DeepTutor v1.5.0 Release Notes

Release Date: 2026.07.04

v1.5.0 closes out the entire v1.4 line and opens the next. Rather than a single-point delta, this note looks back across the whole arc from v1.4.0-beta to today — the release that turned DeepTutor into an agent-native, community-driven tutoring platform. Over these weeks the community sent 36 merged pull requests and helped us resolve 53 issues. Thank you — this release is as much yours as ours.

Highlights since v1.4.0

• Partners, born from TutorBot. TutorBot grew into Partners: a production-grade IM pipeline across 15+ channels — Slack, Discord, Telegram, Feishu, WeCom, Zulip, Matrix (with optional E2EE), and a native Mattermost channel — with live streaming replies. You can connect your own Partners, or your local Claude Code / Codex, under My Agents and consult them live mid-chat; each Partner carries its own private memory and its conversations can branch, resume, and replay.
• One agentic chat engine. Chat was rebuilt on a single agent loop with native tool calling on every OpenAI-compatible cloud provider (and SiliconFlow, MiniMax M3, Qwen, Gemini 2.5+), smooth streaming, and an honest activity header.
• A real Knowledge Center. Multiple retrieval engines — LlamaIndex + a FAISS vector backend, LightRAG (local and standalone-server), GraphRAG, PageIndex, and linked / Obsidian knowledge bases — behind one console, on a pluggable document-parse layer (text-only, MinerU, Docling, markitdown, PyMuPDF4LLM). Large-KB retrieval got dramatically faster.
• Guided Learning & Mastery Path. Rebuilt on the chat loop with a per-type mastery gate, a /learning dashboard, LaTeX-rendered quizzes, and graded questions that flow into your Question Bank.
• Multi-user, done properly. Real per-user isolation, admin grants, a redesigned User Management page, a self-service Profile page with avatars, deny-by-default MCP tools, and per-user session isolation.
• Deployment hardening. Rootless-Podman / read-only-rootfs support, a single-port request-time proxy, env-configurable host binding, and a portable supervisord config.
• Security lockdown. The Partner/TutorBot tool sandbox was locked down and a cluster of authorization-bypass, path-traversal, and RCE reports were fixed (see below).
• Three-layer Memory & richer surfaces. A top-level Memory workbench (L1/L2/L3) with Partner conversations bridged in, plus continued work on Deep Research, Solve, Visualize (Animator merged in), and Co-Writer.

In v1.5.0 specifically: the default LlamaIndex engine now routes ingestion through the shared document-parse layer (so it honors your chosen parsing engine and indexes extracted images as multimodal nodes), Partner and Soul ids are ASCII/URL-safe so non-Latin names stay reachable, and the optional graphrag / rag-lightrag extras install cleanly on Python 3.14+ (issues #606, and the fixes below).

Merged pull requests

With gratitude to everyone who sent code:

• #484 — Zulip: content-detection fallback so bots receive @-mentions — @wedone
• #485 — Make require_auth async so the user ContextVar reaches the endpoint — @truffle-dev
• #490 — Unblock Gemini 2.5+ and harden the Visualize pipeline — @skinred78
• #493 — Fix SQLite file-descriptor exhaustion — @thelooter
• #500 — Guided Learning feature work — @arlenwoox
• #507 — Harden ExecTool defaults against command injection (#506) — @kagura-agent
• #508 — Fix the GPT-5 token-limit parameter in the init-wizard probe — @lezhimiffyliu
• #509 — Prevent Document nodes from bypassing the chunking pipeline — @washi4
• #513 — Add a Profile button when no profiles exist — @wedone
• #524 — Truncate oversized event payloads in the session response — @xiongjnu
• #528 — Native tool calling for reasoning models on OpenAI-compatible endpoints — @wedone
• #529 — Qwen JSON preamble, force-recompile overview pages, health false positives — @alvinets
• #540 — Preserve math before citation linkification — @thakrarsagar
• #542 — Route the OAuth backend through the native provider — @thakrarsagar
• #543 — Upgrade the MiniMax default model to M3 — @octo-patch
• #549 — Keep NEXT_PUBLIC_AUTH_ENABLED out of the minifier constant-fold — @IliaAvdeev
• #550 — Keep sidebar footer items as text when the sidebar is collapsed — @IliaAvdeev
• #558 — Surface bad-login errors inline instead of a silent reload — @IliaAvdeev
• #559 — Accept a username, not just an email, on login and register — @IliaAvdeev
• #568 — Gate LLM features for users without an assigned model — @IliaAvdeev
• #570 — Show only provider-relevant fields in Search settings — @IliaAvdeev
• #571 — Discoverable profile rename and auto-name by provider — @IliaAvdeev
• #572 — Translate the missing English settings-tour steps — @IliaAvdeev
• #573 — User profile page with avatar — @IliaAvdeev
• #577 — Harden the image for rootless Podman with a read-only rootfs — @enihcam
• #578 — Chat-history loading animation — @emmett001
• #579 — Deny MCP tools until explicitly granted (multi-user) — @Hinotoi-agent
• #582 — Run supervisord as root so services start under rootful Docker — @IliaAvdeev
• #583 — Redesign the User Management page (avatars, search, skeletons, confirm dialog) — @IliaAvdeev
• #584 — Enable native tool calls for SiliconFlow — @TyrionH-is-coding
• #585 — Move the Back link to its own row in the page header — @IliaAvdeev
• #586 — Make BACKEND_HOST and FRONTEND_HOST env-configurable — @enihcam
• #588 — Render LaTeX in quiz options — @ZhouJ-sh
• #593 — Portable supervisord config across rootful + rootless keep-id — @enihcam
• #602 — Preserve a configured zero LlamaIndex chunk overlap — @VectorPeak
• #604 — Fix mastery choice persistence and grading — @spring618

