Add the green "Resolved: this CVE is now rejected" callout to the six huntr
CVE pages (2024-7033/7034/7038/7039/7040/7959), matching the older rejected
pages, since all six were withdrawn by their issuing CNA.
On CVE-2024-7033, state what the download host allowlist is for: it keeps
downloads pointed at the intended model source and does not constrain where
the bytes land, so the backslash traversal is not a bypass of a
filesystem-write boundary.
On the ZDI records (2026-0765/0766/0767), lead the severity discussion with
the disposition. Because the reports describe intended behavior or a
deployment property, no CVSS score applies; the privilege-metric correction
is kept as a secondary, conditional note rather than the argument.
Add the green "Resolved: this CVE is now rejected" callout to the six huntr
CVE pages (2024-7033/7034/7038/7039/7040/7959), matching the older rejected
pages, since all six were withdrawn by their issuing CNA.
On CVE-2024-7033, state what the download host allowlist is for: it keeps
downloads pointed at the intended model source and does not constrain where
the bytes land, so the backslash traversal is not a bypass of a
filesystem-write boundary.
On the ZDI records (2026-0765/0766/0767), lead the severity discussion with
the disposition. Because the reports describe intended behavior or a
deployment property, no CVSS score applies; the privilege-metric correction
is kept as a secondary, conditional note rather than the argument.
The reference documented CODE_INTERPRETER_BLACKLISTED_MODULES, a name
that does not exist in the code, and described it as a security control.
Rename it to CODE_INTERPRETER_BLOCKED_MODULES and describe what it does:
empty by default so the blocking hook is never installed, and when set it
intercepts only direct top-level imports, leaving indirect imports and the
modules themselves in place. It is an opt-in convenience filter, not a
security boundary; the isolation is the execution engine.
Mark the code execution and code interpreter sections as legacy, since
both the pyodide and jupyter engines are legacy and Open Terminal is the
supported path for code and shell execution.
Fix the same stale variable name on the Python code execution page.
When ENABLE_COMPRESSION_MIDDLEWARE is disabled in favor of proxy-level
compression, the remaining downside (larger first uncached page load) is
eliminated by caching the frontend bundles at the proxy: Open WebUI's
SvelteKit build ships all JS/CSS under /_app/immutable/ with
content-hashed filenames, so a URL never changes content and the files
can be cached with max-age=31536000, immutable and served from the proxy
cache without touching a worker.
- Scaling guide: new "Pair It with Static Asset Caching at the Proxy"
subsection with a ready-made Nginx proxy_cache snippet, the
HTML-shell/version.json short-cache caveat (upgrade detection), and
on-the-fly compression level guidance (level 4-5, min_length)
- Performance guide: "Recommended companion" bullet in the HTTP Response
Compression section pointing at the scaling snippet
- Env reference: extend the compress-at-the-proxy tip with the
/_app/immutable/ caching recommendation
- Scaling & HA troubleshooting: mention proxy-side bundle caching in the
compress-at-the-LB best practice
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XrkxR1KPMABxNNR3b1xr9R
Verified against open-webui source (env.py / main.py, starlette-compress
1.7.1): the flag only gates CompressMiddleware, which touches HTTP
responses exclusively — WebSocket scope passes through untouched, SSE
(text/event-stream) is not in the compressible content-type list, and
responses under 500 bytes are never compressed.
- Expand the env-configuration reference entry with what the middleware
does and does not affect, the CPU/latency upside of disabling (~3-4%
per worker per py-spy profiling), the response-size downside (few KB
for typical API responses, but multi-MB first page load and 5-10x on
large chat/model JSON), and the recommended proxy-offload setup
- Add an HTTP Response Compression section to the performance guide's
High-Concurrency chapter, plus Profile 3 checklist and env var table
entries
- Add an "Offload HTTP Compression to the Load Balancer" step-3 section
and env-block entry to the scaling guide
- Add a compress-at-the-LB best practice to the Scaling & HA
troubleshooting guide
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XrkxR1KPMABxNNR3b1xr9R
The Image Generation permission row described it as a simple capability,
but on backends that keep a single image model loaded, selecting a model
is the same action as switching the loaded one, so a user holding the
permission changes the active image model for the whole instance. Note
that alongside the row, with the guidance that deployments which do not
want non-admin users changing the shared model should not grant the
permission to non-admins, or should use a backend that accepts a model
with each request.
