Note:
- WebUI “Config -> System Config” has moved to “Settings” at the bottom of the WebUI sidebar.
- It's recommended to update to v4.25.6 before updating to this version.
提醒:
- WebUI 的“配置 -> 系统配置”已迁移至 WebUI 侧边栏下方的“设置”。
- 建议先升级到 v4.25.6 再升级到此版本。
- 更新日志(简体中文)
- Changelog(English)
What's Changed
✨ 新功能
- 后端架构从 Quart 迁移至 FastAPI。新增多个 AstrBot OpenAPI。(#8688)
- 统一全平台消息媒体文件的处理逻辑,提升图片、音频、文件和引用消息媒体的解析一致性,对腾讯系 Silk 格式的语音文件不再使用 pilk 库。(#8764)
- 支持配置模型调用出错时的重试次数,增强稳定性。
- WebUI 新增函数工具的逐工具权限管理,支持在工具面板中查看和切换工具权限。(#8693)
- WebUI 新增浅色、深色、跟随系统三种主题模式,并集中处理系统主题同步。(#8648)
- 重组 WebUI 系统配置页面,将系统配置入口迁移到侧边栏下方的设置区域,并优化相关设置项、自动保存和重启提示体验。(#8777)
- 新增 QQ 官方机器人 WebSocket 适配器扫码绑定流程,可通过 WebUI 一键扫码获取并回填 AppID 与 Secret,同时将 WebSocket 模板标记为推荐。(#8821)
- 增强 QQ 官方机器人群聊能力,支持群消息创建类型,并允许 Webhook 适配器在无缓存
msg_id时主动发送群消息。(#8838, #8841) - 为 OpenAI、Gemini、Anthropic 等模型请求加入可配置的重试机制,并新增请求最大重试次数配置,提升临时网络错误与 5xx 服务端错误下的稳定性。(#8893)
- 现在更新项目时,下载 AstrBot Core 会走 AstrBot 官方托管地址,提高网络稳定性。(#8888)
- 支持在请求中加载 workspace skills,并加固 workspace skill 发现流程。(#8884)
- 新增 Exa Web Search 提供商。(#8973)
- 新增 ElevenLabs TTS API Provider。(commit)
- 新增启动时重置 WebUI 密码的命令行开关,便于无法登录时恢复访问。(commit)
- 新增预发布版本可见性开关。(commit)
- 登录页新增公开版本详情展示。(#8986)
- 备份功能现在会包含 skills 目录。(#8700)
优化
- 加强未来任务所有者校验,避免越权访问定时任务。(#8881)
- 优化知识库上传文件名路径穿越风险。(#8971)
- 优化插件上传文件名路径穿越风险。(#8968)
- 在受限本地文件系统工具中拒绝 hardlink 文件,避免通过工作区 hardlink 别名读写允许目录外的文件。
- 加固沙箱文件传输与 CUA 健康检查流程,降低异常环境下的文件操作风险。(#8840)
- 消息组件日志输出现在会截断过长的 base64 字段,避免日志中出现大体积内联媒体内容。(#8591)
- 群聊上下文现在会展示被引用消息的内容。(commit)
- 对话上下文新增当前星期信息。(#8669)
- 使用原子写入方式保存配置文件,降低写入中断导致配置损坏的概率。(#8793)
- 新增 GitHub 代理
gh.dpik.top,并移除失效代理gh.llkk.cc。(#8772, #8761)
修复
- 修复 aiocqhttp 平台适配器与消息事件处理器在多处 API 调用中缺少
self_id路由参数的问题。(#8779) - 修复生成平台 ID 时可能包含空白字符的问题。(#8768)
- 修复 Gemini Provider 工具定义没有正确传回模型,导致重复工具调用的问题。(#8833)
- 修复提供商源修改 ID 后保存被静默还原的问题。(#8915)
- 修复插件 LLM Tools 开关的归属校验问题,避免误操作其他插件的工具配置。(commit)
- 完善插件命名模式校验和边界场景处理。(commit)
- 修复插件重装后仓库来源丢失的问题。(commit)
- 修复子目录工具的
handler_module_path不一致问题。(#8578) - 修复 run-based tools 的保护逻辑,避免受保护工具在注册流程中被错误丢失。(#8790)
- 修复 persona 工具列表场景下系统工具被移除的问题。(#8908)
- 修复人格设定中将工具和 Skills 从指定列表切回“默认使用全部”后不生效的问题。(#8835)
- 修复新版 MCP 中 Streamable HTTP client 重命名导致的兼容问题,并保持
mcp依赖小于 2。 - 修复本地 Python 工具没有在当前 session workspace 中运行的问题。(#8792)
- 修复静态资源缺失时仍显示 WebUI ready banner 的问题。(#8804)
- 修复 Dashboard 创建文件夹时按 Enter 无法提交的问题。(#8597)
- 修复聊天输入框在非末尾位置使用输入法组合输入时可能丢失字符的问题。(#8811)
- 修复 changelog 弹窗中的锚点链接处理。(#8750)
- 修复 onboarding 平台配置与备份上传相关问题。(#8834)
- 将知识库上下文作为临时 user 内容注入,修复模型请求中知识库上下文角色不准确的问题。(#8904)
- 修复 cron 星期调度规范化问题。(#8984)
- 修复 QQ 官方平台发送消息时 At 组件被丢失的问题。(#8983)
- 修复引用消息中的 image caption 可能重复显示的问题。(#8718)
- 修复 Embedding API version 后缀被错误截断的问题。(#8736)
- 延迟导入 FAISS C 库,避免部分环境启动时进程卡住。(#8696)
- 关闭时主动释放数据库 engine,减少会话和测试环境中的资源残留。(#8650)
- 修复 CLI 版本来源不正确的问题。(#8692)
- 修复执行
