Skip to content

Local Deep Research

v1.9.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 15d LLM Frameworks
βœ“ No known CVEs patched
Read the diff β†’ Tool health β†’ What is this tool? β†’
This release patches 1 known CVE

Topics

academia anthropic arxiv brave deep-research encryption
+14 more
home-automation homeserver local local-deep-research local-llm mistral ollama openai pubmed research research-tool retrieval-augmented-generation searxng self-hosted

ReleasePort's take

Light signal
editorial:auto 14d

Versionβ€―1.9.2 expands research‑step output to show full tool results (up to 4,000 characters) and lists every enabled tool in agent heartbeats.

Why it matters: Improves observability of chat UI workflows by surfacing complete step data and full tool inventories; applies to all deployments on v1.9.2.

Summary

AI summary

Broad release touches πŸ› Bug Fixes, ✨ New Features, πŸ“ Other Changes, and πŸ”§ CI/CD & Maintenance.

Changes in this release

Feature Medium

Research steps in chat mode now expand to show full tool output (capped at 4,000 chars).

Research steps in chat mode now expand to show full tool output (capped at 4,000 chars).

Source: llm_adapter@2026-07-12

Confidence: high

β€”
Feature Medium

Agent heartbeat now lists every enabled tool instead of sampling three.

Agent heartbeat now lists every enabled tool instead of sampling three.

Source: llm_adapter@2026-07-12

Confidence: high

β€”
Dependency Low

Patch version bumped to 1.9.2.

Patch version bumped to 1.9.2.

Source: llm_adapter@2026-07-12

Confidence: high

β€”
Bugfix Medium

Numbers in exported PDFs no longer render as spaced‑out emoji glyphs.

Numbers in exported PDFs no longer render as spaced‑out emoji glyphs.

Source: llm_adapter@2026-07-12

Confidence: high

β€”
Bugfix Medium

Language Model dropdown no longer comes up empty on New Research page load.

Language Model dropdown no longer comes up empty on New Research page load.

Source: llm_adapter@2026-07-12

Confidence: low

β€”
Bugfix Medium

Submitting without selecting a model now shows an inline error and focuses the field.

Submitting without selecting a model now shows an inline error and focuses the field.

Source: llm_adapter@2026-07-12

Confidence: low

β€”
Full changelog

Chat research-step transparency and fixes for the model dropdown and PDF exports

The headline feature is in chat mode: clicking a research step now expands to show what the tool actually returned β€” the formatted search results or fetched page content (capped at 4,000 chars) instead of a bare 150-character preview. The agent's between-steps heartbeat also lists every enabled tool by name, rather than sampling three and hiding the rest behind "+N more" (#5051).

New Research page fixes

Two long-standing annoyances on the New Research page are fixed:

  • The Language Model dropdown no longer comes up empty on load. Previously you often had to click the refresh button to populate it. The page now issues a single model-list request instead of two competing ones, the Ollama model query gets a more forgiving 5-second timeout (up from 2s, which a cold Ollama regularly missed), and a transient empty result no longer sticks in the cache for five minutes (#5053).
  • Submitting without a model now fails fast with an inline "Please select or enter a model." error that focuses the field β€” expanding the Advanced Options panel if you had it collapsed β€” instead of kicking off a research run that would fail downstream (#5048).

PDF export fix

Numbers in exported PDFs no longer render as wide, spaced-out emoji glyphs ("2 0 2 6" instead of "2026"). Digits carry the Unicode Emoji property, so listing Noto Color Emoji in the PDF font stacks made Pango draw every digit with the emoji font. The emoji families are removed from the stacks; emoji themselves still render correctly through per-character font fallback (#5050).

The remaining changes are test-suite hygiene (fixing cross-test state leaks and flaky UI tests) with no user-facing impact.

✨ New Features

  • Research steps in chat mode now expand to show the actual tool output (search results, fetched page content β€” capped at 4,000 chars) when clicked, and the agent's "selecting next action from …" heartbeat lists every enabled tool instead of sampling 3 with "+N more". (#5051)

πŸ› Bug Fixes

  • Fix the Language Model dropdown frequently coming up empty on the New Research page (requiring a manual click of the refresh button). Three root causes are addressed: the page fired two concurrent /available-models requests on every load, which contended against a cold Ollama; Ollama's model-list query used a too-tight 2-second timeout (raised to 5s) whose failure was silently turned into an empty list; and a transient empty result could linger in the client cache. The list now loads once per page and self-heals from a transient empty response.
  • Fixed numbers in exported PDFs rendering as wide, spaced-out emoji glyphs ("2 0 2 6" instead of "2026"). Digits 0-9 carry the Unicode Emoji property, so listing "Noto Color Emoji" in the PDF font stacks (#4730) made Pango draw every digit with the emoji font. Emoji families are removed from the stacks; emoji still render via fontconfig per-character fallback to the installed emoji font.
  • Validate that a language model is selected before starting a research from the New Research page. Submitting with an empty model now shows an inline "Please select or enter a model." error and focuses the model field instead of kicking off a run that would fail downstream.

πŸ“ Other Changes

  • Fixed cross-test state leaks from tests that reload or evict production modules: the rate-limiter tests restored a fake config, the history-routes fixture leaked auth-bypassed blueprints, the office-format tests could leak a blocked-dependency loader registry, the settings-logger tests leaked the log level, the security import-fallback helper re-created the whole security tree (stacking permanent audit hooks), and four sibling sites (thread-local-session eviction, auth-db reload, env-definitions re-import, loader-registry import guards) now restore the exact pre-test modules.

What's Changed

πŸ”’ Security Updates

  • docs(security): point scrub guidance at scrub_error() (#5019 follow-up) by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5040

✨ New Features

  • feat(chat): expandable tool-result detail in research steps + full tool listing in heartbeat by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5051

πŸ› Bug Fixes

  • fix(pdf): stop digits rendering as emoji glyphs in exported PDFs by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5050
  • fix(test): restore exact pre-test module state across reload/eviction test sites by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5049
  • fix(web): stop the model dropdown coming up empty on page load by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5053
  • fix(ui-tests): make ctrlEnterSubmit hermetic in accessibility shard by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5056
  • fix(ui-tests): stop logpanel prune-cap counter test timing out by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5057

πŸ”§ CI/CD & Maintenance

  • chore: clear changelog fragments for 1.9.1 by @github-actions[bot] in https://github.com/LearningCircuit/local-deep-research/pull/5054
  • chore: bump patch version to 1.9.2 by @github-actions[bot] in https://github.com/LearningCircuit/local-deep-research/pull/5018

Other Changes

  • fix(web): require a model before starting research on New Research page by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5048

Full Changelog: https://github.com/LearningCircuit/local-deep-research/compare/v1.9.1...v1.9.2

Security Fixes

  • docs(security): point scrub guidance at scrub_error() (#5019 follow-up)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Local Deep Research

Get notified when new releases ship.

Sign up free

About Local Deep Research

AI-powered deep research tool with multi-source search (arXiv, PubMed, web)

All releases β†’

Related context

Earlier breaking changes

  • v1.6.11 JavaScript rendering disabled by default in production Docker image; new web.enable_javascript_rendering setting (default false).

Beta — feedback welcome: [email protected]