With Redis, if every tool server was unreachable when Open WebUI loaded the tool server list, it cached an empty list and served it forever. The tools stayed missing from chats and the tool list after the servers came back, until a restart, a save in the tool server settings or a manual delete of the cached Redis key. An empty cached list is now only trusted while no OpenAPI tool server is enabled, so the next request that loads tools fetches the servers again, the same way terminal servers already behave. While an enabled server stays unreachable, each such request tries it again and can wait for its timeout.
Fixes#29573
Adding a custom parameter named tools to a model, for example to turn on a provider's native web search, made Open WebUI drop all of its own tools for that model: notes, knowledge, tasks and any tools attached to the model stopped working, and attached files lost their context. Those tools now stay, and the model's custom tools are sent alongside them. API calls that pass their own tools, or an empty list to turn tools off, behave as before.
Fixes#32528
Files read from a URL are sent to a document parser based on their file name. An arXiv link like arxiv.org/pdf/1706.03762 has a dot in the paper ID, so the name was read as having the extension ".03762", the PDF went to the plain text reader and the model got raw PDF bytes. When the part after the dot is not a known file type, the extension now comes from the file type the server reports, so these links are read as PDFs. Files the server only labels as generic binary keep their name as before.
Before Open WebUI reads a URL for the model, it checks whether the URL is a web page or a file. That check went out without the user agent, browser headers and SSL verification setting the web loader uses, so sites that block unknown clients (Wikimedia, for example) refused it. The URL was then treated as a web page and the model got the raw PDF bytes instead of the document text. The check now sends the same request as the web loader, so it gets the same answer and files go to document extraction again.
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_OLLAMA=true free_disk:false name:ollama suffix:-ollama]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args: free_disk:false name:main suffix:]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_CUDA=true
USE_CUDA_VER=cu126
free_disk:true name:cuda126 suffix:-cuda126]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_CUDA=true free_disk:true name:cuda suffix:-cuda]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_SLIM=true free_disk:false name:slim suffix:-slim]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_OLLAMA=true free_disk:false name:ollama suffix:-ollama]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_SLIM=true free_disk:false name:slim suffix:-slim]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args: free_disk:false name:main suffix:]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_CUDA=true
USE_CUDA_VER=cu126
free_disk:true name:cuda126 suffix:-cuda126]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_CUDA=true free_disk:true name:cuda suffix:-cuda]) (push) Waiting to run
The prompt and tool editors resend every stored grant on Save, and the
update routes ran that whole list through filter_allowed_access_grants.
A collaborator without the public sharing permission therefore had the
owner's Public grant stripped, and the stripped list replaced the stored
one, so one Save made the prompt or tool private for everyone else.
Keep grants that are already stored and filter only the ones the save
adds, as the model update route has done since 754c4b576.
Since cloned and forked chats keep each message's original author, a
copy of someone else's shared chat kept the sharer as the author of
every prompt and reply. Regenerate and Continue in the copy then failed
with "You can only regenerate your own messages.", and edits to those
messages were dropped on save, although the copy belongs to the person
who made it.
When a shared chat is cloned, or forked by someone other than its owner,
give the source owner's messages to the new owner, the same per-message
loop shared_chat_response uses to set authors. Messages written by other
participants of an Allow replies chat keep their authors.
When Open WebUI authenticates to the OAuth provider with client_secret_basic, either because OAUTH_TOKEN_ENDPOINT_AUTH_METHOD is set to it or because an MCP tool server's OAuth provider only offers that method, sign-in sent the client ID and secret in an HTTP Basic header but the token refresh always put them in the request body. Providers that only accept Basic rejected every refresh with invalid_client, so once the access token expired Open WebUI deleted the user's saved OAuth tokens, and model connections and tool servers set to forward the user's OAuth token stopped working until the user signed in again. The refresh now authenticates the same way sign-in does for client_secret_basic, with the credentials only in the Basic header. Setups using client_secret_post, or leaving the setting unset, still send the credentials in the request body exactly as before.
Fixes#32506
With audit logging on, requests that used an API key in the x-api-key header (what Anthropic SDKs send) worked but never showed up in the audit log, because the audit check only looked for a Bearer token or a session cookie. These requests are now logged with the user the key belongs to, and this also covers a custom header set through CUSTOM_API_KEY_HEADER. Failed attempts with a wrong key in that header now appear in the log without a user, just like a wrong Bearer key. A malformed Authorization header with no other credential is no longer logged, since it can never authenticate.
