v4.8.0

## Warning
Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration).

See the assets to download this version and install.

## What's Changed
* chore(devops): blame-ignore the getattr annotation commit by @acaprau in https://github.com/onyx-dot-app/onyx/pull/14349
* fix(mcp): store each MCP tool once when a connect fires two refreshes by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14348
* feat(connector-stability): POST capability check trigger + runner task by @acaprau in https://github.com/onyx-dot-app/onyx/pull/14053
* fix(web): keep the saved embedding provider when re-indexing by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14329
* chore(devops): drop sandbox from the image audit matrix by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14354
* refactor(web): scope the forced tool to the surface that chose it by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14347
* ci(terraform-provider): publish releases to the Terraform Registry by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14318
* perf(auth): use conditional requests for the disposable email domain fetch by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14356
* docs(terraform-provider): give the provider its own LICENSE by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14359
* perf(auth): refresh disposable email domains in the background by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14357
* fix(llm): isolate Bedrock sync calls from litellm's shared HTTP pool by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14362
* refactor(web): make app position URL-driven and self-navigating by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14361
* chore(web): upgrade Next.js to 16.3.3 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14368
* fix(web): never enable auto mode for custom LLM providers by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14369
* refactor(web): give a chat one tool configuration by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14367
* fix(api): stop destroying the caller's connector, mask custom action headers by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14365
* feat(mobile): add model selector and fix composer and actions bugs by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14383
* fix(craft): honor the admin-configured default model by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13545
* feat(opal): let a Content title be struck through by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14386
* feat(opal): let a LineItemButton be disabled by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14387
* feat(github): allow a per-credential base URL for GitHub Enterprise Server by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14391
* fix(opal): let disabled outrank a Content's own colour by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14389
* fix(api): give every error response a machine-readable error_code by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14390
* feat(craft): workspace default model, settable from Craft preferences by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14303
* fix(scim): mark promoted shadow users verified on adoption by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14397
* fix(highspot): remove stale 403 xfail and fix flaky poll_source test by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14382
* feat(reindex): old-index reclaim beat task (state machine) by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/13401
* feat(reindex): consent capture + name-reuse guard by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/13403
* feat(reindex): pre-flight consent modal for won't-port connectors by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/13405
* fix(reindex): stop and clean up in-flight ports on revert/supersede by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/13438
* test(reindex-port): add integration tests for the reindex port flow by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/13090
* feat(helm): add first-class Redis TLS support (CI mirror of #14232) by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14313
* feat(web): per-block RTL rendering for chat messages by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14393
* feat(web): RTL layout support driven by the locale by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14394
* feat(i18n): Arabic locale with full RTL support by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14395
* feat(web): complete the i18n string extraction across the product by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14396
* chore(llms): update recommended models by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14402
* chore(deps): bump nltk to 3.10.3 (PYSEC-2026-3735) by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14400
* fix(terraform): resolve masked header reads against state by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14409
* fix(web): treat enterprise-settings 404 as CE, not a fatal error by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14413
* fix(web): align the build tsconfig target with types:check by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14405
* fix(llm): stop a provider edit erasing the pointer-flow defaults by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14408
* chore(docker): refresh the python slim digest for openssl 3.5.7 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14407
* feat(connector-stability): stuck capability run recovery by @acaprau in https://github.com/onyx-dot-app/onyx/pull/14054
* fix: prevent document set deletion FK violations by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14417
* fix(opal): stop an explicit undefined replacing a component's default by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14392
* fix(web): Unpin the first column in chat markdown tables by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14425
* chore(docker): refresh the DHI base image digests for openssl 3.5.7 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14428
* fix(web): translate the login welcome copy, submit label, and divider by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14416
* feat: Add Zed editor support (debug + task configs) by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14420
* chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14437
* chore(deps): bump @radix-ui/react-menubar from 1.1.20 to 1.1.24 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14438
