* refac

* chore: Changelog updates (open-webui#22460)

* Add v0.8.10 changelog entry

* changelog: docker startup fix for missing opentelemetry dependency

* changelog: add translation updates for v0.8.10

* changelog: oauth-error-handling, exception-messages

* changelog: fix YAML file processing with Docling (open-webui#22399)

* changelog: tool access fix for non-admin users

* changelog: fix time range month names localization

* changelog: pipeline filter, webhook crash, shutdown handling

* changelog: tool method filtering, OAuth URL encoding, Azure TTS

* changelog: add analytics group filtering fix

* changelog: api-calls, optimization, performance

* changelog: add MariaDB Vector support entry

* changelog: add web search favicon fallback fix

* changelog: custom model fallback fix

* changelog: pending message image display fix (open-webui#22256)

* changelog: task message truncation for title and tag generation

* changelog: oidc, logout, custom-endpoint

* changelog: files list stability fix for issue open-webui#21879

* Remove empty Changed section from v0.8.10

* changelog: file metadata sanitization fix

* Remove empty Changed section from v0.8.10

* changelog: fix knowledge file embedding updates for RAG

* changelog: add Azure speech transcription error fix

* chore: bump

* refac

* refac

* refac

* Update fi-FI translation.json (open-webui#22542)

Added missing translations, minor fixes and translation consistency updates.

* refac: refined shimmer effect (open-webui#22516)

Rework shimmer animation timing and gradient for a smoother sweep.
Slower start with acceleration through the text using a custom
cubic-bezier curve. Softer highlight contrast in both light and
dark modes.

* Updated pt-PT Translation (open-webui#22587)

Co-authored-by: Tim Baek <tim@openwebui.com>
Co-authored-by: joaoback <156559121+joaoback@users.noreply.github.com>

* fix: handle non-dict history/messages in chat_message migration (open-webui#22588)

Some databases contain chat records where 'history' or 'messages' are
stored as lists instead of dicts. This causes an AttributeError
('list' object has no attribute 'items') during the
8452d01d26d7_add_chat_message_table migration.

Add isinstance checks to skip chat records with unexpected data shapes
gracefully, matching the existing pattern used for individual message
validation.

* fix: ddgs

* i18n: Update Catalan translation.json (open-webui#22570)

* refac

* refac: rm mariadb dep

* enh: verify terminal connection

* refac: safer tool server handling

* feat(otel): introduce an environment variable to control the export interval of otel metrics (open-webui#22529)

* i18n(tr-TR): improve Turkish translations - increase coverage and fix typos/terminology errors (open-webui#22544)

* i18n: complete Turkish translations for {{}} placeholder strings

* i18n(tr-TR): fix multiple translation errors

* i18n(tr-TR): add missing translations for Y section

* i18n(tr-TR): add missing translations for Model section

* i18n(tr-TR): add missing Turkish translations for Image section

* i18n(tr-TR): translate Knowledge section strings in Turkish

* i18n(tr-TR): translate upload-related strings in Turkish

* 18n: translate Invalid error messages to Turkish.

* i18n(tr-TR):add Turkish translations for Enter input fields

* i18n(tr-TR): add missing translations for "No" strings

* i18n(tr-TR): replace "istem" with "prompt" for consistency

* i18n(tr-TR): standardize "ID" terminology in Turkish translations

* i18n(tr-TR): add missing translations for "S" strings

* i18n(tr-TR): add missing translations for basic UI and navigation element

* i18n(tr-TR): add missing translations for C-D sections

* i18n(tr-TR): add missing translations for E-F sections

* i18n(tr-TR): standardize "Chunk" terminology to "Parça"

---------

Co-authored-by: MSI I9 12900KS RTX <alifurkanstahl@users.noreply.github.com>

* refac: modernize type hints and imports in access_control module (open-webui#22594)

* refac: allow emoji unselect from folder

* refac

* fix: Prefer model-provided web search result count over admin default (open-webui#22577)

* Prefer model-provided web search result count over admin default

Update `search_web` to prioritize the model-provided `count` parameter before falling back to the admin-configured `WEB_SEARCH_RESULT_COUNT`, and finally defaulting to 5.

