v0.8.4-rc1

https://www.librechat.ai/changelog/v0.8.4-rc1

<details>
<summary><h2>Click to expand Release Notes</h2></summary>


## What's Changed

### 🐛 Fixes

* ⛈️ MCP Reconnection Storm Prevention with Circuit Breaker, Backoff, and Tool Stubs by [@mawburn](https://github.com/mawburn) in [#12162](https://github.com/danny-avila/LibreChat/pull/12162)
* 🛤️ Base URL Fallback for Path-based OAuth Discovery in Token Refresh by [@oreonl](https://github.com/oreonl) in [#12164](https://github.com/danny-avila/LibreChat/pull/12164)
* 🛂 MCP OAuth Race Conditions, CSRF Fallback, and Token Expiry Handling by [@danny-avila](https://github.com/danny-avila) in [#12171](https://github.com/danny-avila/LibreChat/pull/12171)
* 🫙 Force MeiliSearch Full Sync on Empty Index State by [@danny-avila](https://github.com/danny-avila) in [#12202](https://github.com/danny-avila/LibreChat/pull/12202)
* 🔏 MCP Server URL Schema Validation by [@danny-avila](https://github.com/danny-avila) in [#12204](https://github.com/danny-avila/LibreChat/pull/12204)
* 🪪 MCP API Responses and OAuth Validation by [@danny-avila](https://github.com/danny-avila) in [#12217](https://github.com/danny-avila/LibreChat/pull/12217)
* 🚦 Add Rate Limiting to Conversation Duplicate Endpoint by [@danny-avila](https://github.com/danny-avila) in [#12218](https://github.com/danny-avila/LibreChat/pull/12218)
* 🔐 Add User Filter to Message Deletion by [@danny-avila](https://github.com/danny-avila) in [#12220](https://github.com/danny-avila/LibreChat/pull/12220)
* 🔑 Require OTP Verification for 2FA Re-Enrollment and Backup Code Regeneration by [@danny-avila](https://github.com/danny-avila) in [#12223](https://github.com/danny-avila/LibreChat/pull/12223)
* 🛡️ Agent Permission Check on Image Upload Route by [@danny-avila](https://github.com/danny-avila) in [#12219](https://github.com/danny-avila/LibreChat/pull/12219)
* 🧹 Sanitize Artifact Filenames in Code Execution Output by [@danny-avila](https://github.com/danny-avila) in [#12222](https://github.com/danny-avila/LibreChat/pull/12222)
* 🌊 Prevent Buffered Event Duplication on SSE Resume Connections by [@danny-avila](https://github.com/danny-avila) in [#12225](https://github.com/danny-avila/LibreChat/pull/12225)
* 📎 Respect fileConfig.disabled for Agents Endpoint Upload Button by [@danny-avila](https://github.com/danny-avila) in [#12238](https://github.com/danny-avila/LibreChat/pull/12238)
* 📎 Enforce File Count and Size Limits Across All Attachment Paths by [@danny-avila](https://github.com/danny-avila) in [#12239](https://github.com/danny-avila/LibreChat/pull/12239)
* 🛰️ Cross-Replica Created Event Delivery by [@danny-avila](https://github.com/danny-avila) in [#12231](https://github.com/danny-avila/LibreChat/pull/12231)
* 🛡️ Cover full fe80::/10 link-local range in IPv6 check by [@danny-avila](https://github.com/danny-avila) in [#12244](https://github.com/danny-avila/LibreChat/pull/12244)
* 🪤 Fail-Closed MCP Domain Validation for Unparseable URLs by [@danny-avila](https://github.com/danny-avila) in [#12245](https://github.com/danny-avila/LibreChat/pull/12245)
* 🛡️ Enforce MULTI_CONVO and agent ACL checks on addedConvo by [@danny-avila](https://github.com/danny-avila) in [#12243](https://github.com/danny-avila/LibreChat/pull/12243)
* 🛡️ Validate User-provided URLs for Web Search by [@danny-avila](https://github.com/danny-avila) in [#12247](https://github.com/danny-avila/LibreChat/pull/12247)
* 🪪 Enforce VIEW ACL on Agent Edge References at Write and Runtime by [@danny-avila](https://github.com/danny-avila) in [#12246](https://github.com/danny-avila/LibreChat/pull/12246)
* 📑 Sanitize Markdown Artifacts by [@danny-avila](https://github.com/danny-avila) in [#12249](https://github.com/danny-avila/LibreChat/pull/12249)
* 🫷 Validate User-Provided Base URL in Endpoint Init by [@danny-avila](https://github.com/danny-avila) in [#12248](https://github.com/danny-avila/LibreChat/pull/12248)
* 🔏 Scope Agent-Author File Access to Attached Files Only by [@danny-avila](https://github.com/danny-avila) in [#12251](https://github.com/danny-avila/LibreChat/pull/12251)
* 🪙 Resolve Azure AD Group Overage via OBO Token Exchange for OpenID by [@Airamhh](https://github.com/Airamhh) in [#12187](https://github.com/danny-avila/LibreChat/pull/12187)
* 🔏 Enforce MCP Server Authorization on Agent Tool Persistence by [@danny-avila](https://github.com/danny-avila) in [#12250](https://github.com/danny-avila/LibreChat/pull/12250)
* 🛂 Enforce Actions Capability Gate Across All Event-Driven Tool Loading Paths by [@danny-avila](https://github.com/danny-avila) in [#12252](https://github.com/danny-avila/LibreChat/pull/12252)
* 🧱 Enforce Agent Access Control on Context and OCR File Loading by [@danny-avila](https://github.com/danny-avila) in [#12253](https://github.com/danny-avila/LibreChat/pull/12253)
* 🗝️ Exempt Admin-Trusted Domains from MCP OAuth Validation by [@danny-avila](https://github.com/danny-avila) in [#12255](https://github.com/danny-avila/LibreChat/pull/12255)
* 🧯 Prevent Env-Variable Exfil. via Placeholder Injection by [@danny-avila](https://github.com/danny-avila) in [#12260](https://github.com/danny-avila/LibreChat/pull/12260)
* 🪪 Enforce Conversation Ownership Checks in Remote Agent Controllers by [@danny-avila](https://github.com/danny-avila) in [#12263](https://github.com/danny-avila/LibreChat/pull/12263)
* 🔏 Remove Federated Tokens from OpenID Refresh Response by [@danny-avila](https://github.com/danny-avila) in [#12264](https://github.com/danny-avila/LibreChat/pull/12264)
* 🪝 MCP Refresh token on OAuth Discovery Failure by [@danny-avila](https://github.com/danny-avila) in [#12266](https://github.com/danny-avila/LibreChat/pull/12266)
* 🪢 Action Domain Encoding Collision for HTTPS URLs by [@danny-avila](https://github.com/danny-avila) in [#12271](https://github.com/danny-avila/LibreChat/pull/12271)
* 🏷️ Clear Model Spec Fields When Navigating with Non-spec Query Params by [@danny-avila](https://github.com/danny-avila) in [#12274](https://github.com/danny-avila/LibreChat/pull/12274)
* 🧯 Add Pre-Parse File Size Guard to Document Parser by [@danny-avila](https://github.com/danny-avila) in [#12275](https://github.com/danny-avila/LibreChat/pull/12275)
* 🛂 Validate `types` Query Param in People Picker Access Middleware by [@danny-avila](https://github.com/danny-avila) in [#12276](https://github.com/danny-avila/LibreChat/pull/12276)