Also normalise the remaining admin settings paths. The earlier pass
matched only unadorned paths, leaving bold, backtick and arrow variants
pointing at the old Admin Panel page.
Add feature pages for the four features this release introduces:
- Sub-agents, covering delegation, foreground and background runs, the
admin limits and what a sub-agent deliberately cannot do.
- Timers, including that they are gated by the Sub-agents setting rather
than having one of their own.
- Notifications, covering webhook targets, the four subscribable events,
away and always delivery, and migration from the old single webhook.
- Keyboard shortcuts, with the fifteen rebindable defaults.
Document the new configuration: the seven SUBAGENTS_* variables,
TIMER_POLL_INTERVAL, USER_PERMISSIONS_ACCESS_GRANTS_ALLOW_GROUPS and
ENABLE_PLUGINS, and add delegate_task, timer and notify to the builtin
tool tables.
Correct what the release made wrong: the title-generation prompt no
longer asks for emojis, per-model compaction thresholds are now bounded
by a cap rather than by the global threshold, replace_note_content takes
range operations, the Webhooks page still described the removed single
webhook field, and the Archived Chats path moved.
Admin settings are now a section of the Settings dialog rather than a
page of their own, so rewrite the paths accordingly, and record the
access-grant sharing permissions, the note-chat tool overrides and the
new Anthropic token-counting endpoints.
Update the schema reference for the chat_message.meta column, and bring
the version notes and pinned image examples up to v0.10.3.
huntr / Protect AI accepted Open WebUI's disputes and withdrew
CVE-2024-7040, -7959, -7039, -7038, -7034 and -7033. All six are now in
the REJECTED state on cve.org, which propagates to NVD and downstream
feeds.
Mark them as CNA REJECTED in the Official Resolution column, add an
Official Resolution row and the withdrawal to the timeline on each
disposition page, and replace the dispute-pending wording with the
resolved outcome. CVE-2024-7040 also gains the Root's routing of the
dispute to the CNA under Program Rule 4.1 and the CNA's acceptance.
The three ZDI records remain in progress and are unchanged.
The user/session headers under ENABLE_FORWARD_USER_INFO_HEADERS did not
mention that each connection can also forward arbitrary custom headers
whose values embed template placeholders substituted per request
({{MESSAGE_ID}}, {{CHAT_ID}}, {{USER_EMAIL}}, {{USER_AGENT}}, file and
task placeholders, and more). Add a section covering how to set them
(Admin Panel > Settings > Connections, or the connection headers object
in OPENAI_API_CONFIGS / OLLAMA_API_CONFIGS), the full placeholder list,
where they apply, and that they work independently of
ENABLE_FORWARD_USER_INFO_HEADERS and take precedence over the built-in
forwarded headers.
The selected suggestion row and matched terms fall back to
--ifm-color-primary, which is #ddd in dark mode, leaving forced white text
on a light grey row. Set the search plugin's own colour variables for dark
mode instead: white marks on the dark dropdown and an inverted selected row
(white background, near-black text).
Swap docusaurus-lunr-search for @easyops-cn/docusaurus-search-local. All
query words are now required to match instead of being OR-ed, so a page
spamming one common word no longer outranks the page containing the whole
query. Underscore-joined names like CONTEXT_COMPACTION_TOKEN_CAP are
indexed both whole and as sub-words, matched terms are highlighted on the
target page, and a full results page is available at /search.
Add an exact-match layer on top (src/client/exactSearch.js, wired via
webpack module replacement). Multi-word or quoted queries that occur
verbatim on a page always rank first, rendered as a single marked phrase
with a section-anchor deep link, with token-based results following. A
SearchBar wrapper (src/theme/SearchBar) highlights exactly the searched
sentence on the target page and scrolls it into view, replacing the
per-word highlight parameters for these results.
Also mention the Builtin Tools capability name on the tools page so the
in-product term is findable by search.
Classic298