v4.3.0-beta.0

Warning

Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. See additional documentation here.

See the assets to download this version and install.

What's Changed

• feat(db): support TLS for Postgres with server certificate verification by @justin-tahara in #12290
• feat(db): mutual TLS (client certs) for Postgres + shared SSLContext builder by @justin-tahara in #12294
• chore(deps-dev): bump starlette from 1.0.1 to 1.3.1 by @dependabot[bot] in #12091
• feat(mobile): port Opal Text and share typography tokens by @Subash-Mohan in #12256
• feat(indexing): docprocessing stage-metric coverage + residual by @Subash-Mohan in #12182
• feat(mobile): port Opal Button to React Native by @Subash-Mohan in #12255
• fix(craft): add egress NetworkPolicy on the sandbox proxy (block IMDS/link-local) by @rohoswagger in #12229
• feat(mobile): react-hook-form input layouts + InputTypeIn-parity atoms by @Subash-Mohan in #12303
• chore(deps): use uv ecosystem for dependabot python updates by @jmelahman in #12309
• chore(deps): bump msgpack from 1.1.2 to 1.2.1 in /loadtest by @dependabot[bot] in #12249
• chore(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #12310
• chore(deps): bump pydantic-settings from 2.12.0 to 2.14.2 by @dependabot[bot] in #12250
• feat(audit): generalized SIEM-exportable audit-event subsystem by @justin-tahara in #12219
• chore(deps-dev): bump opensearch-py from 3.0.0 to 3.2.0 by @dependabot[bot] in #12311
• chore(deps): bump uvicorn from 0.35.0 to 0.49.0 by @dependabot[bot] in #12312
• feat: hierarchy nodes have copyable links by @evan-onyx in #12295
• chore(deps): bump zeep from 4.3.2 to 4.3.3 by @dependabot[bot] in #12247
• feat(audit): emit auth audit events (login, logout, register, password reset, verify) by @justin-tahara in #12271
• chore(deps): bump nick-fields/retry from 3.0.2 to 4.0.0 by @dependabot[bot] in #12315
• chore(deps): bump sharp from 0.33.5 to 0.35.1 in /web by @dependabot[bot] in #12319
• fix(chat): suppress open_url reminder when the tool is disabled by @justin-tahara in #12323
• chore(deps): bump dompurify from 3.4.8 to 3.4.11 in /web by @dependabot[bot] in #12183
• fix(sidebar-tab): clamp title to 1 line by @raunakab in #12326
• chore(deps-dev): bump google-auth-oauthlib from 1.0.0 to 1.4.0 by @dependabot[bot] in #12313
• refactor(loadtest): fold standalone uv project into root dependency group by @jmelahman in #12320
• fix(sandbox-proxy): block sandbox egress relay to internal destinations by @rohoswagger in #12242
• feat(web): add full-width chat mode toggle by @nmgarza5 in #12308
• feat(audit): emit admin-config and access-control audit events by @justin-tahara in #12325
• feat(redis): mutual TLS (client certificate) for Redis connections by @justin-tahara in #12321
• fix(search): bound document_filter LLM calls with a timeout (ENG-4238) by @justin-tahara in #12333
• feat(opensearch): server certificate verification + mutual TLS by @justin-tahara in #12301
• fix(craft): mark scheduled-task run FAILED on turn timeout (ENG-4234) by @rohoswagger in #12330
• fix(helm): drop privileged from model-server and celery default securityContext by @justin-tahara in #12337
• feat(llm): add Nebius Token Factory as a built-in LLM provider by @siriusfreak in #12306
• feat(craft): Add HubSpot as a built-in external app by @Danelegend in #11930
• feat(billing): redis cache for trial + billing info lookups by @nmgarza5 in #10521
• fix(audit): attach dedicated stdout handler so api-server audit events aren't dropped by @justin-tahara in #12346
• fix(craft): avoid returning external app secrets by @wenxi-onyx in #12343
• fix(craft): bound external app bundle uploads by @wenxi-onyx in #12344
• fix(redis): async TLS/IAM passed an unsupported ssl_context — use native ssl_* kwargs by @justin-tahara in #12342
• fix(craft): skip hidden entries in webapp downloads by @wenxi-onyx in #12349
