Merge pull request open-webui#21618 from open-webui/dev

0.8.4

Author: tjbck

.github/workflows/docker-build.yaml

@@ -804,3 +804,109 @@ jobs:
       - name: Inspect image
         run: |
           docker buildx imagetools inspect ${{ env.FULL_IMAGE_NAME }}:${{ steps.meta.outputs.version }}
+
+  # Copy images from GHCR to Docker Hub (best-effort, won't block GHCR)
+  copy-to-dockerhub:
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
+    needs: [merge-main-images, merge-cuda-images, merge-cuda126-images, merge-ollama-images, merge-slim-images]
+    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - variant: main
+            suffix: ""
+          - variant: cuda
+            suffix: "-cuda"
+          - variant: cuda126
+            suffix: "-cuda126"
+          - variant: ollama
+            suffix: "-ollama"
+          - variant: slim
+            suffix: "-slim"
+    steps:
+      - name: Set repository and image name to lowercase
+        run: |
+          echo "IMAGE_NAME=${IMAGE_NAME,,}" >>${GITHUB_ENV}
+          echo "FULL_IMAGE_NAME=ghcr.io/${IMAGE_NAME,,}" >>${GITHUB_ENV}
+        env:
+          IMAGE_NAME: '${{ github.repository }}'
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Determine source and destination tags
+        id: tags
+        run: |
+          DOCKERHUB_IMAGE="openwebui/open-webui"
+          SUFFIX="${{ matrix.suffix }}"
+
+          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+            # For version tags: copy version tag and major.minor tag
+            VERSION="${{ github.ref_name }}"
+            VERSION="${VERSION#v}"
+            MAJOR_MINOR="${VERSION%.*}"
+
+            echo "tags<<EOF" >> $GITHUB_OUTPUT
+            echo "${VERSION}${SUFFIX}" >> $GITHUB_OUTPUT
+            echo "${MAJOR_MINOR}${SUFFIX}" >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
+          else
+            # For main branch
+            if [ -z "$SUFFIX" ]; then
+              echo "tags=latest" >> $GITHUB_OUTPUT
+            else
+              # e.g. latest-cuda -> also tag as just "cuda"
+              VARIANT_NAME="${SUFFIX#-}"
+              echo "tags<<EOF" >> $GITHUB_OUTPUT
+              echo "latest${SUFFIX}" >> $GITHUB_OUTPUT
+              echo "${VARIANT_NAME}" >> $GITHUB_OUTPUT
+              echo "EOF" >> $GITHUB_OUTPUT
+            fi
+          fi
+
+          echo "dockerhub_image=${DOCKERHUB_IMAGE}" >> $GITHUB_OUTPUT
+
+      - name: Copy images from GHCR to Docker Hub
+        run: |
+          DOCKERHUB_IMAGE="${{ steps.tags.outputs.dockerhub_image }}"
+          SUFFIX="${{ matrix.suffix }}"
+
+          # Determine the source tag on GHCR
+          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+            VERSION="${{ github.ref_name }}"
+            VERSION="${VERSION#v}"
+            SOURCE_TAG="${VERSION}${SUFFIX}"
+          else
+            if [ -z "$SUFFIX" ]; then
+              SOURCE_TAG="latest"
+            else
+              SOURCE_TAG="latest${SUFFIX}"
+            fi
+          fi
+
+          SOURCE="${{ env.FULL_IMAGE_NAME }}:${SOURCE_TAG}"
+
+          echo "Copying from ${SOURCE} to Docker Hub..."
+
+          # Copy each destination tag
+          while IFS= read -r TAG; do
+            [ -z "$TAG" ] && continue
+            DEST="${DOCKERHUB_IMAGE}:${TAG}"
+            echo "  -> ${DEST}"
+            docker buildx imagetools create -t "${DEST}" "${SOURCE}"
+          done <<< "${{ steps.tags.outputs.tags }}"

CHANGELOG.md

@@ -12,7 +12,7 @@
 
 ![Open WebUI Banner](./banner.png)
 
-**Open WebUI is an [extensible](https://docs.openwebui.com/features/plugin/), feature-rich, and user-friendly self-hosted AI platform designed to operate entirely offline.** It supports various LLM runners like **Ollama** and **OpenAI-compatible APIs**, with **built-in inference engine** for RAG, making it a **powerful AI deployment solution**.
+**Open WebUI is an [extensible](https://docs.openwebui.com/features/extensibility/plugin), feature-rich, and user-friendly self-hosted AI platform designed to operate entirely offline.** It supports various LLM runners like **Ollama** and **OpenAI-compatible APIs**, with **built-in inference engine** for RAG, making it a **powerful AI deployment solution**.
 
