v0.8.5-rc1

Click to expand Release Notes

What's Changed

✨ Features

• 🧩 Redesign Tool Call UI with Contextual Icons, Smart Grouping, and Rich Output Rendering by @berry-13 in #12163
• 🎛️ DB-Backed Per-Principal Configuration Override System by @danny-avila in #12354
• 🧵 ALS Context Middleware, Tenant Threading, and Config Cache Invalidation by @danny-avila in #12407
• 👥 Admin Groups API Endpoints by @dustinhealy in #12387
• 🪪 Admin Roles API Endpoints by @dustinhealy in #12400
• 🏢 Tenant-Scoped App Config in Auth Login Flows by @danny-avila in #12434
• 🏗️ 3-Tier MCP Server Architecture with Config-Source Lazy Init by @danny-avila in #12435
• 🏗️ bulkWrite Isolation, Pre-Auth Context, Strict-Mode Fixes by @danny-avila in #12445
• ⛩️ Admin Grants API Endpoints by @dustinhealy in #12438
• 📄 Model-Aware Bedrock Document Size Validation by @danny-avila in #12467
• 🔐 Admin Auth Support for SAML and Social OAuth Providers by @danny-avila in #12472
• 👨‍👨‍👦‍👦 Admin Users API Endpoints by @dustinhealy in #12446
• 📌 Add Pin Support for Model Specs by @berry-13 in #11219

🐛 Fixes

• 🔑 Type-Safe User Context Forwarding for Non-OAuth Tool Discovery by @crossagent in #12348
• 🐛 Resolve MeiliSearch Startup Sync Failure from Model Loading Order by @adityaarunsinghal in #12397
• 🗝️ Resolve User-Provided API Key in Agents API Flow by @ESJavadex in #12390
• 📸 Snapshot Options to Prevent Mid-Await Client Disposal Crash by @danny-avila in #12398
• 🏁 Invalidate Message Cache on Stream 404 Instead of Showing Error by @danny-avila in #12411
• 🔑 Robust MCP OAuth Detection in Tool-Call Flow by @danny-avila in #12418
• 🪝 Safe Hook Fallbacks for Tool-Call Components in Search Route by @danny-avila in #12423
• 🛡️ Add Origin Binding to Admin OAuth Exchange Codes by @danny-avila in #12469
• 💰 Lazy-Initialize Balance Record at Check Time for Admin Panel Overrides by @danny-avila in #12474
• 🖼️ Message Icon Flickering from Context-Triggered Re-renders by @danny-avila in #12489
• 🛡️ Restrict System Grants to Role Principals by @dustinhealy in #12491
• 🗂️ Allow Empty-Overrides Scope Creation in Admin Config by @danny-avila in #12492
• 🔏 Strip Unnecessary Fields Across Write Paths in Conversation & Message Methods by @danny-avila in #12498
• 🔒 Exclude Unnecessary Fields from Conversation $unset by @danny-avila in #12501
• 🔑 Auth-Aware Startup Config Caching for Fresh Sessions by @danny-avila in #12505
• 🔁 Pass recursionLimit to OpenAI-Compatible Agents API Endpoint by @danny-avila in #12510
• 🏖️ Sandpack ExternalResources for Static HTML Artifact Previews by @danny-avila in #12509
• 🎯 MCP Tool Misclassification from Action Delimiter Collision by @danny-avila in #12512
• 📎 Route Unrecognized File Types via supportedMimeTypes Config by @danny-avila in #12508
• 🪆 Allow Nested addParams in Config Schema by @danny-avila in #12526
• 🔐 Strip code_challenge from Admin OAuth Requests Before Passport by @danny-avila in #12534
• 🔍 Only Show Searchbar if Enabled by @dlew in #12424
• 🔨 Custom Role Permissions by @dustinhealy in #12528
• 📝 Properly Restore Draft Text When Switching Conversations by @dlew in #12384
• 🗣️ Prevent @librechat/client useLocalize from Overwriting Host App Language State by @shtayeb in #12515
• 🔎 Specify Explicit Primary Key for Meilisearch Document Operations by @danny-avila in #12542
• ♻️ Reuse Existing MCP OAuth Client Registrations to Prevent client_id Mismatch by @DenisPalnitsky in #11925
• 🚫 Hide Delete Account Button When ALLOW_ACCOUNT_DELETION Is Disabled by @danny-avila in #12568
• 🎯 Use Resolved Provider for Agent Token Lookup on Custom Endpoints by @danny-avila in #12574
• 🔐 Add Tenant Context to Admin OAuth Callback Routes by @dustinhealy in #12579
• 🧬 Merge Custom Endpoints by Name Instead of Replacing Entire Array by @danny-avila in #12586
• 🧮 Atomize Redis Event Sequence Counters for Multi-Replica Deployments by @danny-avila in #12578
• 📂 Enable Hidden File Upload for GitNexus Index Artifact by @danny-avila in #12597
• 📂 Respect supportedMimeTypes Config in File Picker Accept Filter by @danny-avila in #12596
• 📩 Restore Primary Action Button Visibility in Light Mode by @UnicronBE in #12591

