Merge remote-tracking branch 'upstream/dev' into dev

Author: github-actions[bot]

backend/open_webui/main.py

@@ -1375,6 +1375,13 @@ async def check_url(request: Request, call_next):
     request.state.token = get_http_authorization_cred(
         request.headers.get("Authorization")
     )
+    # Fallback to cookie token for browser sessions
+    if request.state.token is None and request.cookies.get("token"):
+        from fastapi.security import HTTPAuthorizationCredentials
+        request.state.token = HTTPAuthorizationCredentials(
+            scheme="Bearer",
+            credentials=request.cookies.get("token")
+        )
 
     request.state.enable_api_keys = app.state.config.ENABLE_API_KEYS
     response = await call_next(request)

backend/requirements-min.txt

@@ -4,7 +4,7 @@
 fastapi==0.128.0
 uvicorn[standard]==0.40.0
 pydantic==2.12.5
-python-multipart==0.0.21
+python-multipart==0.0.22
 itsdangerous==2.2.0
 
 python-socketio==5.16.0
@@ -16,20 +16,20 @@ PyJWT[crypto]==2.10.1
 authlib==1.6.6
 
 requests==2.32.5
-aiohttp==3.13.2
+aiohttp==3.13.2 # do not update to 3.13.3 - broken
 async-timeout
 aiocache
 aiofiles
-starlette-compress==1.6.1
+starlette-compress==1.7.0
 httpx[socks,http2,zstd,cli,brotli]==0.28.1
 starsessions[redis]==2.2.1
 
-sqlalchemy==2.0.45
-alembic==1.18.1
+sqlalchemy==2.0.46
+alembic==1.18.3
 peewee==3.19.0
 peewee-migrate==1.14.3
 
-pycrdt==0.12.44
+pycrdt==0.12.45
 redis
 
 APScheduler==3.11.2
@@ -38,17 +38,17 @@ RestrictedPython==8.1
 loguru==0.7.3
 asgiref==3.11.0
 
-mcp==1.25.0
+mcp==1.26.0
 openai
 
-langchain==1.2.4
+langchain==1.2.7
 langchain-community==0.4.1
 langchain-classic==1.0.1
 langchain-text-splitters==1.1.0
 
 fake-useragent==2.2.0
 
-chromadb==1.4.0
-black==25.12.0
+chromadb==1.4.1
+black==26.1.0
 pydub
 chardet==5.2.0

backend/requirements.txt

@@ -1,7 +1,7 @@
 fastapi==0.128.0
 uvicorn[standard]==0.40.0
 pydantic==2.12.5
-python-multipart==0.0.21
+python-multipart==0.0.22
 itsdangerous==2.2.0
 
 python-socketio==5.16.0
@@ -13,21 +13,21 @@ PyJWT[crypto]==2.10.1
 authlib==1.6.6
 
 requests==2.32.5
-aiohttp==3.13.2
+aiohttp==3.13.2 # do not update to 3.13.3 - broken
 async-timeout
 aiocache
 aiofiles
-starlette-compress==1.6.1
+starlette-compress==1.7.0
 httpx[socks,http2,zstd,cli,brotli]==0.28.1
 starsessions[redis]==2.2.1
 python-mimeparse==2.0.0
 
-sqlalchemy==2.0.45
-alembic==1.18.1
+sqlalchemy==2.0.46
+alembic==1.18.3
 peewee==3.19.0
 peewee-migrate==1.14.3
 
-pycrdt==0.12.44
+pycrdt==0.12.45
 redis
 
 APScheduler==3.11.2
@@ -38,13 +38,13 @@ asgiref==3.11.0
 
 # AI libraries
 tiktoken
-mcp==1.25.0
+mcp==1.26.0
 
 openai
 anthropic
-google-genai==1.59.0
+google-genai==1.60.0
 
-langchain==1.2.4
+langchain==1.2.7
 langchain-community==0.4.1
 langchain-classic==1.0.1
 langchain-text-splitters==1.1.0
@@ -55,22 +55,22 @@ weaviate-client==4.19.2
 opensearch-py==3.1.0
 
 transformers==4.57.6
-sentence-transformers==5.2.0
+sentence-transformers==5.2.2
 accelerate
 pyarrow==20.0.0 # fix: pin pyarrow version to 20 for rpi compatibility #15897
-einops==0.8.1 
+einops==0.8.2 
 