astrbot命令时不必要地创建 data 目录的问题。(#8932) - 修复 sdist 构建产物路径,确保 Dashboard artifact 可被包含。(#8933)
- 修复插件页资源 token fallback。(#8970)
- 更新
max_context_length与dequeue_context_length默认值。 - 稳定 FastAPI Dashboard 路由注册测试,兼容 included router 节点。(commit)
- 稳定 Dashboard 路由相关测试,兼容最新 FastAPI 行为。(commit)
What's Changed (EN)
✨ New Features
- Migrated the backend architecture from Quart to FastAPI and added multiple OpenAPI definitions. (#8688)
- Unified media file handling across platforms, improving consistency for images, audio, files, and quoted-message media. Tencent Silk voice files no longer use the pilk library. (#8764)
- Added per-tool permission management for function tools in WebUI, with support for viewing and toggling tool permissions from the tools panel. (#8693)
- Added light, dark, and system theme modes to WebUI, with centralized system theme synchronization. (#8648)
- Reorganized the WebUI system configuration page. The system configuration entry has moved to the Settings area at the bottom of the sidebar, with improved settings, autosave, and restart notices. (#8777)
- Added a QR binding flow for the QQ Official Bot WebSocket adapter. WebUI can now fetch and autofill AppID and Secret through one-click QR setup, and the WebSocket template is marked as recommended. (#8821)
- Enhanced QQ Official Bot group chat support by adding group message creation types and allowing the Webhook adapter to proactively send group messages without a cached
msg_id. (#8838, #8841) - Added configurable retry handling for OpenAI, Gemini, Anthropic, and related model requests, including a maximum request retry setting for better stability during temporary network errors and 5xx server errors. (#8893)
- AstrBot Core downloads now use AstrBot's officially hosted source during project updates, improving network stability. (#8888)
- Added support for loading workspace skills in requests and hardened workspace skill discovery. (#8884)
- Added Exa as a web search provider. (#8973)
- Added the ElevenLabs TTS API provider. (commit)
- Added a startup flag to reset the WebUI password, making it easier to recover access when login is unavailable. (commit)
- Added a prerelease visibility toggle. (commit)
- Added public version details to the login page. (#8986)
- Backups now include the skills directory. (#8700)
Improvements
- Strengthened Future Task owner checks to prevent unauthorized scheduled-task access. (#8881)
- Hardened knowledge base upload filename handling against path traversal risks. (#8971)
- Hardened plugin upload filename handling against path traversal risks. (#8968)
- Rejected hardlinked files in restricted local filesystem tools to prevent workspace hardlink aliases from reading or writing files outside allowed directories.