🔧 Refactoring

• 🎨 Redesign Sidebar with Unified Icon Strip Layout by @berry-13 in #12013
• 🔄 Migrate to react-resizable-panels v4 with Artifacts Header Polish by @danny-avila in #12356
• 📁 Prompts UI by @berry-13 in #11570
• 📐 Resolve Stale Active Sidebar Panel and Favorites Row Height by @danny-avila in #12366
• ⚡ Fast-Fail MCP Tool Discovery on 401 for Non-OAuth Servers by @danny-avila in #12395
• ⚡ Use In-Memory Cache for App MCP Configs to Avoid Redis SCAN by @danny-avila in #12410
• 🌊 Local Snapshot for Aggregate Key Cache to Avoid Redundant Redis GETs by @danny-avila in #12422
• 🪢 Eliminate Unnecessary Re-renders During Message Streaming by @danny-avila in #12454
• 🧹 Tighten Conf...

v0.8.4

https://www.librechat.ai/changelog/v0.8.4

🏞️ Highlights

This release of LibreChat is primarily focused on security and stability improvements.

• Security Hardening
  • 30+ security fixes: Strongly recommended update for all deployments.
• MCP Improvements
  • Reconnection storm prevention with circuit breaker and backoff, OAuth race condition fixes, fail-closed domain validation, better STDIO UX with customUserVars.
• Replaced tiktoken with ai-tokenizer
  • Lighter, faster tokenization dependency.
• Artifact Rendering
  • Replaced React Markdown renderer with static HTML for more reliable artifact display.
• Accessibility
  • Screen reader improvements for conversation headings and date groups.

Click to expand Release Notes

For detailed changes in the release candidate, see:

• v0.8.4-rc1

---

Changes Since v0.8.4-rc1

✨ Features

• 📖 Add Native ODT Document Parser Support by @pol9061 in #12303
• 📡 Support Unauthenticated SMTP Relays by @mfish911 in #12322

