# SillyTavern 1.18.0

- Product: SillyTavern (https://whatsnew.fyi/product/sillytavern)
- Vendor: SillyTavern
- Date: 2026-05-03
- Version: 1.18.0
- Original notes: https://github.com/SillyTavern/SillyTavern/releases/tag/1.18.0
- Permalink: https://whatsnew.fyi/product/sillytavern/releases/1.18.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Added Cloudflare Workers AI and MiniMax as Chat Completion sources
- **changed** — KoboldCpp grammar state will be preserved when using a Continue option
- **added** — KoboldCpp added forwarding of reasoning effort when running as a Custom Chat Completion source
- **added** — Tool Calling added configurable tool calling recursion limit and enabled interleaved thinking for Custom sources
- **changed** — Text Completion impersonation requests use a Last User Message prefix at the end of the prompt if configured
- **added** — Text Generation WebUI added Adaptive-P controls
- **added** — NanoGPT added provider selection and model sorting
- **added** — Added ability to view remaining balance for OpenRouter and NanoGPT
- **added** — Enhanced support for new models: DeepSeek v4, GPT 5.4 and 5.5, Gemma 4, GLM-5V-Turbo, Claude Opus 4.7
- **removed** — Removed post-install script, config migration is now handled by the app or a dedicated npm run init command
- **added** — Added npm configuration to prevent execution of package scripts during installation
- **changed** — Moved HTTP error pages and user.css file from /public to /data to support immutable setups
- **changed** — Disabled HTTP keep-alive by default to restore old Node 18 behavior, can be enabled with config
- **added** — Added rate limiting to the basic authentication flow to mitigate brute-force attacks
- **added** — Added configuration options to choose which headers can be used for forwarded IP detection to prevent spoofing
- **added** — Added a private address whitelist to prevent SSRF attacks
- **added** — Added an IP whitelist for SSO trusted proxies to prevent authentication bypass
- **added** — Added invalidation of session cookies on password change to prevent session hijacking
- **changed** — Increased the length of password reset code to 6 characters to guard against brute-force attacks
- **added** — Implemented PKCE challenge in OpenRouter OAuth flow for more secure key exchange

#### SillyTavern 1.18.0

##### Important news

Read the maintainers statement regarding a recent security incident involving the "Bot Browser" third-party extension and learn how to stay safe: https://github.com/SillyTavern/SillyTavern/discussions/5592

##### Backends

- Added Cloudflare Workers AI and MiniMax as Chat Completion sources.
- KoboldCpp: Grammar state will be preserved when using a "Continue" option.
- KoboldCpp: Added forwarding of reasoning effort when running as a Custom Chat Completion source.
- Tool Calling: Added a configurable tool calling recursion limit; enabled interleaved thinking for Custom sources.
- Text Completion: Impersonation requests use a "Last User Message" prefix at the end of the prompt (if configured).
- Text Generation WebUI: Added Adaptive-P controls.
- NanoGPT: Added provider selection and model sorting.
- Added ability to view remaining balance for OpenRouter and NanoGPT.
- Enhanced support for new models: DeepSeek v4, GPT 5.4 and 5.5, Gemma 4, GLM-5V-Turbo, Claude Opus 4.7.

##### Server & Security

- Removed post-install script, config migration is now handled by the app or a dedicated `npm run init` command.
- Added npm configuration to prevent execution of package scripts during installation.
- Moved HTTP error pages and `user.css` file from `/public` to `/data` to support immutable setups.
- Disabled HTTP keep-alive by default to restore old Node 18 behavior, can be enabled with config.
- Added rate limiting to the basic authentication flow to mitigate brute-force attacks.
- Added configuration options to choose which headers can be used for forwarded IP detection to prevent spoofing.
- Added a private address whitelist to prevent SSRF attacks. See the documentation on how to enable and configure: [Private Address Whitelist](https://docs.sillytavern.app/usage/remoteconnections#private-address-whitelisting).
- Added an IP whitelist for SSO trusted proxies to prevent authentication bypass.
- Added invalidation of session cookies on password change to prevent session hijacking.
- Increased the length of password reset code to 6 characters to guard against brute-force attacks.
- Implemented PKCE challenge in OpenRouter OAuth flow for more secure key exchange.

##### UI/UX

- Improved swipe picker: mobile requires a long press on swipe counter to open; added buttons to expand or copy the swipe text.
- "Click to Edit" mode now also applied to reasoning blocks.
- Welcome Screen: Number of recent chats can be configured.
- Streamed requests now can show an error message in the console if the request fails.

##### STscript

- Added commands for persona management: `/persona-create`, `/persona-update`, `/persona-delete`, `/persona-duplicate`, and `/persona-get`.
- Added a command to force update the Prompt Manager's prompt list: `/pm-render`.
- Added a command to get the state of the regex script: `/regex-state`.
- Added a command to set fallback expression: `/expression-fallback`.
- Added a command to generate a streamed response with a connection profile: `/profile-genstream`.

##### Extensions

- Assets list now groups extensions by "Official" or "Community" categories.
- Added an additional confirmation prompt when installing third-party extensions (can be disabled).
- Supported extensions can use a secret-id from connection profiles when making an LLM request.
- Extensions list now shows the extension's author name resolved from the git remote URL.
- Vector Storage: Added Workers AI source; added a toggle to keep vectors for hidden messages; added retry logic to summary generation.
- Image Generation: Added Workers AI source; generation can now be cancelled by pressing a button in the status toast.
- Image Captioning: Added support for macros in the caption prompt.
- TTS: "Skip code blocks" no longer ignores lines that start with 4 spaces (legacy code block syntax); "disabled" voice now shows a toast only once per character.

###

_[Truncated at 4000 characters — full notes: https://github.com/SillyTavern/SillyTavern/releases/tag/1.18.0]_