- Hardened sandbox file transfers and CUA health checks to reduce file-operation risks in abnormal environments. (#8840)
- Message component logs now truncate long base64 fields to avoid large inline media payloads in logs. (#8591)
- Group chat context now includes quoted message content. (commit)
- Added current weekday information to conversation context. (#8669)
- Configuration files are now saved atomically, reducing the chance of corruption during interrupted writes. (#8793)
- Added GitHub proxy
gh.dpik.topand removed the invalidgh.llkk.ccproxy. (#8772, #8761)
Bug Fixes
- Fixed missing
self_idrouting parameters across multiple aiocqhttp platform adapter and message event API calls. (#8779) - Fixed generated platform IDs potentially containing whitespace characters. (#8768)
- Fixed Gemini Provider tool definitions not being passed back to the model correctly, which could cause repeated tool calls. (#8833)
- Fixed provider source ID edits being silently restored after saving. (#8915)
- Fixed ownership checks when toggling plugin LLM tools to prevent accidental changes to other plugins' tool settings. (commit)
- Improved plugin naming pattern validation and edge-case handling. (commit)
- Fixed repository source information being lost after reinstalling plugins. (commit)
- Fixed inconsistent
handler_module_pathvalues for tools inside subdirectories. (#8578) - Fixed run-based tool protection so protected tools are not incorrectly dropped during registration. (#8790)
- Fixed system tools being removed when persona tool lists are configured. (#8908)
- Fixed persona tool and Skill settings not taking effect after switching from selected items back to "use all by default". (#8835)
- Fixed compatibility with the renamed Streamable HTTP client in newer MCP versions while keeping the
mcpdependency below 2. - Fixed local Python tools not running inside the current session workspace. (#8792)
- Fixed the WebUI ready banner being shown even when static assets are missing. (#8804)
- Fixed Dashboard folder creation not being submitted when pressing Enter. (#8597)
- Fixed possible IME composition character loss when typing at a non-terminal cursor position in the chat input. (#8811)
- Fixed changelog anchor link handling in the Dashboard dialog. (#8750)
- Fixed onboarding platform configuration and backup upload issues. (#8834)
- Injected knowledge base context as temporary user content, fixing the role used for knowledge context in model requests. (#8904)
- Fixed cron weekday scheduling normalization. (#8984)
- Fixed At components being dropped when sending messages on the QQ Official platform. (#8983)
- Fixed duplicate captions for quoted images. (#8718)
- Fixed Embedding API version suffixes being truncated incorrectly. (#8736)
- Deferred FAISS C library imports to avoid startup hangs in some environments. (#8696)
- Disposed the database engine on shutdown to reduce resource leftovers in sessions and tests. (#8650)
- Fixed the CLI version source. (#8692)
- Fixed unnecessary data directory creation when executing the
astrbotcommand. (#8932) - Fixed the sdist build artifact path so the Dashboard artifact can be included. (#8933)
- Fixed plugin page asset token fallback. (#8970)
- Updated the
max_context_lengthanddequeue_context_lengthdefaults. - Stabilized FastAPI Dashboard route registration tests for included router nodes. (commit)
- Stabilized Dashboard route tests for the latest FastAPI behavior. (commit)
What's Changed
- fix: dispose database engine on shutdown by @KBVsent in #8650
- feat(core): show weekday in datetime prompt by @Sisyphbaous-DT-Project in #8669
- feat(dashboard): add per-tool permission management for function tools by @RC-CHN in #8693
- docs: fix LM Studio public IP typo by @liliiiliili in #8707