🐛 Fixes

• 🎭 Set Explicit Permission Defaults for USER Role in roleDefaults by @danny-avila in #12308
• 🧯 Remove Revoked Agents from User Favorites by @danny-avila in #12296
• 🖼️ Correct ToolMessage Response Format for Agent-Mode Image Tools by @danny-avila in #12310
• 🔌 Isolate Code-Server HTTP Agents to Prevent Socket Pool Contamination by @danny-avila in #12311
• 🛂 Reject OpenID Email Fallback When Stored openidId Mismatches Token Sub by @danny-avila in #12312
• 🛡️ Prevent loop in ChatGPT import on Cyclic Parent Graphs by @danny-avila in #12313
• 🪦 ACL-Safe User Account Deletion for Agents, Prompts, and MCP Servers by @danny-avila in #12314
• 🚦 ERR_ERL_INVALID_IP_ADDRESS and IPv6 Key Collisions in IP Rate Limiters by @bprussell in #12319
• 💣 Harden against falsified ZIP metadata in ODT parsing by @danny-avila in #12320
• 🪂 Automatic logout_hint Fallback for Oversized OpenID Token URLs by @Airamhh in #12326
• ♾️ Permanent Ban Cache and Expired Ban Cleanup Defects by @JooyoungChoi14 in #12324
• 🪤 Avoid express-rate-limit v8 ERR_ERL_KEY_GEN_IPV6 False Positive by @danny-avila in #12333
• ⛓️‍💥 Replace React Markdown Artifact Renderer with Static HTML by @danny-avila in #12337
• 🛂 Gate MCP Queries Behind USE Permission to Prevent 403 Spam by @danny-avila in #12345

🔧 Refactoring

• 🫧 Clear Drafts and Surface Error on Expired SSE Stream by @danny-avila in #12309
• 🩺 Surface Descriptive OCR Error Messages to Client by @danny-avila in #12344

♿ Accessibility

• 🗣️ Add Screen Reader Context to Conversation Date Group Headings by @danny-avila in #12340
• 🗣️ Distinguish Conversation Headings for Screen Readers by @danny-avila in #12341

📦 Dependencies & Chores

• 📦 Bump @dicebear dependencies to v9.4.1 by @danny-avila in #12315
• 🐳 Upgrade Alpine packages in Dockerfiles by @danny-avila in #12316
• 📦 Update fast-xml-parser to v5.5.7 by @danny-avila in #12317
• 🧹 Resolve correct memory directory in .gitignore by @ethanlaj in #12330

🌍 Internationalization

• 🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #12338

New Contributors

• @pol9061 made their first contribution in #12303
• @bprussell made their first contribution in #12319
• @JooyoungChoi14 made their first contribution in #12324
• @mfish911 made their first contribution in #12322
• @JasonYeYuhe made their first contribution in #12323