 ftfy==6.3.1
 chardet==5.2.0
-pypdf==6.6.0
+pypdf==6.6.2
 fpdf2==2.8.5
-pymdown-extensions==10.20
+pymdown-extensions==10.20.1
 docx2txt==0.9
 python-pptx==1.0.2
-unstructured==0.18.27
+unstructured==0.18.31
 msoffcrypto-tool==5.4.2
 nltk==3.9.2
-Markdown==3.10
+Markdown==3.10.1
 pypandoc==1.16.2
 pandas==2.3.3
 openpyxl==3.1.5
@@ -82,15 +82,15 @@ sentencepiece
 soundfile==0.13.1
 
 pillow==12.1.0
-opencv-python-headless==4.12.0.88
+opencv-python-headless==4.13.0.90
 rapidocr-onnxruntime==1.4.4
 rank-bm25==0.2.2
 
 onnxruntime==1.23.2
 faster-whisper==1.2.1
 
-black==25.12.0
-youtube-transcript-api==1.2.3
+black==26.1.0
+youtube-transcript-api==1.2.4
 pytube==15.0.0
 
 pydub
@@ -115,14 +115,14 @@ psycopg2-binary==2.9.11
 pgvector==0.4.2
 
 PyMySQL==1.1.2
-boto3==1.42.29
+boto3==1.42.38
 
-pymilvus==2.6.6
+pymilvus==2.6.8
 qdrant-client==1.16.2
-playwright==1.57.0 # Caution: version must match docker-compose.playwright.yaml - Update the docker-compose.yaml if necessary
+playwright==1.58.0 # Caution: version must match docker-compose.playwright.yaml - Update the docker-compose.yaml if necessary
 elasticsearch==9.2.1
 pinecone==6.0.2
-oracledb==3.4.1
+oracledb==3.4.2
 
 av==14.0.1 # Caution: Set due to FATAL FIPS SELFTEST FAILURE, see discussion https://github.com/open-webui/open-webui/discussions/15720
 
@@ -138,7 +138,7 @@ pytest-docker~=3.2.5
 ldap3==2.9.1
 
 ## Firecrawl
-firecrawl-py==4.13.0
+firecrawl-py==4.14.0
 
 ## Trace
 opentelemetry-api==1.39.1

docker-compose.playwright.yaml

@@ -1,8 +1,8 @@
 services:
   playwright:
-    image: mcr.microsoft.com/playwright:v1.57.0-noble # Version must match requirements.txt
+    image: mcr.microsoft.com/playwright:v1.58.0-noble # Version must match requirements.txt
     container_name: playwright
-    command: npx -y playwright@1.57.0 run-server --port 3000 --host 0.0.0.0
+    command: npx -y playwright@1.58.0 run-server --port 3000 --host 0.0.0.0
 
   open-webui:
     environment:

pyproject.toml

@@ -9,7 +9,7 @@ dependencies = [
     "fastapi==0.128.0",
     "uvicorn[standard]==0.40.0",
     "pydantic==2.12.5",
-    "python-multipart==0.0.21",
+    "python-multipart==0.0.22",
     "itsdangerous==2.2.0",
 
     "python-socketio==5.16.0",
@@ -21,21 +21,21 @@ dependencies = [
     "authlib==1.6.6",
 
     "requests==2.32.5",
-    "aiohttp==3.13.2",
+    "aiohttp==3.13.2" # do not update to 3.13.3 - broken,
     "async-timeout",
     "aiocache",
     "aiofiles",
-    "starlette-compress==1.6.1",
+    "starlette-compress==1.7.0",
     "httpx[socks,http2,zstd,cli,brotli]==0.28.1",
     "starsessions[redis]==2.2.1",
     "python-mimeparse==2.0.0",
 
-    "sqlalchemy==2.0.45",
-    "alembic==1.18.1",
+    "sqlalchemy==2.0.46",
+    "alembic==1.18.3",
     "peewee==3.19.0",
     "peewee-migrate==1.14.3",
 
-    "pycrdt==0.12.44",
+    "pycrdt==0.12.45",
     "redis",
 
     "APScheduler==3.11.2",
@@ -45,13 +45,13 @@ dependencies = [
     "asgiref==3.11.0",
 
     "tiktoken",
-    "mcp==1.25.0",
+    "mcp==1.26.0",
 
     "openai",
     "anthropic",
-    "google-genai==1.59.0",
+    "google-genai==1.60.0",
 
-    "langchain==1.2.4",
+    "langchain==1.2.7",
     "langchain-community==0.4.1",
     "langchain-classic==1.0.1",
     "langchain-text-splitters==1.1.0",
@@ -60,25 +60,25 @@ dependencies = [
     "chromadb==1.4.1",
     "opensearch-py==3.1.0",
     "PyMySQL==1.1.2",
-    "boto3==1.42.29",
+    "boto3==1.42.38",
 
