This release adds LaTeX rendering and a startup banner to the TUI, introduces a configurable request size limit for the API server, and includes security fixes for session working directory path traversal.
What's New
- Adds LaTeX-to-Unicode rendering for inline and display math in TUI markdown
- Adds a startup banner to the normal TUI, shown as a centered empty state when no welcome message is configured
- Adds a configurable
--max-request-sizeflag toserve api, allowing the HTTP request size limit to be adjusted (default remains 1 MiB; requests exceeding the limit return HTTP 413) - Adds concurrency-safe, namespaced string attributes to sessions, persisted in SQLite and preserved across JSON round trips, metadata updates, clones, branches, and derived sessions
Bug Fixes
- Fixes path traversal vulnerability in API session working directories by rejecting traversal, sibling-directory, and symlink escapes when a
--session-workingdir-rootboundary is configured - Fixes startup banner display in small viewports by hiding it when the viewport is too small
- Fixes startup banner ordering to appear before startup info
- Fixes TUI markdown rendering to preserve content after unclosed math expressions
- Fixes TUI matrix rendering to display columns without separators
- Updates gopher example files to reference
gemini-3.1-pro-previewaftergemini-3-pro-previewwas removed from the model catalog
Technical Changes
- Migrates Docker Hub push jobs in CI from PAT-based login to short-lived OIDC tokens
- Uses TypeScript types for codemode
What's Changed
- docs: update CHANGELOG.md for v1.123.0 by @docker-read-write[bot] in #3931
- ci: migrate Hub logins to OIDC by @ronan-thibaut-glitch in #3932
- feat(tui): render LaTeX in markdown by @rumpl in #3950
- feat: add startup banner to normal TUI by @rumpl in #3949
- docs: auto-update for merged PRs (2026-08-07) by @aheritier in #3953
- Use typescript types for codemode by @rumpl in #3956
- feat: persist generic session attributes by @rumpl in #3958
- chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in the go_modules group across 1 directory by @dependabot[bot] in #3954
- fix(server): contain API session working directories by @Sayt-0 in #3916
- feat(api): add configurable --max-request-size flag to serve api by @aheritier in #3938
- fix: update gopher examples to gemini-3.1-pro-preview (model removed from catalog) by @aheritier in #3961
- docs: clarify request-size limits and large input strategies by @aheritier in #3963
Full Changelog: v1.123.0...v1.124.0