danny-avila/LibreChat v0.8.6 on GitHub

https://www.librechat.ai/changelog/v0.8.6

🏞️ Highlights

Agent Skills & Subagents
- Agent Skills package reusable instructions, references, scripts, assets, and permissions into portable capabilities that agents can invoke automatically or on request.
- Subagents let agents delegate specialized work to other agents while preserving upload, user, and MCP context with recursion and graph limits.
Code Execution & Artifacts
- Text, source-code, DOCX, CSV, XLSX, and PPTX artifacts can render inline or in the side panel with richer previews.
- Artifact editing, Gemini PDF media blocks, model-spec icons, and persistent agent resource files received reliability fixes.
Observability & Operations
- Added Prometheus metrics, backend OpenTelemetry tracing, SSE lifecycle tracing, HyperDX browser RUM, structured logging context, explicit readiness endpoints, file-log controls, and graceful HTTP shutdown.
MCP, Auth, and Admin Hardening
- Improved MCP remote proxy support, OAuth audience handling, JWT expiry fallback, optional OpenID/MCP client-secret flows, multi-audience OpenID validation, trusted registration overrides, admin-panel SSO redirects, streamable HTTP limits, and MCP permission enforcement for agent tools.
Provider and Model Updates
- Added Claude Opus 4.8 support, Gemini 3.5 Flash support, Gemini tool combinations, Gemma 4 thinking-level support, model-aware Google/Gemini max output tokens, Bedrock AWS profile/API key support, and Bedrock guardrail handling.
Reliability and UI Polish
- Hardened retention semantics, user/config response sanitization, configured rich-text rendering, Redis/in-memory generation cleanup, all-data retention for agent files, MCP title rendering, sidebar/chat race handling, hover actions, shared links, generated file chips, and balance script config loading.

Click to expand Release Notes

For detailed changes in the release candidate, see:

v0.8.6-rc1

Changes Since v0.8.6-rc1

✨ Features

🚧 feat: Support Guardrail Config Option streamProcessingMode by @dlew in #12815
📈 feat: Add Prometheus Metrics Endpoint + AWS Credential Providers by @danny-avila in #13111
🧾 feat: Add Structured Logging Context by @danny-avila in #13110
🛡️ feat: Bedrock Guardrail Config Environment Variable Resolution by @entropic489 in #11717
📡 feat: Add Backend OpenTelemetry Tracing by @danny-avila in #12909
🏷️ feat: Hide Model Spec Badge Rows by @danny-avila in #13124
👟 feat: Enable Eager Execution of Tool Calls by @danny-avila in #13192
🍪 feat: Add Session Cookie Secure Override by @danny-avila in #13189
🪂 feat: Graceful HTTP shutdown on SIGTERM/SIGINT by @pjhampton in #13211
🩺 feat: Add Explicit Readiness Endpoints by @danny-avila in #13212
🗂️ feat: Allow Disabling File Log Transports by @danny-avila in #13215
⚡ feat: Add Gemini 3.5 Flash Support by @danny-avila in #13231
🛣️ feat: Add MCP Remote Proxy Support by @danny-avila in #13076
⚖️ feat: Add Operational Prometheus Metrics by @danny-avila in #13265
🖲️ feat: Trace SSE Stream Lifecycle with OTel by @upman in #13266
📜 feat: Add Explicit new Skill Route from Agent Builder by @sand116 in #13119
🆔 feat: Built-in Build Metadata for Support Triage by @danny-avila in #12756
🛂 feat: Add AWS Profile Support for Bedrock Credentials by @iElsha in #10504
🪙 feat: Add AWS Bedrock API key support by @dustinhealy in #8690
🛰️ feat: Support Gemini Tool Combinations by @danny-avila in #13273
🧠 feat: Add Claude Opus 4.8 Support by @danny-avila in #13380
♊ feat: Model-Aware Max Output Tokens for Google/Gemini by @danny-avila in #13390
📡 feat: Add Configurable HyperDX Browser Real User Monitoring by @upman in #13287
🪪 feat: Accept Multiple OpenID JWT Audiences by @danny-avila in #13404
🪪 feat: MCP OAuth - Support audience parameter for Auth0/Cognito-style providers by @Freudator86 in #13402
💠 feat: Extend thinkingLevel Support to Gemma 4 Models by @King-of-Infinite-Space in #13088

