DeepTutor v1.5.0 Release Notes

Release Date: 2026.07.04

v1.5.0 closes out the entire v1.4 line and opens the next. Rather than a single-point delta, this note looks back across the whole arc from v1.4.0-beta to today — the release that turned DeepTutor into an agent-native, community-driven tutoring platform. Over these weeks the community sent 36 merged pull requests and helped us resolve 53 issues. Thank you — this release is as much yours as ours.

Highlights since v1.4.0

Partners, born from TutorBot. TutorBot grew into Partners: a production-grade IM pipeline across 15+ channels — Slack, Discord, Telegram, Feishu, WeCom, Zulip, Matrix (with optional E2EE), and a native Mattermost channel — with live streaming replies. You can connect your own Partners, or your local Claude Code / Codex, under My Agents and consult them live mid-chat; each Partner carries its own private memory and its conversations can branch, resume, and replay.
One agentic chat engine. Chat was rebuilt on a single agent loop with native tool calling on every OpenAI-compatible cloud provider (and SiliconFlow, MiniMax M3, Qwen, Gemini 2.5+), smooth streaming, and an honest activity header.
A real Knowledge Center. Multiple retrieval engines — LlamaIndex + a FAISS vector backend, LightRAG (local and standalone-server), GraphRAG, PageIndex, and linked / Obsidian knowledge bases — behind one console, on a pluggable document-parse layer (text-only, MinerU, Docling, markitdown, PyMuPDF4LLM). Large-KB retrieval got dramatically faster.
Guided Learning & Mastery Path. Rebuilt on the chat loop with a per-type mastery gate, a /learning dashboard, LaTeX-rendered quizzes, and graded questions that flow into your Question Bank.
Multi-user, done properly. Real per-user isolation, admin grants, a redesigned User Management page, a self-service Profile page with avatars, deny-by-default MCP tools, and per-user session isolation.
Deployment hardening. Rootless-Podman / read-only-rootfs support, a single-port request-time proxy, env-configurable host binding, and a portable supervisord config.
Security lockdown. The Partner/TutorBot tool sandbox was locked down and a cluster of authorization-bypass, path-traversal, and RCE reports were fixed (see below).
Three-layer Memory & richer surfaces. A top-level Memory workbench (L1/L2/L3) with Partner conversations bridged in, plus continued work on Deep Research, Solve, Visualize (Animator merged in), and Co-Writer.

In v1.5.0 specifically: the default LlamaIndex engine now routes ingestion through the shared document-parse layer (so it honors your chosen parsing engine and indexes extracted images as multimodal nodes), Partner and Soul ids are ASCII/URL-safe so non-Latin names stay reachable, and the optional graphrag / rag-lightrag extras install cleanly on Python 3.14+ (issues #606, and the fixes below).

Merged pull requests

With gratitude to everyone who sent code:

#484 — Zulip: content-detection fallback so bots receive @-mentions — @wedone
#485 — Make require_auth async so the user ContextVar reaches the endpoint — @truffle-dev
#490 — Unblock Gemini 2.5+ and harden the Visualize pipeline — @skinred78
#493 — Fix SQLite file-descriptor exhaustion — @thelooter
#500 — Guided Learning feature work — @arlenwoox
#507 — Harden ExecTool defaults against command injection (#506) — @kagura-agent
#508 — Fix the GPT-5 token-limit parameter in the init-wizard probe — @lezhimiffyliu
#509 — Prevent Document nodes from bypassing the chunking pipeline — @washi4
#513 — Add a Profile button when no profiles exist — @wedone
#524 — Truncate oversized event payloads in the session response — @xiongjnu
#528 — Native tool calling for reasoning models on OpenAI-compatible endpoints — @wedone
#529 — Qwen JSON preamble, force-recompile overview pages, health false positives — @alvinets
#540 — Preserve math before citation linkification — @thakrarsagar
#542 — Route the OAuth backend through the native provider — @thakrarsagar
#543 — Upgrade the MiniMax default model to M3 — @octo-patch
#549 — Keep NEXT_PUBLIC_AUTH_ENABLED out of the minifier constant-fold — @IliaAvdeev
#550 — Keep sidebar footer items as text when the sidebar is collapsed — @IliaAvdeev
#558 — Surface bad-login errors inline instead of a silent reload — @IliaAvdeev
#559 — Accept a username, not just an email, on login and register — @IliaAvdeev
#568 — Gate LLM features for users without an assigned model — @IliaAvdeev
#570 — Show only provider-relevant fields in Search settings — @IliaAvdeev
#571 — Discoverable profile rename and auto-name by provider — @IliaAvdeev
#572 — Translate the missing English settings-tour steps — @IliaAvdeev
#573 — User profile page with avatar — @IliaAvdeev
#577 — Harden the image for rootless Podman with a read-only rootfs — @enihcam
#578 — Chat-history loading animation — @emmett001
#579 — Deny MCP tools until explicitly granted (multi-user) — @Hinotoi-agent
#582 — Run supervisord as root so services start under rootful Docker — @IliaAvdeev
#583 — Redesign the User Management page (avatars, search, skeletons, confirm dialog) — @IliaAvdeev
#584 — Enable native tool calls for SiliconFlow — @TyrionH-is-coding
#585 — Move the Back link to its own row in the page header — @IliaAvdeev
#586 — Make BACKEND_HOST and FRONTEND_HOST env-configurable — @enihcam
#588 — Render LaTeX in quiz options — @ZhouJ-sh
#593 — Portable supervisord config across rootful + rootless keep-id — @enihcam
#602 — Preserve a configured zero LlamaIndex chunk overlap — @VectorPeak
#604 — Fix mastery choice persistence and grading — @spring618

