v2.6.0

[abhinavxd]

What's new

AI features (beta) land in this release. Bring your own model: any OpenAI-compatible endpoint works, including a local one.

• AI assistants - route conversations to an AI assistant with an automation rule, it answers from your knowledge base and hands off to a human when it can't help.
• Juno, the AI copilot - a conversation sidebar tab that answers questions about the conversation and your knowledge base.
• Generate reply - draft a reply from the editor toolbar, then edit it before sending.
• Knowledge base snippets - write snippets by hand or import them from a URL for the assistant to search.
• Learn from resolved conversations - Libredesk drafts snippets from resolved conversations for you to approve or reject. Each approved one joins the knowledge base, so the assistant keeps improving over time.
• Custom AI tools - point an assistant at your own APIs so it can look up an order's status or update a customer's address mid-conversation.
• Tag suggestions - suggest tags for a conversation from your existing tag list.
• Summarize with AI - add a summary of a conversation as a private note.
• Refreshed theme - new palette and a consistent design system across the app.

What's fixed

• Broken image thumbnails in live chat widget for S3 store.
• Fixes to pre-chat form in live chat widget.
• New opt-in [ssrf] guard blocks admin-configured outbound URLs (webhooks, OIDC discovery, AI provider and tool calls) from reaching private, loopback and cloud-metadata addresses. Read more.
• Many other quality of life fixes and improvements.

Upgrade notes

• webhook.allowed_hosts is deprecated and ignored, move it to ssrf.allowed_cidrs and set ssrf.enabled = true to keep webhooks blocked from private addresses.
• Always take a database backup before upgrading.
• Follow the steps here.

