Skip to content

Releases: danny-avila/LibreChat

v0.8.6-rc1

13 May 02:45
@danny-avila danny-avila
v0.8.6-rc1
947bfa4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.8.6-rc1 Pre-release
Pre-release

🏞️ Highlights

  • 📜 Agent Skills
    • Agent Skills let you package reusable agent behavior into SKILL.md bundles: instructions, reference files, scripts, assets, and tool permissions can travel together as a capability an agent can invoke automatically, on request, or always-on.
    • Skills can be imported, size-limited, shared like agents and MCP servers, and scoped per agent, making it easier to build repeatable workflows without baking every instruction into the agent prompt.
  • 👥 Subagents
    • Subagents let agents call other agents as tools, so a primary agent can delegate specialized work, run independent passes in parallel, or even call a configured copy of itself for fan-out style problem solving.
    • Subagent runs preserve the surrounding upload, user, and MCP context while enforcing recursion and graph limits, which keeps multi-agent execution powerful without making it unbounded.
  • 🖥️ Code Execution & Artifacts (pending OSS Code Interpreter release)
    • Text, source-code, DOCX, CSV, XLSX, and PPTX artifacts can render inline or in the side panel with richer previews.
    • Nested artifact paths, Unicode filenames, file metadata encoding, and generated-code context filtering received several hardening passes.
  • ☁️ CloudFront + S3 File Delivery
    • New CloudFront file strategy support includes signed cookies, signed downloads, strict signed-access enforcement, region-aware storage keys, and cookie refresh on auth refresh.
  • 🔒 Security, Auth, and MCP Hardening
    • Improved security for MCP OAuth, OpenID/OIDC, artifact routing, permission caching, avatar fetching, and HTML rendering
  • 🔍 Providers, Search, and Model Support
    • Tavily search/scraping, OpenRouter prompt-cache configuration, Vertex AI multi-region endpoints, Anthropic tool-argument streaming, and GPT-5.5 token definitions are now supported.

Click to expand Release Notes

What's Changed

✨ Features

🐛 Fixes

  • 🗨️ Restore ModelSpec Preset Greeting (and iconURL Fallback) by @danny-avila in #12809
  • 🛡️ Prevent silent crash from unhandled MCP OAuth reconnect rejections by @danny-avila in #12812
  • 🌱 Inject Code-Tool Files Into Graph Sessions on First Call (+ read_file Sandbox Fallback) by @danny-avila in #12831
  • 🚫 Reject Binary Files in read_file Sandbox Fallback (No More Mojibake) by @danny-avila in #12851
  • 🔧 Replace Literal NUL Bytes in handlers.spec Test Fixture + Normalize CRLF by @danny-avila in #12852
  • 📂 Preserve Nested Folder Paths for Code-Execution Artifacts by @danny-avila in #12848
  • 🛂 Skip Inherited / Mark Skill Files Read-Only in Code-Env Pipeline by @danny-avila in #12866
  • 💎 Stop Double-Counting Cache Tokens for Gemini/OpenAI in Usage Spend by @danny-avila in #12868
  • 🛡️ Filter user_provided Sentinel in Tool Credential Loading by @Falenos in #12840
  • 🧹 Graceful MCP OAuth Revoke Cleanup When Tokens Are Missing by @gaurav0107 in #12825
  • 🔌 Prevent Repeated Idle Check Triggers for Users With Failed MCP Connections by @darthhexx in #12853
  • 🧜‍♂️ Preserve Mermaid foreignObject HTML in Sanitized SVG by @ethanlaj in #12819
  • 🩹 Treat responseCode === 0 as Transport Failure, Not Server Error by @derhelge in #12834
  • 📂 Preserve Nested Skill Paths in Code-Env Uploads by @danny-avila in #12877
  • 🩹 Polish code-execution attachment UX by @danny-avila in #12870
  • 🔌 Follow 307/308 redirects in MCP streamable HTTP transport by @ontl in #12850
  • 📥 Resolve Imported-Conversation Default Model From Runtime modelsConfig by @danny-avila in #12885
  • 🩹 Sync ControlCombobox popover width with trigger after layout changes by @ethanlaj in #12887
  • 🛡️ Handle MCP Tool Cache Lookup Failures by @danny-avila in #12910
  • 📌 Stabilize Agent Prompt Cache Prefix by @danny-avila in #12907
  • 🧭 Migrate Anthropic Long Context by @danny-avila in #12911
  • 🧹 Clear MCP OAuth Tokens On Revoke by [@danny-avila](https://github.com/danny-avi...
Read more
Loading

chart-2.0.3

13 May 15:46
@danny-avila danny-avila
chart-2.0.3
947bfa4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
chart-2.0.3 Pre-release
Pre-release

