Onyx Community Edition

v3.3.7 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 14d LLM Frameworks

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai ai-chat chatgpt chatui enterprise-search gen-ai

+7 more

information-retrieval llm llm-ui nextjs python self-hosted vector-db

ReleasePort's take

Moderate signal

editorial:auto 13d

Onyx 3.3.7 requires environment variable migration and ships comprehensive access control fixes across chat, search, and admin APIs. Update DANSWER_RUNNING_IN_DOCKER to ONYX_RUNNING_IN_DOCKER before deployment.

Why it matters: Breaking change: DANSWER_RUNNING_IN_DOCKER→ONYX_RUNNING_IN_DOCKER requires deployment update. Seven security patches harden access controls across chat sessions, agents, document access, and admin endpoints to prevent unauthorized access and data exposure. Apply before rollout.

Summary

AI summary

Broad release touches deps, fix, indexing, and feat.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	Medium	Enforce chat session ownership on stop endpoint to prevent unauthorized session termination. Enforce chat session ownership on stop endpoint to prevent unauthorized session termination. Source: llm_adapter@2026-05-22 Confidence: high	—
Security	Medium	Enforce agent access control on chat session creation; prevent unauthorized agent usage. Enforce agent access control on chat session creation; prevent unauthorized agent usage. Source: llm_adapter@2026-05-22 Confidence: high	—
Security	Medium	Enforce document set access control in search filters; prevent cross-tenant data exposure. Enforce document set access control in search filters; prevent cross-tenant data exposure. Source: llm_adapter@2026-05-22 Confidence: high	—
Security	Medium	Prevent masked OAuth credentials from being stored during re-authentication. Prevent masked OAuth credentials from being stored during re-authentication. Source: llm_adapter@2026-05-22 Confidence: high	—
Security	Medium	Implement redis-backed rate limits on admin invite endpoints to prevent brute-force attacks. Implement redis-backed rate limits on admin invite endpoints to prevent brute-force attacks. Source: llm_adapter@2026-05-22 Confidence: high	—
Security	Medium	Migrate reCAPTCHA to Enterprise Assessment API for enhanced bot detection. Migrate reCAPTCHA to Enterprise Assessment API for enhanced bot detection. Source: llm_adapter@2026-05-22 Confidence: high	—
Security	Medium	Gate /users API endpoint to admin-only access via USER_DIRECTORY_ADMIN_ONLY flag. Gate /users API endpoint to admin-only access via USER_DIRECTORY_ADMIN_ONLY flag. Source: llm_adapter@2026-05-22 Confidence: high	—
Breaking	Medium	Environment variable DANSWER_RUNNING_IN_DOCKER renamed to ONYX_RUNNING_IN_DOCKER. Environment variable DANSWER_RUNNING_IN_DOCKER renamed to ONYX_RUNNING_IN_DOCKER. Source: llm_adapter@2026-05-22 Confidence: high	—
Feature
Feature	Medium	Add smooth character-level streaming for improved text generation UX. Add smooth character-level streaming for improved text generation UX. Source: llm_adapter@2026-05-22 Confidence: high	—
Feature	Medium	Enable multi-model chat mode with parallel model comparisons and stream isolation. Enable multi-model chat mode with parallel model comparisons and stream isolation. Source: llm_adapter@2026-05-22 Confidence: high	—
Feature	Medium	Add file_id tracking to Document model for improved document file association. Add file_id tracking to Document model for improved document file association. Source: llm_adapter@2026-05-22 Confidence: high	—
Feature	Medium	Support TabularSection for structured tabular document indexing. Support TabularSection for structured tabular document indexing. Source: llm_adapter@2026-05-22 Confidence: high	—
Feature	Medium	Implement OpenSearch-only mode option; operator can disable Vespa dependency. Implement OpenSearch-only mode option; operator can disable Vespa dependency. Source: llm_adapter@2026-05-22 Confidence: high	—
Feature	Medium	Include Claude Opus 4.7 in recommended LLM provider list. Include Claude Opus 4.7 in recommended LLM provider list. Source: llm_adapter@2026-05-22 Confidence: high	—
Dependency	Medium	Upgrade Node.js from v20 to v24 for latest runtime features and security. Upgrade Node.js from v20 to v24 for latest runtime features and security. Source: llm_adapter@2026-05-22 Confidence: high	—
Dependency	Medium	Replace mypy with ty for Python type checking. Replace mypy with ty for Python type checking. Source: llm_adapter@2026-05-22 Confidence: high	—
Performance	Medium	Speed up text generation via optimized character-level streaming. Speed up text generation via optimized character-level streaming. Source: llm_adapter@2026-05-22 Confidence: high	—
Performance	Medium	Stream Excel extraction to reduce peak memory footprint on large files. Stream Excel extraction to reduce peak memory footprint on large files. Source: llm_adapter@2026-05-22 Confidence: high	—
Deprecation	Medium	Announce upcoming group-based permissions migration to users and admins. Announce upcoming group-based permissions migration to users and admins. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix
Bugfix	Medium	Fix Jira bulk issue fetch batching to prevent timeout on large result sets. Fix Jira bulk issue fetch batching to prevent timeout on large result sets. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Fix race condition in SCIM endpoint seat-limit enforcement via advisory lock. Fix race condition in SCIM endpoint seat-limit enforcement via advisory lock. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Fix seat-limit TOCTOU race, plug promotion path, cloud auto-bill flow. Fix seat-limit TOCTOU race, plug promotion path, cloud auto-bill flow. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Fix Opus 4.7 support; litellm not stripping unsupported temperature parameter. Fix Opus 4.7 support; litellm not stripping unsupported temperature parameter. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Refresh OIDC access tokens on every authenticated request, not just Google. Refresh OIDC access tokens on every authenticated request, not just Google. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Fix Google Drive connector pruning for removed workspace users RefreshError. Fix Google Drive connector pruning for removed workspace users RefreshError. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Add HTTP timeouts to connector worker threads to prevent indefinite hangs. Add HTTP timeouts to connector worker threads to prevent indefinite hangs. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Treat account_inactive as expired credential in Slack connector. Treat account_inactive as expired credential in Slack connector. Source: llm_adapter@2026-05-22 Confidence: high	—
Bugfix	Medium	Fix Confluence data center WebSudo authentication flow. Fix Confluence data center WebSudo authentication flow. Source: llm_adapter@2026-05-22 Confidence: high	—