Full Changelog: v0.8.3...v0.8.4

chart-2.0.2

Full Changelog: chart-2.0.1...chart-2.0.2

v0.8.4-rc1

https://www.librechat.ai/changelog/v0.8.4-rc1

Click to expand Release Notes

What's Changed

🐛 Fixes

• ⛈️ MCP Reconnection Storm Prevention with Circuit Breaker, Backoff, and Tool Stubs by @mawburn in #12162
• 🛤️ Base URL Fallback for Path-based OAuth Discovery in Token Refresh by @oreonl in #12164
• 🛂 MCP OAuth Race Conditions, CSRF Fallback, and Token Expiry Handling by @danny-avila in #12171
• 🫙 Force MeiliSearch Full Sync on Empty Index State by @danny-avila in #12202
• 🔏 MCP Server URL Schema Validation by @danny-avila in #12204
• 🪪 MCP API Responses and OAuth Validation by @danny-avila in #12217
• 🚦 Add Rate Limiting to Conversation Duplicate Endpoint by @danny-avila in #12218
• 🔐 Add User Filter to Message Deletion by @danny-avila in #12220
• 🔑 Require OTP Verification for 2FA Re-Enrollment and Backup Code Regeneration by @danny-avila in #12223
• 🛡️ Agent Permission Check on Image Upload Route by @danny-avila in #12219
• 🧹 Sanitize Artifact Filenames in Code Execution Output by @danny-avila in #12222
• 🌊 Prevent Buffered Event Duplication on SSE Resume Connections by @danny-avila in #12225
• 📎 Respect fileConfig.disabled for Agents Endpoint Upload Button by @danny-avila in #12238
• 📎 Enforce File Count and Size Limits Across All Attachment Paths by @danny-avila in #12239
• 🛰️ Cross-Replica Created Event Delivery by @danny-avila in #12231
• 🛡️ Cover full fe80::/10 link-local range in IPv6 check by @danny-avila in #12244
• 🪤 Fail-Closed MCP Domain Validation for Unparseable URLs by @danny-avila in #12245
• 🛡️ Enforce MULTI_CONVO and agent ACL checks on addedConvo by @danny-avila in #12243
• 🛡️ Validate User-provided URLs for Web Search by @danny-avila in #12247
• 🪪 Enforce VIEW ACL on Agent Edge References at Write and Runtime by @danny-avila in #12246
• 📑 Sanitize Markdown Artifacts by @danny-avila in #12249
• 🫷 Validate User-Provided Base URL in Endpoint Init by @danny-avila in #12248
• 🔏 Scope Agent-Author File Access to Attached Files Only by @danny-avila in #12251
• 🪙 Resolve Azure AD Group Overage via OBO Token Exchange for OpenID by @Airamhh in #12187
• 🔏 Enforce MCP Server Authorization on Agent Tool Persistence by @danny-avila in #12250
• 🛂 Enforce Actions Capability Gate Across All Event-Driven Tool Loading Paths by @danny-avila in #12252
• 🧱 Enforce Agent Access Control on Context and OCR File Loading by @danny-avila in #12253
• 🗝️ Exempt Admin-Trusted Domains from MCP OAuth Validation by @danny-avila in #12255
• 🧯 Prevent Env-Variable Exfil. via Placeholder Injection by @danny-avila in #12260
• 🪪 Enforce Conversation Ownership Checks in Remote Agent Controllers by @danny-avila in #12263
• 🔏 Remove Federated Tokens from OpenID Refresh Response by @danny-avila in #12264
• 🪝 MCP Refresh token on OAuth Discovery Failure by @danny-avila in #12266
• 🪢 Action Domain Encoding Collision for HTTPS URLs by @danny-avila in #12271
• 🏷️ Clear Model Spec Fields When Navigating with Non-spec Query Params by @danny-avila in #12274
• 🧯 Add Pre-Parse File Size Guard to Document Parser by @danny-avila in #12275
• 🛂 Validate types Query Param in People Picker Access Middleware by @danny-avila in #12276

🔧 Refactoring

• 🔄 OAuth Metadata Discovery with Origin Fallback by @danny-avila in #12170
• ⚡ Replace tiktoken with ai-tokenizer by @danny-avila in #12175
• 📏 Add File Size Limits to Conversation Imports by @danny-avila in #12221
• 💁 Better Config UX for MCP STDIO with customUserVars by @danny-avila in #12226
• 🛡️ Scope Action Mutations by Parent Resource Ownership by @danny-avila in #12237
• 🐍 Normalize Non-Standard Browser MIME Type Aliases in inferMimeType by @danny-avila in #12240
• 🔧 Proper MCP Menu Dismissal by @dustinhealy in #12256

⚙️ Other Changes

• 🧪 MCP Reconnect Storm Follow-Up Fixes and Integration Tests by @danny-avila in #12172
• 📦 Bump NPM Audit Packages by @danny-avila in #12227
• 📦 Bump @librechat/agents to v3.1.56 by @danny-avila in #12258