Changes:
- Set `count` default to `None` instead of `5`.
- Adjust fallback order to: model-provided `count` → admin-configured value → `5`.
- Update comment to reflect the new precedence logic.

This ensures explicit model requests for result count are respected while preserving sensible defaults.

* Enforce maximum web search result count from config

Update `search_web` to cap the model-provided `count` parameter at the admin-configured `WEB_SEARCH_RESULT_COUNT` to prevent excessive result requests.

Changes:
- Set default `count` parameter to `5`.
- Replace fallback logic with enforcement logic that limits `count` to the configured maximum.
- Update comment to reflect that the result count is now capped to prevent abuse.

This ensures web search requests cannot exceed the configured limit while maintaining a sensible default.

* refac

* avoid silent failure of pip/uv install in Dockerfile (open-webui#22598)

* feat: support whitelist filtering in AuditLoggingMiddleware (open-webui#22515)

Add AUDIT_INCLUDED_PATHS env var for whitelist-based audit filtering.
When set, only matching paths are audited and AUDIT_EXCLUDED_PATHS is
ignored. Auth endpoints (signin/signout/signup) are always logged
regardless of filtering mode.

* refac

* refac

* feat: knowledge - clickable file icon opens content (open-webui#22629)

Replaces the static document icon with an interactive button that opens
the file content in a new tab via the files API endpoint.

* fix: prevent user groups overflow in profile preview (open-webui#22547)

Add flex-wrap, max-h-20, and overflow-y-auto to the groups container
in UserStatus.svelte to prevent horizontal overflow when users have
many groups. Groups now wrap to multiple rows with a scrollbar when
exceeding the max height.

Co-authored-by: QinQin <qinqin@geotab.com>

* refac

* refac

* refac

* Create generate-sbom.sh

* refac

* refac

* refac

* refac

* i18n: Update Japanese translation (open-webui#22696)

* refac

* doc: sec

* refac

* feat: add ruff linter & formatter (open-webui#22576)

* chore: add ruff linter with base config

* ci: add ruff pre-commit hook

* ci: add ruff github actions workflow

* ci: run ruff only on changed files

* refac

* fix(ui): add icon fallback for missing model icons on Models pages (open-webui#22485)

* feat(ui): add bulk actions hamburger menu to workspace Models page (open-webui#22484)

Add hamburger menu with bulk actions (Enable All, Disable All, Show All,
Hide All) to the workspace Models page filter bar, matching the
functionality from the admin Settings Models page.

* chore: svelte bump

* i18n: improve Chinese translation (open-webui#22480)

* refac

* fix: replace bare except with except Exception (open-webui#22473)

Replace bare except clauses with except Exception to follow Python best practices and avoid catching unexpected system exceptions like KeyboardInterrupt and SystemExit.

* refac

* Added Readiness probe (open-webui#22507)

* refac

* i18n(fr-FR): complete French translation (open-webui#22714)

Translate all missing keys in the fr-FR locale file across all components.

* fix: add profile image fallback handlers for model and user avatars in remaining areas (open-webui#22486)

* fix(ui): add profile image fallback handlers for models and users

* Update UserList.svelte

* fix(ui): add profile image fallback handlers for models on New Chat page

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* i18n(et-EE): update Estonian translations (open-webui#22731)

Added missing translations and fixed incorrect ones.

Co-authored-by: Illimar Reinbusch <illimar.reinbusch@tootukassa.ee>

* refac

* refac

* fix(channel): allow sending image-only messages without text (open-webui#22752)

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* i18n: correct Spanish (es-ES) translation errors (open-webui#22870)

Co-authored-by: Tim Baek <tim@openwebui.com>
Co-authored-by: joaoback <156559121+joaoback@users.noreply.github.com>

* refac

* refac

* sec (open-webui#22897)

* fix(ui): chat input triggers correctly re-trigger on backspace (open-webui#22899)

* fix(ui): close thread sidebar on parent message deletion (open-webui#22890)

* refac

* refac

* refac

* refac

* refac

* refac

* fix: Prevent task list checkboxes from shrinking for consistent alignment (open-webui#22886)

* FIX: serper.dev API - Change snippet key from 'description' to 'snippet' (open-webui#22869)

This has apparently been broken since forever and native tool calling made it a lot more apparent.

