS after empty entries (#21987)
• Apply hash constraints to every repeated requirement under --require-hashes and --verify-hashes (#21996)
• Allow metadata builds for first-party workspace projects under --no-build (#21988)
• Honor project exclusion flags with --all-packages, including --no-install-project and --no-emit-project (#21994)
• Restore pyproject.toml if uv upgrade fails or is interrupted (#21983)
• Generate working Nushell activation scripts for relocatable virtual environments (#21979)
• Prevent commands from running and changing state after displaying --show-settings (#21989)
• Treat UTF-16 requirements files containing only a byte-order mark as empty (#21991)

[Package Updates]

[3.5.7]

• Update uv to 0.12.21

[Package Updates]

[3.5.8]

• Update uv to 0.12.22
• Full Changelog
• Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 (#22147)
• Accept uppercase release suffixes in wheel platform tags (#22113)
• Record workspace-member default groups in lockfiles (#22010, #22103)
• Record workspace-member dependency-group Python requirements in lockfiles (#22044, #22103)
• Add UV_PYTHON_ARCH to select an interpreter architecture independently of its Python version (#22098)
• Verify unchanged requirements against existing lockfile hashes when relocking (#22083)
• Honor dependency-group Python requirements at non-project workspace roots (#22101)
• Use each selected workspace member's recorded default groups during frozen sync (#22015)
• Avoid false entry-point warnings for required workspace members (#22112)
• Reduce uv's binary size by compressing embedded Python download metadata (#22126)

[Package Updates]

[3.5.9]

• Update uv to 0.12.23
• Full Changelog
• Add CPython 3.15.0rc3 (#22164)
• Sync from uv.lock without a workspace manifest using uv sync --frozen with frozen-lockfile (#22018)
• Export from uv.lock without a workspace manifest using uv export --frozen with frozen-lockfile (#22007)
• Inspect dependency trees from uv.lock without a workspace manifest using uv tree --frozen with frozen-lockfile (#22016)
• Inspect workspace metadata and optionally sync its environment from uv.lock without a workspace manifest using uv workspace metadata --frozen with frozen-lockfile (#22017, #22018)
• Reject alternate sources for workspace members across conflicting dependency selections, avoiding lockfiles that cannot be installed (#22153)
• Allow x86-64 Python interpreters running under emulation on Windows ARM64 to install compatible win_amd64 wheels instead of building from source (#22099)

[Package Updates]

[3.5.10]

• Update uv to 0.12.24

[Package Updates]

[3.6.0]

• Update uv to 0.13.0
• Full Changelog
• Use Python 3.15 as the default stable version
• Honor --require-hashes in included constraints files (#22275)
• Prefer native Python on Windows ARM64 (#22100)
• Reject editable requirements in included constraints files (#22282)
• Omit the distutils startup patch on Python 3.10 and later (#22096)
• Treat requirement-file option values as single paths (#22290)
• Use tar-codec for tar archives by default (#22094)
• Add CPython 3.15.0 (#22400)
• Fix incorrect dependency resolution when reusing source metadata with different build settings (#22404)
• Avoid overlong wheel cache lock filenames on Windows (#22134)

[Package Updates]

[3.7.0]