🌍 Internationalization

• 🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #12176, #12203, #12259

New Contributors

• @oreonl made their first contribution in #12164

Full Changelog: v0.8.3...v0.8.4-rc1

chart-2.0.1

Full Changelog: chart-2.0.0...chart-2.0.1

v0.8.3

https://www.librechat.ai/changelog/v0.8.3

🏞️ Highlights

• Event-Driven Lazy Tool Loading
  • MCP tools load on-demand, reducing memory load. Includes programmatic tool calling UI.
• New Models & Providers
  • Moonshot provider, Claude Opus 4.6 (1M context, adaptive thinking), Sonnet 4.6, GPT-5.3/5.4, Gemini 3.1
  • Bedrock document uploads and reasoning_effort, Gemini Thinking Level parameter
• Performance
  • Optimized message re-renders, image preview caching, delta buffering for SSE, Redis scalability improvements.
• Local Document Text Extraction
  • PDF, DOCX, XLS/XLSX, and OpenDocument parsing locally.
• MCP Server Credential Variables
  • Secure per-user auth for UI-created MCP servers via credential placeholders.
• Monaco Code Editor for Artifacts
  • Now reliably allows artifact editing.
• Agents
  • Editors can now duplicate agents. Added messageId for transaction tracking.
• Security
  • TOCTOU-safe SSRF protection, OIDC improvements (RP-initiated logout, configurable email claim)
  • Hardened API routes, ALLOW_SHARED_LINKS_PUBLIC defaults to false.

Click to expand Release Notes

For detailed changes in each release candidate, see:

• v0.8.3-rc1 - Event-Driven Lazy Tool Loading, Moonshot Provider, Claude Opus/Sonnet 4.6, Delta Buffering
• v0.8.3-rc2 - Local Document Extraction, Bedrock Document Uploads, Credential Variables for MCP, Agent Duplication

---

Changes Since v0.8.3-rc2

✨ Features

• 🤖 GPT-5.4 and GPT-5.4-pro Context + Pricing by @danny-avila in #12099

🐛 Fixes

• 🏆 Longest-or-Exact-Key Match in findMatchingPattern, Remove Deprecated Models by @danny-avila in #12073
• 🧭 Subdirectory Deployment Auth Redirect Path Doubling by @danny-avila in #12077
• 🕰️ Preserve updatedAt Timestamps During Meilisearch Batch Sync by @danny-avila in #12084
• 🧮 XLSX/XLS Upload-as-Text via Buffer-Based SheetJS Parsing by @danny-avila in #12098
• 📐 Replace JS Image Scaling with CSS Viewport Constraints by @CavMCarolina in #12089
• 🛡️ Add Permission Guard for Temporary Chat Visibility by @Airamhh in #12107
• ⛵ Resolve Agent Provider Endpoint Type for File Upload Support by @danny-avila in #12117
• 🔒 Hex-normalized IPv4-mapped IPv6 in Domain Validation by @danny-avila in #12130
• 🩹 MCP Server Recovery from Startup Inspection Failures by @danny-avila in #12145
• 🕵️ remoteAgents Field Omitted from Config by @Airamhh in #12150

🔧 Refactoring

• ⚡ Parallelize CI Workflows with Isolated Caching and Fan-Out Test Jobs by @danny-avila in #12088
• ⚡ Optimize Message Re-renders by @danny-avila in #12097
• 🏎️ Replace Sandpack Code Editor with Monaco for Artifact Editing by @danny-avila in #12109
• 🎞️ Image Rendering with Preview Caching and Layout Reservation by @danny-avila in #12114
• 🔒 Set ALLOW_SHARED_LINKS_PUBLIC to false by Default by @ucodia in #12100

📦 Dependencies & Chores

• 📦 npm audit bump by @danny-avila in #12074
• 📦 Bump multer to v2.1.1 by @danny-avila
• 📦 Bump express-rate-limit to v8.3.0 by @danny-avila in #12115
• 🏷️ Remove Docker Images by Named Tag in deployed-update.js by @danny-avila in #12138
• 📦 Bump mermaid and dompurify by @danny-avila

🌍 Internationalization

• 🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #12070

New Contributors

• @CavMCarolina made their first contribution in #12089
• @Airamhh made their first contribution in #12107
• @ucodia made their first contribution in #12100