What's Changed

https://www.librechat.ai/changelog/v0.8.6-rc1

New Contributors

Full Changelog: chart-2.0.2...chart-2.0.3

Contributors

ontl, christopher-b, and 16 other contributors
Loading

v0.8.5

22 Apr 21:04
@danny-avila danny-avila
v0.8.5
9ccc8d9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.8.5 Pre-release
Pre-release

https://www.librechat.ai/changelog/v0.8.5

🏞️ Highlights

  • Admin Panel Foundation
    • Per-principal (Roles & Groups) configuration overrides, Custom Roles & Groups, System Grants for admin-level access control
    • Admin panel, available for testing here
  • Context Compaction/Summarization
    • Long-running agent conversations are automatically summarized to stay within context limits. Includes configurable triggers, context pruning of large tool results, and a new top-level summarization config. See Config v1.3.8.
  • Claude Opus 4.7 Support
    • Full model support with configurable reasoning visibility (thinkingDisplay). See Config v1.3.9.
  • UI Redesign
    • Redesigned sidebar with unified icon strip layout, including all panels (agent builder, prompts, etc.)
    • Overhauled tool call UI with grouping/richer output rendering
    • Refreshed Prompts UI
    • Sidebar icon toggle & new chat history switch
  • Performance & MCP Improvements
    • In-memory caching, Redis event sequence atomization, lazy MCP init
    • OAuth client registration fixes and stale client recovery
  • Pinned Model Specs: Users can now pin favorite model specs for quick access

Click to expand Release Notes

For detailed changes in the release candidate, see:

Changes Since v0.8.5-rc1

✨ Features

🐛 Fixes

  • 📑 Alias Mimetype text/x-markdown to text/markdown by @dlew in #12608
  • 🔬 Scope Web Search Results to Own Turn by @danny-avila in #12631
  • 🔀 Resolve Action Tools by Exact Name to Prevent Multi-Action Domain Collision by @lrreverence in #12594
  • 🔑 Clear Stale Client Registration on invalid_client During OAuth Token Refresh by @danny-avila in #12643
  • 🎯 Preserve Selected Artifact When Clicking Artifact Button by @starchow in #12601
  • 🔍 Anthropic Web Search Multi-Turn Issue and Attachment Results by @danny-avila in #12651
  • 🖼️ Hide Duplicate Image Placeholder During Image Generation by @danny-avila in #12654
  • 🧊 In-Memory Endpoint Token Config Cache Isolation by @danny-avila in #12673
  • 🔉 Normalize audio MIME types in STT format validation by @danny-avila in #12674
  • 💎 Handle usage_metadata in Title Transaction for Gemini Models by @kojinseok-del in #12386
  • 🤝 Normalize Empty Handoff Fields to Restore Default Fallback by @xxsLuna in #12707
  • 🪐 Replace $bitsAllSet ACL Queries for Azure Cosmos DB Compatibility by @danny-avila in #12736
  • 📝 Preserve Raw Markdown Formatting on Upload as Text by @danny-avila in #12734
  • 📐 Align Summarization Trigger Schema with Documented and Runtime-Supported Types by @danny-avila in #12735
  • 🔊 Preserve Log Metadata on Console for Warn/Error Levels by @danny-avila in #12737
  • 🤝 Load Handoff Agents for Agents API by @danny-avila in #12740
  • 🗺️ Resolve Custom-Endpoint Providers for Summarization by @danny-avila in #12739
  • 🔒 Validate MCP OAuth Protected Resource Metadata binding by @danny-avila in #12755
  • 🔐 Prefer WWW-Authenticate resource_metadata Hint for MCP OAuth by @danny-avila in #12763
  • 🔏 Prevent Browser Autofill From Silently Dropping MCP CustomUserVars on Save by @jschmetzer in #12770
  • 🧹 Clean Up Orphaned Agent File Stubs After Deletion by @danny-avila in #12781

