This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+14 more
Summary
AI summaryBroad release touches β¬οΈ Dependencies, test, π Bug Fixes, and π§ CI/CD & Maintenance.
Full changelog
Cleaner synthesis and more robust LLM handling
This release hardens how the system handles LLM responses and fixes several user-visible bugs where reasoning-model output leaked into answers or citations behaved incorrectly.
Reasoning-model output no longer leaks into reports
Reasoning models (and other LLMs that emit thinking blocks) previously leaked raw reasoning output into synthesized answers, reports, and citations. This release consistently strips those blocks across the entire pipelineβcitation handlers, report structure generation, findings synthesis, and knowledge compressionβso only the final answer reaches the UI. The fix also normalizes LLM responses that arrive as plain strings instead of structured messages, preventing downstream crashes. (#3884, #4334, #4336, #4342)
Fixed citation crashes and duplicate sources
- Follow-up research no longer crashes on string-only LLM responses. Providers such as local Ollama sometimes return raw strings rather than message objects, which caused an
AttributeErrorduring follow-up research. Citation handlers now safely accept both shapes. (#3884, #4334, #4342) - Cross-engine filtering deduplicates ranked results. When an LLM returned the same source index multiple times, a single source could appear with different citation numbers after reindexing. Duplicate indices are now removed while preserving first-seen order. (#3867)
- Empty extractor answers are handled gracefully. A recent regression could emit a stray
". {content}"snippet when an LLM returned an empty or think-only response. Guards now fall back to the non-LLM extraction path. (#4336)
UI and embedding fixes
- Mobile navigation overlap fixed on News, Library, and Collections pages. Bottom-fixed nav elements on these pages now receive proper safe-area clearance, so controls are no longer obscured on iPhone and similar devices. (#4314)
- OpenAI-compatible embedding endpoints are easier to test. The embedding tester now sends strings rather than raw tokens when probing OpenAI API-compatible models, and scheme-less base URLs such as
api.openai.comare normalized before the hostname check so context-length validation is not accidentally disabled. (#4229, #4310)
π Bug Fixes
- Citation handlers and the report structure generator now route LLM responses through
get_llm_response_text, stripping<think>reasoning blocks from synthesized answers and reports (previously leaked verbatim with reasoning models) and normalizing string/message responses in one place. - Cross-engine filtering now deduplicates repeated LLM-ranked result indices so the same source does not appear multiple times with different citation numbers.
- Fix
AttributeErrorin citation handlers during follow-up research when LLMs return string responses instead of message objects. - Restore
str()coercion in the precision citation handler's key-fact extraction so it always returns a string (fixes a mypyno-any-returnfailure introduced in #3884).
What's Changed
π Security Updates
- ci: pin pre-commit to 4.6.0 in pre-commit workflow by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4331
β¨ New Features
- fix(ci): paginate sticky PR-comment lookups; make research comment sticky by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4333
- test: migrate 3 search_cache TTL tests from time.sleep to freezegun by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4289
- refactor(news): drop duplicate escapeHtml on SubscriptionManager by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4313
π Bug Fixes
- fix(embeddings): normalize OpenAI base_url before hostname check by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4310
- fix(css): extend mobile-nav clearance to News/Library/Collections wrappers by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4314
- fix(citation): restore str() in _extract_key_facts to fix mypy no-any-return by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4330
- fix(ci): stop puppeteer E2E from spamming fork PRs named
mainby @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4332 - test(logpanel): fix flaky MAX_LOG_ENTRIES prune test (timeout under parallel load) by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4304
- fix(synthesis): complete the leak fix + guard empty extractor answers by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4336
- fix(llm): normalize str-returns to a message in the central LLM wrapper (+ ainvoke) by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4342
π Documentation
- chore: bump patch version to 1.6.13 by @github-actions[bot] in https://github.com/LearningCircuit/local-deep-research/pull/4213
- docs(ci): correct misleading Scorecard comment on pre-commit install by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4341
π§ CI/CD & Maintenance
- chore: clear changelog fragments for 1.6.12 by @github-actions[bot] in https://github.com/LearningCircuit/local-deep-research/pull/4305
- test: gate test_research_creation.py with @pytest.mark.requires_llm by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4288
- chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 by @dependabot[bot] in https://github.com/LearningCircuit/local-deep-research/pull/4324
- chore(deps): bump step-security/harden-runner from 2.19.3 to 2.19.4 by @dependabot[bot] in https://github.com/LearningCircuit/local-deep-research/pull/4325
- chore(deps): bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/LearningCircuit/local-deep-research/pull/4320