• Update open-webui to 0.12.0
• Full Changelog
• Security Advisory: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. Advisories
• Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.
• IMPORTANT for Milvus and Milvus multitenancy users: back up your Milvus data before upgrading: On first start with "ENABLE_DB_MIGRATIONS" on (the default), every existing Milvus collection is copied in full into a new one holding its vectors, text and BM25 keyword index together, and Open WebUI only finishes starting once that is done, which can take hours for hundreds of gigabytes and needs free disk space for a second copy of your Milvus data. Nothing is re-embedded, and the originals are only dropped once every copy has succeeded. Back up first and avoid upgrading Milvus and Open WebUI on the same day. Hybrid search on Milvus needs Milvus 2.5 or newer; on older versions the migration is skipped and there is no native hybrid search. #31645, #31660
• Realtime voice calls. Administrators can now switch Call mode in the Voice calls section of Audio settings from Standard to Realtime, so Voice mode talks through an OpenAI Realtime voice model (gpt-realtime-2.1-mini with the Marin voice by default) that handles small talk itself and hands real questions and tasks to the chat's selected model, with its conversation history and tools, before speaking the answer while the full reply appears in the chat. Commit, #5894
• Two-factor sign-in. Administrators can require an authenticator app for every user under Admin Settings > Authentication, or with "ENABLE_MFA", so users set one up from a QR code on their next sign-in, get ten single-use recovery codes, and can later replace their authenticator or create new recovery codes in their account settings. Commit
• ENABLE_PLUGINS is the master switch. Setting "ENABLE_PLUGINS=false" now turns off every kind of plugin, including external OpenAPI, MCP and Open Terminal servers and personal direct connections, and overrides "ENABLE_TOOLS", "ENABLE_FUNCTIONS" and "ENABLE_TOOL_SERVERS"; all four need a restart to take effect. Commit, #31509
• Arena models off by default. "ENABLE_EVALUATION_ARENA_MODELS" now defaults to off, so new installations no longer show the built-in arena model in the model selector; existing installations keep their current setting. Commit
• Revoked access ends live updates. Removing someone's access to a shared channel or a note, or deleting it, now also stops the live messages and edits their open sessions were still receiving from it. Commit
• Links no longer act on your behalf without asking. Opening Open WebUI from a link, including from another website or a hidden frame, can no longer act in your name unseen: a prompt given with "?q=" is only filled into the message box instead of being sent, loading web pages or videos with "load-url" or "youtube" and starting a voice call with "call=true" or "voice=true" now ask for confirmation first. Commit
• orjson on by default. "ENABLE_ORJSON" now defaults to on, and setting "ENABLE_ORJSON=false" switches back to the standard JSON encoder. #31616

[Package Updates]

[3.7.1]

• Update open-webui to 0.12.2
• Full Changelog
• MinerU 4.x servers. The MinerU document engine now works with self-hosted MinerU 4.x servers, where every document failed with a 404 because 4.x removed the old parsing interface; 3.x servers work as before, 4.x servers take a tier (flash, basic, standard or advanced) and enable_ocr in the MinerU parameters while language and model_version stay 3.x only, and images that 4.x returns inside the document text are left out of the indexed content. #32422, Commit, #31516
• Channel message metadata kept server side. Channel messages posted or edited through the API no longer take their metadata from the request, so a user can no longer make a message appear to come from a channel webhook or a model. #32421, Commit
• SCIM cannot delete admins. An identity provider can no longer delete administrator accounts, including the first admin, through a SCIM delete request, which now answers with 403 and leaves the account in place, so a sync that prunes unassigned users can no longer leave the instance without an administrator; admins are removed in the admin panel. #32415, Commit, #27662
• Valkey connections tagged as Open WebUI. Open WebUI's Valkey vector store connections now report their library name as GlidePySync(open-webui), so operators of a shared Valkey or ElastiCache can tell its traffic apart; this needs valkey-glide-sync 2.5.2 or newer, so installs that use VECTOR_DB=valkey with an older manually installed version must upgrade it, or startup fails. #32428, Commit, #31654
• Database Migrations: This release includes database schema changes; we strongly recommend backing up your database and all associated data before upgrading in production environments. If you are running a multi-worker, multi-server, or load-balanced deployment, all instances must be updated simultaneously, rolling updates are not supported and will cause application failures due to schema incompatibility.
• External apps in channels. Administrators can now turn on Apps in Admin Settings > General, or with "ENABLE_APPS", and connect external apps in the new Apps tab of Admin Settings by their HTTPS address, reviewing the permissions each app asks for, such as reading its mentions, reading channel messages or posting messages, and choosing who may use it; channel managers then add an app to a channel with Add Members in the channel info, where it is listed with the members and its own profile picture, and mentioning it with @ lets it answer in the channel with replies that can be shown only to the person who asked, show cards with a title, fields and a thumbnail, offer buttons or links, follow up with a later message for longer tasks or provide a Markdown file to download. Commit
• SSO sign in for SCIM users. Users created through SCIM can sign in with SSO again, where they got "401 Invalid authentication request" since 0.12.0 because no sign-in record was created for them; a database migration adds the missing record for existing accounts without giving them a usable password, SCIM email changes now also update the sign-in email and deleting a user through SCIM removes the sign-in record as well. Commit, #32347
• No reconnect loop after sign-in. A tab where you signed in without reloading the page now reconnects signed in after a connection drop, such as sleep, a network change or a server restart, where since 0.12.0 it reconnected several times per second until the page was reloaded and put heavy load on the server. #32341, #32338
• Deleting a message mid-chat. Deleting a message in the middle of a chat no longer makes the model forget every earlier message while the chat still shows them. #32332, Commit, #32331
• Azure OpenAI Realtime calls. Realtime voice calls can now use Azure OpenAI: in the Voice calls section of Audio settings, administrators pick Azure OpenAI as the Provider, enter the Azure endpoint and the deployment name and sign in with an API key or with Microsoft Entra ID, and clearer errors now point to wrong credentials or a wrong URL or deployment, with the "AUDIO_REALTIME_PROVIDER" and "AUDIO_REALTIME_AUTH_TYPE" environment variables for the new settings. Commit, #32343