Full changelog

See the assets to download this version and install.

What's Changed

feat(slack-bot): make agent selector searchable by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10036
feat(helm): add API and heavy worker ServiceMonitors by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10025
chore(devtools): introduce a .devcontainer by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10035
chore(devtools): upgrade ods: 0.7.3->0.7.4 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10039
chore(devtools): devcontainer allows go and rust repos by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10041
fix: jira bulk issue fetch batching by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10044
feat(federated): full thread replies + direct URL fetch in Slack search by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/9940
feat(helm): add OpenSearch and Redis queues Grafana dashboards by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10042
fix(fe): Query History table has constrained column size by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10047
fix(chat): hide ModelSelector in search mode by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10052
chore(devtools): improve devcontainer usability w/ rootless docker by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10054
fix(LLM config): resolve API Key before fetching models by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10056
feat: google drive error resolution by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/9842
feat: add logos for embedding providers (Cohere, Nomic, Voyage) to @opal/logos by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10034
chore(devtools): upgrade ods: 0.7.4->0.7.5 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10060
fix(license): exclude service account users from seat count by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10053
feat: opalified Divider by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10063
fix(scim): add advisory lock to prevent seat limit race condition by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10048
chore(deps): bump lodash from 4.17.23 to 4.18.1 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/9901
fix(mcp): prevent masked OAuth credentials from being stored on re-auth by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10066
fix(mcp): route OAuth callback to web server instead of MCP server by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10071
fix: italicize proper nouns in modal titles by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10073
fix(mcp): add Ingress route for OAuth callback to reach web server by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10074
fix(chat): model selection + multi-model follow-up correctness by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10075
feat: add padding API to Divider by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10077
chore(devtools): rm docker socket from devcontainer by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10079
feat(chat): smooth character-level streaming by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10076
Revert "feat(chat): smooth character-level streaming" by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10083
fix(copy-button): fall back when Clipboard API unavailable by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10080
chore: remove Knowledge Graph admin page by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10110
refactor: migrate refresh-components/Separator and refresh-components/Divider to @opal/components.Divider by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10064
feat(chat): smooth character-level streaming by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10093
chore(indexing): Add tests for current document chunking by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10086
chore: remove top-level Formik from ChatPreferencesPage by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10112
chore(indexing): Add kind enum to Section model by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10092
chore(deps): bump j178/prek-action from 1.1.1 to 2.0.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10120
feat(chat): scrollable tables with overflow fade by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10097
fix(chat): isolate multi-model streaming errors to their panels by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10113
chore(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10122
fix: welcome message alignment in chrome extension/desktop by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10094
Add Datadog admission opt-out label to sandbox pods by @alex000kim in https://github.com/onyx-dot-app/onyx/pull/10040
chore(deletion): Cleanup log by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10133
fix(deletion): Handle Null Connector Properly by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10131
feat(admin): add global multi-model chat toggle by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10132
fix: CLAUDE.md incorrect task info by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10116
refactor(indexing): Split document chunking into section-based strategies by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10087
chore(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10121
fix(chat): disable Deep Research in multi-model mode (ENG-4009) by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10126
chore(deps): bump next from 16.1.7 to 16.2.3 in /examples/widget by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10125
refactor: rename nonInteractive to withLabel in input layouts by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10117
chore(deps): bump pillow from 12.1.1 to 12.2.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10129
fix(widget): surface descriptive error for trial account 429 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10141
chore(admin): rework chat preferences page layout by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10143
chore(ci): disable automatic Greptile reviews on push by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10146
feat(indexing): add error_type to index_attempt_errors by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10134
chore(deps-dev): bump pypdf from 6.9.2 to 6.10.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10070
chore(deps): bump lodash from 4.17.23 to 4.18.1 in /backend/onyx/server/features/build/sandbox/kubernetes/docker/templates/outputs/web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/9937
chore(deps): bump pytest from 8.3.5 to 9.0.3 in /backend/requirements by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10124
chore(deps-dev): bump black from 25.1.0 to 26.3.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/9313
chore(deps): bump @hono/node-server from 1.19.10 to 1.19.13 in /backend/onyx/server/features/build/sandbox/kubernetes/docker/templates/outputs/web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/9985
chore(deps): bump next from 16.1.7 to 16.2.3 in /backend/onyx/server/features/build/sandbox/kubernetes/docker/templates/outputs/web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10062