🔧 Refactoring

📦 Dependencies & Chores

🌍 Internationalization

New Contributors

Full Changelog: v0.8.5-rc1...v0.8.5

Loading

v0.8.5-rc1

10 Apr 02:25
@danny-avila danny-avila
v0.8.5-rc1
4f133f8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.8.5-rc1 Pre-release
Pre-release

Click to expand Release Notes

What's Changed

✨ Features

🐛 Fixes

  • 🔑 Type-Safe User Context Forwarding for Non-OAuth Tool Discovery by @crossagent in #12348
  • 🐛 Resolve MeiliSearch Startup Sync Failure from Model Loading Order by @adityaarunsinghal in #12397
  • 🗝️ Resolve User-Provided API Key in Agents API Flow by @ESJavadex in #12390
  • 📸 Snapshot Options to Prevent Mid-Await Client Disposal Crash by @danny-avila in #12398
  • 🏁 Invalidate Message Cache on Stream 404 Instead of Showing Error by @danny-avila in #12411
  • 🔑 Robust MCP OAuth Detection in Tool-Call Flow by @danny-avila in #12418
  • 🪝 Safe Hook Fallbacks for Tool-Call Components in Search Route by @danny-avila in #12423
  • 🛡️ Add Origin Binding to Admin OAuth Exchange Codes by @danny-avila in #12469
  • 💰 Lazy-Initialize Balance Record at Check Time for Admin Panel Overrides by @danny-avila in #12474
  • 🖼️ Message Icon Flickering from Context-Triggered Re-renders by @danny-avila in #12489
  • 🛡️ Restrict System Grants to Role Principals by @dustinhealy in #12491
  • 🗂️ Allow Empty-Overrides Scope Creation in Admin Config by @danny-avila in #12492
  • 🔏 Strip Unnecessary Fields Across Write Paths in Conversation & Message Methods by @danny-avila in #12498
  • 🔒 Exclude Unnecessary Fields from Conversation $unset by @danny-avila in #12501
  • 🔑 Auth-Aware Startup Config Caching for Fresh Sessions by @danny-avila in #12505
  • 🔁 Pass recursionLimit to OpenAI-Compatible Agents API Endpoint by @danny-avila in #12510
  • 🏖️ Sandpack ExternalResources for Static HTML Artifact Previews by @danny-avila in #12509
  • 🎯 MCP Tool Misclassification from Action Delimiter Collision by @danny-avila in #12512
  • 📎 Route Unrecognized File Types via supportedMimeTypes Config by @danny-avila in #12508
  • 🪆 Allow Nested addParams in Config Schema by @danny-avila in #12526
  • 🔐 Strip code_challenge from Admin OAuth Requests Before Passport by @danny-avila in #12534
  • 🔍 Only Show Searchbar if Enabled by @dlew in #12424
  • 🔨 Custom Role Permissions by @dustinhealy in #12528
  • 📝 Properly Restore Draft Text When Switching Conversations by @dlew in #12384
  • 🗣️ Prevent @librechat/client useLocalize from Overwriting Host App Language State by @shtayeb in #12515
  • 🔎 Specify Explicit Primary Key for Meilisearch Document Operations by @danny-avila in #12542
  • ♻️ Reuse Existing MCP OAuth Client Registrations to Prevent client_id Mismatch by @DenisPalnitsky in #11925
  • 🚫 Hide Delete Account Button When ALLOW_ACCOUNT_DELETION Is Disabled by @danny-avila in #12568
  • 🎯 Use Resolved Provider for Agent Token Lookup on Custom Endpoints by @danny-avila in #12574
  • 🔐 Add Tenant Context to Admin OAuth Callback Routes by @dustinhealy in #12579
  • 🧬 Merge Custom Endpoints by Name Instead of Replacing Entire Array by @danny-avila in #12586
  • 🧮 Atomize Redis Event Sequence Counters for Multi-Replica Deployments by @danny-avila in #12578
  • 📂 Enable Hidden File Upload for GitNexus Index Artifact by @danny-avila in #12597
  • 📂 Respect supportedMimeTypes Config in File Picker Accept Filter by @danny-avila in #12596
  • 📩 Restore Primary Action Button Visibility in Light Mode by @UnicronBE in #12591

