* perf: renaming a folder or deleting all chats takes seconds when many users are online
Renaming, sharing, moving or deleting a folder, and deleting all chats, each made the server recheck access for every chat that any online user had open in a browser tab, one database lookup at a time, before the request finished, and every one of those open chats reloaded its contents afterwards. Any user can do these, so with a few thousand people online every such click took several seconds and reloaded everyone's open chat. Owners keep access to their own chats (a role change or account deletion already disconnects them), so the recheck now skips owners entirely, with no lookup and no reload, and only checks people viewing someone else's chat and chats that no longer exist. Anyone who lost access is still removed from the chat as before.
Postgres 16, one open chat per online user, 2% of them viewing someone else's chat, time for a folder rename (the other actions above run the same recheck):
| Online users | No Redis, before | No Redis, after | Redis, before | Redis, after |
| --- | --- | --- | --- | --- |
| 1,000 | 2.2 s | 0.12 s | 2.5 s | 0.23 s |
| 3,000 | 6.9 s | 0.60 s | 7.7 s | 0.78 s |
* refac: collect the open chats with a plain loop
Same behaviour, the owner lookup now reads more plainly.
* refac: shorten the owner comment in the chat access sweep
* fix: web search engine settings show while web search is off
Settings > Web Search showed the search engine picker and all engine credentials even with web search turned off. They now only show while the Web Search switch is on, and flipping it on shows them right away, so the engine can be set up before saving. An API key the web loader shares with the hidden engine now shows in the loader section instead. Stored engine settings and keys are kept.
Refs #32830
* fix: web search confirmation and Bypass Web Loader show while web search is off
The Web Search Confirmation switch, its text and the Bypass Web Loader switch also showed with web search turned off, although they only act on web searches. They now hide together with the engine settings, and their stored values are kept. Bypass Embedding and Retrieval and Trust Proxy Environment stay visible, since they also apply to web pages attached to a chat.
Refs #32830
* refac: mark web search fields as plainly required
These fields only show while web search is on, so tying their required flag to the toggle no longer does anything.
* refac: write the web search checks inline
Same behaviour, the conditions now sit directly where they are used.
* fix: /skills:create shows for models that cannot create skills
"/skills:create" showed when the model had the "Builtin Tools" capability or its "Skills" built-in tool turned off, and the model then answered that skill creation is disabled. The command now shows only when every selected model has both turned on.
Refs #32830
* refac: keep the skill creation check with the other model capability checks
Moves the check next to the other per-model capability checks so it reads like them.
* refac: add type annotations to the skill creation check
Restores the type on the new option and types the new check.
Settings > Interface showed "Regenerate Menu" to users without permission to regenerate responses. Those users have no regenerate button, so the setting did nothing. It now only shows to users who can regenerate, and the settings search skips it for everyone else.
Refs #32830
Settings > Interface showed the terminal file display, show files on terminal select and terminal preview settings to users who have no terminal to use, which is the default. They now show once the user can reach a terminal, either one the admin set up or one of their own, the same way the chat input decides whether to offer the terminal picker. In the admin default interface settings they show whenever the instance offers terminals.
Refs #32830
* fix: model capability toggles show while their feature is off
In the model editor and the admin model defaults, the Web Search, Image Generation, Code Interpreter and Memory capabilities and the matching Default Features showed even when the admin had turned that feature off for the whole instance, so switching them did nothing. They are now hidden while the feature is off. Values already saved on a model are kept, so turning the feature back on restores each model's settings.
Refs #32830
* refac: use the codebase's name for instance feature switches
Renames the new feature lookup to match how the rest of the frontend refers to instance features.
* refac: keep each feature switch next to its capability
Reads the instance feature switch from the existing capability list instead of a separate map, with no change in behaviour.
* fix: MCP tools that list their arguments under anyOf are called with no arguments
When an MCP tool described its input as alternatives, for example a page by id or by path and locale, and had no top-level list of fields, every argument the model sent was dropped and the tool was called with nothing, so the server rejected the call. Arguments for MCP tools now reach the server as the model sent them, and the MCP server checks them against its own schema. Other tool types still keep only the arguments their schema lists.
Fixes#32898
* refac: shorten the MCP arguments comment
The comment now only says why MCP tools skip the argument filter.
* fix: MCP tool errors reach the model as a Python list dump instead of the server's message
When an MCP tool server answered a call with an error, the model got a Python dump of the whole result list, with quotes, annotations and meta fields, instead of the error text the server wrote. Line breaks in the message were escaped as well, so a validation error listing the missing argument was hard to read and models tended to retry the same broken call. The model now gets the server's error text as written, the same way successful results already arrive.
Fixes#32918
* refac: drop the fallback text for MCP errors with no message
The error now carries only the text the server sent.
* fix: keep a readable error when an MCP error has no text
MCP error results that only carry images, audio or resources now give the model a short error message instead of an empty one.
* fix: Terminal capability shows while no terminal server exists
The Terminal capability showed in the model editor even when the admin had set up no terminal server and direct integrations were off, which is the default, so it did nothing. It now shows only when an enabled terminal server exists or users can add their own through direct integrations, and the value saved on a model is kept. The server now reports whether any enabled terminal server exists, since the editor itself only sees the servers the current user can access and a model can be shared with other users.
Refs #32830
* fix: hide the default terminal picker when no terminal is available
The model editor still showed the default terminal line when no terminal server or direct integration was available. It now follows the same rule as the Terminal capability.
