Starstruk Logo MarkStarstruk

v4.1.1

eisenzopf/rvoipv4.1.1Jun 12, 2026by github-actions[bot]

AI Summary

A security and bug fix patch release for Onyx. It consolidates SSRF protection, hardens default credentials, and improves URL validation and LLM routing.

Key Highlights

  • Consolidated SSRF protection into a single admin setting
  • Hardened default MinIO/S3 object-storage credentials
  • Applied URL validation across all fetch paths
  • Fixed Claude Fable 5 / Mythos 5 routing via adaptive thinking

New Features

  • Security hardening for non-dev deployments
  • Sanitized docx-preview output in file preview modal

Full Release Notes

## Warning
Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration).

See the assets to download this version and install.

## What's Changed
* feat(security): consolidate SSRF protection into one admin setting (#11881) to release v4.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/11970
* fix(web-connector): apply URL validation across all fetch paths (#11973) to release v4.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/11989
* fix(llm): route Claude Fable 5 / Mythos 5 through adaptive thinking (#11992) to release v4.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/11995
* fix(security): harden default MinIO/S3 object-storage credentials (#12003) to release v4.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/12018
* fix(security): require USER_AUTH_SECRET on non-dev deployments (#12038) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12042
* fix(web): don't shrink custom placeholders in PasswordInputTypeIn (#12041) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12046
* fix(web): sanitize docx-preview output in file preview modal (#12043) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12047


**Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.1.0...v4.1.1