- fix: defer faiss C library import to prevent process hang on startup by @Blueteemo in #8696
- fix: preserve repo source on plugin reinstall by @HIUEETR in #8675
- chore(deps): bump codecov/codecov-action from 6 to 7 in the github-actions group by @dependabot[bot] in #8687
- fix(dashboard): allow creating folder by pressing Enter by @micaiguai in #8597
- feat: add ElevenLabs TTS API provider by @jayzen33 in #8680
- style: apply pyupgrade updates by @yzy123908944141 in #8684
- feat: backup skills directory by @lingyun14beta in #8700
- feat: show quoted message content in group chat context by @ScarletPupil in #8634
- fix: handle changelog anchor links by @he-yufeng in #8750
- fix: preserve embedding api version suffixes by @he-yufeng in #8736
- fix: avoid duplicate quoted image captions by @he-yufeng in #8718
- Fix CLI version source by @Rat0323 in #8692
- feat(ci): allow conventional PR title prefixes by @SunmiJJW in #8665
- feat(dashboard): add a configurable theme mode with light, dark, and system options and centralize theme synchronization with system preferences. by @lingyun14beta in #8648
- perf(cli): optimize plugin list building performance and robustness while adding coverage for key merge and edge-case scenarios by @SeRazon in #8705
- fix: consistent handler_module_path for subdirectory tools by @muhamedfazalps in #8679
- fix: unify media reference handling by @Soulter in #8764
- fix(proxy): drop invalid proxy gh.llkk.cc by @th-dd in #8761
- fix: sanitize Lark platform id suffixes by @he-yufeng in #8768
- feat(proxy): add gh proxy link gh.dpik.top by @th-dd in #8772
- refactor(core): migrate backend backbone from Quart to FastAPI and introduce more OpenAPI by @Soulter in #8688
- fix: updates the aiocqhttp platform adapter and message event handler to include self_id routing parameters across multiple API calls by @exynos967 in #8779
- feat(components): override repr_args to truncate long base64 fields for safe logging by @KBVsent in #8591
- fix: preserve guarded run-based tools by @zouyonghe in #8790
- fix: run local python in session workspace by @zouyonghe in #8792
- fix: write config files atomically by @zouyonghe in #8793
- fix: avoid WebUI ready banner when assets missing by @Soulter in #8804
- fix: make project update flow atomic by @Soulter in #8805
- feat: reorganize settings system configuration by @Soulter in #8777
- chore(deps): bump pnpm/action-setup from 6.0.8 to 6.0.9 in the github-actions group by @dependabot[bot] in #8808
- chore: reduce pyright type errors by @Dt8333 in #8197
- refactor: delegate star tool event creation to platforms by @Soulter in #8813
- fix(chat): prevent IME composition character loss at non-terminal cur… by @Fronut in #8811
- fix: upload skills with generated multipart body by @Soulter in #8817
- feat: add qq official qr binding by @Soulter in #8821
- feat: add startup reset password flag by @Soulter in #8826
- fix(gemini): tool definition does not pass back to gemini properly, causing repeated tool calls. by @Soulter in #8833
- fix: repair onboarding platform and backup upload by @Soulter in #8834
- fix: preserve persona default tool selection by @Soulter in #8835
- Change faiss-cpu version baseline from 1.12.0 to 1.14.3. by @404MaximWang in #8837
- feat(qqofficial): Add support for QQ Official GROUP_MESSAGE_CREATE events by @letr007 in #8838
- feat(qqofficial): allow QQ Official Webhook adapters to proactively send group messages without requiring a cached msg_id by @Soulter in #8841
- fix: harden sandbox file transfers by @zouyonghe in #8840
- fix: recover interrupted dashboard upgrades by @Soulter in #8846
- Fix: persona edit duplicate ID validation by @Sisyphbaous-DT-Project in #8843
- fix: prefer v1 auth with legacy recovery fallback by @Soulter in #8847
