open-notebook

We recommend all users upgrade. v1.14.0 is a providers-and-plumbing release: six new ways to connect models, a DNS-rebinding hardening pass on every outbound provider call, and fixes to two failure modes that could silently break a working install after a redeploy. Validated through the full release process — backend/frontend suites, a fresh-install and an upgrade test against real Docker images, and an end-to-end pass over the running app.

🔒 Security hardening

• Outbound provider requests are now pinned to a DNS-vetted IP. Validating a URL and then handing it to the HTTP client left a rebinding window: the hostname was resolved again at connect time, so a name that passed validation could point at a cloud metadata endpoint on the actual connection. Resolution now happens once, dangerous addresses are rejected, and the request is pinned to the vetted address while Host and TLS SNI keep the original hostname — so certificate verification and routing are unaffected. Applied to credential saves, connection tests and model discovery (#1063)
• Private IPs, localhost, host.docker.internal, LAN hostnames and Tailscale addresses remain fully supported — this is a self-hosted application and local providers are a first-class use case. That guarantee is now pinned by regression tests rather than left implicit (#1193)
• Error text returned by the sources API is capped, so internal exception detail from extraction libraries no longer reaches clients (#1136)
• Resolved all open Dependabot alerts: mcp → 1.28.1 (3 high, transitive via content-core) and axios → 1.18.1 (#1191)

✨ New features

• Four new AI providers: Cohere (language + embedding via its native v2 API), PayPerQ / PPQ (multi-modality gateway — language, embedding, STT, TTS), Novita (OpenAI-compatible LLM gateway), and speech-to-text on the existing Deepgram provider (#1170)
• oMLX as a first-class provider — native Esperanto profile, default base URL http://localhost:11435/v1, connection test and model discovery, no remapping to openai-compatible (#1048)
• OpenRouter now does text-to-speech and speech-to-text, not just LLMs and embeddings. Note that its TTS model uses Microsoft neural voice names (e.g. en-US-AvaNeural), not OpenAI's alloy/nova set (#987)
• anthropic_compatible credential provider for endpoints that speak only the Anthropic Messages format, such as Kimi (#675)
• Docling formula & vision enrichment toggles in Settings → Content Processing — extract mathematical formulas as structured markup, and describe images / extract chart data with a vision model. Both opt-in and off by default; vision is significantly slower (#1131)
• Worker concurrency is configurable via OPEN_NOTEBOOK_WORKER_MAX_TASKS (default 5). Set it to 1 on single-GPU or local-LLM setups that were being overloaded by parallel source processing (#893)
• Newer ElevenLabs models in discovery — eleven_v3, eleven_flash_v2_5, eleven_flash_v2, and scribe_v2 for STT (#1167)
• Podcast episode profiles expose an optional "Max output tokens" field in the UI, with help text explaining it caps output per generation step (outline + transcript) and defaults to the built-in values when blank (#991)

⚡ Performance

• Typing in the chat composer no longer lags in long conversations. Composer state is isolated from the message list and each row is memoized, so a keystroke no longer re-renders the whole history. Most noticeable for IME users (Japanese, Chinese, Korean), where every composition event was triggering a full re-render (#1147)