### 🔧 Refactoring

* 🔄 OAuth Metadata Discovery with Origin Fallback by [@danny-avila](https://github.com/danny-avila) in [#12170](https://github.com/danny-avila/LibreChat/pull/12170)
* ⚡ Replace `tiktoken` with `ai-tokenizer` by [@danny-avila](https://github.com/danny-avila) in [#12175](https://github.com/danny-avila/LibreChat/pull/12175)
* 📏 Add File Size Limits to Conversation Imports by [@danny-avila](https://github.com/danny-avila) in [#12221](https://github.com/danny-avila/LibreChat/pull/12221)
* 💁 Better Config UX for MCP STDIO with `customUserVars` by [@danny-avila](https://github.com/danny-avila) in [#12226](https://github.com/danny-avila/LibreChat/pull/12226)
* 🛡️ Scope Action Mutations by Parent Resource Ownership by [@danny-avila](https://github.com/danny-avila) in [#12237](https://github.com/danny-avila/LibreChat/pull/12237)
* 🐍 Normalize Non-Standard Browser MIME Type Aliases in `inferMimeType` by [@danny-avila](https://github.com/danny-avila) in [#12240](https://github.com/danny-avila/LibreChat/pull/12240)
* 🔧 Proper MCP Menu Dismissal by [@dustinhealy](https://github.com/dustinhealy) in [#12256](https://github.com/danny-avila/LibreChat/pull/12256)

### ⚙️ Other Changes

* 🧪 MCP Reconnect Storm Follow-Up Fixes and Integration Tests by [@danny-avila](https://github.com/danny-avila) in [#12172](https://github.com/danny-avila/LibreChat/pull/12172)
* 📦 Bump NPM Audit Packages by [@danny-avila](https://github.com/danny-avila) in [#12227](https://github.com/danny-avila/LibreChat/pull/12227)
* 📦 Bump `@librechat/agents` to v3.1.56 by [@danny-avila](https://github.com/danny-avila) in [#12258](https://github.com/danny-avila/LibreChat/pull/12258)

### 🌍 Internationalization

* 🌍 i18n: Update translation.json with latest translations by [@github-actions[bot]](https://github.com/apps/github-actions) in [#12176](https://github.com/danny-avila/LibreChat/pull/12176), [#12203](https://github.com/danny-avila/LibreChat/pull/12203), [#12259](https://github.com/danny-avila/LibreChat/pull/12259)

</details>

## New Contributors

* [@oreonl](https://github.com/oreonl) made their first contribution in [#12164](https://github.com/danny-avila/LibreChat/pull/12164)

**Full Changelog**: https://github.com/danny-avila/LibreChat/compare/v0.8.3...v0.8.4-rc1