chore: add the token logging, model picture and image size entries to 0.11.4

Fixed leads, below the advisory, with the credentials an identity provider
handed over being written into the application log when a sign-in failed part
way through, and with the model picture that any signed-in person could fetch
whatever their access, which also told them whether a model id existed at all.
Both sit above the rest of the section, a credential in a log file and a way to
enumerate what a server holds costing more than anything below them.

Changed records the consequence a viewer will notice: a model picture falling
back to the standard logo wherever no grant is held, which is a change to what
people see rather than a correction, so it is kept apart from the entry above.

Added records the container image losing the second Python it never used.

CHANGELOG.md

@@ -15,12 +15,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - 🏷️ **Custom file metadata.** Metadata attached to an uploaded file now travels with the pieces that file is split into and arrives with the retrieved sources, the oversized and internal fields left out. [#29499](https://github.com/open-webui/open-webui/pull/29499), [#29486](https://github.com/open-webui/open-webui/issues/29486), [Commit](https://github.com/open-webui/open-webui/commit/894655f66b9563890e63c76090ddecc90a311eb2), [#29502](https://github.com/open-webui/open-webui/pull/29502)
 - 🗑️ **Quick delete for notes and automations.** Holding Shift over a note in the list or grid, or over a row on the automations page, turns its trailing controls into a delete button, removing the entry in one click rather than the three the menu and its confirmation ask for. [#29635](https://github.com/open-webui/open-webui/pull/29635), [#29633](https://github.com/open-webui/open-webui/issues/29633), [#29640](https://github.com/open-webui/open-webui/pull/29640), [#29637](https://github.com/open-webui/open-webui/issues/29637)
 - ⚡ **Searching without holding up the server.** Searching the text of chats and knowledge now runs beside the rest of the server rather than in front of it, so a long search no longer keeps other requests waiting. [#29621](https://github.com/open-webui/open-webui/pull/29621)
+- 📦 **A smaller container image.** The image no longer carries a second copy of Python and its headers that nothing in it used, taking about sixty megabytes off what has to be pulled. [#29731](https://github.com/open-webui/open-webui/pull/29731)
 - 🔄 **General improvements.** Various improvements were implemented across the application to enhance performance, stability, and security.
 - 🌐 **Translation updates.** Translations for Traditional Chinese, Korean, Finnish, Russian, Ukrainian, German, and Spanish were enhanced and expanded.
 
 ### Fixed
 
 - 🛡️ **Security Advisory**: This release includes security and access-control fixes. We recommend updating production deployments at your earliest convenience. Not all security fixes in this version may be enumerated in the fixed section. Some may be withheld for a short time to give administrators time to upgrade. [Advisories](https://github.com/open-webui/open-webui/security)
+- 🔑 **Tokens stay out of logs.** A failure part way through signing in with an identity provider no longer writes the credentials it was handed into the application log, recording the provider and the error it reported instead. [#29709](https://github.com/open-webui/open-webui/pull/29709)
+- 🔐 **Model pictures follow model access.** The picture belonging to a model is now shown only to people who can see that model, where anyone signed in could fetch it and tell an existing model from an unknown one by which picture came back. [#29700](https://github.com/open-webui/open-webui/pull/29700)
 - 🐍 **Saving a tool or function.** Saving a tool or function in the admin pages no longer fails with a missing module error from the built-in code formatter, which was not installing everything it needed. [#29503](https://github.com/open-webui/open-webui/pull/29503)
 - 🍎 **Answers survive on Apple Silicon.** Asking a question that searches a knowledge base with a locally run reranking model no longer takes the whole server down on a Mac, losing the answer and the connection with it. [#29735](https://github.com/open-webui/open-webui/pull/29735), [#29722](https://github.com/open-webui/open-webui/issues/29722)
 - 📚 **Web results stop being cited.** Pages a web search only listed are no longer offered to the model as things to cite, which had it attaching a result id to text from a different result and the citations panel resolving that to a title that looked right. [#29631](https://github.com/open-webui/open-webui/pull/29631), [#29627](https://github.com/open-webui/open-webui/issues/29627)
@@ -43,6 +46,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - 🔗 **Default suggestions answer with an object.** Saving the default prompt suggestions now answers with the suggestions and their per-language wording together rather than the bare list it returned before, which anything calling it directly will need to read. [Commit](https://github.com/open-webui/open-webui/commit/7b6562e3358956ec71eed05352538a646d047734)
+- 🖼️ **Default picture without access.** A model picture now falls back to the standard logo wherever the viewer holds no grant on that model, such as a model reply shown to the other members of a channel, or the admin analytics and evaluation pages with the access bypass switched off. [#29700](https://github.com/open-webui/open-webui/pull/29700)
 
 ## [0.11.3] - 2026-08-31