With tool approval set to ask, a knowledge or file tool the user approved ran and answered, but no sources were saved on the reply or shown below it. The same call without approval listed them as usual. The sources of an approved call are now saved and shown the same way.
Fixes#32436
With websocket support turned off, the browser falls back to HTTP long polling and every poll was written to the audit log as its own entry, flooding it. The same traffic over a websocket was never audited, and AUDIT_EXCLUDED_PATHS only matches API routes, so there was no way to filter it out. Polling requests are now skipped as well, so the audit log looks the same whichever transport is in use.
Fixes#31871
Custom headers on connections and tool servers could pass the chat, message, user and task to downstream services, but not which model the request was for. Chat requests can now use {{MODEL_ID}}, which holds the ID of the model handling the request; for a workspace model that is the workspace model's own ID. In a multi-model chat each model's request carries its own ID, so downstream services can route by model or log usage per model.
Fixes#30006
The audit log only showed which model a request used inside the logged request body, which is cut off at MAX_BODY_LOG_SIZE, so the model went missing whenever a long prompt came before it. Audit entries for chat and completion requests, including the OpenAI, Ollama and Anthropic-compatible endpoints, now carry a model_id field with the model the client asked for, at every AUDIT_LOG_LEVEL and however long the request is. Other requests log it as null.
Fixes#30097
Pipes and tools received None instead of a list of files on messages without attachments, which does not match the docs and breaks plugins that loop over the files. Pipes and tools now get an empty list in that case.
Fixes#32379
Connecting an OAuth 2.1 MCP tool server such as Canva failed with "OAuth client registration is still invalid after re-registration" whenever Cloudflare answered Open WebUI's own server-side check of the provider's sign-in page with a bot challenge. The challenge page repeats the requested address, which contains the redirect URL, so Open WebUI read it as the provider rejecting its registration. Open WebUI now skips its check when it gets a bot challenge, and the browser goes on to the provider's sign-in page as usual. Real provider errors about an unknown client or redirect URL still trigger re-registration as before.
Fixes#32363
Automations scheduled with the Daily, Weekly or Monthly picker ran a few seconds after the chosen time, taking the seconds from whenever the previous run was handled. Now and then that left the next run due again within the same minute, and the automation ran twice. Users whose timezone is behind the server's could also have their first run moved to the next day. These schedules now run at the exact minute chosen, in the user's own timezone.
Fixes#32263
When the Redis Sentinels are protected with a password, every Redis operation failed with "No master found", because the password in REDIS_URL was used for the Redis server itself but never for the Sentinels. The Sentinels now get the same credentials, both for REDIS_URL and for WEBSOCKET_REDIS_URL. Sentinels without a password keep working, and Sentinel credentials set by hand in WEBSOCKET_REDIS_OPTIONS still take precedence.
Fixes#32240
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_OLLAMA=true free_disk:false name:ollama suffix:-ollama]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_SLIM=true free_disk:false name:slim suffix:-slim]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args: free_disk:false name:main suffix:]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_CUDA=true
USE_CUDA_VER=cu126
free_disk:true name:cuda126 suffix:-cuda126]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_CUDA=true free_disk:true name:cuda suffix:-cuda]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_OLLAMA=true free_disk:false name:ollama suffix:-ollama]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_SLIM=true free_disk:false name:slim suffix:-slim]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args: free_disk:false name:main suffix:]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_CUDA=true
USE_CUDA_VER=cu126
free_disk:true name:cuda126 suffix:-cuda126]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_CUDA=true free_disk:true name:cuda suffix:-cuda]) (push) Waiting to run
With Redis Sentinel, Open WebUI lowercased the master name given as the host part of REDIS_URL, so a master named myMaster was looked up as mymaster and every Redis call failed with "No master found". The OT-Container-Kit redis-operator for Kubernetes names its master myMaster by default, so its users hit this out of the box. The master name is now used exactly as written in REDIS_URL, so it has to match the case configured in Sentinel.
Fixes#31918
When an MCP tool server fails to connect during a chat, the chat shows "Failed to connect to MCP server" but the reason was only logged at debug level, so it never appeared in the logs of a default install. The failure is now logged as an error with the full cause, such as a refused connection or a 401 from the server. The message in the chat is unchanged.
Fixes#32213
After an OAuth sign-in, the cookies tying the browser to the user's OAuth session were dropped when the browser closed, while the login itself stayed valid for the full JWT lifetime. After a restart the user was still signed in, but model connections and terminal servers using system OAuth got no token, and signing out no longer ended the session at the identity provider. These cookies now last as long as the login again, with and without MFA, as they did in 0.11.