* fix: replace legacy surrogate-pair emoji regex with Unicode property escape (open-webui#22915)

The previous regular expression used manual surrogate-pair ranges to
match emojis and missed a large category of commonly used symbols:

  /[\uD800-\uDBFF][\uDC00-\uDFFF]|\uD83C[\uDC00-\uDFFF]|\uD83D[\uDC00-\uDE4F]/g

This approach only covers emojis encoded as surrogate pairs (U+1F000 –
U+1F4FF range), but silently skips BMP emojis that use a text-
presentation code point followed by the variation selector U+FE0F,
such as ❤️ (U+2764 U+FE0F), ☀️, ✅, ⚡, ⭐, and keycap sequences
like 1️⃣, as well as ZWJ family sequences (👨‍👩‍👧‍👦) and flag sequences.

Replace with the Unicode property escape \p{RGI_Emoji} using the 'v'
(unicodeSets) flag introduced in ES2024. This single pattern covers
every standardised emoji sequence defined by Unicode, including all
the cases above.

Browser support: Chrome 112+, Firefox 116+, Safari 17+, Node.js 20+.
All browsers targeted by open-webui already support this syntax.

Co-authored-by: Tim Baek <tim@openwebui.com>
Co-authored-by: joaoback <156559121+joaoback@users.noreply.github.com>
Co-authored-by: yoloni <yoloni@tencent.com>

* fix(ui): reset page to 1 when searching prompts (open-webui#22912)

* i18n: add Azerbaijani (az-AZ) translation (open-webui#22792)

Co-authored-by: Tim Baek <tim@openwebui.com>
Co-authored-by: joaoback <156559121+joaoback@users.noreply.github.com>
Co-authored-by: m.shabanov <m.shabanov@asan.local>

* fix(ui): refine message data lazy loading to prevent 404s (open-webui#22894)

* fix: wrong icon shown after removing a toggled filter (open-webui#22862)

* fix(ui): show model avatars in chat search preview modal (open-webui#22782)

* refac

* refac

* enh: colon fence md

* refac

* refac

* fix: guard chat:tasks:cancel handler with message_id check (open-webui#22743)

* refac

* chore: align black with Ruff backend formatting (open-webui#22766)

* refac

* feat: add confirmation dialog for single memory entry deletion (open-webui#22888)

* feat(ui): add confirmation dialog for memory deletion

* fix

* refac

* refac

* refac

* refac

* enh: allow iframe postMessage prompts without same-origin (with HITL confirmation) (open-webui#22908)

* Update Chat.svelte

* Update Chat.svelte

* refac

* refac

* refac

* refac

* refac

* fix: add from_attributes to FunctionResponse (open-webui#22924)

* refac

* enh: WEBUI_AUTH_TRUSTED_ROLE_HEADER

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* enh: inline html result context

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* reafc

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* perf: use asyncio.to_thread for heartbeat DB write (open-webui#22980)

* refac

* refac

* refac

* refac

* fix: new password validation

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* chore: format

* refac

* perf: batch history reactive triggers to rAF in chatEventHandler (open-webui#22947)

* Update translation.json (open-webui#22985)

* refac

* refac

* refac

* refac (open-webui#22987)

* i18n: add pt-BR translations for newly added UI items and consistency pass (open-webui#22989)

New **pt-BR** translations for items introduced in the latest releases, plus a consistency/quality pass across existing strings (grammar, tone, capitalization, pluralization). Placeholders and hotkeys preserved. No logic changes.