🐛 Notable fixes

• A selected content-processing engine whose runtime isn't installed no longer breaks ingestion silently. The engine choice lives in the database; the opt-in runtimes that serve it come from environment flags. A redeploy that drops OPEN_NOTEBOOK_ENABLE_CRAWL4AI/_DOCLING therefore left the setting pointing at nothing, and every extraction failed with an unhelpful "Could not extract any text content" — with the URL engine set to Crawl4AI, that broke URL ingestion entirely. Extraction now degrades to the auto chain and logs which engine and which flag are involved (#1194)
• An HTTP proxy no longer kills the worker on startup. websockets 15.0 began routing even ws:// connections through HTTP_PROXY, so the internal SurrealDB socket was tunneled through the external proxy, rejected with a 403, and took the worker down. The internal DB hosts are now added to no_proxy at startup, merged with any value you set (#1160)
• Vertex credentials now configure text-to-speech correctly when used through a stored credential rather than environment variables — previously it crashed on an unexpected project argument (#1151)
• Auto-assign no longer re-fills optional model slots you deliberately cleared; it now only fills the two required slots, and empty optional slots show what they fall back to (#1098)
• Per-transformation model selection actually takes effect — an assigned model_id was persisted but ignored at execution time, so every transformation ran on the global default (#1137)
• PPQ model discovery lists all modalities, not just chat (#1180)
• Deleting a notebook now also deletes its chat sessions instead of orphaning them (#1124)
• Japanese (ja-JP) translations reviewed and improved throughout (#998)
• The quick-start and Ollama compose examples used OLLAMA_BASE_URL, which nothing reads — the correct variable is OLLAMA_API_BASE. Following them verbatim left Ollama permanently unavailable with no error explaining why (#1148)

⚠️ Behavior changes for self-hosters

1. Outbound provider URLs are DNS-pinned. Local and private endpoints are explicitly still supported. If you use an endpoint whose hostname resolves to a link-local or cloud-metadata address, it will now be refused — that is the intended protection.
2. OLLAMA_BASE_URL was never read. If you copied it from the old quick-start, switch to OLLAMA_API_BASE — your Ollama was not connected.
3. Worker concurrency default is unchanged (5) but now adjustable via OPEN_NOTEBOOK_WORKER_MAX_TASKS. It is read at worker launch, so restart the worker after changing it.
4. Docling / Crawl4AI stay opt-in (OPEN_NOTEBOOK_ENABLE_DOCLING, OPEN_NOTEBOOK_ENABLE_CRAWL4AI). If you had one selected as your engine and the flag is missing after this upgrade, extraction now falls back to auto and logs it, instead of failing.

🙏 Thanks

• @Gautam-Diwan — the DNS-pinning hardening on outbound provider requests (#1063), the first-class oMLX provider (#1164), and the Ollama env var correction in .env.example (#1064)
• @mvanhorn — the anthropic_compatible credential provider (#1043) and episode profile max output tokens in the UI (#992)
• @kentalos — a thorough review and rewrite of the Japanese (ja-JP) translations (#998)
• @dyzur — a pre-commit configuration mirroring the CI gates, so contributors catch lint/type failures before pushing (#1129)

And thank you to everyone who filed issues this cycle — several fixes here started as a report describing a setup we could not have guessed at.

Full details in the CHANGELOG.

We recommend all users upgrade. v1.13.0 is our biggest content-processing upgrade yet: it rebuilds extraction on top of Content Core 2.0 (a major architecture release), adds opt-in Docling (OCR + layout-aware parsing) and Crawl4AI (JavaScript rendering) engines, brings EPUB and Reddit support, moves PDF extraction to MIT-licensed pdfplumber, fixes audio extraction, and keeps the default image lean by making the heavy runtimes opt-in. Plus a batch of podcast correctness fixes. Validated with the release confidence process: full backend/frontend suites, the fresh-install + upgrade image gate, and manual verification of the opt-in runtimes, real podcast/TTS and PDF extraction on the pushed image.

✨ A major content-processing upgrade (Content Core 2.0)

Extraction now runs on content-core 2.x — a ground-up refactor of the extraction stack. What it means for you:

• Docling document engine (opt-in) — real OCR for scanned PDFs and images plus layout-aware parsing. Toggle OCR in Settings → Content Processing (on by default; turn it off to speed up text-native docs). (#1104)
• Crawl4AI URL engine (opt-in) — renders JavaScript-heavy pages locally with no API key, or offloads to a Crawl4AI server (CRAWL4AI_API_URL). Selectable alongside Firecrawl, Jina and Simple. And your persisted engine choice now actually takes effect — the source-processing graph reads the saved Content Settings and passes them to content-core (it previously always ran auto and silently ignored the selection). (#432)
• New formats — EPUB books are now supported, and Reddit links extract the post and its comments automatically.
• Better PDF & audio — PDF extraction moves to MIT-licensed pdfplumber (replacing AGPL PyMuPDF), and audio moves to direct ffmpeg calls — faster, and it fixes extraction from MP3 files carrying chapter metadata. (#1103)
• Faster, clearer failures — unsupported uploads are rejected instantly at ingestion with a 415 naming the detected type, instead of a background job retrying for ~an hour. (#975)