* chore(deps): bump react-icons from 4.12.0 to 5.7.0 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14441
* chore(deps-dev): bump postcss from 8.5.24 to 8.5.26 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14442
* chore(deps): bump marked from 18.0.7 to 18.0.11 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14443
* chore(deps): bump posthog-js from 1.395.0 to 1.421.0 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14444
* chore(deps): bump tornado from 6.5.7 to 6.5.8 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14404
* fix(search): tag the search endpoints for the public OpenAPI spec by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/14446
* chore(deps-dev): bump pypdf from 6.15.0 to 6.16.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14412
* chore(deps-dev): bump mistune from 3.3.0 to 3.3.3 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14435
* chore(deps): bump terser from 5.50.0 to 5.51.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14439
* fix(web): persist a reasoning level chosen before the first message by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14448
* fix(hubspot): pass a request timeout to every HubSpot SDK call by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14453
* perf(tests): share the env fixture across the group-manager agents module by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14429
* feat(mcp): let MCP search run as a named Onyx agent by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14465
* feat: add voice provider API secret migration by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14423
* feat: keep voice provider secrets out of config by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14424
* docs(greptile): codify that the backend API has non-web consumers by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14467
* chore(scripts): retire the bastion tenant cleanup path, default to 60 days by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14464
* fix(api): harden the admin config API for machine clients by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14366
* feat(llm): admin toggle to hide provider grouping in the model selector by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14473
* perf(search): double the section-selection token budget by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/14451
* fix(llm): keep a model visible while it still holds a deployment default by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14466
* chore(deps): bump unstructured from 0.18.27 to 0.24.0 in /backend/requirements by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14472
* refactor(tools): Give tools popover rows a one-prop API by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14476
* chore(dev): upgrade devcontainer image by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14484
* fix(tools): i18n fixes for builtin-tools by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14477
* feat(ods): add "ods release beta" to cut beta release tags by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14375
* feat(ods): add `ods test` for the repo's Go modules by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14374
* fix(tools): Don't make declared sources wait on the connector fetch by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14486
* test(web): mask the usage period in admin screenshots by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14373
* perf(web): composite text shimmer on the GPU by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14489
* feat(ods): let "ods release beta" cut a new release branch by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14490
* refactor(deps): drop the unstructured package by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14494
* fix(auth): rewrite a same-provider link when the IdP re-issues its subjects by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14485
* fix(api): report only live groups on a pair, and keep a stated key by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14483
* feat(ods): ship the auditor as the onyx-devtools[audit] extra by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14488
* chore(deps): upgrade gitpython: 3.1.58->3.1.61 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14497
* chore(ci): pin onyx-devtools to the pyproject version by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14496
* chore(deps): upgrade braintrust: 0.3.9->0.37.0 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14498
* fix(appearance): Give the chat footer 500 characters by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14499
* fix(terraform-provider): survive a concurrent release, and make the licence detectable by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14487
* feat(ods): add `ods coverage` to gate Go coverage against a baseline by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14492
* refactor(appearance): Enforce the appearance length caps on the API by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14501
* fix(auth): keep oidc_expiry current when a concurrent request already refreshed the token by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14507
* chore(llms): update recommended models by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14530
* refactor(terraform-provider): rename onyx_persona to onyx_agent by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14543
* refactor(opal): Text wrapping and alignment props on `@opal/Text` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14512
* ci(terraform-provider): publish the changelog as the release body by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14546
* ci(terraform-provider): let the release App update the mirror's workflow by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14549
* docs(web): cut web/AGENTS.md by 80% and fix stale references by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14515
* fix(web): center the chat footer disclaimer when it wraps by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14551
* docs(terraform-provider): correct the publishing section and group the known limitations by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14550
* fix(deployment): pin the code-interpreter image by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14553
* feat(deployment): add a healthcheck to the code-interpreter service by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14554
