chore: cover whitespace in model ids and knowledge folder deletion

CHANGELOG.md

@@ -63,6 +63,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - 🧊 **Replies from vLLM and LiteLLM stop arriving mangled.** The header filter on the OpenAI and Ollama connections compared names in title case only, so an upstream that writes them in lower case, as anything served by uvicorn does, had nothing stripped at all, `Content-Encoding` included, and a desktop or programmatic client then failed trying to decompress a body the server had already decoded. Names are now compared without regard to case. [#29843](https://github.com/open-webui/open-webui/pull/29843)
 - 🛑 **Stopping a chat stops everything running in it.** Where a chat had more than one task in flight, stopping it, deleting it, or closing a note being worked on could stop the first and leave the rest running to the end, both because a task that had already finished ended the round early and because the list being worked through was rewritten underneath it as each one was cleared away; every task is now stopped in turn. Instances sharing their state through Redis were not affected. [Commit](https://github.com/open-webui/open-webui/commit/e35b907f737e625b900b3a03d61890f67ab0c4b0)
 - 🖊️ **Code in a channel model reply behaves like code anywhere else.** Where a model answers in a channel with structured output, the code inside it was drawn as plain highlighted text rather than in the editor every other message uses, so it could not be edited in place and a diff in it could not be opened for editing; it now renders the same way as everywhere else. [#29861](https://github.com/open-webui/open-webui/pull/29861)
+- 🧽 **Deleting a folder in a knowledge base takes its contents with it.** Deleting a folder without moving what was in it up a level dropped the files from the listing but left their text in the search index and the files themselves in storage, so a model went on retrieving and citing pages from a folder that was no longer there; the text is now removed with the folder, and a file no other knowledge base holds is deleted with it unless file retention is switched on. [Commit](https://github.com/open-webui/open-webui/commit/17dbc6f001aeea25ae1df528cb79bb272eca4a77)
 - 🧯 **Reading a web page leaves the log alone.** Fetching a page through the browser-driven loader filled the log with tracebacks where the page closed while it was still pulling pieces of itself, as sites behind Cloudflare and similar do; those requests are now let go of before the page closes. [#29325](https://github.com/open-webui/open-webui/pull/29325), [#28869](https://github.com/open-webui/open-webui/issues/28869)
 - 📤 **Exporting tools stops at what you may edit.** Exporting all tools at once returned every tool the account could see, the source of a tool shared for reading included; it now returns only the tools it may edit, matching the single-tool export and the way models already export. [#29310](https://github.com/open-webui/open-webui/pull/29310)
 - 🔐 **Model pictures follow model access.** The picture belonging to a model is now shown only to people who can see that model, where anyone signed in could fetch it and tell an existing model from an unknown one by which picture came back. [#29700](https://github.com/open-webui/open-webui/pull/29700)
@@ -107,6 +108,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - 📥 **Slim pulls the code interpreter's packages from a CDN.** The slim image carries the Python runtime that runs code in the browser but not the packages it draws on, so the browser downloads numpy, pandas, matplotlib, scikit-learn and the rest from `cdn.jsdelivr.net` the first time code imports them, which means the code interpreter needs outbound access from the browser and stops working where that is blocked. [Commit](https://github.com/open-webui/open-webui/commit/98fcb844e1b19f7dd6289af26273cdec5447dc52)
 - 🧰 **Slim installs no requirement from a git address.** The slim image no longer carries git, so a tool or function whose requirements point at a `git+https://` address fails to install and needs the standard image or a published package. [Commit](https://github.com/open-webui/open-webui/commit/30eed1251301f74e0dfeaad09c41e81320f790fc)
 - 🧾 **Tools importing packages they never declared stop working.** Packages that sat in the image only by accident, among them nltk, pymongo, the Google Drive client and the Gemini SDK, are no longer installed, so a tool or function importing one stops working on upgrade until it names the package in its own requirements; an instance that cannot reach the package index needs the package built into the image instead. [#29725](https://github.com/open-webui/open-webui/pull/29725), [#29726](https://github.com/open-webui/open-webui/pull/29726), [Commit](https://github.com/open-webui/open-webui/commit/a1c02098aa2687c72482a59117efe643b785df51)
+- 🆔 **A model's ID may no longer hold a space.** Creating or saving a workspace model whose ID contains a space or a tab is now refused in the editor and through the API, and such a model is skipped when models are imported. A model already stored with whitespace in its ID goes on answering, but it can no longer be saved or have its access changed until it is recreated under an ID without one. [Commit](https://github.com/open-webui/open-webui/commit/8a19e2f867063256bb2836649e2fe80af41ef748)
 - 🔗 **Default suggestions answer with an object.** `POST /api/v1/configs/suggestions` now answers with an object holding the suggestions and their per-language wording, in place of the bare list it returned before, so anything calling it directly has to read the new shape. [Commit](https://github.com/open-webui/open-webui/commit/7b6562e3358956ec71eed05352538a646d047734)
 - 🧷 **Personal settings are written a field at a time.** `POST /api/v1/users/user/settings/update` now patches the settings named in it rather than replacing the whole interface object: a field left out keeps its value, a field sent as null goes back to the administrator's default, and anything writing settings directly has to follow suit. [Commit](https://github.com/open-webui/open-webui/commit/98a920168e2eea435ac15e1ad3d679946631e41d)
 - 🪵 **A refused model says why in the log.** A request turned away with "Model not found" now writes a warning naming the account, the model and the reason it was refused, whether the model is not registered, the account holds no grant on it, or a base model behind it is out of reach, while the message the caller sees stays as vague as before. [Commit](https://github.com/open-webui/open-webui/commit/f5fcf4c89fb27ed39825875d573446fa84aa2a5b)