🪶 Lean by default, powerful on demand

• The heavy runtimes are opt-in. Docling and local Crawl4AI are no longer bundled into every image — they install automatically on first container startup when enabled. Set OPEN_NOTEBOOK_ENABLE_DOCLING=true and/or OPEN_NOTEBOOK_ENABLE_CRAWL4AI=true; downloads are cached on the /app/data volume (only the first boot is slow), and a failed install degrades gracefully (the app still starts, the engine is reported unavailable) with loud logs. A new GET /api/capabilities probe reports what's actually installed, and Settings → Content Processing disables the Docling/Crawl4AI engines and the OCR toggle (with an env-var hint) until their runtime is available — so the UI never advertises an engine that isn't there. A remote Crawl4AI server needs no local install. Recorded as ADR-007. (#1122)
• Source extraction now logs the effective engine (url_engine / document_engine / docling_ocr) at INFO right before it runs, so you can confirm which engine actually processed a source instead of guessing. (#1125)

🐛 Notable fixes

• Podcast correctness: renaming a speaker profile no longer breaks the episode profiles using it (references are stored by record ID, not name); episode audio paths are stored relative to the podcasts folder so previously generated episodes survive a DATA_FOLDER relocation; episode cards resolve and show the real outline/transcript/speaker model instead of "— / —"; and podcast generation now honors an explicitly supplied speaker_profile all the way into the generation command. (#630, #1030, #1114, #1058)
• Clicking a chat/Ask citation that points at a deleted source, insight or note now shows a friendly "this content no longer exists" state in all three dialogs. (#455)
• Source insights get created/updated timestamps and the API returns null (not the literal string "None") for legacy insights. (#1045)
• Optional model defaults (transformation, tools, large context, TTS, STT) can now be cleared via PUT /api/models/defaults (chat and embedding still can't be null). (#1091)
• Creating a transformation from the empty state works again — after deleting every transformation, the "New Transformation" button did nothing. (#999)
• The source detail view now fetches through the shared React Query hook (consistent caching and 404 handling), and the settings UI reads the provider list from GET /api/providers so new providers need zero frontend edits. (#1106, #1082)
• uv sync alone now provides the full dev toolchain (mypy included). (#1101)

⚠️ Behavior changes for self-hosters

1. Docling and local Crawl4AI are now opt-in. If you relied on Docling parsing/OCR or local Crawl4AI rendering, set OPEN_NOTEBOOK_ENABLE_DOCLING=true and/or OPEN_NOTEBOOK_ENABLE_CRAWL4AI=true — the first container boot then installs them (cached afterwards). The default image no longer ships Chromium or the multi-GB ML stack. A remote Crawl4AI server (CRAWL4AI_API_URL) needs no local install.
2. Persisted engine selections now take effect. If you had a document/URL engine selected in Settings → Content Processing, it was previously ignored (everything ran auto); it now actually applies. Re-check your selection after upgrading — and remember to click Save for it to persist.
3. Frontend bind override changed. Docker images force the Next.js frontend to bind 0.0.0.0; the HOSTNAME variable is no longer honored as a bind override — use the new FRONTEND_BIND_HOST variable instead. (#994)
4. Podcast profile migrations (19–22) apply automatically on startup. Profiles whose legacy model mapping never converged (e.g. a provider credential was never configured) may need you to re-pick the models/speaker in the profile form once. Podcast episodes stored under non-standard absolute paths are treated as legacy-invalid — regenerate to restore playback.
5. docker-compose.yml SurrealDB command now uses the YAML list (exec) form, so SURREAL_USER / SURREAL_PASSWORD values containing spaces are passed correctly. (#1093)