Full Changelog: v0.8.2...v0.8.3

chart-2.0.0

Full Changelog: chart-1.9.9...chart-2.0.0

v0.8.3-rc2

https://www.librechat.ai/changelog/v0.8.3-rc2

Check out our 2026 Roadmap! 🎉

Click to expand Release Notes

What's Changed

✨ Features

• 🤖 Gemini 3.1 Pricing and Context Window by @danny-avila in #11884
• 📄 Local Text Extraction for PDF, DOCX, and XLS/XLSX by @danny-avila in #11900
• 🪨 AWS Bedrock Document Uploads by @dustinhealy in #11912
• 🖱️ Native Browser Navigation Support for New Chat by @Fahleen1 in #11904
• 📍 Preserve Deep Link Destinations Through the Auth Redirect Flow by @vmskonakanchi in #10275
• 🪪 Add OPENID_EMAIL_CLAIM for Configurable OpenID User Identifier by @jkuehn in #11699
• 🧩 OpenDocument Format File Upload and Native ODS Parsing by @danny-avila in #11959
• 🪙 Add messageId to Transactions by @danny-avila in #11987
• 🧠 Add reasoning_effort Configuration for Bedrock Models by @danny-avila in #11991
• 🔀 Update OpenRouter with New Reasoning Config by @danny-avila in #11993
• 🎚️ Add Thinking Level Parameter for Gemini 3+ Models by @danny-avila in #11994
• 🗝️ Credential Variables for DB-Sourced MCP Servers by @danny-avila in #12044
• 🤖 gemini-3.1-flash-lite-preview Window & Pricing by @danny-avila in #12043
• 💰 Add gpt-5.3 Context Window and Pricing by @danny-avila in #12049
• 🧬 Allow Agent Editors to Duplicate Agents by @danny-avila in #12041

🐛 Fixes

• 🪣 Proper Key Extraction from S3 URL by @H31nz3l in #11241
• 🪪 Handle Delimited String Role Claims in OpenID Strategy by @danny-avila in #11892
• 🪣 S3 Path-Style URL Support for MinIO, R2, and Custom Endpoints by @danny-avila in #11894
• 🪣 Serve Fresh Presigned URLs on Agent List Cache Hits by @danny-avila in #11902
• 💎 Gemini Image Gen Tool Vertex AI Auth and File Storage by @danny-avila in #11923
• 🔌 Reuse Undici Agents Per Transport and Close on Disconnect by @danny-avila in #11935
• ⏱️ Separate MCP GET SSE Stream Timeout from POST and Suppress SDK-Internal Recovery Errors by @danny-avila in #11936
• 🪣 Prevent Memory Retention from AsyncLocalStorage Context Propagation by @danny-avila in #11942
• 📌 Populate userMessage.files Before First DB Save by @marbence101 in #11939
• 🪃 Prevent Recursive Login Redirect Loop by @danny-avila in #11964
• 🧩 Redirect Stability and Build Chunking by @danny-avila in #11965
• 🚦 404 JSON Responses for Unmatched API Routes by @danny-avila in #11976
• 💸 Model Identifier Edge Case in Agent Transactions by @danny-avila in #11988
• 🎯 Use Agents Endpoint Config for Agent Panel File Upload Validation by @danny-avila in #11992
• ✂️ Unicode-Safe Title Truncation and Shared View Layout Polish by @danny-avila in #12003
• 🔗 Normalize MCP OAuth resource Parameter to Match Token Exchange by @danny-avila in #12018
• 🔌 Resolve MCP OAuth Flow State Race Condition by @busla in #11941
• 👥 Duplicate Indicators for Model Specs by @dustinhealy in #11946
• 🚪 Complete OIDC RP-Initiated Logout With id_token_hint and Redirect Race Fix by @danny-avila in #12024
• 🧭 Restore Post-Auth Navigation After Silent Token Refresh by @danny-avila in #12025
• 🌐 Preserve URL Query Params Through Auth Refresh and Conversation Init by @danny-avila in #12028
• 🔒 Request Interceptor for Shared Link Page Scenarios by @danny-avila in #12036
• 🤝 Respect Server Token Endpoint Auth Method Preference in MCP OAuth by @danny-avila in #12052
• 🧩 Expand Toolkit Definitions to Include Child Tools in Event-Driven Mode by @danny-avila in #12066