* chore(compose): replace docker-compose.multitenant-dev.yml with an overlay by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14559
* feat(ods): add update-base-digests to replace Dependabot's dead Docker coverage by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14235
* fix(craft-dev): unbreak fresh local kind setup by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14562
* refactor(opal): Let `LineItemButton` props reach the row element by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14521
* fix(indexing): stop deleting visible punctuation from indexed text by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14560
* refactor(web): Move four files off `LineItem` onto `LineItemButton` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14522
* chore(deps): bump next from 16.3.1 to 16.3.4 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14569
* chore(deps): bump dompurify from 3.4.13 to 3.4.14 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14565
* chore(deps): update python base image digests by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14584
* chore(deps): update ubuntu base image digests by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14585
* chore(deps): bump @zip.js/zip.js from 2.8.26 to 2.9.0 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14571
* chore(deps): bump react and @types/react in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14570
* chore(deps-dev): bump vite from 8.1.5 to 8.2.2 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14573
* chore(deps-dev): bump azure-storage-blob from 12.30.0 to 12.30.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14575
* chore(deps): update node base image digests by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14583
* chore(deps-dev): bump croniter from 6.2.2 to 6.2.4 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14574
* chore(deps): update bun base image digests by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14582
* fix(cli): fetch config files from the release ref for -dev image tags by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14587
* fix(i18n): Translate the enabled-count phrase by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14581
* fix(cli): reload the proxy after an upgrade replaces the app containers by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14576
* chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.2 in /tools/ods by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14578
* chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.2 in /terraform-provider-onyx by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14577
* fix(sharepoint): index files synced in with back-dated modification times [mirror of #13608 for edits] by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14557
* fix(opal): Drop the hardcoded top gap on tab panels by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14591
* fix(scim): exempt the SCIM discovery documents from the tier gate by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14594
* chore(deps): bump @radix-ui/react-slider from 1.4.1 to 1.4.7 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14595
* chore(deps-dev): bump @types/lodash from 4.17.24 to 4.17.25 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14596
* fix(auth): let scoped tokens reach the search filter listings by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14593
* chore(deps-dev): bump faker from 40.1.2 to 40.38.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14600
* chore(deps-dev): bump pre-commit from 3.2.2 to 4.6.2 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14601
* chore(deps-dev): bump @types/node from 26.2.0 to 26.4.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14597
* chore(deps): bump terser from 5.51.0 to 5.51.2 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14598
* fix(opal): Lock the document while the app frame is mounted by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14590
* chore(deps-dev): bump markitdown[docx,pdf,pptx,xls,xlsx] from 0.1.2 to 0.1.7 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14599
* feat(chat): tell the model the user's interface language by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14564
* refactor(voice): harden shared streaming infrastructure by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14469
* feat(opal): Add a presentational mode to `LineItemButton` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14604
* feat(i18n): route Opal labels and date formatting through the app locale by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14552
* refactor(web): Migrate presentational rows off `LineItem` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14606
* fix(llm): send reasoning_effort=none for GPT-5.4+ tool calls over chat completions by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14603
* feat(i18n): move the remaining hardcoded admin and chat strings into the catalog by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14580
* feat(i18n): format numbers and dates in the UI locale, with Arabic-Indic digits for Arabic by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14589
* fix(web): Harden the service-account name field by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14614
* refactor(web): Make the empty-memories state a SelectCard by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14612
* refactor(web): Retire the refresh inputs that Opal already covers by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14616
* refactor(opal): Name card colors for the tokens they paint by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14615
* refactor(opal): Move the dependency-free raw inputs into Opal by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14617
* refactor(opal): Move the remaining raw inputs into Opal by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14618
* fix(auth): upgrade a placeholder on the session that holds its row lock by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14609
* feat(zoom): add Zoom API client and transcript parsing by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14481
* feat(zoom): index Cloud Recording transcripts from configured meetings by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14482
* ci: gate merge-queue checks on RunsOn Spot reruns by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14619
* chore: upgrade code-interpreter to v0.4.7 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14624
