* fix: MCP tool errors reach the model as a Python list dump instead of the server's message
When an MCP tool server answered a call with an error, the model got a Python dump of the whole result list, with quotes, annotations and meta fields, instead of the error text the server wrote. Line breaks in the message were escaped as well, so a validation error listing the missing argument was hard to read and models tended to retry the same broken call. The model now gets the server's error text as written, the same way successful results already arrive.
Fixes#32918
* refac: drop the fallback text for MCP errors with no message
The error now carries only the text the server sent.
* fix: keep a readable error when an MCP error has no text
MCP error results that only carry images, audio or resources now give the model a short error message instead of an empty one.
* fix: Terminal capability shows while no terminal server exists
The Terminal capability showed in the model editor even when the admin had set up no terminal server and direct integrations were off, which is the default, so it did nothing. It now shows only when an enabled terminal server exists or users can add their own through direct integrations, and the value saved on a model is kept. The server now reports whether any enabled terminal server exists, since the editor itself only sees the servers the current user can access and a model can be shared with other users.
Refs #32830
* fix: hide the default terminal picker when no terminal is available
The model editor still showed the default terminal line when no terminal server or direct integration was available. It now follows the same rule as the Terminal capability.
* fix: temporary chat and delete chat shortcuts show while not allowed
The keyboard shortcuts list showed "New Temporary Chat" and "Delete Chat" to users who may not use temporary chats or delete chats, and pressing those shortcuts neither opened a temporary chat nor deleted anything for them. Both entries now only show to users with the matching permission, and the settings search skips them otherwise.
Refs #32830
* fix: new temporary chat shortcut does nothing without the permission
Users without the temporary chat permission were sent to a new chat by the New Temporary Chat shortcut; it now does nothing for them.
Fixes CVE-2026-111497 (the "Node2Shell"/"HTTP2Shell" Brotli decoder flaw). Open WebUI decodes Brotli responses automatically whenever it fetches from a model provider, a tool server or a web page, so a malicious server could hand it a crafted response that hits the vulnerable decoder. Both packages now use the fixed releases.
The required parameters of OpenAPI tool server tools, Open Terminal included, were sent to the model in a random order that could change every time Open WebUI restarted. The tool list sits at the start of every prompt, so a different order made every prefix cache on the model side miss, and long chats were processed again from scratch after a restart. The required parameters now keep the order the tool server declares, so the tool list stays identical across restarts.
Picks up the 3.14.4 security release and the 3.14.5 fixes. Open WebUI only uses aiohttp as a client, and the fixes that apply there stop Secure cookies from going out over plain HTTP, stop a connection from being reused after a cancelled upload, fix a memory leak on upstream websocket connections, and keep a websocket open when the server sends a control frame with the RSV1 bit set. Its URL library yarl moves to 1.25.1 because the new aiohttp requires it. Checked with a fresh install, the startup check, the unit and outbound HTTP integration tests, and a streamed chat.
Pillow, the image library behind image uploads, edits and PDF image reading, moves to 13.0.0, the major release that carries fixes for crafted image files in its JPEG, TIFF, GIF, BMP and other decoders. No code had to change, since nothing in Open WebUI uses the features this release removed or changed. Verified with a real install, a server boot, the unit tests and the image-related integration tests, plus live runs of chat image uploads, image editing, PDF image extraction and profile pictures that gave the same results as the current version.
pypdf moves from 6.7.5 to 6.21.2, which brings many fixes for malformed PDFs that could hang the server or exhaust its memory during upload. Its text extraction also changed a little: some line breaks inside a block of text now come out as spaces, so a re-uploaded document can be split into chunks slightly differently, with the same words. cryptography picks up its 48.0.1 patch release, which ships wheels built against OpenSSL 4.0.1. Verified with a real install, the startup check and the upload, retrieval and sign-in tests, plus a text PDF and an image PDF that give the same extracted text as before.
Upgrade the MCP SDK to 2.3.0 and build MCPClient on its Client in
mode='auto', which probes server/discover for the stateless 2026-07-28
protocol and falls back to the initialize handshake for legacy servers.
MCPClient's public surface is unchanged.
MCP_INITIALIZE_TIMEOUT becomes the session's default request timeout, so
it bounds the legacy handshake, tool listing and resource reads; tool
calls keep using AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER.
Relates to #29778
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
When one sentence failed to synthesize during Read Aloud, playback ended but every remaining sentence was still sent to the speech provider, each failure showed its own error toast and any audio that came back was thrown away. Read Aloud now requests no further sentences after the first failure, so a provider outage gives one error and no wasted requests.
Fixes#33023
Users > Groups and the default permissions showed toggles such as Web Search, Channels, Notes, API Keys or Rate Response even when the admin had turned that feature off for the whole instance, so changing them did nothing. Each of these toggles, and the sharing toggles for notes, folders and calendars, now only shows while its feature is on. Stored permission values are kept, so turning a feature back on restores each group's setting.
Refs #32830
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_OLLAMA=true free_disk:false name:ollama suffix:-ollama]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_SLIM=true free_disk:false name:slim suffix:-slim]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_CUDA=true
USE_CUDA_VER=cu126
free_disk:true name:cuda126 suffix:-cuda126]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_CUDA=true free_disk:true name:cuda suffix:-cuda]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_SLIM=true free_disk:false name:slim suffix:-slim]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args: free_disk:false name:main suffix:]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_CUDA=true
USE_CUDA_VER=cu126
free_disk:true name:cuda126 suffix:-cuda126]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args: free_disk:false name:main suffix:]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_OLLAMA=true free_disk:false name:ollama suffix:-ollama]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_CUDA=true free_disk:true name:cuda suffix:-cuda]) (push) Waiting to run
The Voice section in Settings > Interface, with voice interruption and emoji in call, showed to users without the call permission, who cannot start a call. The section now only shows to users who can make calls, and the settings search skips it for everyone else.
Refs #32830
Co-authored-by: Tim Baek <tim@openwebui.com>
Settings > Interface showed "Web Search in Chat" when web search is off for the instance or the user may not use it, and the choice had no effect. It now shows under the same conditions as the web search button in the chat input, and the settings search skips it otherwise. A saved choice is kept and applies again once web search is available.
Refs #32830
Tool servers and Open Terminal connections a user added in their Integrations settings kept loading and were still used in every chat after the admin turned Direct Integrations off, which only hid the settings tab. They are now ignored while Direct Integrations is off, for admins and users alike, and the server ignores them even when a request still includes them. The saved connections stay in each user's settings and come back as soon as the switch is turned on again.