Changelog

• 6496cde Merge pull request increase default http write timeout to 60s #456 from abhinavxd/fix/http-write-timeout
• def21f8 increase default http write timeout to 60s
• 189c086 Merge pull request remove redundant comments in v2.6.0 migration #455 from abhinavxd/chore/tidy-migration-comments
• 232d445 Merge pull request fix(log): don't drop the error detail in unsnoozeAll log call #454 from amaanJvd/fix/unsnoozer-dropped-error-log
• 081cc46 remove redundant comments in v2.6.0 migration
• 3d5d67b fix(log): don't drop the error in unsnoozeAll log call
• ee3a547 Merge pull request hardcode copilot name and tidy up AI admin copy #453 from abhinavxd/fix/ai-misc
• c25452a remove redundant snippet URL import hint
• f2edc74 hardcode copilot name and tidy up AI admin copy
• 859777d Merge pull request shortlist tags with embeddings before asking the LLM to suggest them #447 from abhinavxd/feat/ai-tag-embeddings
• 5e7b1af Merge pull request link message media in one query inside the insert transaction #451 from abhinavxd/fix/inline-cid-case-and-tx-linking
• 06242de Merge remote-tracking branch 'origin/main' into fix/inline-cid-case-and-tx-linking
• 52a455f link message media in one query inside the insert transaction
• 3544a80 Merge pull request Fix live chat image thumbnails for S3 store. #450 from abhinavxd/fix/s3-thumbnail-preview
• cda5369 use shared attachment URL signing in message handlers
• 75a0925 Fix WS image URLs
• 205ad8a Serve thumbnails inline
• b553e96 Keep widget images inline
• 37224b1 Clarify thumbnail store handling
• 79da9e8 Fix live chat image thumbnails
• 11d0b52 bound the tag query by tokens and always clear the tag index on purge
• 000d789 shortlist tags with embeddings before asking the LLM to suggest them
• 9c1c413 Merge pull request render the generated reply as html instead of showing raw markdown #446 from abhinavxd/fix-ai-reply-markdown
• 16b9906 render the generated reply as html instead of showing raw markdown
• fb4d665 Merge pull request Feat/ai agent #421 from abhinavxd/feat/ai-agent
• 5e972d1 point each AI admin page's docs link at its section anchor
• bbcc92f add an aria-label to the channel icon in the conversation list
• 276f19d show enabled state as a status badge and stop making checkbox fields required
• f271462 dedup mined FAQs against question and answer so near-duplicate suggestions get caught
• 82f29f2 fix Vue onUnmounted warning on the auth pages
• 0b2ad13 Merge pull request build(deps-dev): bump postcss from 8.5.10 to 8.5.18 in /frontend #443 from abhinavxd/dependabot/npm_and_yarn/frontend/postcss-8.5.18
• 349e695 build(deps-dev): bump postcss from 8.5.10 to 8.5.18 in /frontend
• 4ec387a Merge pull request add CI check to block edits to translated i18n files #442 from abhinavxd/i18n-guard
• 1c500ed Revert "temp: test i18n guard, do not merge"
• bcfbd45 temp: test i18n guard, do not merge
• 6d7ce3c require a verified contact in the example tools server and fix its README mismatches
• 71fb197 bump the default completion model off gpt-4o-mini
• 8db2e34 show specific AI provider errors instead of a generic message
• c25ad46 run i18n guard from the base branch and fail on API errors
• e8e2419 show a clear error when the AI agent runs out of steps and hoist openai response structs
• 763bcd6 add CI check to block edits to translated i18n files
• fd21893 cache AI assistants in a store instead of refetching on every copilot panel mount
• b569777 match email quote classes exactly and enforce password length on set password
• 49c5cb3 make AI agent max steps and history size configurable
• 6b8a0f9 fix content loss in knowledge base chunking and harden AI agent limits
• 9f8f10a drop the unenforced-rules section from the design doc
• 23938a1 rename the design doc to DESIGN.md and resync it with the code
• d8b73c5 retheme UI to the green palette and fix form and search bugs
• 712fcbb return clear 400 errors for invalid AI tool and snippet input
• 7c2e19b style sidebar section headers as labels and add design system doc
• b8b2b6c standardize frontend design system, fix form validation, and skip continuity/CSAT messages in AI context
• 1a0a78f Merge pull request seed default business hours and SLA policy on install #438 from chahat-101/seed-default-business-hours-sla
• 74813b2 reveal admin table row actions on hover and switch to vertical menu, add AI tool enable toggle
• d925640 drop migration, seed only in schema.sql
• 40f8284 strip quoted reply chains from AI agent message context
• d2a548e seed default business hours and SLA policy on install
• 6125f5c harden AI agent knowledge base, OTP, and prompt injection defenses
• cf629f3 only include checked checkbox fields in prechat form submission
• 83f9bb5 show a BETA badge on the AI admin nav item
• aa200f5 make the missing AI API key message provider-agnostic
• ae44e7f expand AI tool context and let contacts correct their email
• 8f8512f apply workspace instructions even with an empty base prompt
• c74eef0 harden the AI agent run loop and admin lifecycle
• f417aac drain AI workers on shutdown before closing the database
• ea03339 address CodeRabbit review findings in the AI agent
• 35ddfe5 make the image pixel-count guard overflow-safe
• 8bedb1a set OTP send-counter TTL atomically to prevent resend lockout
• c659e30 address CodeRabbit review findings in the AI agent
• 2fced94 log when the verification email no-reply guard can't be set
• 1812a03 Merge pull request build(deps): bump axios from 1.16.0 to 1.18.0 in /frontend #437 from abhinavxd/dependabot/npm_and_yarn/frontend/axios-1.18.0
• b422833 build(deps): bump axios from 1.16.0 to 1.18.0 in /frontend
• 1034617 point livechat verification email replies at a no-reply address
• 7760974 send AI verification code through the conversation's inbox
• 085880d make OTP attempt check atomic to prevent brute-force bypass
• bfc3b6e gate AI custom tools behind email OTP verification
• 752e604 drop CC'd contacts' messages from the AI agent history
• 6015859 scope copilot thinking state per conversation
• 1384fd5 scope Generate Reply tools to the conversation's contact
• f460f6b expand copilot with customer-history tools, persona picker, and tag suggestions
• dd3465f make the quoted text toggle keyboard accessible
• b570502 remember when a provider needs max_completion_tokens and track token usage
• ec5333a move OIDC client secret masking to the backend
• 52cebdf update livechat launcher logo
• b1d6fb4 limit when the AI agent appends the confirm prompt
• 35d69fc fix review findings in reports overview and avatar upload
• 94334a0 polish reports overview, avatar upload, and conversation list UI
• 8ac465c support multiple auth headers on AI tools and tune agent timeouts
• e7fa4ce fix review findings in the aiagent package
• a4be8ec fix review findings in the ai package
• fe17af2 drop hardcoded transport fallback in ssrf.NewTransport
• 8f34fc5 guard against a replaced http.DefaultTransport in ssrf.NewTransport
• c7f55e2 guard reply-box AI prompt race and share the SSRF-safe http transport
• a3cdd71 remove inline OpenAI key prompt and reuse generating state for AI prompts
• e5ce8e3 truncate long assistant descriptions in admin table
• 0f2aef1 fix Groq and Together AI provider preset defaults
• cd7e6d9 Update README.md
• 99771a6 Update README.md
• 97c227b skip AI agent on non-open status categories instead of hardcoded names
• 758a01a guard knowledge base URL import against SSRF and fix OIDC transport defaults
• eed50ef link SSRF docs page from SECURITY.md
• 9566dcb apply SSRF guard to all admin-configured outbound URLs
• de8ffa5 Update README.md
• 0f81806 Update README.md
• d02b65f address CodeRabbit findings in AI embedding and assistant flows
• c030c9e harden AI embedding and agent prompt handling, add tokenizer, and switch to a green theme
• 8cdfe86 add AI snippet URL import, conversation summarize, and assistant reply languages
• 616fd00 Update ROADMAP.md
• afb338c address PR review findings in the AI agent
• 976c45d add AI provider connection test and self-heal reasoning model param errors
• e1695b7 send AI agent confirmation question as a separate widget message
• 85a3869 restrict copilot to built-in tools and add per-assistant handoff toggle
• dad99bf render AI agent replies as markdown and fix assistant identity, handoff, and stats bugs
• 3137a3f add conversation attributes to AI agent prompt and mark customer data as untrusted
• 34241f7 improve AI agent context and disclosure
• a7288e1 add AI assistant expectation message shown in the livechat widget
• 44925e6 fix AI agent reply, turn-cap, and stats bugs
• 76d1628 gate AI tool identity to verified contacts and merge v2.6.0 migration into v2.7.0
• 3ba2b82 Merge remote-tracking branch 'origin/main' into feat/ai-agent
• 51d29e0 add local widget JWT test page
• 623fa2c load agents directly in AgentList
• c8884ec add AI reply-box UI and AI author links
• ac40379 improve copilot reply drafts and add presets
• ef0add0 add reasoning effort setting for providers
• 1343790 restrict custom tool methods to GET and POST
• 0d755fc send CSAT on every resolve path
• 16c79a2 guard AI agent replies and add prior-conversation context
• 7186c95 add WIP autonomous AI agent that replies to assigned conversations
• 2fe850a Merge pull request build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 #419 from abhinavxd/dependabot/go_modules/golang.org/x/crypto-0.52.0
• 5815342 build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0
• 0ecd783 add AI copilot backed by a knowledge base and custom tools

