onyx-dot-app/onyx v4.9.0 on GitHub

Warning

Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. See additional documentation here.

See the assets to download this version and install.

What's Changed

chore(opal): build with tsdown and TypeScript 7 by @jmelahman in #14776
test(ods): raise ods test coverage to 90% by @jmelahman in #14771
fix(llm): send output_config effort on Claude 5 turns after a tool call [mirror of #14062 for edits] by @nmgarza5 in #14812
ci: raise the arm64 model-server build volume to 60gb by @justin-tahara in #14834
ci(go): cache Go build and test results across runs by @jmelahman in #14836
fix(connectors): share Teams channels with their members, not the tenant by @nmgarza5 in #14840
fix(files): validate file references at access boundaries by @justin-tahara in #14824
fix(oauth): validate endpoints and bind callbacks to their owner by @justin-tahara in #14831
fix(users): restrict test provisioning and scoped directory fields by @justin-tahara in #14819
fix(gateway): meter disconnected streams and restrict shared references by @justin-tahara in #14826
fix(llm): honor reasoning off on adaptive-thinking Claude models by @nmgarza5 in #14839
fix(tools): encode request parameters and bound search waits by @justin-tahara in #14813
fix(search): filter tag suggestions by document access by @justin-tahara in #14818
feat(connectors): index Teams threads per message and checkpoint per channel page by @nmgarza5 in #14842
fix(connectors): cap downloads and protect temporary credentials by @justin-tahara in #14821
fix(permissions): count oversized ACLs as sync errors by @justin-tahara in #14811
feat(tools): an empty source selection searches nothing by @raunakab in #14820
fix(clients): protect navigation and sensitive request data by @justin-tahara in #14833
fix(llm): send explicit reasoning none for OpenAI models that support it by @rohoswagger in #14810
fix(connectors): restore file connector access for group managers by @Subash-Mohan in #14767
feat(chat): add experimental search receipts to internal search responses by @rohoswagger in #14849
fix(logging): keep request secrets and internal traces private by @justin-tahara in #14823
docs(hierarchy): explain unfiltered MIT connector visibility by @justin-tahara in #14815
ci(preview): build previews for pull requests, not every branch push by @justin-tahara in #14852
refactor(cli): order struct fields to remove padding by @jmelahman in #14872
refactor(terraform): order struct fields for tight memory alignment by @jmelahman in #14873
refactor(ods): order struct fields for tight memory layout by @jmelahman in #14874
feat(web): chat-scoped search filters, orthogonal to the tool trinary by @raunakab in #14846
fix(web): point the Coda connector docs link at a page that exists by @justin-tahara in #14876
fix(web): tools popover polish by @raunakab in #14850
fix(auth): tenant-aware websocket auth; fixes craft HMR preview on multi-tenant by @wenxi-onyx in #14875
fix(auth): stop pinning a DB connection for the whole streaming response by @wenxi-onyx in #14871
feat(connectors): index files posted in Teams channels behind an attachments option by @nmgarza5 in #14851
chore(deps): bump anyio to 4.14.2 for GHSA-82r6-8w77-94w6 by @wenxi-onyx in #14889
fix(lint): apply ruff dict.fromkeys autofixes in zoom connector by @wenxi-onyx in #14890
chore: rm jmelahman mentions by @jmelahman in #14897
feat(admin): add a copy button to the reset password modal by @justin-tahara in #14892
fix(slack): close socket clients for deleted Slack bots by @nmgarza5 in #14886
test(connectors): pick the Outlook fixture meeting by subject by @nmgarza5 in #14896
fix(tenants): scope index scans and cache tier lookup misses by @justin-tahara in #14827
chore(dev): upgrade onyx-devtools to 0.13.8 by @onyx-cherry-pick[bot] in #14902
fix(metrics): restore DB connection metrics under external poolers and sharding by @wenxi-onyx in #14895
chore: add Google Drive partial-visibility test expectations by @evan-onyx in #14907
fix: GitHub mcp form token exchange [edit of #14906] by @evan-onyx in #14909
feat: for edits option in ods run-ci by @evan-onyx in #13363