🔧 Refactoring

  • 🎨 Redesign Sidebar with Unified Icon Strip Layout by @berry-13 in #12013
  • 🔄 Migrate to react-resizable-panels v4 with Artifacts Header Polish by @danny-avila in #12356
  • 📁 Prompts UI by @berry-13 in #11570
  • 📐 Resolve Stale Active Sidebar Panel and Favorites Row Height by @danny-avila in #12366
  • ⚡ Fast-Fail MCP Tool Discovery on 401 for Non-OAuth Servers by @danny-avila in #12395
  • ⚡ Use In-Memory Cache for App MCP Configs to Avoid Redis SCAN by @danny-avila in #12410
  • 🌊 Local Snapshot for Aggregate Key Cache to Avoid Redundant Redis GETs by @danny-avila in #12422
  • 🪢 Eliminate Unnecessary Re-renders During Message Streaming by @danny-avila in #12454
  • 🧹 Tighten Conf...
Read more
Loading

v0.8.4

20 Mar 23:57
@danny-avila danny-avila
v0.8.4
0736ff2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.8.4 Pre-release
Pre-release

https://www.librechat.ai/changelog/v0.8.4

🏞️ Highlights

This release of LibreChat is primarily focused on security and stability improvements.

  • Security Hardening
    • 30+ security fixes: Strongly recommended update for all deployments.
  • MCP Improvements
    • Reconnection storm prevention with circuit breaker and backoff, OAuth race condition fixes, fail-closed domain validation, better STDIO UX with customUserVars.
  • Replaced tiktoken with ai-tokenizer
    • Lighter, faster tokenization dependency.
  • Artifact Rendering
    • Replaced React Markdown renderer with static HTML for more reliable artifact display.
  • Accessibility
    • Screen reader improvements for conversation headings and date groups.

Click to expand Release Notes

For detailed changes in the release candidate, see:

Changes Since v0.8.4-rc1

✨ Features

🐛 Fixes

  • 🎭 Set Explicit Permission Defaults for USER Role in roleDefaults by @danny-avila in #12308
  • 🧯 Remove Revoked Agents from User Favorites by @danny-avila in #12296
  • 🖼️ Correct ToolMessage Response Format for Agent-Mode Image Tools by @danny-avila in #12310
  • 🔌 Isolate Code-Server HTTP Agents to Prevent Socket Pool Contamination by @danny-avila in #12311
  • 🛂 Reject OpenID Email Fallback When Stored openidId Mismatches Token Sub by @danny-avila in #12312
  • 🛡️ Prevent loop in ChatGPT import on Cyclic Parent Graphs by @danny-avila in #12313
  • 🪦 ACL-Safe User Account Deletion for Agents, Prompts, and MCP Servers by @danny-avila in #12314
  • 🚦 ERR_ERL_INVALID_IP_ADDRESS and IPv6 Key Collisions in IP Rate Limiters by @bprussell in #12319
  • 💣 Harden against falsified ZIP metadata in ODT parsing by @danny-avila in #12320
  • 🪂 Automatic logout_hint Fallback for Oversized OpenID Token URLs by @Airamhh in #12326
  • ♾️ Permanent Ban Cache and Expired Ban Cleanup Defects by @JooyoungChoi14 in #12324
  • 🪤 Avoid express-rate-limit v8 ERR_ERL_KEY_GEN_IPV6 False Positive by @danny-avila in #12333
  • ⛓️‍💥 Replace React Markdown Artifact Renderer with Static HTML by @danny-avila in #12337
  • 🛂 Gate MCP Queries Behind USE Permission to Prevent 403 Spam by @danny-avila in #12345

🔧 Refactoring

♿ Accessibility

  • 🗣️ Add Screen Reader Context to Conversation Date Group Headings by @danny-avila in #12340
  • 🗣️ Distinguish Conversation Headings for Screen Readers by @danny-avila in #12341

📦 Dependencies & Chores

🌍 Internationalization

New Contributors

Full Changelog: v0.8.3...v0.8.4

Loading

chart-2.0.2

20 Mar 23:57
@danny-avila danny-avila
chart-2.0.2
0736ff2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
chart-2.0.2 Pre-release
Pre-release