- fix: restore OpenAPI file uploads by @Soulter in #8851
- fix(core): enforce persona tool boundaries by @he-yufeng in #8786
- docs: clarify OpenAPI chat username identity by @Soulter in #8880
- fix: enforce future task owner checks by @Soulter in #8881
- fix(core): reject hardlinked files in restricted local fs tools by @Soulter in #8883
- feat: support workspace skills in requests by @Soulter in #8884
- feat: add hosted core package downloads by @Soulter in #8888
- fix: support renamed MCP streamable HTTP client by @Soulter in #8892
- feat: implement request retry mechanism for provider requests by @Soulter in #8893
- chore: add release preparation workflow by @Soulter in #8891
- chore: bump version to 4.26.0-beta.9 by @Soulter in #8895
- fix: restore webui 401 login redirect by @Soulter in #8903
- fix: keep WebUI assets in sync with core version by @Soulter in #8901
- perf(knowledge-base): inject knowledge base results as temporary user content to improve cache rate by @lxfight in #8904
- chore: bump version to 4.26.0-beta.10 by @Soulter in #8905
- fix: keep system tools with persona tool lists by @Soulter in #8908
- docs: 文档更新 - 指令、FAQ、网页搜索、插件发布等 by @NayukiChiba in #8912
- fix: restore static runtime version by @Soulter in #8925
- chore: bump version to 4.26.0-beta.11 by @Soulter in #8927
- fix: 修复提供商源修改 ID 后保存被静默还原的问题 by @lingyun14beta in #8915
- fix: created unnecessary data dir when executing astrbot command by @Soulter in #8932
- fix: add sdist build artifact path to allow dashboard artifact to be included by @Soulter in #8933
- chore: bump version to 4.26.0-beta.12 by @Soulter in #8934
- fix: remove redundant font family from stylesheet link by @Soulter in #8942
- feat(websearch): add Exa as a web search provider by @10ishq in #8973
- fix: prevent path traversal vulnerability in knowledge base upload filenames by @VectorPeak in #8971
- fix: prevent path traversal vulnerability in plugin upload filenames by @VectorPeak in #8968
- fix: normalize cron weekday scheduling by @Soulter in #8984
- fix: add data scope to api keys by @Soulter in #8985
- feat: show public version details on login by @Soulter in #8986
- docs: Updated Documentation on Password Reset by @CooperWang0912 in #8987
- chore(deps): bump actions/checkout from 6 to 7 in the github-actions group by @dependabot[bot] in #8963
- fix: allow plugin page asset token fallback by @FuShang114 in #8970
- fix: preserve At components when sending messages on qq_official plat… by @Zzzzzzouhang in #8983
- fix: reconnect MCP client on terminated session by @EterUltimate in #8694
- chore: revert "fix: reconnect MCP client on terminated session" by @Soulter in #8991
- chore: bump version to 4.26.0 by @Soulter in #8994
New Contributors
- @liliiiliili made their first contribution in #8707
- @HIUEETR made their first contribution in #8675
- @micaiguai made their first contribution in #8597
- @jayzen33 made their first contribution in #8680
- @yzy123908944141 made their first contribution in #8684
- @ScarletPupil made their first contribution in #8634
- @SunmiJJW made their first contribution in #8665
- @SeRazon made their first contribution in #8705
- @muhamedfazalps made their first contribution in #8679
- @th-dd made their first contribution in #8761
- @404MaximWang made their first contribution in #8837
- @10ishq made their first contribution in #8973
- @VectorPeak made their first contribution in #8971
- @CooperWang0912 made their first contribution in #8987
- @FuShang114 made their first contribution in #8970
- @Zzzzzzouhang made their first contribution in #8983
Full Changelog: v4.25.5...v4.26.0
What's Changed
- fix: dispose database engine on shutdown by @KBVsent in #8650
- feat(core): show weekday in datetime prompt by @Sisyphbaous-DT-Project in #8669