* refac

* refac

* perf: lookup

Co-Authored-By: alifurkanstahl <180474740+alifurkanstahl@users.noreply.github.com>

* enh: GOOGLE_OAUTH_AUTHORIZE_PARAMS

* fix: use full_output() in reasoning content delta emit (open-webui#23001)

* refac

* refac

* refac: include black

* refac

* refac

* refac

* feat: oauth 2.1 static mcp

Co-Authored-By: Joost Mul <6438009+donmul@users.noreply.github.com>

* refac

* refac

* enh: consecutive details rendering

* refac

* perf: remove redundant getChatList call from sendMessage (open-webui#22982)

* refac

* refac

* chore: pin deps

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

* refac

Co-Authored-By: Taylor Wilsdon <6508528+taylorwilsdon@users.noreply.github.com>

* perf: remove getChatList from saveChatHandler (open-webui#22983)

* refac

* refac

* refac

* perf: fix double-RAF streaming display lag (open-webui#23016)

* refactor: streamline logging and permission checks in auths.py (open-webui#22960)

* chore: format

* refac

* chore: changelog (open-webui#22569)

* changelog: smoother loading animation

* changelog: add Finnish translations to 0.8.11

* changelog: shimmer animation, general improvements, finnish translation

* changelog: add migration reliability fix for issue open-webui#22568

* changelog: update Finnish, Portuguese (Portugal), and Catalan translations

* changelog: fix channel @mentions for direct connection models

* changelog: web search result limit control

* changelog: migration reliability, channel mentions, docker build, web search

* changelog: logit bias parameter handling fix

* changelog: add Turkish translations

* changelog: add terminal connection verification feature

* changelog: tool server index bounds checking fix

* changelog: add chat folder emoji reset feature

* changelog: add terminal access user visibility fix

* changelog: metrics export interval config

* changelog: knowledge base file previews

* changelog: user groups display, admin panel

* changelog: terminal server, connection confirmations, document loaders, memory search, SBOM

* changelog: remove docker build entry

* changelog: update date to 2026-03-12

* changelog: update date to 2026-03-15

* changelog: fix public note access 500 error

* changelog: mcp integration visibility, web search limit

* changelog: add Japanese to translations

* changelog: security, terminal proxy, path sanitization

* changelog: add ruff linter and formatter entry

* changelog: tool configuration access control security fix

* changelog: markdown file editing, file navigator

* changelog: add Simplified Chinese and Traditional Chinese to translations

* changelog: model profile image fallbacks fix

* changelog: model bulk actions menu

* changelog: files list pagination support

* changelog: temp chat tool calling fix

* changelog: add readiness probe endpoint for Kubernetes

* changelog: update svelte upgrade performance entry to clarify markdown rendering