* feat(mcp): resolve search filters on the call and teach on failure by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14468
* refactor(web): Retire IconButton onto Opal's Button by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14625
* fix: keep disabled actions out of chat and unblock Chat Preferences toggles by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14627
* perf(celery): cut worker boot memory by ~28% with lazy imports by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14632
* chore(deps): update python base image digests by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14637
* feat(opal): add `@opal/AttachmentItemButton` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14629
* refactor(web): converge attachment rows on `AttachmentItemButton` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14639
* feat(opal): add InputMultiSelect and its Formik field by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14641
* feat(ods): add `ods type-coverage` to gate TypeScript type coverage against a baseline by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14628
* feat: add metadata-only system LLM tracing by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14510
* feat: track and enforce system LLM usage by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14452
* feat: expose system LLM usage in reports by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14454
* feat(cli): resolve agents by name (--agent-name) by @AhmedElsayed200 in https://github.com/onyx-dot-app/onyx/pull/14296
* chore(ruff): enable the PIE lint rules by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14645
* feat: show system LLM usage in workspace analytics by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14455
* fix: explain system usage by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14647
* chore(ci): install ods from uv.lock with hash verification by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14662
* chore(web): remove redundant `as Route` casts by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14663
* refactor(web): add JSON value types and typed readers by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14648
* refactor(opal): input naming reorg and select-family grouping by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14664
* chore(web): type JSON responses in src/lib services by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14649
* fix(cli): refuse host filesystem access from remote TUI clients by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14677
* chore(web): type JSON responses in admin pages by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14650
* chore(web): type react-markdown renderer props by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14661
* chore(web): type JSON responses in app, craft and ee code by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14653
* chore(web): replace casts on literals with satisfies and annotations by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14656
* refactor(opal): collect the input families into organizational directories by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14681
* fix(deployment): pull MinIO from quay.io and pin the latest release by digest by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14689
* ci: run pull_request workflows on every base branch by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14682
* feat(zoom): index webinars alongside meetings by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14516
* feat(zoom): discover sessions by host allowlist and Zoom Group by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14517
* fix(metrics): serve stale data while a collection stalls, add Redis socket deadlines by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14643
* fix(web): stop react-dropzone double-handling pasted files by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14700
* fix(craft): validate sandbox tar members and stop running install scripts by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14675
* fix(salesforce): keep per-record SOQL GETs under the URL budget by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14669
* fix(sharepoint): bind the access token to the tenant host and scrub logs by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14674
* fix(imap): verify TLS before sending mailbox credentials by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14670
* chore(dev): improve local kind development and add Zed launcher by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14683
* chore(web): delete unreachable modules by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14717
* refactor(ods): replace the jmelahman/tag dependency and fold tag classification into `ods release classify` by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14704
* chore(web): remove unused dependencies by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14718
* fix(auth): block email/password and is_verified mass assignment by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14673
* fix(chat): serve chat files with an inline-MIME allowlist by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14672
* refactor(web): delete unused handleFederatedOAuthCallback and uploadFilesForChat by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14658
* feat(ods): report Go coverage against the base commit's snapshot by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14563
* chore(web): enforce no-unknown-parameters and no-conditional-empty-object-spread by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14720
* build: pin the wheel build environment and upgrade Go to 1.27.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14719
* Delete .kanban.toml by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14657
* fix(ee): verify invites and bind a licence claim to the stored tenant by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14676
* fix(ee): sniff uploaded logos and bind the refresh-token route to its caller by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14679
* refactor(connectors): extract a shared Microsoft Graph package by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14620
* feat(ods): add `ods release cli` and `ods release ods` by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14724
* fix(chat): respect model limits when setting output allowances by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14605
* chore(dev): upgrade onyx-devtools to 0.13.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14725