- feat(dashboard): add per-tool permission management for function tools by @RC-CHN in #8693
- docs: fix LM Studio public IP typo by @liliiiliili in #8707
- fix: defer faiss C library import to prevent process hang on startup by @Blueteemo in #8696
- fix: preserve repo source on plugin reinstall by @HIUEETR in #8675
- chore(deps): bump codecov/codecov-action from 6 to 7 in the github-actions group by @dependabot[bot] in #8687
- fix(dashboard): allow creating folder by pressing Enter by @micaiguai in #8597
- feat: add ElevenLabs TTS API provider by @jayzen33 in #8680
- style: apply pyupgrade updates by @yzy123908944141 in #8684
- feat: backup skills directory by @lingyun14beta in #8700
- feat: show quoted message content in group chat context by @ScarletPupil in #8634
- fix: handle changelog anchor links by @he-yufeng in #8750
- fix: preserve embedding api version suffixes by @he-yufeng in #8736
- fix: avoid duplicate quoted image captions by @he-yufeng in #8718
- Fix CLI version source by @Rat0323 in #8692
- feat(ci): allow conventional PR title prefixes by @SunmiJJW in #8665
- feat(dashboard): add a configurable theme mode with light, dark, and system options and centralize theme synchronization with system preferences. by @lingyun14beta in #8648
- perf(cli): optimize plugin list building performance and robustness while adding coverage for key merge and edge-case scenarios by @SeRazon in #8705
- fix: consistent handler_module_path for subdirectory tools by @muhamedfazalps in #8679
- fix: unify media reference handling by @Soulter in #8764
- fix(proxy): drop invalid proxy gh.llkk.cc by @th-dd in #8761
- fix: sanitize Lark platform id suffixes by @he-yufeng in #8768
- feat(proxy): add gh proxy link gh.dpik.top by @th-dd in #8772
- refactor(core): migrate backend backbone from Quart to FastAPI and introduce more OpenAPI by @Soulter in #8688
- fix: updates the aiocqhttp platform adapter and message event handler to include self_id routing parameters across multiple API calls by @exynos967 in #8779
- feat(components): override repr_args to truncate long base64 fields for safe logging by @KBVsent in #8591
- fix: preserve guarded run-based tools by @zouyonghe in #8790
- fix: run local python in session workspace by @zouyonghe in #8792
- fix: write config files atomically by @zouyonghe in #8793
- fix: avoid WebUI ready banner when assets missing by @Soulter in #8804
- fix: make project update flow atomic by @Soulter in #8805
- feat: reorganize settings system configuration by @Soulter in #8777
- chore(deps): bump pnpm/action-setup from 6.0.8 to 6.0.9 in the github-actions group by @dependabot[bot] in #8808
- chore: reduce pyright type errors by @Dt8333 in #8197
- refactor: delegate star tool event creation to platforms by @Soulter in #8813
- fix(chat): prevent IME composition character loss at non-terminal cur… by @Fronut in #8811
- fix: upload skills with generated multipart body by @Soulter in #8817
- feat: add qq official qr binding by @Soulter in #8821
- feat: add startup reset password flag by @Soulter in #8826
- fix(gemini): tool definition does not pass back to gemini properly, causing repeated tool calls. by @Soulter in #8833
- fix: repair onboarding platform and backup upload by @Soulter in #8834
- fix: preserve persona default tool selection by @Soulter in #8835
- Change faiss-cpu version baseline from 1.12.0 to 1.14.3. by @404MaximWang in #8837
- feat(qqofficial): Add support for QQ Official GROUP_MESSAGE_CREATE events by @letr007 in #8838
- feat(qqofficial): allow QQ Official Webhook adapters to proactively send group messages without requiring a cached msg_id by @Soulter in #8841
- fix: harden sandbox file transfers by @zouyonghe in #8840
- fix: recover interrupted dashboard upgrades by @Soulter in #8846