 Passionate about open-source AI? [Join our team →](https://careers.openwebui.com/)
 
@@ -172,7 +172,7 @@ After installation, you can access Open WebUI at [http://localhost:3000](http://
 
 We offer various installation alternatives, including non-Docker native installation methods, Docker Compose, Kustomize, and Helm. Visit our [Open WebUI Documentation](https://docs.openwebui.com/getting-started/) or join our [Discord community](https://discord.gg/5rJgQTnV4s) for comprehensive guidance.
 
-Look at the [Local Development Guide](https://docs.openwebui.com/getting-started/advanced-topics/development) for instructions on setting up a local development environment.
+Look at the [Local Development Guide](https://docs.openwebui.com/getting-started/development) for instructions on setting up a local development environment.
 
 ### Troubleshooting
 

README.md

@@ -573,6 +573,20 @@ def __getattr__(self, key):
 )
 
 
+oauth_group_default_share = (
+    os.environ.get("OAUTH_GROUP_DEFAULT_SHARE", "true").strip().lower()
+)
+OAUTH_GROUP_DEFAULT_SHARE = PersistentConfig(
+    "OAUTH_GROUP_DEFAULT_SHARE",
+    "oauth.group_default_share",
+    (
+        "members"
+        if oauth_group_default_share == "members"
+        else oauth_group_default_share == "true"
+    ),
+)
+
+
 OAUTH_BLOCKED_GROUPS = PersistentConfig(
     "OAUTH_BLOCKED_GROUPS",
     "oauth.blocked_groups",
@@ -1249,6 +1263,18 @@ def reachable(host: str, port: int) -> bool:
     [],
 )
 
+DEFAULT_MODEL_METADATA = PersistentConfig(
+    "DEFAULT_MODEL_METADATA",
+    "models.default_metadata",
+    {},
+)
+
+DEFAULT_MODEL_PARAMS = PersistentConfig(
+    "DEFAULT_MODEL_PARAMS",
+    "models.default_params",
+    {},
+)
+
 DEFAULT_USER_ROLE = PersistentConfig(
     "DEFAULT_USER_ROLE",
     "ui.default_user_role",
@@ -1428,6 +1454,10 @@ def reachable(host: str, port: int) -> bool:
     os.environ.get("USER_PERMISSIONS_CHAT_FILE_UPLOAD", "True").lower() == "true"
 )
 
+USER_PERMISSIONS_CHAT_WEB_UPLOAD = (
+    os.environ.get("USER_PERMISSIONS_CHAT_WEB_UPLOAD", "True").lower() == "true"
+)
+
 USER_PERMISSIONS_CHAT_DELETE = (
     os.environ.get("USER_PERMISSIONS_CHAT_DELETE", "True").lower() == "true"
 )
@@ -1566,6 +1596,7 @@ def reachable(host: str, port: int) -> bool:
         "system_prompt": USER_PERMISSIONS_CHAT_SYSTEM_PROMPT,
         "params": USER_PERMISSIONS_CHAT_PARAMS,
         "file_upload": USER_PERMISSIONS_CHAT_FILE_UPLOAD,
+        "web_upload": USER_PERMISSIONS_CHAT_WEB_UPLOAD,
         "delete": USER_PERMISSIONS_CHAT_DELETE,
         "delete_message": USER_PERMISSIONS_CHAT_DELETE_MESSAGE,
         "continue_response": USER_PERMISSIONS_CHAT_CONTINUE_RESPONSE,
@@ -1678,6 +1709,10 @@ def reachable(host: str, port: int) -> bool:
     os.environ.get("ENABLE_ADMIN_CHAT_ACCESS", "True").lower() == "true"
 )
 
+ENABLE_ADMIN_ANALYTICS = (
+    os.environ.get("ENABLE_ADMIN_ANALYTICS", "True").lower() == "true"
+)
+
 ENABLE_COMMUNITY_SHARING = PersistentConfig(
     "ENABLE_COMMUNITY_SHARING",
     "ui.enable_community_sharing",
@@ -2903,6 +2938,12 @@ class BannerModel(BaseModel):
     os.environ.get("ENABLE_ASYNC_EMBEDDING", "True").lower() == "true",
 )
 
+RAG_EMBEDDING_CONCURRENT_REQUESTS = PersistentConfig(
+    "RAG_EMBEDDING_CONCURRENT_REQUESTS",
+    "rag.embedding_concurrent_requests",
+    int(os.getenv("RAG_EMBEDDING_CONCURRENT_REQUESTS", "0")),
+)
+
 RAG_EMBEDDING_QUERY_PREFIX = os.environ.get("RAG_EMBEDDING_QUERY_PREFIX", None)
 