* changelog: message queue responsiveness fix

* changelog: profile image fallbacks

* changelog: fix model drag-and-drop in admin settings

* changelog: reorder performance entry to top of Added section

* changelog: add Estonian translations

* changelog: security, model access control

* changelog: channel message attachments fix

* changelog: add collaborative document authorization security fix

* changelog: web fetch content length config

* changelog: oracle-23ai, hybrid-search, bugfix

* changelog: tool server connection persistence fix

* changelog: fix paginated list duplicates

* changelog: temporary chat, folder support, knowledge files

* changelog: temporary chat, folder support

* changelog: add Spanish to translations

* changelog: thread sidebar cleanup, channel attachments

* changelog: chat suggestion modal re-trigger fix

* changelog: dynamic HTML lang attribute fix

* changelog: file upload deduplication

* changelog: ollama anthropic endpoint support

* changelog: chat action button timing fix

* changelog: fix serper dev search results display

* changelog: markdown task list checkbox styling

* changelog: memory modal event bubbling fix

* changelog: webhook, channel, console-errors

* changelog: artifacts sidebar, URL indexing fixes

* changelog: emoji removal normalization fix

* changelog: prompts, pagination, search

* changelog: add Azerbaijani to translations

* changelog: search modal avatars fix

* changelog: filter icon display fix

* changelog: channel, messages, API

* changelog: skeleton loader fix

* changelog: knowledge, hybrid-search, reranking

* changelog: date update

* changelog: writing blocks, rendering, UI

* changelog: reasoning block, copy, text

* changelog: add commit links for writing blocks and copy cleanup

* changelog: sidebar menu, memory modal, oracle search

* changelog: task cancellation status tracking

* changelog: shared chat crash, public note access, filter icons

* changelog: plugin ID sanitization for Functions and Tools

* changelog: memory deletion confirmation dialog

* changelog: oauth session persistence

* changelog: chat, redirect, navigation

* changelog: functions list API optimization

* changelog: embed prompt, cross-origin, confirmation

* changelog: chat title preservation fix

* changelog: oauth sub claim fix

* changelog: read aloud crash fix, search modal TTS

* changelog: image-only message handling for Gemini Claude

* changelog: input variables modal crash fix

* changelog: functions API crash fix, input variables modal crash

* changelog: admin OAuth group sync

* changelog: trusted role header authentication config

* changelog: redis, model, race-condition

* changelog: user menu navigation, SPA routing fix

* changelog: input variables modal crash fix

* changelog: tools, embeds, context

* changelog: responses-api-streaming, rag-thinking-models

* changelog: responses API stateful sessions

* changelog: reorder Added entries - Responses API to top, major improvements highlighted

* changelog: restore duplicate Temporary chat folder support entry

* changelog: remove duplicate Temporary chat folder support entry

* changelog: fix Responses API entry link format

* changelog: remove unrelated issue link from Responses API entry

* changelog: add commit links to Responses API streaming improvements

* changelog: deduplicate 💬 emoji in Fixed section

* changelog: add multi-artifact HTML, drag chats, terminal prompts, terminal state entries

* changelog: tool, html, embed

* changelog: add file viewing pagination and knowledge search scoping entries

* changelog: update date to 2026-03-24

* changelog: tool binary response handling

* changelog: terminal file navigator, port previews, file rename

* changelog: tool server, timeout, configuration

* changelog: heartbeat, websocket, event loop

* changelog: password, security, validation

* changelog: oauth, mcp, discovery

* changelog: message upsert API crash fix

* changelog: oidc, authorization, oauth

* changelog: forward auth proxy compatibility

* changelog: remove duplicate Tool HTML embed context entry from Changed section

* changelog: terminal, file navigator, downloads

* changelog: reorder Responses API entries to top of Added section

* changelog: terminal folder downloads

* changelog: add German to localization entry

* changelog: chat render throttling performance

* changelog: oauth, security, access control

* changelog: tool call streaming display fix

* changelog: pyodide, file refresh, code execution

* changelog: google-oauth, session-persistence, refresh-tokens

* changelog: reasoning spinner, tool call display

* changelog: tool valves access control

* changelog: webhook, configuration, security

* changelog: pyodide, file list, refresh

* changelog: model lookup optimization

* changelog: offline code formatting, black formatter

* changelog: ollama, embedding, rag

* changelog: dropdown menu, submenu hover stability

* changelog: skill model mention persistence

* changelog: emoji audit, duplicate removal, positioning fixes for v0.8.11

* changelog: rag, thinking models, json extraction

* changelog: multi-system message merging fix

* changelog: MCP OAuth 2.1 static credentials support

* changelog: bump date to 2026-03-25

* changelog: qwen, system-messages, pipeline

* changelog: scim, group filtering, authentication

* changelog: chat, sidebar, refresh

* changelog: collapsible tool groups, chat UI

* changelog: forwarded-allow-ips, configuration, startup-scripts

* changelog: memory tool registration fix

* changelog: tool server, timeout, frontend

* changelog: ollama embedding retry logic

* changelog: model list auth cookie forwarding

* changelog: model tags, normalization, filter crash

* changelog: model tags, normalization, issue open-webui#20819

* changelog: model editor default metadata

* changelog: Microsoft Entra ID OAuth role claim preservation

* changelog: editor, paste, sanitization

* changelog: arena model sub-model settings

* changelog: chat history save optimization

* changelog: MCP OAuth tool auto-selection

* changelog: bulk model action reliability fix

* fix: align file context injection by user-role messages for native FC (open-webui#22776)

The add_file_context function used a positional zip() to pair API
payload messages with DB-stored messages. After
process_messages_with_output() expands assistant messages containing
tool calls into multiple OpenAI-format messages (assistant + tool
results), the payload list becomes longer than the stored list. This
caused the zip to misalign, so subsequent user messages never received
their attached_files tags -- the model could see uploaded images via
vision but had no file URL to pass to edit_image.

Fix: filter both lists to user-role messages only before zipping.
User messages maintain the same order in both lists regardless of
assistant message expansion, restoring correct file context injection.