What's Changed (Auto generated)

• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 #419
• build(deps): bump axios from 1.16.0 to 1.18.0 in /frontend by @dependabot[bot] in build(deps): bump axios from 1.16.0 to 1.18.0 in /frontend #437
• seed default business hours and SLA policy on install by @chahat-101 in seed default business hours and SLA policy on install #438
• add CI check to block edits to translated i18n files by @abhinavxd in add CI check to block edits to translated i18n files #442
• build(deps-dev): bump postcss from 8.5.10 to 8.5.18 in /frontend by @dependabot[bot] in build(deps-dev): bump postcss from 8.5.10 to 8.5.18 in /frontend #443
• Feat/ai agent by @abhinavxd in Feat/ai agent #421
• render the generated reply as html instead of showing raw markdown by @abhinavxd in render the generated reply as html instead of showing raw markdown #446
• Fix live chat image thumbnails for S3 store. by @abhinavxd in Fix live chat image thumbnails for S3 store. #450
• link message media in one query inside the insert transaction by @abhinavxd in link message media in one query inside the insert transaction #451
• shortlist tags with embeddings before asking the LLM to suggest them by @abhinavxd in shortlist tags with embeddings before asking the LLM to suggest them #447
• hardcode copilot name and tidy up AI admin copy by @abhinavxd in hardcode copilot name and tidy up AI admin copy #453
• fix(log): don't drop the error detail in unsnoozeAll log call by @amaanJvd in fix(log): don't drop the error detail in unsnoozeAll log call #454
• remove redundant comments in v2.6.0 migration by @abhinavxd in remove redundant comments in v2.6.0 migration #455
• increase default http write timeout to 60s by @abhinavxd in increase default http write timeout to 60s #456

New Contributors

• @chahat-101 made their first contribution in seed default business hours and SLA policy on install #438
• @amaanJvd made their first contribution in fix(log): don't drop the error detail in unsnoozeAll log call #454

Full Changelog: v2.5.0...v2.6.0

---

This discussion was created from the release v2.6.0.

[mdguggenbichler]

Am I missing something, or is the v2.6.1 image on Docker Hub actually v2.5.0?

Pulled libredesk/libredesk:v2.6.1 fresh today. Running it, but everything points to it actually being v2.5.0 under the hood:

• Startup log: Build: v2.5.0 (e6a1c908 2026-07-11T15:34:23Z, linux/amd64)
• Admin UI also shows v2.5.0
• The app's own update checker flags itself as outdated and links to the v2.6.1 release notes — so the binary's self-reported version really is v2.5.0, not just a stray log string
• --upgrade says no upgrades to run. Database is up to date. — the v2.6.0 migration never runs
• None of the AI features (AI assistants, Juno copilot, knowledge base snippets, custom tools, tag suggestions) or the refreshed theme are present

I verified the image isn't a stale local pull — docker image inspect shows digest sha256:d39b745859fc4081bba0fe39033a696fc47dec74c2f96ee7fa26e908140b64fb, matching the RepoDigest for the v2.6.1 tag on Docker Hub.

My setup: Coolify, custom entrypoint running --install --idempotent-install --yes → --upgrade --yes → normal start, per the docs. Tried force-rebuild without cache too, same result.

Is the v2.6.1 image on Docker Hub possibly built from the wrong ref? Or is there some config flag I'm missing that gates the AI features behind a beta opt-in?