🙏 Thanks

• @pelazas — fixed the transformation editor being unreachable from the empty state (#999).
• @lfnovo — the opt-in runtime system (#1122), the Crawl4AI URL engine and persisted-engine wiring (#432), the OCR toggle (#1104), the content-core 2.x upgrade (#1103), the podcast correctness batch (#630, #1030, #1114, #1058), the 415 ingestion guard (#975), and the rest of the release.

And a collective thank-you to everyone who filed issues and reported bugs that shaped this release — the deleted-citation UX, the engine-selection gap, the podcast speaker/rename cases, and more.

Full details in the CHANGELOG.

We recommend all users upgrade. v1.12.0 is a maintainability and correctness release: a full-repo cleanup (20+ focused PRs) that removed ~3,000 lines of dead code, fixed real user-facing bugs along the way, and turned on the quality gates that keep them fixed — validated end-to-end by the release test process (full suites, API+UI smoke, fresh-install and upgrade tests on the real images).

✨ New features

• Live Anthropic model discovery — "Discover models" for Anthropic credentials now queries Anthropic's models API instead of a hardcoded 2024-era list, so new Claude models appear as soon as they ship (#1070)
• GET /api/providers — new endpoint exposing provider metadata (modalities, docs, env-configured status) from a single backend registry (#1075)
• Math rendering in chat — prompts now steer models to emit $$...$$/$...$ so formulas render via KaTeX instead of raw LaTeX code blocks (#1051)

🐛 Notable fixes

• Errors now tell you what's wrong: a missing/misconfigured model returns a clear 422 with guidance (and not-found resources a 404) instead of a generic "Internal Server Error" — across all API routes (#1078)
• Translations interpolate correctly in all 14 languages: counters, names and plurals no longer risk showing literal {count}/{name} placeholders; eight podcast toasts that always showed {name} are fixed (#1074, #1077)
• Podcast dialog: rapid source toggling no longer causes a request storm with flickering token counts, and the dialog closes deterministically after the episode list refreshes (#1067)

🧹 Code health (why this release exists)

• ~3,000 lines of dead code removed, including the entire leftover Streamlit-era service layer (#1053, #1054, #1056)
• CI now gates every PR on ruff, ESLint, the frontend production build and mypy at zero errors (was: 197 baseline errors, not enforced) (#1062, #1068, #1076)
• One provider registry drives env config, modalities, connection tests and discovery — adding a provider went from ~6 hand-synced locations to 2, both test-enforced (#1075)
• Heavy copy-paste deduplicated across the chat routers, sources router, embedding commands and model discovery (#1069–#1072)
• Both Docker images are now built from a single multi-stage Dockerfile, eliminating drift between the regular and single-container variants — published image names and tags are unchanged (#1066)
• Dependency diet: unused langchain-community and langchain-deepseek removed, upper bounds on the langchain family, and an undeclared transitive dependency made explicit (#1073)

⚠️ Behavior changes for self-hosters

1. API error codes are now accurate — if you script against the API and matched on 500 for configuration mistakes, update your handling: configuration errors return 422, missing resources 404, provider rate limits 429, upstream provider failures 502 (#1078).
2. POST /api/notebooks/{id}/context was removed — it duplicated POST /api/chat/context and had no known callers. If you used it, switch to POST /api/chat/context with body {notebook_id, context_config} (#1079).
3. Upgrading from a version older than 1.6 with embedding jobs still queued: drain the queue on a 1.x release before upgrading past this version — the pre-1.6 job compatibility shims were removed (#1056).

🙏 Thanks

This cycle was a focused maintenance sprint by the core team, but it stands on the community's shoulders: thank you to everyone who reported the issues that shaped the cleanup backlog and the release checklist — your reports are what turned a "refactor" into a list of real bugs to fix. Special mention to the contributors whose earlier security work (#1042, #1046, #1049) set the quality bar this release enforces in CI.