♿ Accessibility

• ♿ Hide Collapsed Thinking Content From Screen Readers by @danny-avila in #11927
• 👁️‍🗨️ Replace Select with Menu in AccountSettings for Screen Reader Accuracy by @dlew in #11980
• 💤 Add inert to Hidden/Background Content by @dlew in #12016
• 🫳 Restore Background on Drag and Drop Overlay by @dlew in #12017
• 🔍 Correct Conversations ARIA Role and Increase Placeholder Contrast by @dlew in #12021

🔧 Refactoring

• 🔒 graphTokenController to Use Federated Access Token for OBO Assertion by @danny-avila in #11893
• 🧮 Bulk Transactions & Balance Updates for Token Spending by @danny-avila in #11996
• 🪵 onmessage Handler and Restructure MCP Debug Logging by @danny-avila in #12004
• 📅 Replace Numeric Weekday Index with Named Day in Date Template Variables by @danny-avila in #12022
• 🌗 Consistent Mermaid Theming for Inline and Artifact Renderers by @danny-avila in #12055

⚙️ Other Changes

• 🔍 Update MeiliSearch Version by @danny-avila in #11873
• 🐳 Update Image Registry References in Docker/Helm Configurations by @danny-avila in #12026
• 📦 Bump @librechat/agents to v3.1.51–v3.1.55 by @danny-avila in #11891, #12051
• 📦 Bump @modelcontextprotocol/sdk from 1.26.0 to 1.27.1 by @danny-avila in #11937
• 🛡️ Bump ESLint Tooling Deps and Resolve ajv Security Vulnerability by @danny-avila in #11938
• 📦 Bump minimatch due to ReDoS vulnerability, bump rimraf, rollup by @danny-avila in #11963
• 📦 Update multer dependency to v2.1.0 by @danny-avila in [#12000...

chart-1.9.9

Full Changelog: chart-1.9.8...chart-1.9.9

v0.8.3-rc1

https://www.librechat.ai/changelog/v0.8.3-rc1

Check out our 2026 Roadmap! 🎉

Click to expand Release Notes

What's Changed

✨ Features

• 🦥 Event-Driven Lazy Tool Loading by @danny-avila in #11588
• 📉 Add Token Usage Tracking for Agents API Routes by @danny-avila in #11600
• 🎯 Add Programmatic Tool Calling UI for MCP Tools by @danny-avila in #11604
• 🌙 Moonshot Provider Support by @danny-avila in #11621
• 📬 Implement Delta Buffering System for Out-of-Order SSE Events by @danny-avila in #11643
• 🤖 Claude Opus 4.6 - 1M Context, Premium Pricing, Adaptive Thinking by @danny-avila in #11670
• 🎮 Bedrock Parameters for OpenAI GPT-OSS models by @danny-avila in #11798
• 🛰️ Add Bedrock Parameter Settings for MoonshotAI and Z.AI Models by @danny-avila in #11783
• 🤖 Claude Sonnet 4.6 support by @danny-avila in #11829
• 🎭 Override Custom Endpoint Schema with Specified Params Endpoint by @danny-avila in #11788
• 🏎️ Smart Reinstall with Turborepo Caching for Better DX by @danny-avila in #11785
• 💎 Add Redis as Optional Sub-chart Dependency in Helm Chart by @SharpLu in #11664
• ⛵ Expose enableServiceLinks in Helm Deployment Templates by @bhat-ganesh in #11741
• 🔧 deleteRagFile utility for Consistent RAG API document deletion by @ethanlaj in #11493