Full Changelog: chart-2.0.1...chart-2.0.2

Loading

v0.8.4-rc1

17 Mar 21:05
@danny-avila danny-avila
v0.8.4-rc1
b5a55b2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.8.4-rc1 Pre-release
Pre-release

https://www.librechat.ai/changelog/v0.8.4-rc1

Click to expand Release Notes

What's Changed

🐛 Fixes

🔧 Refactoring

⚙️ Other Changes

🌍 Internationalization

New Contributors

Full Changelog: v0.8.3...v0.8.4-rc1

Loading

chart-2.0.1

17 Mar 20:17
@danny-avila danny-avila
chart-2.0.1
1e1a3a8

Choose a tag to compare

View all tags
chart-2.0.1 Pre-release
Pre-release

Full Changelog: chart-2.0.0...chart-2.0.1

Loading

v0.8.3

09 Mar 19:22
@danny-avila danny-avila
v0.8.3
cfbe812
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v0.8.3 Pre-release
Pre-release

https://www.librechat.ai/changelog/v0.8.3

🏞️ Highlights

  • Event-Driven Lazy Tool Loading
    • MCP tools load on-demand, reducing memory load. Includes programmatic tool calling UI.
  • New Models & Providers
    • Moonshot provider, Claude Opus 4.6 (1M context, adaptive thinking), Sonnet 4.6, GPT-5.3/5.4, Gemini 3.1
    • Bedrock document uploads and reasoning_effort, Gemini Thinking Level parameter
  • Performance
    • Optimized message re-renders, image preview caching, delta buffering for SSE, Redis scalability improvements.
  • Local Document Text Extraction
    • PDF, DOCX, XLS/XLSX, and OpenDocument parsing locally.
  • MCP Server Credential Variables
    • Secure per-user auth for UI-created MCP servers via credential placeholders.
  • Monaco Code Editor for Artifacts
    • Now reliably allows artifact editing.
  • Agents
    • Editors can now duplicate agents. Added messageId for transaction tracking.
  • Security
    • TOCTOU-safe SSRF protection, OIDC improvements (RP-initiated logout, configurable email claim)
    • Hardened API routes, ALLOW_SHARED_LINKS_PUBLIC defaults to false.

Click to expand Release Notes

For detailed changes in each release candidate, see:

  • v0.8.3-rc1 - Event-Driven Lazy Tool Loading, Moonshot Provider, Claude Opus/Sonnet 4.6, Delta Buffering
  • v0.8.3-rc2 - Local Document Extraction, Bedrock Document Uploads, Credential Variables for MCP, Agent Duplication

Changes Since v0.8.3-rc2

✨ Features

🐛 Fixes

  • 🏆 Longest-or-Exact-Key Match in findMatchingPattern, Remove Deprecated Models by @danny-avila in #12073
  • 🧭 Subdirectory Deployment Auth Redirect Path Doubling by @danny-avila in #12077
  • 🕰️ Preserve updatedAt Timestamps During Meilisearch Batch Sync by @danny-avila in #12084
  • 🧮 XLSX/XLS Upload-as-Text via Buffer-Based SheetJS Parsing by @danny-avila in #12098
  • 📐 Replace JS Image Scaling with CSS Viewport Constraints by @CavMCarolina in #12089
  • 🛡️ Add Permission Guard for Temporary Chat Visibility by @Airamhh in #12107
  • ⛵ Resolve Agent Provider Endpoint Type for File Upload Support by @danny-avila in #12117
  • 🔒 Hex-normalized IPv4-mapped IPv6 in Domain Validation by @danny-avila in #12130
  • 🩹 MCP Server Recovery from Startup Inspection Failures by @danny-avila in #12145
  • 🕵️ remoteAgents Field Omitted from Config by @Airamhh in #12150

🔧 Refactoring

📦 Dependencies & Chores

🌍 Internationalization

New Contributors

Full Changelog: v0.8.2...v0.8.3

Loading

chart-2.0.0

09 Mar 19:21
@danny-avila danny-avila
chart-2.0.0
cfbe812
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
chart-2.0.0 Pre-release
Pre-release

Full Changelog: chart-1.9.9...chart-2.0.0

Loading