onyx version history

- Added image generation via admin-configured provider and onyx-cli. - Improved security by redacting sensitive information from basic users. - Introduced `ods audit image` for image scanning, replacing Trivy. - Enhanced mobile chat functionality with core send/stream/markdown support.

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix: public root nodes (#12880) to release v4.3 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12889 * fix(open_url): resolve type-ambiguous Google Drive links to indexed docs (#12892) to release v4.3 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12895 * fix(web): render Nebius provider logo on its lime brand tile (#12951) to release v4.3 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12955 * fix(ttl): isolate + batch chat retention cleanup off the primary queue (#12928) [backport v4.3] by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12959 * ci(craft-k8s): scope the helm trigger to sandbox/craft chart paths (#12957) to release v4.3 by @onyx-cherry-pick[bot] in https://gith

- Fix MCP OAuth public PKCE registration - Accept Entra ID group member removal in SCIM

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix(auth): sync in-memory oidc_expiry after OAuth refresh [v4.3] by @raunakab in https://github.com/onyx-dot-app/onyx/pull/12803 * fix(agents): clear rejected file from agent editor upload state (#12812) to release v4.3 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12814 * fix(web): key model-selector selection by model configuration id (#12823) to release v4.3 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12831 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.3.2...v4.3.3

See the assets to download this version and install. ## What's Changed * fix(freshdesk): handle null due by (#10801) [backport v3.3] by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12866 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v3.3.12...v3.3.13

- Fix in-memory OIDC expiry sync after OAuth refresh - Backport API server and indexing stability improvements

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix(desktop): grant webview ACL permissions for shell-open and titlebar drag (#12719) to release v4.2 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12721 * fix(voice): gate silent audio out of chunked STT to stop hallucinated transcripts (#12713) to release v4.2 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12726 * fix(chat): render full multi-model comparison in shared chats (#12792) to release v4.2 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/12795 * fix(auth): sync in-memory oidc_expiry after OAuth refresh [v4.2] by @raunakab in https://github.com/onyx-dot-app/onyx/pull/12802 * fix(llm): omit sampling params and use adaptive thinking for claude-sonnet-5 (#12735) [v4.2] by @justin-tahara in https://gith

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix(code-interpreter): Too many files accumulating in code interpreter (#12536) to release v4.1 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12696 * fix(desktop): grant webview ACL permissions for shell-open and titlebar drag (#12719) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12722 * fix(voice): gate silent audio out of chunked STT to stop hallucinated transcripts (#12713) to release v4.1 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12725 * fix(confluence): anchor attachment link to webui URL (#12124) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12742 * fix(auth): sync in-memory oidc_expiry after OAuth refresh [v4.1] by @raunakab in https

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * refactor: agent knowledge pane (#12752) to release v4.3 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12770 * fix(files): render xlsx chat attachments via backend-parsed spreadsheet preview (#12764) to release v4.3 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12785 * fix(prompts): stress stateless sandbox + batching in python tool guidance (#12763) to release v4.3 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12786 * fix(chat): render full multi-model comparison in shared chats (#12792) to release v4.3 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12794 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.3.1...v4.3.2

Maintenance and minor improvements.

- Fixed Helm chart deployment blockers and desktop webview ACL permissions. - Addressed voice transcription issues and LLM sampling parameters for Claude Sonnet-5. - Added Gemini Embedding-2 as a cloud embedding option. - Introduced knowledge pane search frontend functionality.

Maintenance and minor improvements.

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix(deployment): read release id from create response to avoid list race (#12471) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12479 * chore(deploy): re-enable model-server `sbom` and `provenance` (#12521) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12523 * chore: ee codeowners (#12236) to release v4.1 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/12593 * chore: more ee codeowners (#12386) to release v4.1 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/12597 * chore: litellm bump v1.89.4 (#12620) to release v4.1 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/12633 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.1.8...

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix: disambiguate mcp tools (#12548) to release v4.2 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12569 * fix(desktop): keep app content below the macOS native title bar after login (#12534) to release v4.2 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12589 * fix(code-interpreter): Too many files accumulating in code interpreter (#12536) to release v4.2 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12582 * fix(confluence): pass scoped_token to group sync client (#12559) to release v4.2 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12566 * chore: more ee codeowners (#12386) to release v4.2 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/12594 * cho

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * chore(hotfix): cherry-pick 6 commits to release v4.2 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/12700 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.2.3...v4.2.4

