v3.18.0

Security

• Restricted the API publication endpoints to the bot owner and administrators by @Yukinobu-Mine (#1179)
  • In v3.0.0 through v3.17.0, any user in the PublishAllowed group could view publication details and API key values, create or delete API keys, and delete the publication of a bot shared with all users, even if they did not own the bot.
  • We recommend that all deployments update to this release. If you suspect misuse, delete and reissue the API keys of your published bots, and review the members of the PublishAllowed group.
• Switched JWT verification from python-jose to PyJWT by @Yukinobu-Mine (#1177)

Features

• Added support for Claude Opus 5.5 model by @kimnamu (#1165)
• Added support for OpenAI GPT-6 Sol, Luna and Astra models by @kimnamu (#1162)

Enhancements

• Migrated the frontend to Tailwind CSS v4 by @Yukinobu-Mine (#1178)
• Updated the Node.js version used for building the frontend and CDK from 22 to 24 by @Yukinobu-Mine (#1177)

Bug Fixes

• Fixed empty conversation titles when the title model returns reasoning content before the text by @kimnamu (#1164)
• Fixed run.sh of the backend API handler so that it is bundled as an LF executable, which failed when deploying from Windows by @mvanhorn (#1176, fixes #894)
• Fixed the OAuth code exchange failing because of a trailing slash in cognitoDomain by @NitroBoss (#1120)
• Mapped the standard OIDC email claim for external identity providers by @NitroBoss (#1121)
• Fixed the enableBotStoreReplicas context key not being read because of incorrect casing by @NitroBoss (#1123)
• Added eu-central-2 to the cross-region inference map of Claude Haiku 4.5 by @NitroBoss (#1122)