chore(deps): bump lodash-es from 4.17.23 to 4.18.1 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/9858
feat(metrics): Wire Promtheus Metrics for Light Worker by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10148
fix: confluence 504 retry with smaller page size by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10147
chore(deps): bump cryptography from 46.0.6 to 46.0.7 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10012
fix(pruning): Adjust Prometheus histogram buckets for pruning metrics by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10155
fix(pruning): Commit hierarchy node upserts atomically in pruning by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10156
fix(pruning): Release DB connection before connector enumeration in pruning by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10154
fix: properly refresh settings/ee settings on license upload success by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10158
chore(deps): bump hono from 4.12.7 to 4.12.12 in /backend/onyx/server/features/build/sandbox/kubernetes/docker/templates/outputs/web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/9986
feat(metrics): Add Deletion-specific Prometheus Metrics by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10157
fix: show correct knowledge toggle status on agent edit page by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10151
chore(pruning): Add Celery task queue wait time metric by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10161
fix: llm popover should refresh on admin provider edit by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10152
fix(google): handle JSON credential payloads in KV storage (@jack-larch) by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10160
refactor: opalify input layouts with trinary withLabel prop by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10144
fix(files): Lower log level on file store cache miss by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10164
fix: document set name patch by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10162
chore(deps-dev): bump langchain-core from 1.2.22 to 1.2.28 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10010
fix: use static provider list instead of querying be by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10166
chore(deps): bump alembic from 1.10.4 to 1.18.4 in /backend by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/9768
feat(notifications): announce upcoming group-based permissions migration by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/10178
refactor: replace Radix Slot with div wrapper in @opal/core.Disabled by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10119
fix(llm): Fix the Auto Fetch workflow by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10181
fix: auth logout modal on fresh load by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10007
fix(chat): speed up text gen by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10186
chore(fe): Toast logs to the console by default in dev by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10183
fix(chat): eliminate long-lived DB session in multi-model worker threads by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10159
fix: text shimmer animation nice and fast by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10184
chore(opensearch): Add debug log for when the migration task releases its lock by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10190
fix: uploaded files as knowledge source by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10167
chore(deps): upgrade python patch version in docker by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10192
chore(deps): upgrade playwright: 1.55.0->1.58.0 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10194
fix(pruning): Skip Permission Sync During Google Drive Pruning by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10185
feat(indexing): Add TabularSection by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10095
chore(deps): bump next from 16.1.7 to 16.2.3 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10195
fix(chat): render inline citation chips in multi-model panels by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10196
feat(indexing): capture swallowed per-doc exceptions in Sentry by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10149
chore(devtools): install java runtime into devcontainer by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10197
feat: add ref forwarding to input layout components by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10206
fix(fe): handle file attachment overflow by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10211
feat(indexing): add diagnostic logging to check_for_indexing beat task by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10200
feat: opalify Tooltip component, migrate all consumers by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10210
fix(chat): fix fade gradient missing on last multi-model panel by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10199
fix(chat): disable hover/pointer states on multi-model panels during streaming by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10202
fix(chat): keep model selector popover open until max models reached by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10203
feat(indexing): add admin API for failed documents by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10204
feat(indexing): notify admins when connector enters repeated error state by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10207
fix(ollama): always include model tag in display name by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10218
fix(voice): send TTS text in POST body instead of query params by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10213
feat(monitoring): add local Prometheus + Grafana docker-compose stack by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/9627
chore(deps): bump transformers from 4.53.0 to 5.5.4 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/9987
chore(tests): avoid openapi client import in tests by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10220
feat(pruning): pruning grafana dashboard for single tenant by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10208
feat(metrics): replace pull-based connector metrics with push-based for multi-tenant by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10189
chore(devtools): connect databases and github remote to devcontainer by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10222
feat(indexing): CSV Chunker - Field-Value Implementation by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10099
feat(canvas): checkpoint logic (3/4) by @benwu408 in https://github.com/onyx-dot-app/onyx/pull/9807
fix(chat): only header click selects preferred in multi-model panels by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10198
fix(chat): snap typewriter to full content on tab re-focus by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10226