fix(sidebar): highlight search tab while the search command menu is open by @raunakab in #14935
feat(connectors): index the images pasted into Teams messages by @nmgarza5 in #14856
fix(llm): show the model id in the provider model list by @nmgarza5 in #14936
perf(llm): disable LiteLLM per-chunk streaming logging by @wenxi-onyx in #14937
revert: remove experimental search receipts from internal search responses (#14849) by @rohoswagger in #14938
fix(llm): floor reasoning off at low for Gemini 3.7+ Flash by @devin-ai-integration[bot] in #14945
refactor(search): remove the dead bypass_acl flag by @rohoswagger in #14943
refactor(file_processing): share the WebVTT transcript parser and let it keep speakers by @nmgarza5 in #14861
fix(cost): stop recording $0 for gateway models litellm cannot price by @rohoswagger in #14947
refactor(connectors): split the Teams connector into one module per content type by @nmgarza5 in #14956
fix(nrf): search results washed out and unscrollable on the extension new tab page by @rohoswagger in #14957
fix(drupal-wiki): stop a failed page fetch from pruning the page by @rohoswagger in #14959
feat(ods): install onyx-llm-context skills as Cursor rules by @evan-onyx in #14944
feat(ods): install onyx-llm-context for Codex via a compiled local file by @evan-onyx in #14946
fix(connectors): make DocumentFailure.document_id match Document.id by @rohoswagger in #14962
ci(preview): report a failed preview instead of leaving a stale success by @justin-tahara in #14967
refactor(opal): unify the input-select family by @raunakab in #14646
perf(llm): initialize litellm once per process, not once per message by @Danelegend in #14964
fix(indexing): never caption with a vision model nobody chose by @raunakab in #14965
refactor(opal): split InputTypeInTag from InputMultiSelect + regroup inputs by @raunakab in #14970
feat(connectors): index Teams meeting transcripts as their own documents by @nmgarza5 in #14863
refactor(web): lib/indexing/ becomes lib/searchSettings/ by @raunakab in #14982
feat(ods): install-skill updates the checkout by default by @evan-onyx in #14971
perf(connectors): share Teams threads with a group, not a list of people by @nmgarza5 in #14928
fix(web): hide craft_file from the Add Connector page by @wenxi-onyx in #14991
refactor(web): rename lib/search/interfaces.ts to types.ts by @wenxi-onyx in #14994
feat: let the chat widget forward end-user JWTs by @evan-onyx in #14968
feat(opal): clickable SelectCards are keyboard-operable by @raunakab in #14997
feat: add Salesforce packaged ECA metadata by @evan-onyx in #14953
perf(llm): send a plain request from invoke() when streaming is not needed by @Bo-Onyx in #14954
feat(chat): answer-completeness reminder for search-backed turns by @Bo-Onyx in #14960
feat(connectors): reskin the connector catalog by @raunakab in #14993
feat(admin): indexing status page moves to /admin/indexing-status + minor UI touches by @raunakab in #15000
docs: refresh README and Simplified Chinese translation by @yuhongsun96 in #15005
chore: document Salesforce ECA releases by @evan-onyx in #15006
feat(llm): add Vercel AI Gateway as a built-in provider by @rohoswagger in #14969
fix(tests): name models LiteLLM still knows in the model capability tests by @nmgarza5 in #15009
feat(connectors): index the chat of Teams meetings by @nmgarza5 in #14929
perf(connectors): stop the Teams permission sync re-reading threads, and prune channels side by side by @nmgarza5 in #14958
feat(reindex): verify ported documents before the index swap by @Subash-Mohan in #14463
fix(pruning): read indexed ids before the crawl, not after it by @Subash-Mohan in #14975
fix(reindex): clear stale connector alerts and harden reclaim tests by @Subash-Mohan in #14527
fix(chrome-extension): only accept new tab messages from the Onyx origin by @rohoswagger in #15023
fix(api): return a generic body for unhandled server errors by @justin-tahara in #14985
fix(auth): rate-limit JWT public key refetches by @justin-tahara in #14989
fix(auth): block password login and reset for service accounts by @justin-tahara in #14987
fix(usage): enforce LLM budgets on the Slack bot, /search, and the gateway by @rohoswagger in #15024