Full details in the CHANGELOG.

We recommend all users upgrade. This release includes a comprehensive security-hardening pass (16 fixes), several long-requested features, and meaningful performance improvements — validated by a new release-testing process covering everything from the unit suite to fresh-install and upgrade tests on the actual Docker images.

🔒 Security hardening

A dedicated security review produced 16 fixes across the stack. Highlights:

• SurrealQL injection closed in the repository layer and credential ordering (#1002, #1021)
• SSRF protection on web-source ingestion, plus request-time re-validation of provider URLs (DNS-rebinding window closed) — private IPs and localhost remain fully supported for self-hosted Ollama/LM Studio (#1005, #1006)
• Constant-time comparison for the API password (#1003)
• User prompts are no longer compiled as Jinja2 templates (#1004)
• Request body cap (default 100 MB, configurable via OPEN_NOTEBOOK_MAX_UPLOAD_SIZE_MB) (#1014)
• Markdown note previews sanitize raw HTML (#1007)
• API error responses no longer leak internal details (#1012, #1017)
• Pillow forced to 12.3.0, resolving all 6 open Dependabot advisories (#1041)
• docker-compose now binds SurrealDB to localhost only (#1025) and sources DB credentials from env (#946)

✨ New features

• Sort the Sources table by any column — including the new "Updated" column (#895)
• Recently Viewed section on the Notebooks page (#850)
• List view for notebooks — tile/list toggle, remembered across reloads (#885)
• Per-transformation model selection — assign a specific model to each transformation (#776)
• "Refresh content" action on web-link sources (#259)
• Syntax highlighting for code blocks + restored markdown typography (#783)
• LaTeX math (KaTeX) everywhere — sources, insights, Ask answers, transformations and the note editor, not just chat (#269)
• EasyPanel deployment template (#189)

⚡ Performance

• Ask and source-chat now stream progressively through the Next.js proxy — no more waiting at "Processing..." (#770)
• Chat/context/podcast startup uses batched insight queries (14 → 3 queries on a 12-source notebook) (#1008)
• File uploads, DNS resolution and chat inference no longer block the event loop (#1009, #1011, #704)

🐛 Notable fixes

• Google/Vertex connection tests survive Google retiring Gemini models (#970)
• API startup waits for SurrealDB instead of crashing on boot races (#708)
• Podcast generation no longer truncates dense content — max_tokens on episode profiles (#639)
• Clearing credential fields (Ollama base URL, Vertex settings) now actually clears them (#1046)
• Note editor fills the dialog properly and long notes scroll instead of overflowing (#932)
• CRUD endpoints return proper 404s instead of 500s (#862)

⚠️ Behavior changes for self-hosters

1. SurrealDB port binding: docker-compose.yml now publishes SurrealDB on 127.0.0.1 only. If you connect to the DB from another machine, use the new docker-compose.override.yml.example.
2. CORS: the default wildcard no longer sends credentials. If you make credentialed cross-origin requests, set CORS_ORIGINS explicitly.
3. Upload cap: request bodies over 100 MB are now rejected — raise OPEN_NOTEBOOK_MAX_UPLOAD_SIZE_MB if you upload larger files.
4. Host validation: reverse proxies must forward a clean Host header; malformed values now fall back to localhost instead of being trusted.
5. Raw HTML in notes no longer renders in the preview (it is sanitized).