fix(chat): hide incomplete citation links during streaming by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10224
feat: opalify MessageCard by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10223
fix(xlsx): Openpyxl Formatting Issues by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10230
feat(connectors): Connectors output TabularSections for tabular files by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10096
fix(pruning): GitHub connector pruning timeout via SlimConnector by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10205
fix(pruning): Resolve hierarchy node FK error for Confluence and Notion by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10235
feat(mt): Infra setup for Redis Set (1/3) by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10209
fix(deletion): Commit Session in per-doc cleanup by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10193
fix(model-server): add missing onyx/configs to Dockerfile for sentry support by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10236
feat(metrics): add connector_name label to push-based connector metrics by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10237
fix: invert already_existed logic in ingestion API response by @jaffarkeikei in https://github.com/onyx-dot-app/onyx/pull/9999
chore(helm): update Grafana dashboard for new push-based metric names by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10238
chore(tests): remove defunct test_litellm_embedding by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10244
chore(deps): bump langsmith from 0.3.45 to 0.7.31 in /backend/requirements by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10250
chore(deps): bump hono from 4.12.12 to 4.12.14 in /backend/onyx/server/features/build/sandbox/kubernetes/docker/templates/outputs/web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10252
chore(python): replace mypy with ty by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10256
chore(deps): bump dompurify from 3.3.2 to 3.4.0 in /widget by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10253
feat(celery): Monitoring for Primary Worker by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10257
fix(helm): increase proxy timeouts to prevent HTTP/2 stream resets by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10247
chore(pre-commit): add ty hook by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10263
chore(search): Search API load test script by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10248
fix(metrics): move in_progress emission from subprocess to watchdog thread by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10249
fix(openpyxl): Adding support for xlsm by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10261
chore(python): fix ty warnings by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10265
chore(opensearch): Add option to conditionally disable migration task by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10260
feat(indexing): Sheet descriptor chunk for tabular indexing by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10245
feat(mt): Writer Hooks for tenant work gating (2/3) by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10246
chore(devcontainer): pre-seed known_hosts, install build-essentials by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10266
chore(playwright): always hide the text under the onyx-logo by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10267
fix(mt): Tighten tenant work-gating writer hooks (2.5/3) by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10268
chore(ci): bump docker/setup-buildx-action to v4 and docker/build-push-action to v7 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10270
feat(img): Editing User Uploaded Images by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10264
feat(opal): add SvgVector icon by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10274
feat(indexing): Total descriptor chunk emitted during Tabular Indexing by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10259
feat(anthropic): include Opus 4.7 in recommended models by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10273
feat(connectors): convert Gong connector from poll to checkpointed by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10258
fix(logos): github logo displays correctly in dark mode by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10269
fix(pruning): Add pruning dashboard panels and reorder layout by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10279
chore(deps): bump pypdf from 6.10.0 to 6.10.2 in /backend/requirements by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10287
chore(deps): bump mako from 1.2.4 to 1.3.11 in /backend/requirements by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10286
feat(opal): add LinkButton component by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10275
fix: gmail datetime parsing on unexpected values by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10290
fix(llm-selector): show each provider instance as its own group by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10292
chore(deps): bump authlib from 1.6.9 to 1.6.11 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10293
fix(image): Cap Uploaded File Image Count by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10298
feat(opal): opalify ExpandableCard by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10276
refactor: migrate EmptyMessage to @opal/components.EmptyMessageCard by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10302
fix(pruning): Google Drive Connector - Skip redundant folder metadata calls for orphaned folders by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10304
fix(fe): LineItem can disable icon stroke by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10289
refactor: migrate ActionsLayouts to @opal/layouts's CardLayout.Header by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10301
fix(web): Sentry Token Check by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10310
fix: chat preferences page spacing and layout cleanup by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10317
refactor: Update toast notifications look and feel by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10320
fix: zuplip temp dir init by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10324
fix(deps): install transitive vertexai dependency by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10328
refactor: Rename /admin/configuration/llm to /admin/configuration/language-models by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10327
feat: add document sets to mcp server options by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10322
fix: s3 test assertion by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10329
feat(opensearch): Add option to disable Vespa and run Onyx with only OpenSearch by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10330
fix(xlsx): Additional fixes for mime types by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10331
fix(metrics): Adding in hostname by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10335