Fixes open-webui#21878

* refac

* refac

* chore: ci

* refac

* chore: ci

* chore: bump

* Update fi-FI translation.json

Added missing translations and fixed typos.

* fix: bs4 pip install

* Merge pull request open-webui#23110 from joaoback/patch-33

i18n: add pt-BR translations for newly added UI items and consistency pass

* i18n: improve zh-CN translation (open-webui#23102)

* i18n: improve zh-CN translation

* i18n: improve zh-TW translation

* i18n: improve zh-CN translation

* i18n: Update catalan translation.json (open-webui#23069)

* refac

* fix

* refac

* refac

* refac

* refac

* refac

* chore: format

* refac

* refac

* refac

* chore: changelog (open-webui#23119)

* Add changelog entry for v0.8.12

* changelog: translation updates for zh-CN, ca, pt-BR, fi

* changelog: fix beautifulsoup4 missing dependency

* changelog: add Lithuanian to translation updates

* changelog: api files list, beautifulsoup4

* changelog: api files, license loading fixes

* changelog: terminal server connection verification security fix

* changelog: terminal server security

* changelog: terminal tools exception handling fix

* changelog: admin model visibility fix

* changelog: tool call embed visibility

* refac

* chore: format

* chore: bump

* refac

---------

Co-authored-by: Timothy Jaeryang Baek <tim@openwebui.com>
Co-authored-by: Classic298 <27028174+Classic298@users.noreply.github.com>
Co-authored-by: Kylapaallikko <Kylapaallikko@users.noreply.github.com>
Co-authored-by: Jannik S. <jannik.streidl@icloud.com>
Co-authored-by: Ricardo Catarino <ricardomicc@gmail.com>
Co-authored-by: joaoback <156559121+joaoback@users.noreply.github.com>
Co-authored-by: Aleix Dorca <aleixdorca@mac.com>
Co-authored-by: Lorenzo Maffioli <63981558+lorenzophys@users.noreply.github.com>
Co-authored-by: alifurkanstahl <180474740+alifurkanstahl@users.noreply.github.com>
Co-authored-by: MSI I9 12900KS RTX <alifurkanstahl@users.noreply.github.com>
Co-authored-by: Shamil <ashm.tech@proton.me>
Co-authored-by: Steve-Li-1998 <35399390+Steve-Li-1998@users.noreply.github.com>
Co-authored-by: Jan Kessler <Ithanil@users.noreply.github.com>
Co-authored-by: Athanasios Oikonomou <athoik@gmail.com>
Co-authored-by: jqqin <63757369+jqqin@users.noreply.github.com>
Co-authored-by: QinQin <qinqin@geotab.com>
Co-authored-by: Toru Suzuki <35589743+zolgear@users.noreply.github.com>
Co-authored-by: G30 <50341825+silentoplayz@users.noreply.github.com>
Co-authored-by: Shirasawa <764798966@qq.com>
Co-authored-by: Ethan T. <ethanchang32@gmail.com>
Co-authored-by: Jacob Leksan <63938553+jmleksan@users.noreply.github.com>
Co-authored-by: Eliot GODARD <elgodard@groupe-atlantic.com>
Co-authored-by: IllimarR <illimar@reinbus.ch>
Co-authored-by: Illimar Reinbusch <illimar.reinbusch@tootukassa.ee>
Co-authored-by: Victor Nieto <victornt95@gmail.com>
Co-authored-by: biebiep <bram.steurtewagen@gmail.com>
Co-authored-by: yoloni-9527 <nzy0823666@gmail.com>
Co-authored-by: yoloni <yoloni@tencent.com>
Co-authored-by: Miralasgar Shabanov <67014109+alasgarshabanov@users.noreply.github.com>
Co-authored-by: m.shabanov <m.shabanov@asan.local>
Co-authored-by: Algorithm5838 <108630393+Algorithm5838@users.noreply.github.com>
Co-authored-by: Joost Mul <6438009+donmul@users.noreply.github.com>
Co-authored-by: Taylor Wilsdon <6508528+taylorwilsdon@users.noreply.github.com>

…n-webui#22594)