🙏 Thanks

This release carries contributions from all over the community:

• @kwp3 — the entire 16-fix security-hardening pass, plus the performance work on batched queries and event-loop hygiene (#1002–#1026)
• @mvanhorn — API startup resilience (#977), Recently Viewed (#979), per-transformation model selection (#978), podcast max_tokens (#982) and typing improvements (#983)
• @ProfTrader — sortable sources table (#930), the flow-driven release process docs (#960), dependency audit resolution (#962) and typing work (#929, #961)
• @hyeonho-park — end-to-end SSE streaming through the Next.js proxy (#770)
• @Markus328 — syntax highlighting and the markdown typography restoration (#980)
• @GeorgijGrigoriev — configurable API listen host (#986)
• @Thiamath — deprecated Gemini model cleanup (#1027)
• @D-revv — test coverage measurement in CI (#966)
• @nyxst4ck — EasyPanel deployment template (#927)

And a big thank-you to everyone who reported the issues this release closes — the fixes above exist because you took the time to file them. ❤️

Full details in the CHANGELOG.

Highlights: LaTeX rendering in chat, per-type bulk chat-context controls, Turkish UI, a security fix, and a batch of ingestion/search reliability fixes.

Upgrade note: this release adds database migration 15 (a flexible config object on the credential table), applied automatically on API startup.

🔒 Security

• Bumped Starlette → 1.2.1 and FastAPI → 0.136.3 to address CVE-2026-48710 ("BadHost") (#859)

✨ Added

• LaTeX math rendering in chat — inline $...$ and display $$...$$ via KaTeX (#606)
• Bulk chat-context actions in the Sources and Notes column headers — sources: insights only / full content / exclude all; notes: include / exclude all — translated across all 14 locales (#223)
• Turkish (tr-TR) localization (#871)
• NEXT_PUBLIC_API_TIMEOUT_MS to configure the frontend API request timeout (#880)

🔧 Changed

• Prominent "Retry processing" button on failed source cards (#726)
• Docker base image → Debian trixie + Node.js 22.x (#914)

🐛 Fixed

• Sources that fail to ingest are now marked failed (so the retry button actually appears) instead of being saved as completed with the extraction error as their body (#726)
• Podcast generation now uses the notebook's real content via Notebook.get_context() (#864)
• PUT profile handlers use model_dump(exclude_unset=True) so partial updates don't wipe unset fields (#860)
• OpenRouter embedding modality is now exposed (#842)
• POST /sources/{id}/retry: no longer returns 400 for every source (#861), and no longer 500 from a double-prefixed command id
• GET /sources/{id} returns 404 (not 500) for a missing or deleted source
• Text search falls back to vector search on a search::highlight "position overflow" (#648)
• POST /api/search rejects a non-positive limit with 422 (#863)
• Ollama num_ctx override is now persisted via a flexible config object (migration 15) (#875)
• Worker drains legacy embedding jobs via command aliases (#695, #876)
• Updated AI provider configuration docs (#873)

⚡ Performance

• Memoized the notebook source list and stopped polling completed sources (#503)

📚 Docs

• Code of Conduct (#856), local quickstart + worker step (#900), export_docs.py Table of Contents (#865)

📦 Dependencies

• Multiple dependency bumps, including cryptography 46→48, langchain 1.2→1.3, langchain-anthropic, aiohttp, tornado, and frontend dev dependencies.

🙌 Contributors

Thanks to everyone who shipped a PR in this release: @aaronjmars, @doganreis, @Federicorao, @fboudra, @krataratha, @ltianyi992, @mvanhorn, @royfrancis, @zichen0116, and @lfnovo.

Full Changelog: https://github.com/lfnovo/open-notebook/compare/v1.9.0...v1.10.0

✨ Highlights

• Upgraded to Esperanto 2.22.0, unlocking new providers and inheriting several upstream fixes.
• New audio providers:
  • Mistral Voxtral — speech-to-text and text-to-speech (reuses your Mistral credential)
  • Deepgram — text-to-speech (Aura voices) — new provider
  • xAI — text-to-speech
  • Completed the matrix: Google STT/TTS, Vertex TTS, ElevenLabs STT (Scribe)
• Per-credential Ollama num_ctx override — configure the context window for Ollama models in Settings → API Keys (translated across all 13 locales).
• Better speech-to-text connection tests — they now transcribe a real speech clip instead of silence, so a passing test shows actual text.