Resolved issues

🔒 Security & isolation

#506 — ExecTool executed LLM-generated shell commands over the chat WebSocket
#514 — Authorization bypass in the book-confirmation flow
#515 — Cross-session authorization bypass in turn regeneration
#516 — Cross-bot authorization bypass in TutorBot file management
#517 — Path traversal in the TutorBot filesystem tool
#518 — Remote code execution via the TutorBot shell tool
#596 — Sessions were not isolated by user

🐛 Bug fixes

#301 — Guided Learning not working with LM Studio (Docker)
#472 — Co-Writer responses came back extremely short
#481 — Non-admin users hit 404 on all session requests (Docker multi-user)
#487 — A new quiz inherited the previous quiz's answer state
#489 — Visualize and other capabilities silently truncated on Gemini 2.5 / 3.x
#494 — knowledge_learning router not registered in main.py
#495 — Knowledge extractor JSON-parsing error with DeepSeek
#496 — LearningSession had no metadata field, so agents got empty context
#497 — KnowledgePoint validation rejected LLM-extracted data
#502 — Docker sed placeholder broke API base-URL validation with a non-default port
#503 — Unable to communicate with v1.4.0-beta
#504 — Settings-load failure and zombie running turns after container restart (Docker)
#512 — New user could not create an initial profile via the UI (Docker)
#520 — Chat input disabled after the first turn; hardcoded URL guard broke deployments
#521 — Errors while embedding some knowledge-base documents
#527 — Qwen 3.6 Plus failed to use native tool calling
#530 — self-signed-certificate error despite disable_ssl_verify: true
#531 — allow_shell_exec silently reset to false on every auto-start
#534 — allow_shell_exec could not be persisted
#536 — Container appeared to crash after idle time
#537 — Responses were incoherent
#574 — Partner conversations never reached the Memory system (empty L1)
#580 — supervisord pidfile CRIT on rootless Podman + keep-id + read-only rootfs
#587 — Quiz option cards did not render LaTeX formulas
#594 — Choosing PyMuPDF4LLM as the parser was overridden by MinerU when building a LightRAG KB
#595 — Deep Research returned a success response even when a block failed
#599 — Wrong top-left logo/icon after login in multi-user mode
#603 — Guided Learning choice options were lost and correct answers could be mis-graded
#605 — v1.4.15 could not be installed with uv

✨ Features & requests

#511 — HTTP API for multi-turn conversations with a specific TutorBot
#553 — User profile page (account + avatar) and a lighter Admin page
#555 — Moodle support
#569 — Feature request
#576 — Rootless Podman with a read-only rootfs for hardened deployments
#589 — PyMuPDF4LLM for building knowledge bases
#590 — Native Mattermost channel for the Partner subsystem
#591 — Support for a standalone external LightRAG container endpoint

💬 Questions & discussions

#476 — Does adding a doc to a knowledge base have quadratic complexity?
#505 — How to register a provider on v1.4.0
#532 — RAG chat could not return information from the selected knowledge base
#535 — Can TutorBot do almost everything the main system does, via skills?
#552 — RAG chat on a 250 MB knowledge base returned nothing
#565 — Question
#592 — Should DeepTutor become installable apps?
#597 — Does a Partner have its own memory?
#598 — Can non-admin users use and create Partners in multi-user mode?

Upgrade Notes

Drop-in from any v1.4.x: pip install -U deeptutor; Docker users pull ghcr.io/hkuds/deeptutor:latest. No migrations — existing knowledge bases, partners, souls, and mastery paths keep working as-is. Two things to know:

LlamaIndex re-indexing now extracts through the engine you pick in Settings → Document Parsing, not the old text-only path. Existing indexes are untouched; only a re-index picks up the new engine. If a document doesn't extract, confirm the active engine supports that format (keep it on text-only for the previous behavior).
Non-Latin partner/soul ids only change for newly created entities — anything already on disk keeps its current id.

Thanks

DeepTutor v1.5.0 is the work of a growing community. Special thanks to everyone who opened an issue, filed a report, or sent a pull request — and in particular to our contributors this cycle: @wedone, @truffle-dev, @skinred78, @thelooter, @arlenwoox, @kagura-agent, @lezhimiffyliu, @washi4, @xiongjnu, @alvinets, @thakrarsagar, @octo-patch, @IliaAvdeev, @enihcam, @emmett001, @Hinotoi-agent, @TyrionH-is-coding, @ZhouJ-sh, @VectorPeak, and @spring618. Read the docs at deeptutor.info.

Full Changelog: v1.4.0-beta...v1.5.0

HKUDS/DeepTutor v1.5.0 on GitHub