- Fix: persona edit duplicate ID validation by @Sisyphbaous-DT-Project in #8843
- fix: prefer v1 auth with legacy recovery fallback by @Soulter in #8847
- fix: restore OpenAPI file uploads by @Soulter in #8851
- fix(core): enforce persona tool boundaries by @he-yufeng in #8786
- docs: clarify OpenAPI chat username identity by @Soulter in #8880
- fix: enforce future task owner checks by @Soulter in #8881
- fix(core): reject hardlinked files in restricted local fs tools by @Soulter in #8883
- feat: support workspace skills in requests by @Soulter in #8884
- feat: add hosted core package downloads by @Soulter in #8888
- fix: support renamed MCP streamable HTTP client by @Soulter in #8892
- feat: implement request retry mechanism for provider requests by @Soulter in #8893
- chore: add release preparation workflow by @Soulter in #8891
- chore: bump version to 4.26.0-beta.9 by @Soulter in #8895
- fix: restore webui 401 login redirect by @Soulter in #8903
- fix: keep WebUI assets in sync with core version by @Soulter in #8901
- perf(knowledge-base): inject knowledge base results as temporary user content to improve cache rate by @lxfight in #8904
- chore: bump version to 4.26.0-beta.10 by @Soulter in #8905
- fix: keep system tools with persona tool lists by @Soulter in #8908
- docs: 文档更新 - 指令、FAQ、网页搜索、插件发布等 by @NayukiChiba in #8912
- fix: restore static runtime version by @Soulter in #8925
- chore: bump version to 4.26.0-beta.11 by @Soulter in #8927
- fix: 修复提供商源修改 ID 后保存被静默还原的问题 by @lingyun14beta in #8915
- fix: created unnecessary data dir when executing astrbot command by @Soulter in #8932
- fix: add sdist build artifact path to allow dashboard artifact to be included by @Soulter in #8933
- chore: bump version to 4.26.0-beta.12 by @Soulter in #8934
- fix: remove redundant font family from stylesheet link by @Soulter in #8942
- feat(websearch): add Exa as a web search provider by @10ishq in #8973
- fix: prevent path traversal vulnerability in knowledge base upload filenames by @VectorPeak in #8971
- fix: prevent path traversal vulnerability in plugin upload filenames by @VectorPeak in #8968
- fix: normalize cron weekday scheduling by @Soulter in #8984
- fix: add data scope to api keys by @Soulter in #8985
- feat: show public version details on login by @Soulter in #8986
- docs: Updated Documentation on Password Reset by @CooperWang0912 in #8987
- chore(deps): bump actions/checkout from 6 to 7 in the github-actions group by @dependabot[bot] in #8963
- fix: allow plugin page asset token fallback by @FuShang114 in #8970
- fix: preserve At components when sending messages on qq_official plat… by @Zzzzzzouhang in #8983
- fix: reconnect MCP client on terminated session by @EterUltimate in #8694
- chore: revert "fix: reconnect MCP client on terminated session" by @Soulter in #8991
- chore: bump version to 4.26.0 by @Soulter in #8994
New Contributors
- @liliiiliili made their first contribution in #8707
- @HIUEETR made their first contribution in #8675
- @micaiguai made their first contribution in #8597
- @jayzen33 made their first contribution in #8680
- @yzy123908944141 made their first contribution in #8684
- @ScarletPupil made their first contribution in #8634
- @SunmiJJW made their first contribution in #8665
- @SeRazon made their first contribution in #8705
- @muhamedfazalps made their first contribution in #8679
- @th-dd made their first contribution in #8761
- @404MaximWang made their first contribution in #8837
- @10ishq made their first contribution in #8973
- @VectorPeak made their first contribution in #8971
- @CooperWang0912 made their first contribution in #8987
- @FuShang114 made their first contribution in #8970
- @Zzzzzzouhang made their first contribution in #8983
Full Changelog: v4.25.6...v4.26.0