This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+9 more
Affected surfaces
ReleasePort's take
Moderate signalVersion v4.25.3 adds TOTP two‑factor authentication for Dashboard login and introduces several UI enhancements, bug fixes, and performance improvements.
Why it matters: Enables stronger security for Dashboard access; other updates address reliability bugs and boost KV‑cache hit rates, directly benefiting developers, SREs, and security teams.
Summary
AI summaryBroad release touches Improvements and Maintenance, 修复, Bug Fixes, and 重点更新.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Adds TOTP two-factor authentication for Dashboard login. Adds TOTP two-factor authentication for Dashboard login. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Breaking | High |
Upgrades MiniMax Token Plan default model to M3. Upgrades MiniMax Token Plan default model to M3. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Feature | Medium |
Adds `/name` command to name umo entries and display them in the UI. Adds `/name` command to name umo entries and display them in the UI. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Feature | Medium |
Adds plugin WebUI entries to Dashboard sidebar with MDI icon support. Adds plugin WebUI entries to Dashboard sidebar with MDI icon support. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Performance | Medium |
Improves long‑term memory and context compression quality, increasing KV‑cache hit rates. Improves long‑term memory and context compression quality, increasing KV‑cache hit rates. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Fixes DingTalk Stream task recovery to keep reconnecting after unexpected exits. Fixes DingTalk Stream task recovery to keep reconnecting after unexpected exits. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Fixes private message sending failures caused by extra fields in Reply component `toDict` output. Fixes private message sending failures caused by extra fields in Reply component `toDict` output. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Fixes voice parsing in the aiocqhttp adapter and adds audio file existence check. Fixes voice parsing in the aiocqhttp adapter and adds audio file existence check. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Fixes invalid OpenAI Embedding parameters for SiliconFlow non‑Qwen models. Fixes invalid OpenAI Embedding parameters for SiliconFlow non‑Qwen models. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Fixes Gemini batch embedding texts collapsing on `gemini-embedding-2`. Fixes Gemini batch embedding texts collapsing on `gemini-embedding-2`. Source: llm_adapter@2026-06-05 Confidence: high |
— |
Full changelog
What's Changed
重点更新
- 修复钉钉 Stream 任务异常退出后无法持续重连的问题,提升钉钉适配器长连接稳定性。(#8610)
- Dashboard 登录新增 TOTP 双因素认证。(#8189)
- Dashboard 侧边栏新增插件 WebUI 入口,并支持 MDI 图标;插件页面现在会同步 Dashboard 主题。(#8569, #8390)
- 优化未来任务 UI,提高 “创建任务” 的产品化程度。(#8559)
- 新增
/name命令用于命名 umo 且在 UI 中展示。 (#8575) - MiniMax Token Plan 支持动态获取模型列表,默认模型升级为 M3。(#8475, #8505)
- 优化上下文压缩,提高压缩质量和 KV-cache 命中率。(#8530, #8226)
修复
- 修复 Provider 统计遇到 SQLite lock 时未重试的问题。(commit)
- 修复空 modalities 被当作已配置能力,导致核心图片请求错误路由到视觉 fallback 的问题。(#8451)
- 修复 Reply 组件
toDict额外字段导致私聊消息发送失败的问题。(#8477) - 修复带 Reply 组件唤醒机器人且用户提示为空时的处理问题。(#8461)
- 修复 aiocqhttp 适配器无法解析语音的问题,并增加音频文件存在性检查。(#8523, #8529)
- 修复 OpenAI Embedding 在 SiliconFlow 非 Qwen embedding 模型上的无效参数问题。(#8508)
- 修复 Gemini Embedding 批量文本在
gemini-embedding-2上被折叠的问题。(#8537) - 修复 WeCom AI 消息链提取纯文本时的空白处理问题。(#8563)
- 修复 Dashboard 在 launcher 下运行时 frame 安全头过于严格的问题。(#8554)
- 修复控制台 pip 安装错误展示,改为使用 toast 提示。(#8462)
- 优化模板配置相关问题。(#8228)
优化与工程
- 增强 Reply 消息链对 Record 组件的处理。(#8527)
- Whisper STT 调用 OpenAI 转写接口后会关闭音频文件句柄。(#8528)
- 防止唤醒命令被记录为群聊上下文。(#8536)
- 修正中文文本中的 token 术语。(#8465)
- 更新 GitHub Actions 依赖。(#8533)
What's Changed (EN)
Highlights
- Fixed DingTalk Stream task recovery so the adapter keeps reconnecting after unexpected SDK task exits. (#8610)
- Added TOTP two-factor authentication for Dashboard login. (#8189)
- Added plugin WebUI entries to the Dashboard sidebar with MDI icon support, and synchronized Dashboard theme styling into plugin pages. (#8569, #8390)
- Added the future task UI and introduced
/namefor naming umo entries shown in the UI. (#8559, #8575) - MiniMax Token Plan can now fetch model lists dynamically, with the default model upgraded to M3. (#8475, #8505)
- Improved long-term memory and context compression quality, including better KV-cache hit rates. (#8530, #8226)
Bug Fixes
- Retried provider stats reads when SQLite is locked. (commit)
- Treated empty modalities as unconfigured so image requests do not incorrectly route to vision fallback. (#8451)
- Fixed private message sending failures caused by extra fields in Reply component
toDictoutput. (#8477) - Fixed waking the bot with a Reply component and an empty user prompt. (#8461)
- Fixed voice parsing in the aiocqhttp adapter and added an audio file existence check. (#8523, #8529)