Resolved issues

🔒 Security & isolation

• #506 — ExecTool executed LLM-generated shell commands over the chat WebSocket
• #514 — Authorization bypass in the book-confirmation flow
• #515 — Cross-session authorization bypass in turn regeneration
• #516 — Cross-bot authorization bypass in TutorBot file management
• #517 — Path traversal in the TutorBot filesystem tool
• #518 — Remote code execution via the TutorBot shell tool
• #596 — Sessions were not isolated by user

🐛 Bug fixes

• #301 — Guided Learning not working with LM Studio (Docker)
• #472 — Co-Writer responses came back extremely short
• #481 — Non-admin users hit 404 on all session requests (Docker multi-user)
• #487 — A new quiz inherited the previous quiz's answer state
• #489 — Visualize and other capabilities silently truncated on Gemini 2.5 / 3.x
• #494 — knowledge_learning router not registered in main.py
• #495 — Knowledge extractor JSON-parsing error with DeepSeek
• #496 — LearningSession had no metadata field, so agents got empty context
• #497 — KnowledgePoint validation rejected LLM-extracted data
• #502 — Docker sed placeholder broke API base-URL validation with a non-default port
• #503 — Unable to communicate with v1.4.0-beta
• #504 — Settings-load failure and zombie running turns after container restart (Docker)
• #512 — New user could not create an initial profile via the UI (Docker)
• #520 — Chat input disabled after the first turn; hardcoded URL guard broke deployments
• #521 — Errors while embedding some knowledge-base documents
• #527 — Qwen 3.6 Plus failed to use native tool calling
• #530 — self-signed-certificate error despite disable_ssl_verify: true
• #531 — allow_shell_exec silently reset to false on every auto-start
• #534 — allow_shell_exec could not be persisted
• #536 — Container appeared to crash after idle time
• #537 — Responses were incoherent
• #574 — Partner conversations never reached the Memory system (empty L1)
• #580 — supervisord pidfile CRIT on rootless Podman + keep-id + read-only rootfs
• #587 — Quiz option cards did not render LaTeX formulas
• #594 — Choosing PyMuPDF4LLM as the parser was overridden by MinerU when building a LightRAG KB
• #595 — Deep Research returned a success response even when a block failed
• #599 — Wrong top-left logo/icon after login in multi-user mode
• #603 — Guided Learning choice options were lost and correct answers could be mis-graded
• #605 — v1.4.15 could not be installed with uv

✨ Features & requests

• #511 — HTTP API for multi-turn conversations with a specific TutorBot
• #553 — User profile page (account + avatar) and a lighter Admin page
• #555 — Moodle support
• #569 — Feature request
• #576 — Rootless Podman with a read-only rootfs for hardened deployments
• #589 — PyMuPDF4LLM for building knowledge bases
• #590 — Native Mattermost channel for the Partner subsystem
• #591 — Support for a standalone external LightRAG container endpoint

💬 Questions & discussions

• #476 — Does adding a doc to a knowledge base have quadratic complexity?
• #505 — How to register a provider on v1.4.0
• #532 — RAG chat could not return information from the selected knowledge base
• #535 — Can TutorBot do almost everything the main system does, via skills?
• #552 — RAG chat on a 250 MB knowledge base returned nothing
• #565 — Question
• #592 — Should DeepTutor become installable apps?
• #597 — Does a Partner have its own memory?
• #598 — Can non-admin users use and create Partners in multi-user mode?

Upgrade Notes

Drop-in from any v1.4.x: pip install -U deeptutor; Docker users pull ghcr.io/hkuds/deeptutor:latest. No migrations — existing knowledge bases, partners, souls, and mastery paths keep working as-is. Two things to know:

• LlamaIndex re-indexing now extracts through the engine you pick in Settings → Document Parsing, not the old text-only path. Existing indexes are untouched; only a re-index picks up the new engine. If a document doesn't extract, confirm the active engine supports that format (keep it on text-only for the previous behavior).
• Non-Latin partner/soul ids only change for newly created entities — anything already on disk keeps its current id.

Thanks

DeepTutor v1.5.0 is the work of a growing community. Special thanks to everyone who opened an issue, filed a report, or sent a pull request — and in particular to our contributors this cycle: @wedone, @truffle-dev, @skinred78, @thelooter, @arlenwoox, @kagura-agent, @lezhimiffyliu, @washi4, @xiongjnu, @alvinets, @thakrarsagar, @octo-patch, @IliaAvdeev, @enihcam, @emmett001, @Hinotoi-agent, @TyrionH-is-coding, @ZhouJ-sh, @VectorPeak, and @spring618. Read the docs at deeptutor.info.

Full Changelog: https://github.com/HKUDS/DeepTutor/compare/v1.4.0-beta...v1.5.0