With tool approval set to ask, a knowledge or file tool the user approved ran and answered, but no sources were saved on the reply or shown below it. The same call without approval listed them as usual. The sources of an approved call are now saved and shown the same way.
Fixes#32436
Retrieval now matches a collection name in a normalised form, folding letter case together and treating hyphens and underscores alike, so the same collection is identified consistently however its name is written.
With websocket support turned off, the browser falls back to HTTP long polling and every poll was written to the audit log as its own entry, flooding it. The same traffic over a websocket was never audited, and AUDIT_EXCLUDED_PATHS only matches API routes, so there was no way to filter it out. Polling requests are now skipped as well, so the audit log looks the same whichever transport is in use.
Fixes#31871
Custom headers on connections and tool servers could pass the chat, message, user and task to downstream services, but not which model the request was for. Chat requests can now use {{MODEL_ID}}, which holds the ID of the model handling the request; for a workspace model that is the workspace model's own ID. In a multi-model chat each model's request carries its own ID, so downstream services can route by model or log usage per model.
Fixes#30006
The audit log only showed which model a request used inside the logged request body, which is cut off at MAX_BODY_LOG_SIZE, so the model went missing whenever a long prompt came before it. Audit entries for chat and completion requests, including the OpenAI, Ollama and Anthropic-compatible endpoints, now carry a model_id field with the model the client asked for, at every AUDIT_LOG_LEVEL and however long the request is. Other requests log it as null.
Fixes#30097
On a shared Valkey or ElastiCache, Open WebUI's vector store connections identified themselves only as the generic GLIDE Python client, the same as every other app using that library, so operators could not tell its traffic apart in server-side logs. Both connections now report the library name as GlidePySync(open-webui). The tag needs valkey-glide-sync 2.5.2 or newer, so the pinned install version moves from 2.3.1 to 2.5.2, and an older manual install fails at startup until it is upgraded.
Fixes#31654
Open WebUI could not connect to a Milvus server that uses a self-signed or company-issued TLS certificate, because there was no way to tell it which certificate to trust. The new MILVUS_SERVER_PEM_PATH setting takes the path to that certificate file and uses it for the Milvus connection, in both normal and multi-tenancy mode. Leaving it unset keeps the current behaviour.
Fixes#31632
MinerU 4.0 dropped the parsing interface its self-hosted server had in 3.x, so the local MinerU engine failed with a 404 on every document when pointed at a 4.x server. Open WebUI now detects a 4.x server and talks to it through its new interface, while 3.x servers keep working as before. On 4.x, `tier` in the MinerU parameters picks the parsing quality (flash, basic, standard or advanced) and `enable_ocr` forces OCR; 3.x-only settings such as `language` and `model_version` are not sent, since 4.x refuses them. 4.x also returns every image as base64 text inside the document, which would otherwise be indexed as text, so images are left out of the extracted content.
Fixes#31516
An identity provider could delete an admin account through SCIM, including the first admin account, for example when its sync pruned users it no longer had assigned. SCIM already ignores deactivation requests for admins so a sync cannot demote them, and the admin panel refuses to delete the first admin, but a SCIM delete request still went through and could leave the instance without anyone who has admin access. Deleting an admin through SCIM is now refused with a 403 and the account stays; admins are removed from the admin panel instead.
Fixes#27662
Reindexing memories (the admin "Reindex Knowledge and Memory Vectors" button, a user resetting their memory vectors, or the automatic reindex after switching to an embedding model with a different vector size) ignored the "Embedding Concurrent Requests" setting and sent one embedding request per memory at once. With a rate-limited embedding provider, most of those requests came back as 429 errors. Reindexing memories now respects that setting and the embedding batch size, like knowledge file uploads already do.
Fixes#32212
Users with a notification webhook for channel messages received no webhook when someone posted in a group channel or direct message they belong to. Only regular channels they had been given access to sent it. Members of group channels and direct messages now get the webhook too, and muting one of these channels stops the webhook except for messages that mention them.
Fixes#32403