🐛 Fixes

• 🔐 MCP OAuth Tool Discovery and Event Emission by @danny-avila in #11599
• 🔦 Tool resource files not visible in event-driven mode by @usnavy13 in #11610
• 👆 Web Search and Code Interpreter Toggle Cursor Hover Behavior by @dustinhealy in #11614
• 📱 Mention Touch UX and MCP Tool UI Consistency by @danny-avila in #11627
• 🛡️ Preserve CREATE/SHARE/SHARE_PUBLIC Permissions with Boolean Config by @danny-avila in #11647
• 🗣️ Add Various State Change Announcements by @dustinhealy in #11495
• 🎬 Code Session Context In Event Driven Mode by @danny-avila in #11673
• 🆔 Atomic File Dedupe, Bedrock Tokens Fix, and Allowed MIME Types by @danny-avila in #11675
• 🌊 Prevent Truncations When Redis Resumable Streams Are Enabled by @danny-avila in #11710
• 🪟 Update Link Target to Open in Separate Tabs by @flyinggrizzly in #11669
• 🔧 Update z-index for ImagePreview Dialog by @danny-avila in #11714
• 🛡️ Implement TOCTOU-Safe SSRF Protection for Actions and MCP by @danny-avila in #11722
• 🛡️ Secure MCP/Actions OAuth Flows, Resolve Race Condition & Tool Cache Cleanup by @danny-avila in #11756
• 🏁 Resolve Content Aggregation Race Condition in Agent Event Handlers by @danny-avila in #11757
• 🔎 Include Legacy Documents With Undefined _meiliIndex in Search Sync by @ablizorukov in #11745
• 🔒 Prevent Race Condition in RedisJobStore by @danny-avila in #11764
• 🦙 Memory Agent Fails to Initialize with Ollama Provider by @calkeo in #11680
• 🔒 Secure Cookie Localhost Bypass and OpenID Token Selection in AuthService by @danny-avila in #11782
• 🧰 Convert const to enum in MCP Schemas for Gemini Compatibility by @danny-avila in #11784
• 🪟 Tab Isolation for Agent Favorites + MCP Selections by @danny-avila in #11786
• 🕵️‍♂️ Handle 404 errors on agent queries for favorites by @ethanlaj in #11587
• 🏢 Handle Group Overage for Azure Entra Authentication by @WhammyLeaf in #11557
• 🌙 Accessible Contrast for Theme Switcher Icons by @dustinhealy in #11795
• 👻 Prevent Async Title Generation From Recreating Deleted Conversations by @danny-avila in #11797
• 🎛️ Google JSON Schema Normalization/Resolution Logic by @danny-avila in #11804
• 🪂 Handle MongoDB Connection Errors to Prevent Process Crashes by @SharpLu in #11809
• 🪪 Pass Scope in OpenID Refresh Token Grant for Azure Custom API by @seung-myung in #11770
• 🐛 Normalize output_text blocks in Responses API input conversion by @danny-avila in #11835
• 🪹 Prevent whitespace-only Chat input Submissions by @dobernike in #11838
• 🔗 Preserve Stream State Across Reconnects to Prevent Reorder Buffer Desync by @danny-avila in #11842
• 🧭 Robust 404 Conversation Not Found Redirect by @danny-avila in #11853
• 🧬 Backfill Missing SHARE Permissions and Migrate Legacy SHARED_GLOBAL Fields by @danny-avila in #11854
• 💡 System Theme Picker Selection by @dustinhealy in #11220

🔧 Refactoring

• 🧩 Tool Context Builders for Web Search & Image Gen by @danny-avila in #11644
• ✈️ Single-Flight Deduplication for MCP Server Configs and Optimize Redis Batch Fetching by @danny-avila in #11628
• 🔄 Sequential Event Ordering in Redis Streaming Mode by @danny-avila in #11650
• 🪙 Distinguish ID Tokens from Access Tokens in OIDC Federated Auth by @jlevy in #11711
• 🗃️ Separate Tool Cache Namespace for Blue/Green Deployments by @danny-avila in #11738
• 📳 Optimize Model Selector by @danny-avila in #11787
• 🗨️ Better Whitespace handling in Chat Message rendering by @danny-avila in #11791
• 🗂️ Artifacts via Model Specs & Scope Badge Persistence by Spec Context by @danny-avila in #11796
• 🥠 Always set OIDC refresh token cookie to survive session expiry by @danny-avila in [#11810](https://github.com/danny-avila...