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * feat(db): support TLS for Postgres with server certificate verification by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12290 * feat(db): mutual TLS (client certs) for Postgres + shared SSLContext builder by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12294 * chore(deps-dev): bump starlette from 1.0.1 to 1.3.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/12091 * feat(mobile): port Opal Text and share typography tokens by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/12256 * feat(indexing): docprocessing stage-metric coverage + residual by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/12182 * feat(mobile): port Opal Button to React Native by @Subash-Mohan in https://github.com/onyx-d

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix(code-interpreter): Too many files accumulating in code interpreter (#12536) to release v4.0 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12695 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.0.9...v4.0.10

See the assets to download this version and install. ## What's Changed * chore(deps): upgrade litellm: `1.83.0`->`1.85.1` to release v3.3 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/12630 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v3.3.11...v3.3.12

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix(deployment): read release id from create response to avoid list race (#12471) to release v4.2 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12480 * Fix sidebar-tab wrapping issue by @raunakab in https://github.com/onyx-dot-app/onyx/pull/12486 * chore(deploy): re-enable model-server `sbom` and `provenance` (#12521) to release v4.2 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12524 * fix(user-files): drop Vespa-hardcoded chunk-count in delete path (#12417) to release v4.2 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12528 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.2.1...v4.2.2

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix(branding): administer browser-tab title and favicon server-side (to release/v4.1) by @raunakab in https://github.com/onyx-dot-app/onyx/pull/12468 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.1.7...v4.1.8

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * feat(db): support TLS for Postgres with server certificate verification (#12290) to release v4.2 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12293 * feat(indexing): docprocessing stage-metric coverage + residual (#12182) to release v4.2 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12302 * fix(chat): suppress open_url reminder when the tool is disabled (#12323) to release v4.2 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12327 * fix(search): bound document_filter LLM calls with a timeout (ENG-4238) (#12333) to release v4.2 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12336 * fix(model_server): cap torch threads to cgroup CPU quota (#12351) to release v4.2 b

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * chore: centralize retry-after parsing by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/11772 * fix(opal): drop CSS imports via esbuild plugin instead of marking as external by @raunakab in https://github.com/onyx-dot-app/onyx/pull/11816 * ci(nightly): drop backend image from LLM provider chat tests by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/11818 * fix(slack): skip doc-set and persona ACL checks for anonymous Slack bot users by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/11817 * ci(nightly-llm): surface local reproduce command on provider failure by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/11815 * ci(preview): skip preview deployment when Vercel credentials are unset by @jmelahman in https://github.com

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * feat(db): support TLS for Postgres with server certificate verification by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12290 * feat(db): mutual TLS (client certs) for Postgres + shared SSLContext builder by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12294 * chore(deps-dev): bump starlette from 1.0.1 to 1.3.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/12091 * feat(mobile): port Opal Text and share typography tokens by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/12256 * feat(indexing): docprocessing stage-metric coverage + residual by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/12182 * feat(mobile): port Opal Button to React Native by @Subash-Mohan in https://github.com/onyx-d

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix(voice): backend markdown stripping for TTS + optional REST STT toggle (#12284) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12287 * fix(chat): suppress open_url reminder when the tool is disabled (#12323) to release v4.1 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12329 * fix(search): bound document_filter LLM calls with a timeout (ENG-4238) (#12333) to release v4.1 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12339 * fix(model_server): cap torch threads to cgroup CPU quota (#12351) to release v4.1 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12357 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.1.6...v4.1.7

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix(chat): surface context-window errors on long threads + overflow guard [v4.0] (#12165) by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12179 * fix(groups): search members by service account name (#12142) to release v4.0 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/12210 * fix(search): bound document_filter LLM calls with a timeout (ENG-4238) (#12333) to release v4.0 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12340 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.0.8...v4.0.9

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix(gong): configurable API base URL for non-US data residency (#12264) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12265 * fix(llm): resolve vision support for dynamic-provider models + clearer 413 (#12266) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12273 * fix(opensearch): skip metadata update for unknown/zero chunk count (#12137) to release v4.1 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/12281 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.1.5...v4.1.6

## Warning Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration). See the assets to download this version and install. ## What's Changed * fix(chat): keep processing indicator until user files finish indexing (#12208) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12215 * feat(settings): consolidate settings [v4.1 cherry-pick] by @raunakab in https://github.com/onyx-dot-app/onyx/pull/12203 * fix(auth): serve anonymous chat to logged-out users on self-hosted (#11935) (#12074) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12230 * feat(branding): derive `logoUrl` in `useSettings` hook (#12159) by @raunakab in https://github.com/onyx-dot-app/onyx/pull/12205 **Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.1.4...v4.1.5