⚠️ Upgrade Notes (behavior changes inherited from Esperanto)

• Ollama default context window (num_ctx) is now 8192 (was 128000) to avoid out-of-memory errors on consumer GPUs. If you ingest large documents with Ollama, set a higher num_ctx on the Ollama credential.
• Google embedding default model is now gemini-embedding-001 — the previous default, text-embedding-004, was removed from Google's API. If you used Google embeddings with the old default, re-create the model and re-embed your content (the embedding dimensions changed).

🛠️ Inherited Esperanto fixes

• OpenRouter LLM & embedding requests now send a proper JSON body.
• Clear errors (instead of an opaque TypeError) when OpenAI-compatible endpoints return null embeddings.
• Streaming tool calls return proper objects across Anthropic, Google, Vertex, and Ollama.
• base_url trailing slashes normalized (fixes double-slash 301s for Ollama / self-hosted).
• Ollama "thinking" models (e.g. Qwen) merge reasoning content correctly.
• Model discovery honors a custom base_url (LiteLLM/vLLM/proxies).

➕ Also in this release

• OPEN_NOTEBOOK_EMBEDDING_BATCH_SIZE env var to tune embedding batch size (#735)
• CORS_ORIGINS env var to configure allowed API origins (#585, #597, #730)
• OPEN_NOTEBOOK_MIN_CHUNK_SIZE env var to filter degenerate tiny chunks
• Fixed URL-source embedding crash on single-character HTML fragments (#764)
• README Provider Support Matrix synced with actual capabilities

Full changelog: see CHANGELOG.md · compare v1.8.5...v1.9.0

Highlights

• 🇪🇸 Spanish (es-ES) language support with full translation coverage
• Token-based embedding chunking — better handling of CJK and mixed-language content
• Resilient credential handling — broken/mismatched encryption keys no longer crash the API

---

Added

• Spanish (es-ES) locale with 930+ translation keys and language toggle entry (#757) — thanks @chemazener!

Changed

• Embedding chunking is now token-based instead of character-based, improving chunk sizing consistency for CJK and mixed-language content (#542, #749) — thanks @unendless314!
• OPEN_NOTEBOOK_CHUNK_SIZE and OPEN_NOTEBOOK_CHUNK_OVERLAP semantics changed from characters to tokens; default reduced from 1200 characters to 400 tokens to stay safely below the 512-token ceiling of BERT-family embedders (e.g. mxbai-embed-large). Existing stored embeddings are unaffected — only new ingestions use the new chunking.
• Internal: migrated i18n from the custom Proxy pattern to standard react-i18next t() function for better tooling compatibility (#755)

Fixed

• Credentials endpoint no longer crashes (500) when the encryption key doesn't match stored credentials (#740, #753)
• Broken credentials are now shown with a decryption warning and can still be deleted
• DELETE endpoint for broken credentials supports model migration via the migrate_to parameter
• Azure credentials: base_url now correctly maps to endpoint (#741)

Docs

• Improved local quick-start documentation (#734) — thanks @vincentrou!

Dependencies

• Bump langchain-openai 1.1.7 → 1.1.14 (#762)
• Bump langchain-text-splitters 1.1.0 → 1.1.2 (#761)
• Bump langchain-core 1.2.22 → 1.2.28 (#737)
• Bump langsmith 0.6.4 → 0.7.31 (#759)
• Bump authlib 1.6.9 → 1.6.11 (#760)
• Bump cryptography 46.0.6 → 46.0.7 (#736)
• Bump pytest 9.0.2 → 9.0.3 (#752)
• Bump python-multipart 0.0.22 → 0.0.26 (#758)
• Bump tornado 6.5.4 → 6.5.5 (#668)
• Bump next 16.1.7 → 16.2.3 (#744)
• Bump axios 1.13.5 → 1.15.0 (#748)
• Bump follow-redirects 1.15.11 → 1.16.0 (#754)
• Bump vite 7.3.1 → 7.3.2 (#728)

---

🙏 Thanks

Huge thanks to everyone who contributed to this release:

• @chemazener — Spanish localization
• @unendless314 — token-based embedding chunking
• @vincentrou — documentation improvements

And thanks to all the users who opened issues and helped us prioritize what to ship next!