fix(access): scope generated files to the chat session that produced them by @rohoswagger in #14999
fix(craft): stop event pumps when a stream ends by @justin-tahara in #14984
fix(cli): keep remote serve sessions off the host config by @justin-tahara in #14986
feat(connectors): collapse connector creation into one form instead of multiple steps by @raunakab in #15028
fix(usage): hold service accounts to global budgets only by @rohoswagger in #15030
refactor(connectors): organize all connector-related items into lib/connectors/ by @raunakab in #15035
feat(chrome-ext): managed policy for Onyx URL and new-tab toggle; strip trailing slashes by @rohoswagger in #15027
fix(nrf): open SSO sign-in in a new tab when embedded in the extension by @rohoswagger in #15034
fix(security): scope Slack chat-seed to Slack-owned sessions (ENG-4294) by @justin-tahara in #13324
fix(security): verify project ownership in move_chat_session (ENG-4297) by @justin-tahara in #13327
chore(chrome-ext): remove unused isDomainManaged helper by @rohoswagger in #15037
fix(mcp): single-flight SDK-driven OAuth refresh across concurrent tool calls by @rohoswagger in #15040
feat(opal): the settings header takes a list of actions by @raunakab in #15038
fix(db): warm up only the connections the pool can hold by @justin-tahara in #15042
fix(loadtest): make search scenarios actually exercise retrieval by @wenxi-onyx in #14983
fix(whitelabeling): use the custom app name in every catalog string by @nmgarza5 in #15049
feat(security): workspace toggle for connector group restrictions by @justin-tahara in #15031
feat(connectors): the create-connector header icons render to spec by @raunakab in #15055
fix(tools): bound open_url response bodies and block IPv6 IMDS by @justin-tahara in #14990
fix(cli): title the chat session after a one-shot ask by @nmgarza5 in #15059
fix(connectors): bound and monitor server-supplied retry delays by @justin-tahara in #14988
fix(chat): keep file names and extensions on chat file downloads by @justin-tahara in #15044
fix(files): bound archive expansion and skill frontmatter parsing by @justin-tahara in #14866
fix(ods): pin fork CI promotion to the confirmed commit by @justin-tahara in #14865
feat(helm): default readiness probes, drain on shutdown, opt-in PDBs by @justin-tahara in #15047
fix: SharePoint libraries whose URL differs from their display name by @evan-onyx in #15058
fix(persona): reject deletion of built-in agents by @rohoswagger in #15068
fix(mcp): use non-blocking async lock in SDK auth flow by @rohoswagger in #15050
test(usage): stop budget tests leaking enabled limits and spend into the shared DB by @rohoswagger in #15071
feat(ci): weekly model-catalog sync (models.dev + litellm + OpenRouter) by @rohoswagger in #15002
refactor(llm): replace litellm model-cost table with vendored catalog by @rohoswagger in #15003
fix(opal): ShadowDiv paints a real shadow; labelled rows paint their switch's hover by @raunakab in #15070
refactor(mcp): move MCP into lib/mcp/ and clean up the agent editor's MCP card by @raunakab in #15072
fix(federated): stop returning OAuth tokens from the callback by @rohoswagger in #15069
fix(deployment): pull MinIO from our own Docker Hub mirror by @nmgarza5 in #15086
fix(authz): check credential ownership and scoped-manager cc_pair access by @justin-tahara in #14678
fix(connectors): one shared Graph refusal classifier for Microsoft by @nmgarza5 in #15054
fix(logging): drop query strings from uvicorn access and websocket logs by @justin-tahara in #15043
feat(chat): answer-coverage guidance for search-backed turns by @Bo-Onyx in #15067
refactor(llm): give invoke() one total timeout by @wenxi-onyx in #15051
fix(llm): merge split responses and map mid-stream errors by @wenxi-onyx in #15060
feat(connectors): SYNC_RESTRICTED access type and data-access groups by @justin-tahara in #15032
refactor(opal): rename inputs/selects/ to inputs/dropdowns/ by @raunakab in #15102
fix(chat): drop doubled whitespace when stripping XML tool-call blocks by @wenxi-onyx in #15095
fix(enterprise-settings): remove the Hide Onyx Branding toggle by @nmgarza5 in #15112
feat(opal): the dropdown family as four components by @raunakab in #15107