• fix(ci): namespace uv cache per arch + requirement set (no prune) by @jmelahman in #12234
• ci: allow Craft workflow runner labels by @wenxi-onyx in #12352
• feat(craft): Seed external apps for tenants in cloud by @Danelegend in #12288
• fix(model_server): cap torch threads to cgroup CPU quota by @justin-tahara in #12351
• test(craft): add isolated unit and EDU contract coverage by @wenxi-onyx in #12353
• feat(tenants): feature-flag the impersonation endpoint, disabled by default by @jmelahman in #12354
• feat(craft): add sandbox-pod egress NetworkPolicy by @rohoswagger in #12334
• fix(craft): raise sandbox-proxy request body cap to 32 MB by @rohoswagger in #12358
• fix(llm): render the Nebius Token Factory logo on its dark tile by @siriusfreak in #12355
• feat(audit): wire the 3 remaining audit actions (password_reset, user.create, user.group_change) by @justin-tahara in #12362
• feat(audit): emit audit events for impersonation by @jmelahman in #12359
• feat(craft): on-demand session snapshot APIs by @wenxi-onyx in #12361
• fix(ee): unset default SUPER_CLOUD_API_KEY, fail closed when unconfigured by @jmelahman in #12363
• feat(redis): Redis Sentinel (HA) support — app Redis + Celery, TLS-aware by @justin-tahara in #12347
• fix(craft): sanitize message metadata before jsonb writes by @wenxi-onyx in #12375
• fix(craft): keep latest session snapshot safely by @wenxi-onyx in #12376
• chore: more ee codeowners by @evan-onyx in #12386
• refactor(slackbot): move source icons to public assets and delete dead code by @wenxi-onyx in #12385
• fix: hierarchy node cross batch stubs by @evan-onyx in #12365
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /backend/onyx/server/features/build/sandbox/image/templates/outputs/web by @dependabot[bot] in #12314
• chore(deps): bump next from 16.2.6 to 16.2.9 in /backend/onyx/server/features/build/sandbox/image/templates/outputs/web by @dependabot[bot] in #12317
• chore(deps): bump j178/prek-action from 2.0.3 to 2.0.4 by @dependabot[bot] in #12379
• feat(web): enable full highlight.js language set in chat markdown by @jmelahman in #12377
• feat(indexing): stream large spreadsheets via file-backed TabularSection by @nmgarza5 in #12292
• chore(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 by @dependabot[bot] in #12380
• fix: notion db parents by @evan-onyx in #12393
• feat(web-search): add Tavily as a web-search and content provider by @siriusfreak in #12350
• chore(deps-dev): bump opentelemetry-proto from 1.39.1 to 1.42.1 by @dependabot[bot] in #12382
• chore(deps): bump tornado from 6.5.6 to 6.5.7 by @dependabot[bot] in #12090
• chore(deps-dev): bump pypdf from 6.12.0 to 6.13.0 by @dependabot[bot] in #12110
• chore(deps): bump dompurify from 3.4.7 to 3.4.8 by @dependabot[bot] in #11900
• chore(deps-dev): bump vite from 8.0.14 to 8.0.16 by @dependabot[bot] in #11904
• chore(deps): bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in #11907
• chore(deps-dev): bump msoffcrypto-tool from 5.4.2 to 6.0.0 by @dependabot[bot] in #12381
• chore(deps): bump python-multipart from 0.0.27 to 0.0.31 by @dependabot[bot] in #12092
• chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260527.2 to 7.0.0-dev.20260616.1 by @dependabot[bot] in #12316
• fix(settings): respect "Always Start with an Agent" for anonymous users by @jmelahman in #12394
• chore(deps): bump langsmith from 0.8.0 to 0.8.18 by @dependabot[bot] in #12248
• chore(deps): bump @radix-ui/react-slider from 1.3.6 to 1.4.1 in /web by @dependabot[bot] in #12384
• chore(deps): bump motion from 12.29.0 to 12.40.0 in /web by @dependabot[bot] in #11902
• chore(deps-dev): bump aiohttp from 3.14.0 to 3.14.1 by @dependabot[bot] in #12397
• chore(deps): bump cryptography from 46.0.7 to 48.0.1 by @dependabot[bot] in #12396

New Contributors

• @siriusfreak made their first contribution in #12306

Full Changelog: v4.2.0...v4.3.0-beta.0