Full Changelog: https://github.com/lfnovo/open-notebook/compare/v1.8.4...v1.8.5

Security

Three vulnerabilities reported by CERT-EU Offensive Security Team via coordinated disclosure:

• Remote Code Execution via Server-Side Template Injection (CVSS 9.2 Critical)

  • User-created transformation prompts were rendered by an unsandboxed Jinja2 environment, allowing arbitrary Python code execution on the server. Bumped ai-prompter to 0.4.0 which uses SandboxedEnvironment for all template rendering.

• Arbitrary file write via path traversal (CVSS 7.0 High)

  • File upload did not sanitize filenames, allowing path traversal payloads (e.g., ../../../../tmp/test.txt) to write files outside the upload directory. Filenames are now sanitized with os.path.basename() and resolved paths are validated.

• Arbitrary file read via Local File Inclusion (CVSS 8.2 High)

  • The source creation endpoint accepted arbitrary file_path values, allowing reading of any file on the container (e.g., /etc/passwd, /proc/self/environ). File paths are now validated to be within the uploads directory.

Affected versions

All versions up to and including v1.8.3.

Recommended action

Upgrade to v1.8.4 immediately.

Credit

Reported by CERT-EU Offensive Security Team via coordinated vulnerability disclosure.

Security

• Fix SurrealDB injection via unsanitized order_by query parameter (CVSS 8.7 High)
  • GET /api/notebooks accepted arbitrary input in the order_by parameter, allowing injection of SurrealQL commands. Exploitable via CSRF by tricking a user into clicking a crafted URL.
  • Added allowlist validation for sorting parameters in the notebooks endpoint
  • Replaced f-string query interpolation with parameterized $variable binding in source chat and migration queries
  • Added defensive validation in the get_all() base method to prevent injection via order_by parameter

Affected versions

All versions up to and including v1.8.2.

Recommended action

Upgrade to v1.8.3 immediately.

Credit

Reported by CERT-EU Offensive Security Team via coordinated vulnerability disclosure.

What's New

Features

• DashScope (Qwen) & MiniMax provider support — Two new AI providers via Esperanto v2.20.0: Alibaba Cloud's Qwen models and MiniMax models with 204K context (#725)
• Bengali (bn-IN) language support — Full i18n translation for Bengali (#643)

Bug Fixes

• Source asset persistence — Failed sources now persist their asset (URL/file path), making them identifiable and retryable (#722)
• Source title preservation — User-set custom titles are no longer overwritten after background processing (#722)
• Credential cascade delete — Deleting a credential now automatically removes linked models instead of returning a 409 error (#722)
• Source list auto-refresh — Source list now updates automatically after adding a new source via URL, file upload, or text (#721)
• Podcast directory names — Uses UUID for episode directories, fixing filesystem errors with special characters in titles (#666)
• Tiktoken offline handling — API no longer crashes in air-gapped environments when tiktoken can't download encodings (#622)
• SurrealDB healthcheck — Removed incompatible healthcheck from Docker Compose that caused false-negative container status (#656)
• Esperanto embedding fixes — Bumped to v2.19.7 fixing base_url/api_key config issues across multiple embedding providers (#664, #665)

Maintenance

• Upgraded default Azure API version to 2024-10-21 (#638)
• Deprecated single-container Docker image in favor of Docker Compose (#723)
• Dependency updates: langchain-core, fastmcp 3.x, Next.js 16.1.7, aiohttp, cryptography, and more

Contributors

Thanks to everyone who contributed to this release! 🎉

• @dobberr (#656)
• @kunalk16 (#643)
• @orihatav (#622)

Full Changelog: https://github.com/lfnovo/open-notebook/compare/v1.8.1...v1.8.2