feat(connectors): data-access group picker for perm-synced connectors by @justin-tahara in #15033
refactor(web): replace the legacy InputSelect with Opal's InputSingleSelect by @raunakab in #15104
feat(opal): dropdown search, foldable dividers, one keyboard model, rows on LineItemButton by @raunakab in #15115
fix(cc-pair): let group managers see indexing errors by @Subash-Mohan in #15082
refactor(web): organize lib/languageModels/'s types.ts, named list hooks, components/ by @raunakab in #15126
fix(web): address review follow-ups from the lib/languageModels cleanup by @raunakab in #15127
feat(config): env-overridable permission sync and document sync lock TTLs by @nmgarza5 in #15063
fix(opal): InputTypeIn value text uses the main-ui-body preset by @raunakab in #15130
chore(deployment): expose the SharePoint file size cap in the templates by @nmgarza5 in #15144
feat(terraform): add GCP vpc module by @justin-tahara in #15133
feat(terraform): add GCP gcs module by @justin-tahara in #15134
feat(terraform): add GCP postgres module by @justin-tahara in #15135
feat(terraform): add GCP redis module by @justin-tahara in #15136
feat(terraform): add GCP gke module by @justin-tahara in #15137
feat(terraform): add GCP cloud-armor module by @justin-tahara in #15138
feat(terraform): add GCP onyx composition and README by @justin-tahara in #15139
fix(opal): a select inside a label toggles once per click by @raunakab in #15146
fix(terraform): GCP module review fixes and workload identity ordering by @justin-tahara in #15148
feat(cache): optional per-client operation timeout for cache backends by @wenxi-onyx in #15149
fix(redis): apply retry settings to connection pools by @wenxi-onyx in #15150
feat(web): create new SimpleModelSelector component by @raunakab in #15116
docs(terraform): GCP and Azure modules have been applied to live projects by @justin-tahara in #15155
feat(code-interpreter): integrate Code Interpreter 0.4.8 with admission retries by @justin-tahara in #15131
chore: reuse slack test channels and sweep leaked ones by @evan-onyx in #15132
fix(opal): foldable dropdown groups stay put while the list is open by @raunakab in #15156
feat: support multiple document sources by @evan-onyx in #14763
feat: add sharing-aware Microsoft Graph delta pages by @evan-onyx in #14764
chore: add sanitized OneDrive tenant fixture by @evan-onyx in #14765
feat: add OneDrive connector indexing by @evan-onyx in #14766
feat: add OneDrive connector admin experience by @evan-onyx in #14847
feat: sync OneDrive permissions by @evan-onyx in #14848
feat: add OneDrive live coverage and release wiring by @evan-onyx in #14854
fix(zoom): read transcripts from the recording's file list by @Subash-Mohan in #14879
fix(zoom): turn Zoom's refusals into errors an admin can act on by @Subash-Mohan in #14880
fix(zoom): floor the recording listing at Zoom's launch by @Subash-Mohan in #14881
feat(zoom): check credentials, scopes and entitlements before a crawl by @Subash-Mohan in #14882
feat(zoom): add the Zoom connector to the admin UI by @Subash-Mohan in #14883
feat(zoom): scope host and Group discovery to meetings or webinars by @Subash-Mohan in #14884
feat(zoom): prune with a slim connector instead of a full crawl by @Subash-Mohan in #14973
test(zoom): cover pruning and migrate the suite to the new client by @Subash-Mohan in #14974
feat(zoom): read a recording's share settings, viewers and sign-in rules by @Subash-Mohan in #14976
feat(terraform): opt-in L7 load balancer for GCP so Cloud Armor can attach by @justin-tahara in #15174
fix(opal): InputSwitch pads its track as the mocks do by @raunakab in #15175
refactor(web): move the configuration model pickers to SimpleModelSelector by @raunakab in #15145
refactor(opal): MessageCard drops its content padding and pairs its two paddings by @raunakab in #15177
fix(agent-sharing): clear ownership on deactivation and refetch the share modal by @nmgarza5 in #15178
refactor(llm): move provider request types to model_request by @wenxi-onyx in #15158
feat(llm): GenerationRequest API for LLM.invoke by @wenxi-onyx in #15159
feat(llm): streaming GenerationRequest API for LLM.stream by @wenxi-onyx in #15176