     "transformers==4.57.6",
-    "sentence-transformers==5.2.0",
+    "sentence-transformers==5.2.2",
     "accelerate",
     "pyarrow==20.0.0", # fix: pin pyarrow version to 20 for rpi compatibility #15897
-    "einops==0.8.1",
+    "einops==0.8.2",
 
     "ftfy==6.3.1",
     "chardet==5.2.0",
-    "pypdf==6.6.0",
+    "pypdf==6.6.2",
     "fpdf2==2.8.5",
-    "pymdown-extensions==10.20",
+    "pymdown-extensions==10.20.1",
     "docx2txt==0.9",
     "python-pptx==1.0.2",
-    "unstructured==0.18.27",
+    "unstructured==0.18.31",
     "msoffcrypto-tool==5.4.2",
     "nltk==3.9.2",
-    "Markdown==3.10",
+    "Markdown==3.10.1",
     "pypandoc==1.16.2",
     "pandas==2.3.3",
     "openpyxl==3.1.5",
@@ -91,15 +91,15 @@ dependencies = [
     "azure-ai-documentintelligence==1.0.2",
 
     "pillow==12.1.0",
-    "opencv-python-headless==4.12.0.88",
+    "opencv-python-headless==4.13.0.90",
     "rapidocr-onnxruntime==1.4.4",
     "rank-bm25==0.2.2",
 
     "onnxruntime==1.23.2",
     "faster-whisper==1.2.1",
 
-    "black==25.12.0",
-    "youtube-transcript-api==1.2.3",
+    "black==26.1.0",
+    "youtube-transcript-api==1.2.4",
     "pytube==15.0.0",
 
     "pydub",
@@ -145,18 +145,18 @@ all = [
     "docker~=7.1.0",
     "pytest~=8.3.2",
     "pytest-docker~=3.2.5",
-    "playwright==1.57.0", # Caution: version must match docker-compose.playwright.yaml - Update the docker-compose.yaml if necessary
+    "playwright==1.58.0", # Caution: version must match docker-compose.playwright.yaml - Update the docker-compose.yaml if necessary
     "elasticsearch==9.2.1",
 
     "qdrant-client==1.16.2",
 
     "weaviate-client==4.19.2",
-    "pymilvus==2.6.6",
+    "pymilvus==2.6.8",
     "pinecone==6.0.2",
-    "oracledb==3.4.1",
+    "oracledb==3.4.2",
     "colbert-ai==0.2.22",
 
-    "firecrawl-py==4.13.0",
+    "firecrawl-py==4.14.0",
     "azure-search-documents==11.6.0",
 ]
 

src/lib/components/common/SensitiveInput.svelte

@@ -11,12 +11,15 @@
 	export let outerClassName = 'flex flex-1 bg-transparent';
 	export let inputClassName = 'w-full text-sm py-0.5 bg-transparent';
 	export let showButtonClassName = 'pl-1.5  transition bg-transparent';
+	export let screenReader = true;
 
 	let show = false;
 </script>
 
 <div class={outerClassName}>
-	<label class="sr-only" for={id}>{placeholder || $i18n.t('Password')}</label>
+	{#if screenReader}
+		<label class="sr-only" for={id}>{placeholder || $i18n.t('Password')}</label>
+	{/if}
 	<input
 		{id}
 		class={`${inputClassName} ${show ? '' : 'password'} ${($settings?.highContrastMode ?? false) ? 'placeholder:text-gray-700 dark:placeholder:text-gray-100' : ' outline-hidden placeholder:text-gray-300 dark:placeholder:text-gray-600'}`}

src/lib/components/workspace/Knowledge.svelte

@@ -48,17 +48,15 @@
 	$: if (query !== undefined) {
 		clearTimeout(searchDebounceTimer);
 		searchDebounceTimer = setTimeout(() => {
-			if (loaded) {
-				init();
-			}
+			init();
 		}, 300);
 	}
 
 	onDestroy(() => {
 		clearTimeout(searchDebounceTimer);
 	});
 
-	$: if (loaded && viewOption !== undefined) {
+	$: if (viewOption !== undefined) {
 		init();
 	}
 
@@ -77,6 +75,8 @@
 	};
 
 	const init = async () => {
+		if (!loaded) return;
+
 		reset();
 		await getItemsPage();
 	};

src/lib/components/workspace/Models.svelte

@@ -85,6 +85,8 @@
 	}
 
 	const getModelList = async () => {
+		if (!loaded) return;
+
 		try {
 			const res = await getWorkspaceModels(
 				localStorage.token,