fix(pruning): Fix SharePoint sp_tenant_domain not resolved for client secret auth with site pages by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10326
feat(mt): Tenant work-gating gate + metrics (3/3) by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10281
chore(gha): skip ty pre-commit in CI by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10337
chore(devtools): ods web installs node_modules on init by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10046
Fix: mcp langfuse tracing and Jira adf parsing by @aserafin-mtt in https://github.com/onyx-dot-app/onyx/pull/10314
chore(lint): run shellcheck in pre-commit by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10043
feat(opensearch): Allow optional disabling of SSL to OpenSearch via env var by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10339
refactor: replace raw Card+Content message patterns with @opal/components.MessageCard by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10342
feat(opal): Update API for LineItemButton by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10345
chore(metrics): Adding in calles for metrics by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10343
refactor(opal): remove -Variant suffix from component props by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10348
chore(embedding): Add Prometheus metrics for embedding telemetry by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10295
chore(opensearch): Add update and get index settings, and open/close index methods to client by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10297
fix(docs): Adding Partial Index by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10349
fix(openpyxl): There is no item named issue by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10360
fix(redis): update_sync_record_status cleanup by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10344
refactor: update ModelListContent to use LineItemButton by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10346
fix(pruning): WEB connector pruning timeout by implementing SlimConnector by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10350
fix: consolidate Button/ and button/ case-split for Linux builds by @Mberga14 in https://github.com/onyx-dot-app/onyx/pull/10355
fix(external-group-sync): batch upsert + commit before API calls by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10364
feat(chart): allow extra manifests for chart flexibility by @Mberga14 in https://github.com/onyx-dot-app/onyx/pull/10356
chore(sentry): make trace sample rates env-configurable, default celery to 0 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10374
fix(gong): move call-details retry into checkpoint state instead of blocking by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10369
fix(pruning): Google Drive Connector - cache orphaned ancestor paths to skip redundant folder walks by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10376
fix(files): harden authorization on chat file downloads by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10380
fix(xlsx): Stream excel extraction to reduce peak memory by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10375
fix(desktop): check if backend server is available on start by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10389
chore(deps): bump tauri-apps/tauri-action from 0.6.1 to 0.6.2 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10383
chore(deps): bump actions/setup-go from 6.1.0 to 6.4.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10385
chore(devtools): set env which allows api_server to run by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10396
fix(xlsx): Hard limit on num cells by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10377
feat(indexing): Add file_id to Document model by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10299
feat(indexing): Stage file callback for connectors by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10300
fix(pruning): SharePoint Connector - fix pruning crash on site page 401 + permission validation by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10397
fix(pdf): Allowing Image Extraction from PDF files by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10395
feat(indexing): Stage files in docprocessing by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10338
chore: perm sync metrics by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10351
refactor(auth): run disposable-email check before captcha on signup by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10404
fix(db): add missing FK indexes for hot celery worker tables by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10363
feat(auth): require v3 score in captcha verification by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10403
fix(llm): Model reasoning returning None by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10400
feat(security): redis-backed rate limits for admin invite endpoints by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10379
feat(auth): add USER_DIRECTORY_ADMIN_ONLY flag to gate /users by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10399
feat(auth): reCAPTCHA cookie flow gating Google OAuth callback by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10381
fix(security): enforce chat session ownership on stop endpoint by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10413
feat(auth): Redis replay cache on captcha tokens by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10402
chore(opensearch): Debug script can get and set settings from/to, and open, close an index by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10408
feat(auth): per-IP rate limit on /auth/register by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10405
chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10386
feat(opal): add SvgNoImage and SvgSlowTime icons by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10420
fix: unchanged client id not set in backend by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10419
feat(llm-context): Add ods install-skill to wire up llm context skills by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10418
feat(invites): add tenant_invite_event table to cap trial tenant lifetime invites by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10373
fix(opal): keep expandable card separator line default border color by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10423
feat(opal): add headerPadding prop + wire status border on MessageCard by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10424
refactor(opal): add headerPadding prop to Card.Header layout by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10425
chore(deps): bump mcp from 1.26.0 to 1.27.0 in /backend by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10384
chore(deps): bump yarl from 1.22.0 to 1.23.0 in /backend by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10387
refactor(opal): add root.css with library-owned size tokens by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10427
chore(deps): bump brace-expansion in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10426