chore(backend): remove production asserts, unused re-exports and empty package files by @wenxi-onyx in #15190
refactor(opal): updated colours on @opal/Content by @raunakab in #15180
feat(cache): renew a key only while it holds an expected value by @wenxi-onyx in #15191
feat(opal): @opal/Content takes a titleColor override by @raunakab in #15194
fix(backend): join split surrogate pairs, run every shutdown step, delete a dead thread helper by @wenxi-onyx in #15188
refactor(utils): parse streamed tool arguments with pydantic_core by @wenxi-onyx in #15199
fix(coding-agent): advance sub-turn only for rendered think-step output by @wenxi-onyx in #15097
fix(opal): fixes for the inputs/dropdowns family of components by @raunakab in #15203
fix(helm): scope pre-delete cleanup to this release and serialize startup migrations by @justin-tahara in #15045
fix(helm): harden default pod security and warn on default credentials by @justin-tahara in #15046
chore: typed connector config base and registry hook by @evan-onyx in #15182
chore: typed configs for chat, email, and meeting connectors by @evan-onyx in #15183
chore: typed configs for file storage connectors by @evan-onyx in #15184
chore: typed configs for wiki, knowledge base, and web connectors by @evan-onyx in #15185
chore: typed configs for ticketing, code, and CRM connectors by @evan-onyx in #15186
chore: type OneDrive config and require typed configs for all connectors by @evan-onyx in #15187
chore: drop credential kwargs from connector configs by @evan-onyx in #15189
feat: support SharePoint exhaustive_ad_enumeration as a connector config field by @evan-onyx in #15193
feat(index-settings): stage image processing in the page form by @raunakab in #15179
fix(widget): fill the inline container and keep typing keys in the widget by @yuhongsun96 in #15211
fix: renaming a user group no longer drops its connectors by @evan-onyx in #15214
chore(deps): bump soupsieve from 2.8.4 to 2.9.2 by @justin-tahara in #15219
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 by @justin-tahara in #15220
chore(deps): bump tornado from 6.5.8 to 6.5.10 by @justin-tahara in #15221
chore(deps): bump click from 8.4.2 to 8.5.0 by @justin-tahara in #15223
chore(deps): bump mako from 1.3.12 to 1.4.3 by @justin-tahara in #15224
docs(gcp): make the README Helm values install by @justin-tahara in #15238
chore(deps): bump pydantic-settings from 2.14.2 to 2.15.0 by @justin-tahara in #15225
chore(deps): bump python-multipart from 0.0.31 to 0.0.32 by @justin-tahara in #15226
build(deps): bump lucide-react from 1.18.0 to 1.45.0 in /backend/onyx/server/features/build/sandbox/image/templates/outputs/web by @dependabot[bot] in #14899
build(deps): bump @base-ui/react from 1.6.0 to 1.8.0 in /backend/onyx/server/features/build/sandbox/image/templates/outputs/web by @dependabot[bot] in #14900
chore(deps): bump msgpack from 1.2.1 to 1.2.2 by @justin-tahara in #15222
fix(db): verify async Postgres TLS like libpq by @justin-tahara in #15237
fix(opensearch): write public field on metadata updates by @evan-onyx in #15236
chore(deps): bump dompurify from 3.4.12 to 3.4.15 in /web by @dependabot[bot] in #14799
chore(deps): bump sharp to 0.35.4 in /web by @justin-tahara in #15227
build(deps): bump anyio from 4.13.0 to 4.14.2 in /backend/onyx/server/features/build/sandbox/image by @dependabot[bot] in #14891
chore(deps): refresh transitive nanoid in /web by @justin-tahara in #15228
chore(deps): refresh transitive qs in /web by @justin-tahara in #15229
chore(deps): refresh transitive fast-uri in /web by @justin-tahara in #15230
chore(deps): refresh transitive js-yaml 3.x in /web by @justin-tahara in #15231
chore(deps): refresh transitive brace-expansion in /web by @justin-tahara in #15232
chore(deps): refresh transitive browserslist in /web by @justin-tahara in #15233
chore(deps): drop the unused nltk dependency by @justin-tahara in #15234
chore(deps): bump accelerate from 1.14.0 to 1.15.0 by @justin-tahara in #15235
chore(deps): bump cryptography to 50.0.0 by @justin-tahara in #15218
fix(salesforce): order child windows by sortable fields only (#15273) to release v4.9 by @onyx-cherry-pick[bot] in #15275
chore(deps): update python base image digests (#14697) to release v4.9 by @onyx-cherry-pick[bot] in #15276