 RAG_EMBEDDING_CONTENT_PREFIX = os.environ.get("RAG_EMBEDDING_CONTENT_PREFIX", None)
@@ -3485,6 +3526,12 @@ class BannerModel(BaseModel):
     os.environ.get("YANDEX_WEB_SEARCH_CONFIG", ""),
 )
 
+YOUCOM_API_KEY = PersistentConfig(
+    "YOUCOM_API_KEY",
+    "rag.web.search.youcom_api_key",
+    os.environ.get("YOUCOM_API_KEY", ""),
+)
+
 ####################################
 # Images
 ####################################

backend/open_webui/config.py

@@ -5,6 +5,9 @@
 import pkgutil
 import sys
 import shutil
+import traceback
+from datetime import datetime, timezone
+from typing import Any
 from uuid import uuid4
 from pathlib import Path
 from cryptography.hazmat.primitives import serialization
@@ -72,9 +75,51 @@
 # LOGGING
 ####################################
 
+_LEVEL_MAP = {
+    "DEBUG": "debug",
+    "INFO": "info",
+    "WARNING": "warn",
+    "ERROR": "error",
+    "CRITICAL": "fatal",
+}
+
+
+class JSONFormatter(logging.Formatter):
+    """Format log records as single-line JSON objects for structured logging."""
+
+    def format(self, record: logging.LogRecord) -> str:
+        log_entry: dict[str, Any] = {
+            "ts": datetime.fromtimestamp(record.created, tz=timezone.utc).isoformat(
+                timespec="milliseconds"
+            ),
+            "level": _LEVEL_MAP.get(record.levelname, record.levelname.lower()),
+            "msg": record.getMessage(),
+            "caller": record.name,
+        }
+
+        if record.exc_info and record.exc_info[0] is not None:
+            log_entry["error"] = "".join(
+                traceback.format_exception(*record.exc_info)
+            ).rstrip()
+        elif record.exc_text:
+            log_entry["error"] = record.exc_text
+
+        if record.stack_info:
+            log_entry["stacktrace"] = record.stack_info
+
+        return json.dumps(log_entry, ensure_ascii=False, default=str)
+
+
+LOG_FORMAT = os.environ.get("LOG_FORMAT", "").lower()
+
 GLOBAL_LOG_LEVEL = os.environ.get("GLOBAL_LOG_LEVEL", "").upper()
 if GLOBAL_LOG_LEVEL in logging.getLevelNamesMapping():
-    logging.basicConfig(stream=sys.stdout, level=GLOBAL_LOG_LEVEL, force=True)
+    if LOG_FORMAT == "json":
+        _handler = logging.StreamHandler(sys.stdout)
+        _handler.setFormatter(JSONFormatter())
+        logging.basicConfig(handlers=[_handler], level=GLOBAL_LOG_LEVEL, force=True)
+    else:
+        logging.basicConfig(stream=sys.stdout, level=GLOBAL_LOG_LEVEL, force=True)
 else:
     GLOBAL_LOG_LEVEL = "INFO"
 
@@ -557,6 +602,10 @@ def parse_section(section):
     "OAUTH_SESSION_TOKEN_ENCRYPTION_KEY", WEBUI_SECRET_KEY
 )
 
+# Maximum number of concurrent OAuth sessions per user per provider
+# This prevents unbounded session growth while allowing multi-device usage
+OAUTH_MAX_SESSIONS_PER_USER = int(os.environ.get("OAUTH_MAX_SESSIONS_PER_USER", "10"))
+
 # Token Exchange Configuration
 # Allows external apps to exchange OAuth tokens for OpenWebUI tokens
 ENABLE_OAUTH_TOKEN_EXCHANGE = (
@@ -978,6 +1027,11 @@ def parse_section(section):
 # TOOLS/FUNCTIONS PIP OPTIONS
 ####################################
 
+ENABLE_PIP_INSTALL_FRONTMATTER_REQUIREMENTS = (
+    os.environ.get("ENABLE_PIP_INSTALL_FRONTMATTER_REQUIREMENTS", "True").lower()
+    == "true"
+)
+
 PIP_OPTIONS = os.getenv("PIP_OPTIONS", "").split()
 PIP_PACKAGE_INDEX_OPTIONS = os.getenv("PIP_PACKAGE_INDEX_OPTIONS", "").split()