This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+14 more
ReleasePort's take
Light signalVersionβ―1.9.2 expands researchβstep output to show full tool results (up to 4,000 characters) and lists every enabled tool in agent heartbeats.
Why it matters: Improves observability of chat UI workflows by surfacing complete step data and full tool inventories; applies to all deployments on v1.9.2.
Summary
AI summaryBroad release touches π Bug Fixes, β¨ New Features, π Other Changes, and π§ CI/CD & Maintenance.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Research steps in chat mode now expand to show full tool output (capped at 4,000 chars). Research steps in chat mode now expand to show full tool output (capped at 4,000 chars). Source: llm_adapter@2026-07-12 Confidence: high |
β |
| Feature | Medium |
Agent heartbeat now lists every enabled tool instead of sampling three. Agent heartbeat now lists every enabled tool instead of sampling three. Source: llm_adapter@2026-07-12 Confidence: high |
β |
| Dependency | Low |
Patch version bumped to 1.9.2. Patch version bumped to 1.9.2. Source: llm_adapter@2026-07-12 Confidence: high |
β |
| Bugfix | Medium |
Numbers in exported PDFs no longer render as spacedβout emoji glyphs. Numbers in exported PDFs no longer render as spacedβout emoji glyphs. Source: llm_adapter@2026-07-12 Confidence: high |
β |
| Bugfix | Medium |
Language Model dropdown no longer comes up empty on New Research page load. Language Model dropdown no longer comes up empty on New Research page load. Source: llm_adapter@2026-07-12 Confidence: low |
β |
| Bugfix | Medium |
Submitting without selecting a model now shows an inline error and focuses the field. Submitting without selecting a model now shows an inline error and focuses the field. Source: llm_adapter@2026-07-12 Confidence: low |
β |
Full changelog
Chat research-step transparency and fixes for the model dropdown and PDF exports
The headline feature is in chat mode: clicking a research step now expands to show what the tool actually returned β the formatted search results or fetched page content (capped at 4,000 chars) instead of a bare 150-character preview. The agent's between-steps heartbeat also lists every enabled tool by name, rather than sampling three and hiding the rest behind "+N more" (#5051).
New Research page fixes
Two long-standing annoyances on the New Research page are fixed:
- The Language Model dropdown no longer comes up empty on load. Previously you often had to click the refresh button to populate it. The page now issues a single model-list request instead of two competing ones, the Ollama model query gets a more forgiving 5-second timeout (up from 2s, which a cold Ollama regularly missed), and a transient empty result no longer sticks in the cache for five minutes (#5053).
- Submitting without a model now fails fast with an inline "Please select or enter a model." error that focuses the field β expanding the Advanced Options panel if you had it collapsed β instead of kicking off a research run that would fail downstream (#5048).
PDF export fix
Numbers in exported PDFs no longer render as wide, spaced-out emoji glyphs ("2 0 2 6" instead of "2026"). Digits carry the Unicode Emoji property, so listing Noto Color Emoji in the PDF font stacks made Pango draw every digit with the emoji font. The emoji families are removed from the stacks; emoji themselves still render correctly through per-character font fallback (#5050).
The remaining changes are test-suite hygiene (fixing cross-test state leaks and flaky UI tests) with no user-facing impact.
β¨ New Features
- Research steps in chat mode now expand to show the actual tool output (search results, fetched page content β capped at 4,000 chars) when clicked, and the agent's "selecting next action from β¦" heartbeat lists every enabled tool instead of sampling 3 with "+N more". (#5051)
π Bug Fixes
- Fix the Language Model dropdown frequently coming up empty on the New Research page (requiring a manual click of the refresh button). Three root causes are addressed: the page fired two concurrent
/available-modelsrequests on every load, which contended against a cold Ollama; Ollama's model-list query used a too-tight 2-second timeout (raised to 5s) whose failure was silently turned into an empty list; and a transient empty result could linger in the client cache. The list now loads once per page and self-heals from a transient empty response. - Fixed numbers in exported PDFs rendering as wide, spaced-out emoji glyphs ("2 0 2 6" instead of "2026"). Digits 0-9 carry the Unicode Emoji property, so listing "Noto Color Emoji" in the PDF font stacks (#4730) made Pango draw every digit with the emoji font. Emoji families are removed from the stacks; emoji still render via fontconfig per-character fallback to the installed emoji font.
- Validate that a language model is selected before starting a research from the New Research page. Submitting with an empty model now shows an inline "Please select or enter a model." error and focuses the model field instead of kicking off a run that would fail downstream.
π Other Changes
- Fixed cross-test state leaks from tests that reload or evict production modules: the rate-limiter tests restored a fake config, the history-routes fixture leaked auth-bypassed blueprints, the office-format tests could leak a blocked-dependency loader registry, the settings-logger tests leaked the log level, the security import-fallback helper re-created the whole security tree (stacking permanent audit hooks), and four sibling sites (thread-local-session eviction, auth-db reload, env-definitions re-import, loader-registry import guards) now restore the exact pre-test modules.
What's Changed
π Security Updates
- docs(security): point scrub guidance at scrub_error() (#5019 follow-up) by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5040
β¨ New Features
- feat(chat): expandable tool-result detail in research steps + full tool listing in heartbeat by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5051
π Bug Fixes
- fix(pdf): stop digits rendering as emoji glyphs in exported PDFs by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5050
- fix(test): restore exact pre-test module state across reload/eviction test sites by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5049
- fix(web): stop the model dropdown coming up empty on page load by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5053
- fix(ui-tests): make ctrlEnterSubmit hermetic in accessibility shard by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5056
- fix(ui-tests): stop logpanel prune-cap counter test timing out by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5057
π§ CI/CD & Maintenance
- chore: clear changelog fragments for 1.9.1 by @github-actions[bot] in https://github.com/LearningCircuit/local-deep-research/pull/5054
- chore: bump patch version to 1.9.2 by @github-actions[bot] in https://github.com/LearningCircuit/local-deep-research/pull/5018
Other Changes
- fix(web): require a model before starting research on New Research page by @LearningCircuit in https://github.com/LearningCircuit/local-deep-research/pull/5048
Full Changelog: https://github.com/LearningCircuit/local-deep-research/compare/v1.9.1...v1.9.2
Security Fixes
- docs(security): point scrub guidance at scrub_error() (#5019 follow-up)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Local Deep Research
AI-powered deep research tool with multi-source search (arXiv, PubMed, web)
Related context
Related tools
Earlier breaking changes
- v1.6.11 JavaScript rendering disabled by default in production Docker image; new web.enable_javascript_rendering setting (default false).
Beta — feedback welcome: [email protected]