refactor(refresh-components): underline Tab variant, Text color inherit, LineItem wrapDescription by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10430
chore(deps): rm ddtrace by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10382
fix: add missing headerPadding="sm" to all CardLayout.Header consumers by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10433
chore(deps): bump rustls-webpki from 0.103.10 to 0.103.12 in /desktop/src-tauri by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10394
fix(pruning): Set pruning frequency default to 25 days and establish backend as source of truth by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10431
chore(indexing): remove multilingual_expansion from search settings by @jessicasingh7 in https://github.com/onyx-dot-app/onyx/pull/10282
chore(tests): run test_run_multitenant_migrations.py w/ database tests by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10438
fix: kill hung task from watchdog by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10439
chore(deps-dev): bump python-dotenv from 1.1.1 to 1.2.2 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10422
fix(files): Add img generated files to user accessible by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10434
feat(indexing): Delete associated document files on doc delete by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10347
feat(auth): migrate reCAPTCHA to Enterprise Assessment API by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10428
chore(deps-dev): bump python-multipart from 0.0.22 to 0.0.26 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10233
feat(auth): gate /auth/login with captcha by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10437
refactor(opal): remove topRightChildren from Card.Header by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10441
fix(llm): Fields unexpectedly None in llm model object by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10452
feat(indexing): Delete orphan staging indexing doc files by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10453
feat: queued messages by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10451
fix(mcp): normalize empty parameters schema for Azure OpenAI by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10455
fix: preserve DCR fields on server update by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10450
feat(connectors): Save tabular files in Google Drive Connector by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10378
feat(search): Pull associated files for internal search docs by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10444
feat: Admin page cleanup by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10454
feat(auth): add health-check bypass header for login captcha by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10458
refactor(platform): env DANSWER_RUNNING_IN_DOCKER->ONYX_RUNNING_IN_DOCKER by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10442
feat(chat): chat preference to disable smooth streaming by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10460
fix(GoogleDriveConnector): Handle RefreshError for removed Workspace users by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10467
fix(files): Img generated files blocked during chat by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10465
feat(auth): add LOW_CONFIDENCE_SCORE + SUSPECTED_CARDING to hard-reject set by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10471
fix(indexing): Reap files after doc processing by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10475
feat(pruning): migration script for pruning frequency by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10473
chore: llm error scrubbing by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10476
refactor(icons): migrate legacy icons/logos to opal by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10474
refactor(icons): add opal logo components (Part 2) by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10483
chore(tests): fetch keys at runtime by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/7446
feat(telemetry): capture real client IP on every request by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10477
feat(connector): File connector attaches file_id by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10484
chore(playwright): chat file upload tests by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10469
refactor(voice): restructure Voice config page and migrate modals to Formik by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10490
chore(devtools): replace autoflake and reorder-python-imports with ruff by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10489
feat(connector): Blob + Sharepoint connector attach file_id for tabular sections by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10485
feat(query-history): add admin toggle for query history type by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/10457
fix(ConfluenceConnector): preserve /Date macro text and fix Cyrillic encoding by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10488
chore(redis): Contextmanager library function for getting and releasing locks by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10445
feat(tracing): auto-wrap every LLM subclass with braintrust generation_span by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10478
chore(CI): Temporarily disable 2 tests which depend on Anthropic by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10509
feat: google oauth scope overrides by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10513
fix(indexing): short-circuit get_old_index_attempt_ids by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10516
fix(opensearch): Add an index refresh between delete and index in the doc idx class index method by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10514
feat(agents-admin): Add filters by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10506
fix: sharepoint members recursion by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10505
fix(files): allow connector file previews through /chat/file by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10498
feat: openapi tool user placeholder by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10517
feat(tracing): reassemble streaming tool-call deltas on fallback span by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10486
chore(indexing): default embedding_precision to FLOAT by @jessicasingh7 in https://github.com/onyx-dot-app/onyx/pull/10285
chore(redis): Contextmanager library function for getting and releasing locks by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10524
fix(deep_research): emit synthetic tool_result on failed research call by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10527
feat(agents): Standardize agent filters in AgentsNavigationPage and AgentsAdminPage by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10519
chore(deps): upgrade node: 20->24 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10526
fix(slack): catch wrapped UndefinedTable in slack bot tenant iteration by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10531