chore(deps): update node base image digests (#14696) to release v4.9 by @onyx-cherry-pick[bot] in #15277
chore(hotfix): cherry-pick 2 commits to release v4.9 by @nmgarza5 in #15287
chore(hotfix): cherry-pick 2 commits to release v4.9 by @nmgarza5 in #15297
chore(llm): drop Claude Sonnet 4.5 from the provisioning fallback and cache test (#15309) to release v4.9 by @onyx-cherry-pick[bot] in #15313
fix(search): don't scope search to a source that is the question's topic (#15317) to release v4.9 by @onyx-cherry-pick[bot] in #15355
fix(deps): pin sentence-transformers to 5.6.0 (#15335) to release v4.9 by @onyx-cherry-pick[bot] in #15368
chore(deps): bump cryptography from 49.0.0 to 50.0.0 in /backend/onyx/server/features/build/sandbox/image (#13892) to release v4.9 by @onyx-cherry-pick[bot] in #15369
chore(deps): bump sharp to 0.35.5 (#15359) to release v4.9 by @onyx-cherry-pick[bot] in #15373
chore(deps): bump fast-uri to 3.1.7 (#15362) to release v4.9 by @onyx-cherry-pick[bot] in #15376
chore(deps): bump undici to 7.29.1 (#15361) to release v4.9 by @onyx-cherry-pick[bot] in #15377
chore(deps): bump js-yaml to 4.3.2 / 3.15.2 (#15363) to release v4.9 by @onyx-cherry-pick[bot] in #15378
chore(deps): bump brace-expansion to 5.0.11 / 1.1.20 (#15364) to release v4.9 by @onyx-cherry-pick[bot] in #15379
chore(deps): override uuid to 11.1.1 in mobile (#15366) to release v4.9 by @onyx-cherry-pick[bot] in #15386
chore(deps): bump browserslist to 4.28.7 (#15365) to release v4.9 by @onyx-cherry-pick[bot] in #15387
chore(deps): bump next to 16.3.8 (#15358) to release v4.9 by @onyx-cherry-pick[bot] in #15391
chore(deps): bump proxy-addr to 2.0.8 (#15360) to release v4.9 by @onyx-cherry-pick[bot] in #15375
chore(hotfix): cherry-pick security dependency fixes to release v4.9 by @justin-tahara in #15397
fix(auth): restart sign-in on a stale SSO state instead of showing the error (#15395) to release v4.9 by @onyx-cherry-pick[bot] in #15403
chore(hotfix): cherry-pick 4 commits to release v4.9 by @nmgarza5 in #15399
fix(chat): backport file download, upload indicator, code fence, and GPT Image 2.5 fixes to release v4.9 by @onyx-cherry-pick[bot] in #15416
chore(hotfix): cherry-pick 2 commits to release v4.9 by @nmgarza5 in #15437
chore(deps): bump fflate to 0.4.9 (#15464) to release v4.9 by @onyx-cherry-pick[bot] in #15468
chore(deps): bump baseline-browser-mapping to 2.11.0 (#15462) to release v4.9 by @onyx-cherry-pick[bot] in #15469
chore(deps): bump shell-quote to 1.11.0 (#15465) to release v4.9 by @onyx-cherry-pick[bot] in #15470
chore(deps): bump compression to 1.8.2 (#15463) to release v4.9 by @onyx-cherry-pick[bot] in #15471
chore(deps): bump authlib to 1.8.0 (#15466) to release v4.9 by @onyx-cherry-pick[bot] in #15472
chore(deps): bump pypdf to 6.19.0 (#15467) to release v4.9 by @onyx-cherry-pick[bot] in #15473
chore(deps): bump nanoid to 3.3.18 (#15478) to release v4.9 by @onyx-cherry-pick[bot] in #15485
chore(deps): bump fast-uri to 3.1.8 (#15477) to release v4.9 by @onyx-cherry-pick[bot] in #15487
chore(deps): bump brace-expansion to 5.0.12 / 1.1.21 (#15476) to release v4.9 by @onyx-cherry-pick[bot] in #15490
chore(deps): bump qs to 6.16.0 (#15482) to release v4.9 by @onyx-cherry-pick[bot] in #15489
chore(deps): bump postcss-selector-parser to 7.1.3 (#15481) to release v4.9 by @onyx-cherry-pick[bot] in #15488
chore(deps): bump ip-address to 10.7.1 (#15480) to release v4.9 by @onyx-cherry-pick[bot] in #15486
chore(deps): bump hono to 4.13.7 (#15479) to release v4.9 by @onyx-cherry-pick[bot] in #15491
chore(hotfix): cherry-pick 4 commits to release v4.9 by @nmgarza5 in #15499
fix(deps): override tinypool to 2.1.2 to unblock audit (#15573) to release v4.9 by @nmgarza5 in #15587
fix(llm): deliver reasoning effort to models behind OpenAI-compatible providers (#15600) to release v4.9 by @onyx-cherry-pick[bot] in #15607
fix(chat): render bold-labeled file links as links, not citations (#15599) to release v4.9 by @onyx-cherry-pick[bot] in #15618
feat(ci): a fix opened on main is backported to the four newest release lines (#15591) to release v4.9 by @nmgarza5 in #15634

Full Changelog: v4.8.0...v4.9.0