* fix: temporary chat and delete chat shortcuts show while not allowed
The keyboard shortcuts list showed "New Temporary Chat" and "Delete Chat" to users who may not use temporary chats or delete chats, and pressing those shortcuts neither opened a temporary chat nor deleted anything for them. Both entries now only show to users with the matching permission, and the settings search skips them otherwise.
Refs #32830
* fix: new temporary chat shortcut does nothing without the permission
Users without the temporary chat permission were sent to a new chat by the New Temporary Chat shortcut; it now does nothing for them.
Fixes CVE-2026-111497 (the "Node2Shell"/"HTTP2Shell" Brotli decoder flaw). Open WebUI decodes Brotli responses automatically whenever it fetches from a model provider, a tool server or a web page, so a malicious server could hand it a crafted response that hits the vulnerable decoder. Both packages now use the fixed releases.
The required parameters of OpenAPI tool server tools, Open Terminal included, were sent to the model in a random order that could change every time Open WebUI restarted. The tool list sits at the start of every prompt, so a different order made every prefix cache on the model side miss, and long chats were processed again from scratch after a restart. The required parameters now keep the order the tool server declares, so the tool list stays identical across restarts.
Picks up the 3.14.4 security release and the 3.14.5 fixes. Open WebUI only uses aiohttp as a client, and the fixes that apply there stop Secure cookies from going out over plain HTTP, stop a connection from being reused after a cancelled upload, fix a memory leak on upstream websocket connections, and keep a websocket open when the server sends a control frame with the RSV1 bit set. Its URL library yarl moves to 1.25.1 because the new aiohttp requires it. Checked with a fresh install, the startup check, the unit and outbound HTTP integration tests, and a streamed chat.
Pillow, the image library behind image uploads, edits and PDF image reading, moves to 13.0.0, the major release that carries fixes for crafted image files in its JPEG, TIFF, GIF, BMP and other decoders. No code had to change, since nothing in Open WebUI uses the features this release removed or changed. Verified with a real install, a server boot, the unit tests and the image-related integration tests, plus live runs of chat image uploads, image editing, PDF image extraction and profile pictures that gave the same results as the current version.
pypdf moves from 6.7.5 to 6.21.2, which brings many fixes for malformed PDFs that could hang the server or exhaust its memory during upload. Its text extraction also changed a little: some line breaks inside a block of text now come out as spaces, so a re-uploaded document can be split into chunks slightly differently, with the same words. cryptography picks up its 48.0.1 patch release, which ships wheels built against OpenSSL 4.0.1. Verified with a real install, the startup check and the upload, retrieval and sign-in tests, plus a text PDF and an image PDF that give the same extracted text as before.
Upgrade the MCP SDK to 2.3.0 and build MCPClient on its Client in
mode='auto', which probes server/discover for the stateless 2026-07-28
protocol and falls back to the initialize handshake for legacy servers.
MCPClient's public surface is unchanged.
MCP_INITIALIZE_TIMEOUT becomes the session's default request timeout, so
it bounds the legacy handshake, tool listing and resource reads; tool
calls keep using AIOHTTP_CLIENT_TIMEOUT_TOOL_SERVER.
Relates to #29778
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
When one sentence failed to synthesize during Read Aloud, playback ended but every remaining sentence was still sent to the speech provider, each failure showed its own error toast and any audio that came back was thrown away. Read Aloud now requests no further sentences after the first failure, so a provider outage gives one error and no wasted requests.
Fixes#33023
Users > Groups and the default permissions showed toggles such as Web Search, Channels, Notes, API Keys or Rate Response even when the admin had turned that feature off for the whole instance, so changing them did nothing. Each of these toggles, and the sharing toggles for notes, folders and calendars, now only shows while its feature is on. Stored permission values are kept, so turning a feature back on restores each group's setting.
Refs #32830
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_OLLAMA=true free_disk:false name:ollama suffix:-ollama]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_SLIM=true free_disk:false name:slim suffix:-slim]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_CUDA=true
USE_CUDA_VER=cu126
free_disk:true name:cuda126 suffix:-cuda126]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_CUDA=true free_disk:true name:cuda suffix:-cuda]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_SLIM=true free_disk:false name:slim suffix:-slim]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args: free_disk:false name:main suffix:]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_CUDA=true
USE_CUDA_VER=cu126
free_disk:true name:cuda126 suffix:-cuda126]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args: free_disk:false name:main suffix:]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/amd64 runner:ubuntu-latest], map[build_args:USE_OLLAMA=true free_disk:false name:ollama suffix:-ollama]) (push) Waiting to run
Create and publish Docker images with specific build args / build (map[arch:linux/arm64 runner:ubuntu-24.04-arm], map[build_args:USE_CUDA=true free_disk:true name:cuda suffix:-cuda]) (push) Waiting to run
The Voice section in Settings > Interface, with voice interruption and emoji in call, showed to users without the call permission, who cannot start a call. The section now only shows to users who can make calls, and the settings search skips it for everyone else.
Refs #32830
Co-authored-by: Tim Baek <tim@openwebui.com>
Settings > Interface showed "Web Search in Chat" when web search is off for the instance or the user may not use it, and the choice had no effect. It now shows under the same conditions as the web search button in the chat input, and the settings search skips it otherwise. A saved choice is kept and applies again once web search is available.
Refs #32830