🐛 Fixes

🧰 fix: Scope MCP Registry Initialization To Config Fingerprints by @danny-avila in #13115
🧹 fix: Reset Redis Reorder State After Last Unsubscribe by @sand116 in #13117
🏷️ fix: Harden Helm Chart Tag Parsing by @danny-avila in #13123
🛡️ fix: Sanitize Agent List Skill Scope by @danny-avila in #13122
🗝️ fix: Protect Model Spec Instructions by @danny-avila in #13125
🪵 fix: Restore Winston Format Factory Shape In Test Mocks by @JorgeCosta87 in #13139
🛡️ fix: Escape People Picker Search Regex by @danny-avila in #13169
🤝 fix: Honor OPENID_REUSE_TOKENS in Admin OAuth Exchange by @jangByeongHui in #13154
🪪 fix: Resolve Group-Scoped Config Overrides by @danny-avila in #13176
🧽 fix: Strip Admin OAuth Redirect Params by @danny-avila in #13181
🔍 fix: Prefer LibreChat Web Search over Anthropic's when Both Selected by @danny-avila in #13166
🗂️ fix: Scope Handoff Agent Context Docs by @danny-avila in #13167
🪪 fix: Scope Message Conversation Access by @danny-avila in #13183
🧭 fix: Reduce MCP Registry ACL Lookups by @danny-avila in #13195
⛴️ fix: Stop Double-Wrapping configYamlContent in Helm ConfigMap by @vdittgen in #13198
📡 fix: Handle Pre-Session 406 for Optional SSE MCP Stream by @pnancarrow in #13202
🧯 fix: Harden Data Retention Semantics by @danny-avila in #13049
🪪 fix: Add Admin Panel SSO URL Config by @danny-avila in #13220
🦣 fix: Response Size Limits for Streamable HTTP MCP Responses by @danny-avila in #13219
🏃 fix: Improve OpenID Lookup Planning by @danny-avila in #13229
🧩 fix: Support DocumentDB Prompt Group Lookup by @danny-avila in #13232
📡 fix: Respect Custom Endpoint Stream Usage Opt-In by @danny-avila in #13237
🍞 fix: don't show 'deleting file' toast on attached files by @dlew in #13239
🧵 fix: Preserve Streaming Messages During Stale Refetch by @danny-avila in #13247
🛡️ fix: Harden MCP OAuth Request Handling by @danny-avila in #13264
🪪 fix: Consolidate MCP OAuth Policy by @danny-avila in #13254
🪪 fix: Prevent MCP Server Name Collisions by @danny-avila in #13256
⌛ fix: Use JWT exp claim for MCP when OAuth token omits expires_in by @devanchohan in #13248
🪪 fix: Support OpenID PKCE Without Client Secret by @eleite93 in #12364
🪪 fix: Allow Optional client_secret for MCP OAuth by @aupuzikov in #12460
🛂 fix: Detect OAuth Errors From HTTP 400 Responses by @janluedemann-esome in #11961
🪬 fix: Skip MCP Tools When Required Custom User Vars Are Unset by @verifizieren in #13152
🪨 fix: Normalize Empty MCP Tool Descriptions to undefined for Bedrock Compat. by @serhiizghama in #13217
📡 fix: Tighten Streaming Message Cache Preservation by @danny-avila in #13271
🧷 fix: Harden MCP Proxy SSRF Checks by @danny-avila in #13274
🧱 fix: Validate Bedrock User Credentials by @danny-avila in #13277
🧷 fix: Pin MCP OAuth Client Secrets by @danny-avila in #13276
🏣 fix: Reject System Tenant In Auth Context by @danny-avila in #13278
🧾 fix: Validate Bedrock User Credentials by @danny-avila in #13279
🪟 fix: Apply Admin-Panel Config Overrides To YAML-Defined MCP Servers by @dustinhealy in #13173
🪡 fix: Prevent Hover Actions Flash While Streaming by @danny-avila in #13285
🧩 fix: Add REDIS_CLUSTER_SAFE_DELETE Flag for ElastiCache Serverless CROSSSLOT Errors by @serhiizghama in #13275
🧵 fix: Prevent Message Loading Race During Streaming by @danny-avila in #13295
⏭️ fix: Avoid False Resume Submission Stale Detection by @danny-avila in #13297
🧯 fix: Suppress Google Service Key Noise by @danny-avila in #13322
✂️ fix: Truncate Long MCP Server Titles In Builder Panel by @dustinhealy in #13321
📎 fix: Preserve Gemini PDF Media Blocks by @danny-avila in #13357
🛡️ fix: Harden Model Spec Icon Rendering by @danny-avila in #13356
🪡 fix: Artifact Edit Saves by @danny-avila in #13358
🛡️ fix: Cap Default Limit on Agent List Queries by @danny-avila in #13382
🪨 fix: Preserve Bedrock Guardrail Config by @danny-avila in #13381
⚓ fix: Skip Retention for Persistent Agent Resource Files by @maxesse in #13394
🧟 fix: Reap Hung In-Memory Generations for Redis Failsafe Parity by @danny-avila in #13396
🪃 fix: Retry MCP OAuth Token Refresh Without Scope on Server Rejection by @danny-avila in #13412
🖼️ fix: Preserve Model Spec Icon URLs by @danny-avila in #13370
🔑 fix: support 'userinfo' in OPENID_REQUIRED_ROLE_TOKEN_KIND by @pboers1988 in #13182
🪪 fix: Preserve Trusted Registration Provider Overrides by @danny-avila in #13307
💰 fix: Load app config in set-balance script to respect balance settings by @ucodia in #12669
📬 fix: Honor Admin-Panel allowedDomains Override at Registration by @nangelovv in #13204
🔒 fix: Strip post-login fields from unauthenticated /api/config response by @ChrisJr404 in #13102
🏟️ fix: Restrict MCP OAuth Audience in User-Managed Configs by @danny-avila in #13418
🛂 fix: Enforce MCP Permissions for Agent Tools by @danny-avila in #13174
🧼 fix: Sanitize User Response Fields by @danny-avila in #13421
🧼 fix: Harden Configured Rich Text Rendering by @danny-avila in #13423
🪪 fix: Use Shared IdP Avatar Processing by @danny-avila in #13422