fix(slack): bail early on all Slack auth errors in listener by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10534
fix: Enforce is_listed filter for all non-owner agent access by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10528
fix(slack): set TenantSocketModeClient attrs before super().init by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10535
fix(slack): silence LockNotOwnedError on tenant lock release by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10538
feat(helm): add per-deployment extraEnv hook by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10533
fix(tracing): downgrade "No active trace" log from error to debug by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10539
fix(alembic): set tenant contextvar around per-schema migrations by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10536
chore(devtools): ods dev tunnel by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10470
fix(opensearch): Add an index refresh between delete and index in the doc idx class index method by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10525
fix(indexing): handle trial/paid usage-limit as a clean attempt-failure by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10541
fix(embedding): log retryable provider errors at warning, not error by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10542
fix(redis): retry BusyLoadingError and other transient Redis errors by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10537
fix(slack): cache users.info failures and demote to warning by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10550
fix(web): tolerate null document.body in auto-scroll step by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10553
fix(fireflies): retry transient 5xx with exponential backoff by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10551
fix(opensearch): Gate index operations behind a Redis lock by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10446
fix(permissions): demote per-entity "no email" logs to warning by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10561
feat: show app version in account popover by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10540
fix(connector): Disable unused eager loading in indexing status endpoint by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10556
fix(permissions): downgrade Org-member "no email" log to warning by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10579
fix(sharepoint): downgrade sleep_and_retry final-failure log to warning by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10580
fix(db): default POSTGRES_POOL_PRE_PING to true by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10569
fix(indexing): demote vector-db batch-fallback log to warning by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10581
fix(opensearch): Warn on chunk count 0 by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10589
fix(google-drive): tolerate 403 on primary admin lookup in group sync by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10568
chore(deps): bump rustls-webpki from 0.103.12 to 0.103.13 in /desktop/src-tauri by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10587
fix(themes): custom backgrounds switch preferrred dark/light theme by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10588
chore(devtools): upgrade ods: 0.7.5->0.7.6 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10596
chore(opal): move Checkbox into Opal by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10595
chore(deps): bump uuid from 9.0.1 to 14.0.0 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10482
test: verify knowledge toggle persists SearchTool to agent by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10594
feat: linear connector: use refresh_token if access_token is expired [mirror of #7021] by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10585
fix(opal): separate Opal from @web/src shared utilities by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10598
fix(storybook): add global TooltipProvider decorator to Storybook for Opal by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10603
fix(security): enforce agent access on chat session creation by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10601
chore(docker): install torch into dedicated layer by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10604
chore(devtools): upgrade tsgo, fix .next/types/validator.ts errors by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10600
fix(security): enforce document set access in search filters by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10602
chore(deps): bump postcss from 8.5.6 to 8.5.10 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10593
fix(asana): Stop duping asana tasks by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/10614
fix(embedding): Self-blocking async code, other cleanups by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10599
fix(auth): stop /api/auth/refresh request loop on SAML deployments by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10617
chore(embedding, prometheus): Emit telemetry for embedding by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10620
Chinese README by @yuhongsun96 in https://github.com/onyx-dot-app/onyx/pull/10624
chore: demote noisy sentry logs by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10633
fix(storybook): use render functions for RichStr markdown stories by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10610
refactor(opal): Content updates by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10645
refactor(opal): rewrite @opal/core.Disabled from Radix Slot to div wrapper by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10501
fix(api): fetch agent avatars from dedicated /api/persona/{id}/avatar by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10597
feat(sidebar): LineItemButton migrations by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10646
fix(opal): Notification text is always light by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10649
fix(hubspot): make connector more efficient with fewer api calls - phase 1 by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/10616
fix(opal): toPlainString strips markdown by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10650
feat(openai): Add support for GPT Image 2 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10653
feat(metrics): Adding model information to Generated Report by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10648
fix(tracing): record LLM stream usage on abandoned and failed exits by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10658
chore(deps): bump astral-sh/setup-uv from 8.0.0 to 8.1.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10664
chore(deps): bump referencing from 0.36.2 to 0.37.0 in /backend by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10661
chore(deps): bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10660
fix: don't die mid docprocessing by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10668
chore(deps): bump huggingface-hub from 1.10.2 to 1.11.0 in /backend by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10659