[Package Updates]

[3.7.2]

• Update uv to 0.13.1

[Package Updates]

[3.7.3]

• Update open-webui to 0.12.3
• Full Changelog
• End-to-end encrypted chats. Direct messages and private group channels can now hold a temporary end-to-end encrypted chat: a member picks Encrypted Chat in the channel menu, the other members see "Encrypted chat in progress" with a Join link, messages of up to 16 KiB are encrypted in the browser with MLS and only passed through the server without being saved, participants can verify each other by comparing codes and see when others are typing, and the chat is cleared when you leave or reload and ends when channel membership or access changes. Administrators turn it on under Admin Settings > General > Encrypted channels or with "ENABLE_ENCRYPTED_CHANNELS" and grant it with the new Encrypted Channels permission, off by default or set with "USER_PERMISSIONS_FEATURES_ENCRYPTED_CHANNELS", and it needs websocket connections with websocket server logging off and HTTPS in production. Commit, Commit, Commit, Commit
• Model skills now load their full instructions. With the Skills builtin tool on, skills attached to a model in the model editor, which every new chat pre-selects, and skills picked from the chat input menu now send their full instructions with each message, where they were only listed by name and description for the model to load with view_skill; deployments that attached skills to models only to make them available should remove them from the model to avoid the extra prompt length, since every skill the user can read is listed for the model anyway. Commit
• Redis permissions for room channels. With "WEBSOCKET_REDIS_ROOM_CHANNELS" on, the Redis user now needs the PUBLISH, SUBSCRIBE, UNSUBSCRIBE and PING permissions and access to the "&socketio" and "&socketio#*" channels, while PSUBSCRIBE is no longer used; a missing permission is logged with how to fix it. Commit
• Much lighter streaming with Redis. With Redis, a streaming reply is now stored under its own key and new text is appended to it instead of rewriting the whole reply into a shared hash on every update, and replies started on older instances are still read during an upgrade; with room channels on, each instance now only subscribes to the rooms of people connected to it, so Redis no longer sends it live updates for chats it does not serve. Commit Commit #32478
• Workspace search. The search window now searches your chats, chats in folders shared with you, chats shared with you, channel and direct messages and notes in one place, with filters for content type, a folder or channel, and whether something was created by you or shared with you, highlighted matches, a preview of each result with Ctrl/Cmd + Enter, Copy link, and channel results that open the thread scrolled to the matching message. Commit, Commit, Commit
• Knowledge sharing kept on rename. A collaborator with write access who edits a shared knowledge base's name or description no longer turns off sharing they could not set themselves, such as Public. #32450, Commit, #32449
• PDF export of long notes and chats. Long notes and chats now download as PDF, where Firefox failed with "Canvas exceeds max size" and Chrome saved a black PDF. #32459, Commit, #18334, #26373, #19583
• OAuth token refresh with client_secret_basic. When "OAUTH_TOKEN_ENDPOINT_AUTH_METHOD" is client_secret_basic, token refresh now sends the client credentials in the Basic header like sign-in does, where providers that accept only Basic rejected the refresh and Open WebUI deleted the user's OAuth tokens, breaking model connections and tool servers that use them until the next sign-in. #32507, Commit, #32506
• Tool servers back after an outage. With Redis, tools from OpenAPI tool servers now come back once the servers are reachable again, where an empty list cached while every server was down kept them missing until a restart or a save in the tool server settings. #32533 Commit #29573
• Built-in tools with a custom tools parameter. A model with a custom parameter named tools, such as one that turns on a provider's native web search, now keeps its built-in tools, attached tools and file context, and its custom tools are sent alongside them. #32530 Commit #32528