- chore(deps): bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in https://github.com/LearningCircuit/local-deep-research/pull/4323
- test: delete 7 no-assertion tests in test_search_integration.py by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4280
- chore(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in https://github.com/LearningCircuit/local-deep-research/pull/4317
- chore(pre-commit): nudge toward vitest tests when JS source changes lack them by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4262
β¬οΈ Dependencies
- chore(deps): bump date-fns from 4.1.0 to 4.3.0 by @dependabot[bot] in https://github.com/LearningCircuit/local-deep-research/pull/4319
- chore(deps-dev): bump vitest from 4.1.6 to 4.1.7 by @dependabot[bot] in https://github.com/LearningCircuit/local-deep-research/pull/4318
- chore(deps-dev): bump @vitest/coverage-v8 from 4.1.6 to 4.1.7 by @dependabot[bot] in https://github.com/LearningCircuit/local-deep-research/pull/4321
π§Ή Code Quality & Refactoring
- test: remove 7 no-assertion / placeholder tests across 7 files by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4247
- test: replace 4 more tautological asserts with real contracts by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4249
- test: delete two no-assert placeholder tests in test_llm_config.py by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4250
- test: remove 6 duplicate tests from search_engine_factory coverage files by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4254
- test: remove 10 duplicate dual_confidence tests already covered by sibling file by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4255
- test: delete test_evidence_analyzer_coverage.py β 100% duplicates of extended.py by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4258
- test: dedupe 17 redundant EvidenceType tests against high_value sibling by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4259
- test: remove 8 duplicate rejection_engine_extended tests by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4260
- test: dedupe 19 redundant tests from test_evaluator_integration.py by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4263
- test: remove 2 more redundant tests (MCP client + evidence analyzer) by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4261
- test: delete tier-3 dead-code + stdlib shadow + redundant API tests by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4269
- test: dedupe 18 redundant tests in test_findings_repository.py by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4265
- test: tighten 1 status-or-tautology + delete 3 hasattr-only tests by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4271
- test: delete 10 hasattr-only tests in test_research_metrics_extended.py by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4277
- test: dedupe 24 redundant tests from test_evaluator.py by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4264
- test(js): add vitest coverage for saveThemeToServer, addLogEntry delegation, and renderSubscriptionCard by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4311
- test(js): add vitest coverage for three pure Tier-1 helpers by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4297
- test: delete 17 NO_FAILURE_PATH theme tests that always passed silently by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4252
- refactor(js): extract shared formatBytes util (dedup delete_manager + pdf_upload_handler) by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4329
- test(js): add window exports + vitest coverage for 3 Tier-2 pure helpers by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4312
π§ͺ Tests
- test: replace 3 tautology asserts in test_domain_classifier with real checks by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4248
- test: delete two NO_FAILURE_PATH theme tests that always passed by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4251
- test: remove 6 more duplicate dual_confidence tests (batch 2) by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4257
- test: strengthen overmocked rating_storage.create test to verify field mapping by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4246
Other Changes
- feat: disable counting tokens and send strings as part of testing openai api embedding models by @skbs-eng in https://github.com/LearningCircuit/local-deep-research/pull/4229
- fix(citation): handle raw string LLM responses in follow-up research by @Qeuph in https://github.com/LearningCircuit/local-deep-research/pull/3884
- refactor(citation): route LLM responses through get_llm_response_text (+ fix leak) by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4334
- test(citation): fix think-tag test broken by #4334 + harden coverage by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/4335
- fix(search): deduplicate cross-engine filter indices by @qWaitCrypto in https://github.com/LearningCircuit/local-deep-research/pull/3867
New Contributors
- @skbs-eng made their first contribution in https://github.com/LearningCircuit/local-deep-research/pull/4229
- @Qeuph made their first contribution in https://github.com/LearningCircuit/local-deep-research/pull/3884
Full Changelog: https://github.com/LearningCircuit/local-deep-research/compare/v1.6.12...v1.6.13
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Local Deep Research
AI-powered deep research tool with multi-source search (arXiv, PubMed, web)
Related context
Related tools
Earlier breaking changes
- v1.6.11 JavaScript rendering disabled by default in production Docker image; new web.enable_javascript_rendering setting (default false).
Beta — feedback welcome: [email protected]