chore(tests): fix test_bedrock.py unauthenticated text assertion by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10669
feat: rotate llm provider script by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10670
chore(deps): bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10663
fix(chat): allow Uploaded Files citations to open preview by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/10675
chore(deps-dev): bump postcss from 8.5.6 to 8.5.10 in /widget by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/10625
feat(opal): add SvgBullhorn, SvgCheckAll, and SvgSquare icons by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10676
feat: Add a search only option for the EnterpriseRAG Bench script by @yuhongsun96 in https://github.com/onyx-dot-app/onyx/pull/10673
chore: copy new provider rotation script into dockerfile by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/10680
feat: data models for index attempt metrics by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10635
refactor(doc-index-sync): rename vespa_metadata_sync_task by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10613
feat: supporting utils for index attempt metrics by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10636
fix: docfetching stall death by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10678
feat: hook up docfetching metrics by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10637
feat: docprocessing index attempt metrics by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10638
chore(devtools): Delete "Profile celery beat" which uses "austin" from .vscode/tasks.template.jsonc by @acaprau in https://github.com/onyx-dot-app/onyx/pull/10690
feat: endpoint for index attempt metrics by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10639
fix(monitoring): skip monitor_process_memory in kubernetes by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10688
fix(desktop): simplify alt-menu by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10692
refactor(opal): Hoverable variant rename + new variants by @raunakab in https://github.com/onyx-dot-app/onyx/pull/10674
fix(connectors): add HTTP timeouts to prevent worker hangs (#10693) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/10696
fix(slack): treat account_inactive as expired credential (#10694) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/10697
fix(external-group-sync): bridge fence validator transition gap (#10691) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/10695
fix(embedding): Change vertex embedding to global (#10699) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/10701
fix(math): render LaTeX live during message streaming (#10681) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/10702
chore(deps): rollforward "bump litellm from 1.81.6 to 1.83.0 (#9898)" (#10179) to release v3.3 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10720
fix(beat_schedule): include LICENSE_ENFORCEMENT_ENABLED in EE gate (#10683) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/10728
feat(tracing): LLMFlow registry, wrap every LLM call site (#10735) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/10743
fix(sharepoint): add slim connector so it does not need to fetch permission during pruning (#10750) to release v3.3 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10771
fix: dont check per sync creds for public connectors (#10765) to release v3.3 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10777
fix: paginate role assignments (#10749) to release v3.3 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10779
fix(openrouter): enable auto-update mode (#10718) to release v3.3 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10836
fix(slack): key bot auth ID cache by (tenant_id, slack_bot_id) (#10827) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/10832
fix(deploy): add opensearch to depends_on so init-letsencrypt brings it up (#10722) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/10724
feat(license): tiered expiry warnings + 14d grace period (#10758) to release v3.3 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/10869
fix: confluence data center websudo (#10853) to release v3.3 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10879
fix(litellm): Opus 4.7 no longer accepts temperature param, litellm is not dropping it (#10878) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/10887
fix(auth): refresh OAuth tokens for any OIDC provider, not just Google (#10794) to release v3.3 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10913
fix(auth): refresh OIDC access tokens on every authenticated request (follow-up to #10794) (#10806) to release v3.3 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/10914
chore(deps): bump next to 16.2.6 (#10916) to release v3.3 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/10963
fix(tools): Tool Name mismatch issue (#10981) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/10986
fix(mcp): per user multiple header (#10995) to release v3.3 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/11000
feat(slack-bot): gate invocation by respond_member_group_list allowlist (#10992) to release v3.3 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/11012
feat(llm): use Bifrost normalized_name for display names (#11015) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/11019
fix(asana): stop dropping teamless projects from explicit allowlist (#11016) to release v3.3 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/11034
fix(seat-limit): close TOCTOU race + plug promotion + cloud auto-bill (#10900) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/11041
fix(db): asyncpg statement_cache_size=0 (#10871) to release v3.3 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/11056
fix(freshdesk): paginate past 300 pages (#11062) to release v3.3 by @github-actions[bot] in https://github.com/onyx-dot-app/onyx/pull/11066
fix: gdrive hierarchynode parents (#11106) to release v3.3 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/11108
fix(indexing): demote PDF parsing failures to warning (#10543) to release v3.3 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/11168
fix: mcp oauth token handling (#11238) to release v3.3 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/11241

New Contributors

@jaffarkeikei made their first contribution in https://github.com/onyx-dot-app/onyx/pull/9999
@aserafin-mtt made their first contribution in https://github.com/onyx-dot-app/onyx/pull/10314

Full Changelog: https://github.com/onyx-dot-app/onyx/compare/v3.2.14...v3.3.7

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Onyx Community Edition

Get notified when new releases ship.

About Onyx Community Edition

Chat UI that works with any LLM. It comes loaded with advanced features like agents, web search, RAG, MCP, deep research, Connectors to 40+ knowledge sources, and more.

All releases →

Related context

Related tools

Earlier breaking changes

v4.0.2 Requires running the OpenSearch document index migration before upgrading to v4.0.
v3.0.13 OpenSearch enabled as default search backend replacing Vespa
v3.0.13 License enforcement enabled by default in EE mode