🔧 Refactoring

📸 refactor: Refresh Shared Links With Latest Snapshot by @danny-avila in #13095
🗂️ refactor: Collapse Generated File Chips by @danny-avila in #13116
🛟 refactor: Gracefully Skip Unavailable Web Search Rerankers by @danny-avila in #13191
🗂️ refactor: Clarify Code Sandbox File Guidance by @danny-avila in #13236
🧬 refactor: Derive Latest Message From Cache by @danny-avila in #13294
⏱️ refactor: Optimistically Show New Chats In Sidebar by @danny-avila in #13298
🧠 refactor: Replay DeepSeek reasoning_content via OpenRouter by @danny-avila in #13368
📤 refactor: Align Mention Options With Model Selector by @danny-avila in #13397
🧠 refactor: Memoize MCP Permission Checks Per Request by @danny-avila in #13419
🗄️ refactor: Honor All-Data Retention for Agent Files by @danny-avila in #13424

🧪 Tests

🛟 test: Restore Playwright Smoke E2E by @danny-avila in #13020

📦 Dependencies, Chores & CI

🧹 chore: Type Agent MCP lean projection in ServerConfigsDB by @gaurav0107 in #13171
🛡️ chore: Harden CI Supply Chain Workflows by @danny-avila in #13090
🕵🏻 ci: Improve Flaky Subagents Test by @dustinhealy in #13185
📦 chore: npm audit fix, bump otel & @librechat/agents by @danny-avila in #13186
📦 chore: Bump @librechat/agents to v3.1.88 by @danny-avila in #13187
🧪 ci: Stabilize Virtualized Agent Grid Tests by @danny-avila in #13214
🧵 chore: Raise MCP SSE Line Default by @danny-avila in #13224
📦 chore: bump @librechat/agents to v3.1.90 and npm audit fix by @danny-avila in #13242
🚦 ci: Enforce ESLint on Package Changes by @danny-avila in #13280
🎨 chore: prettier --write all workspaces by @danny-avila in #13281
🎨 ci: Check Prettier Formatting Drift on Package Changes by @danny-avila in #13282
🪤 chore: Prevent CI Path Argument Injection by @danny-avila in #13284
🌐 chore: Guard Locize Reviewer Request by @danny-avila in #13286
📦 chore: bump @librechat/agents, qs, langfuse by @danny-avila in #13299
🐢 ci: Raise test-packages-api timeout to 20 min by @danny-avila in #13326
🧮 chore: Update Gemma Context Token Defaults by @danny-avila in #13410
✂️ chore: Strip Session JWT Forwarding from Browser RUM by @danny-avila in #13414
📦 chore: Bump @hyperdx/browser to v0.24.0 by @danny-avila in #13416
🔧 chore: Drop duplicate getAppConfig import in set-balance.js by @danny-avila in #13417

🌍 Internationalization

🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #13107
🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #13128
🌍 i18n: Update translation.json with latest translations by @danny-avila in #13230
🌍 i18n: Update translation.json with latest translations by @danny-avila in #13283
🌍 i18n: Update translation.json with latest translations by @danny-avila in #13291
🌍 i18n: Update translation.json with latest translations by @danny-avila in #13325

New Contributors

@entropic489 made their first contribution in #11717
@sand116 made their first contribution in #13117
@JorgeCosta87 made their first contribution in #13139
@jangByeongHui made their first contribution in #13154
@pjhampton made their first contribution in #13211
@devanchohan made their first contribution in #13248
@eleite93 made their first contribution in #12364
@aupuzikov made their first contribution in #12460
@janluedemann-esome made their first contribution in #11961
@verifizieren made their first contribution in #13152
@serhiizghama made their first contribution in #13217
@iElsha made their first contribution in #10504
@Freudator86 made their first contribution in #13402
@pboers1988 made their first contribution in #13182
@King-of-Infinite-Space made their first contribution in #13088
@nangelovv made their first contribution in #13204
@ChrisJr404 made their first contribution in #13102

Full Changelog: v0.8.6-rc1...v0.8.6