* fix(voice): harden provider admin API before adding STT-only providers by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14728
* fix(voice): ignore Azure EndOfStream cancel on normal close by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14727
* fix(web): keep the source logo at full size on the connectors page by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14737
* fix: show agent-restricted models in agent editor by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14739
* test: Jira team-managed permission sync by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14730
* fix(auth): auto-start SSO when it is the only way in and keep the deep link by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14746
* fix(llm): stop persisting a computed max_input_tokens as an override by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14743
* fix(llm): resolve model defaults by id, not provider display name by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14744
* fix(users): show real last activity instead of the profile row timestamp by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14745
* feat: streamline GitHub group sync fetching by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14747
* fix(search): parse marked document selection lists without regex by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14740
* fix(chat): stop naming read_file where the tool is not attached by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14757
* feat(connectors): add the Outlook connector (mail) by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14726
* feat(voice): add Zoom Scribe admin and microphone flow by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14338
* feat(voice): add Zoom Scribe backend provider by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14470
* feat(telemetry): emit latency record for the main streaming chat flow by @Weves in https://github.com/onyx-dot-app/onyx/pull/14758
* feat(connectors): prune deleted Outlook conversations by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14732
* feat(connectors): index Outlook attachments and accept certificate credentials by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14736
* feat(zoom): populate access control from participants and registrants by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14523
* fix(zoom): split the recording listing into windows Zoom will honour by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14733
* chore(dev): upgrade devcontainer image by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14770
* feat(zoom): pace API calls within Zoom's account-wide rate limits by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14528
* feat(zoom): replay failed occurrences without a full reindex by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14529
* fix(chat): deleted shared chats and the anonymous persona access check by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14671
* feat(connectors): index Outlook calendar events by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14738
* fix(auth): forward the live OAuth link to pass-through tools, not the first row by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14756
* feat(connectors): sync Outlook permissions from mailbox owners and event attendees by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14752
* ci: raise the amd64 model-server build volume to 60gb by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14797
* fix(tools): keep Internal Search pinned when sources sync by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14798
* chore(ruff): enable the C4 and FURB lint rules by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14779
* chore(ci): install pre-commit tools from uv.lock by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14768
* perf(ee): run the license routes in the threadpool, and enable the ASYNC lint rules by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14769
* chore(web): upgrade TypeScript 7 to nightly and re-enable incremental by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14774
* fix(chat): point the out-of-context file notice at the python tool by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14792
* chore(web): use only TypeScript 7 in web/ by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14775
* test(connectors): add a daily live test for the Outlook connector by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14817
* fix(llm): send output_config effort on Claude 5 turns after a tool call [mirror of #14062 for edits] (#14812) to release v4.8 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14835
* ci: raise the arm64 model-server build volume to 60gb (#14834) to release v4.8 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14838
* fix(llm): honor reasoning off on adaptive-thinking Claude models (#14839) to release v4.8 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14843
* fix(connectors): restore file connector access for group managers (#14767) to release v4.8 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14855
* test(connectors): pick the Outlook fixture meeting by subject (#14896) to release v4.8 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14901
* fix: GitHub mcp form token exchange [edit of #14906] (#14909) to release v4.8 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14910
* fix(llm): show the model id in the provider model list (#14936) to release v4.8 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14939
* perf(llm): disable LiteLLM per-chunk streaming logging (#14937) to release v4.8 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14942
* chore(deps): bump anyio to 4.14.2 for GHSA-82r6-8w77-94w6 (#14889) to release v4.8 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14952
* fix(tests): name models LiteLLM still knows in the model capability tests (#15009) to release v4.8 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15011
* fix(reindex): clear stale connector alerts and harden reclaim tests (#14527) to release v4.8 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15013
* fix(pruning): read indexed ids before the crawl, not after it (#14975) to release v4.8 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15012

## New Contributors
* @AhmedElsayed200 made their first contribution in https://github.com/onyx-dot-app/onyx/pull/14296

**Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.7.0...v4.8.0