- Fixed invalid OpenAI Embedding parameters for SiliconFlow non-Qwen embedding models. (#8508)
- Wrapped Gemini batch embedding texts in Content to avoid collapse on
gemini-embedding-2. (#8537) - Fixed whitespace handling when extracting plain text from WeCom AI message chains. (#8563)
- Relaxed Dashboard frame security headers when running under the launcher. (#8554)
- Displayed console pip-install errors with toast messages. (#8462)
- Optimized template config handling. (#8228)
Improvements and Maintenance
- Enhanced Reply chain handling for Record components. (#8527)
- Closed audio file handles after OpenAI transcription calls in Whisper STT. (#8528)
- Prevented wake commands from being recorded as group chat context. (#8536)
- Fixed Chinese token terminology. (#8465)
- Updated GitHub Actions dependencies. (#8533)
What's Changed
- Fix&Feat: Template config optimization by @Railgun19457 in https://github.com/AstrBotDevs/AstrBot/pull/8228
- chore: fix token terminology in zh by @Rain-0x01-39 in https://github.com/AstrBotDevs/AstrBot/pull/8465
- feat: dynamically fetch model list for MiniMax Token Plan via /v1/models API by @Blueteemo in https://github.com/AstrBotDevs/AstrBot/pull/8475
- fix: waking bot with a reply component and empty user prompt by @lingyun14beta in https://github.com/AstrBotDevs/AstrBot/pull/8461
- feat: add TOTP two-factor authentication for dashboard login by @Raven95676 in https://github.com/AstrBotDevs/AstrBot/pull/8189
- fix(message): 修复 Reply 组件 toDict 方法输出多余字段导致私聊消息发送失败的问题 by @NayukiChiba in https://github.com/AstrBotDevs/AstrBot/pull/8477
- fix(core): 将空 list modalities 视为未配置,修复图片无法传递到模型的问题 by @Sisyphbaous-DT-Project in https://github.com/AstrBotDevs/AstrBot/pull/8451
- feat: upgrade MiniMax Token Plan default model to M3 by @octo-patch in https://github.com/AstrBotDevs/AstrBot/pull/8505
- fix(console): use toast for pip-install error display by @xxynet in https://github.com/AstrBotDevs/AstrBot/pull/8462
- fix(ltm): prevent wake commands from being recorded as group chat context by @RC-CHN in https://github.com/AstrBotDevs/AstrBot/pull/8536
- fix: cannot resolve voice when using aiocqhttp adapter by @tjc6666666666666 in https://github.com/AstrBotDevs/AstrBot/pull/8523
- chore(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 in the github-actions group by @dependabot[bot] in https://github.com/AstrBotDevs/AstrBot/pull/8533
- Add check for audio file existence by @tjc6666666666666 in https://github.com/AstrBotDevs/AstrBot/pull/8529
- perf(stt-whisper): close the audio file handle after calling the OpenAI transcription API by @tjc6666666666666 in https://github.com/AstrBotDevs/AstrBot/pull/8528
- fix(openai-embedding): temporarily fix invalid paramater for SiliconFlow provider's non-Qwen embedding models by @Allenyou1126 in https://github.com/AstrBotDevs/AstrBot/pull/8508
- fix(gemini-embedding): wrap batch embedding texts in Content to avoid collapse on gemini-embedding-2 by @Rat0323 in https://github.com/AstrBotDevs/AstrBot/pull/8537
- fix(compress): improve context compression, improve kv-cache rate of context compression, handle compression model modalities by @Foolllll-J in https://github.com/AstrBotDevs/AstrBot/pull/8530
- fix(dashboard): relax frame security headers when running under launcher by @lxfight in https://github.com/AstrBotDevs/AstrBot/pull/8554
- feat: future task UI by @Soulter in https://github.com/AstrBotDevs/AstrBot/pull/8559
- fix(wecomai_event): 修复消息链提取纯文本时的空白处理 by @NayukiChiba in https://github.com/AstrBotDevs/AstrBot/pull/8563
- Enhance Reply chain handling for Record components by @tjc6666666666666 in https://github.com/AstrBotDevs/AstrBot/pull/8527
- fix: retry provider stats on sqlite lock by @zouyonghe in https://github.com/AstrBotDevs/AstrBot/pull/8574
- feat: introduce a command /name to name a umo, and display in ui by @Soulter in https://github.com/AstrBotDevs/AstrBot/pull/8575
- feat: sync dashboard theme to plugin pages by @lxfight in https://github.com/AstrBotDevs/AstrBot/pull/8390
- feat(dashboard): add plugin WebUI entries to sidebar with MDI icon support by @lxfight in https://github.com/AstrBotDevs/AstrBot/pull/8569
- fix: keep DingTalk stream reconnecting by @Soulter in https://github.com/AstrBotDevs/AstrBot/pull/8610
New Contributors
- @octo-patch made their first contribution in https://github.com/AstrBotDevs/AstrBot/pull/8505
- @xxynet made their first contribution in https://github.com/AstrBotDevs/AstrBot/pull/8462
- @Allenyou1126 made their first contribution in https://github.com/AstrBotDevs/AstrBot/pull/8508
- @Rat0323 made their first contribution in https://github.com/AstrBotDevs/AstrBot/pull/8537
Full Changelog: https://github.com/AstrBotDevs/AstrBot/compare/v4.25.2...v4.25.3
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About AstrBot
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]