v4.5.0

## Warning
Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration).

See the assets to download this version and install.

## What's Changed
* feat(opal): add Modal by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/12835
* fix(chat): include current model in options so the default chip renders by @claude[bot] in https://github.com/onyx-dot-app/onyx/pull/13144
* feat(opal): render `TextButton` with an internal `as="p"` instead by @raunakab in https://github.com/onyx-dot-app/onyx/pull/13141
* feat(opal): add modal context hooks by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/12872
* feat(opal): add ConfirmationModalLayout by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/12873
* fix(auth): admin modal shows the SAML ACS the flow actually validates by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13147
* fix(web): correct sidebar & settings-nav responsive breakpoints by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13148
* refactor(web): migrate the modal ecosystem to Opal by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/12840
* feat(cache): add cache_shared_lock backend-agnostic distributed lock by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13145
* feat(metrics): MCP server/client metrics + DB-snapshot connector state gauges [mirror of #12904 for edits] by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13086
* fix(mcp): single-flight the OAuth refresh primitive per config row by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13146
* chore(deps): bump serde_with from 3.17.0 to 3.21.0 in /desktop/src-tauri by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13071
* feat(skills): prompt to reload stale session skills by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13133
* feat(desktop): add --version flag by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13152
* fix(craft): preserve stale skill refresh ordering by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13157
* fix: lowercase model name when deriving OpenSearch index name by @mvanhorn in https://github.com/onyx-dot-app/onyx/pull/12299
* feat(connectors): Box connector (indexing + permission sync) by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/12862
* fix: sharepoint role names localization by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13167
* chore(fmt): remove `force-single-line` by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/12996
* chore(fmt): remove `order-by-type` by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13183
* fix(image-generation): sanitize test endpoint errors by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13151
* fix(gdrive): stream folders during group sync to bound memory by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13190
* feat(auth): capture SAML directory attributes for profile enrichment by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13019
* chore(deps): upgrade litellm 1.89.4 -> 1.93.0 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13192
* fix(desktop): match default window width to large breakpoint by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13194
* feat(auth): per-tenant claims capture, enable IdP enrichment on multi-tenant by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13135
* fix(desktop): respect configured window_title by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13196
* feat(craft): add external app admin disablement by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13200
* fix(metrics): serve worker /metrics on a dual-stack socket by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13191
* fix(desktop): only reserve the title-bar strip on macOS by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13204
* chore(git): add import-sort formatting commits to blame-ignore by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13209
* feat(auth): retain per-provider IdP claim snapshots by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13136
* feat: per-user usage + cost tracking — accounting (2/4) [modifying #11887] by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/12551
* fix(scripts): make tenant cleanup toolkit safe to run concurrently by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13193
* feat(ollama): store API key in api_key field instead of custom_config by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13198
* fix(auth): harden IdP claims capture and resolution by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13137
* feat(opal): add OnyxLoader, IconLoader, and PageLoader by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/12917
* feat(opal): add home and square-plus icons, fix clamped title overflow by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13153
* fix: resolve empty OAuth credential modal for zero-kwargs OAuth connectors by @claude[bot] in https://github.com/onyx-dot-app/onyx/pull/13212
* chore(tools): rm `desktop/CLAUDE.md` by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13215
* refactor(web): migrate InputTextArea consumers to Opal by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/12989
* feat(security): LLM env injection toggle on security hardening page by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13170
* test(auth): cover IdP enrichment integration surface by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13138
* fix(fe): align header items at `flex-start` by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13218
* fix(craft): clean up orphan sandbox workspaces by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13202
* feat(llm): pass custom_config to Litellm kwargs by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13087
* chore(deps): upgrade celery-types to 0.26.0 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13221
* fix(opal): correct home icon geometry to the design glyph by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13223
* fix(auth): let multi-IdP SSO logins claim permission-sync placeholder users by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13224
* fix(onboarding): make flow scrollable and responsive at small viewports by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13228
* fix(tools): rename Code Interpreter LLM function name off OpenAI-reserved "python" by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13235
* feat: daily cost usage buckets by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13226
* chore(db): migrate python tool db name to run_python, drop code-side resolution by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13238
* fix(chat): restore 24px welcome-to-input gap per design spec by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13251
* feat(devcontainer): add cargo to devcontainer image by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13201
* fix(sidebar): scroll-aware edge fades, hide native scrollbar by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13236
* fix: canvas start date by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13254
* chore(dev): upgrade devcontainer image by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/13261
* feat(mcp): add available_in_craft flag + craft-enabled listing API by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13068
* fix(auth): invite-only gates SSO signups, and placeholder claims stop 500ing by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13237
* refactor(mcp): polymorphic gated_app identity for gated targets by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13169
* chore(redis): Log Redis config on app start by @acaprau in https://github.com/onyx-dot-app/onyx/pull/13125
* feat(craft): sandbox-proxy MCP credential resolver by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13126
* fix(auth): harden SSO callbacks, invite-only toggle, and error surfacing by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13256
* fix(desktop): reliable Linux Alt-menu toggle + main.rs hardening by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13219
* chore(deps): bump @radix-ui/react-menubar from 1.1.18 to 1.1.20 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13044
* chore(deps): bump terser from 5.48.0 to 5.49.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13045
* chore(deps): bump sharp from 0.34.5 to 0.35.3 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13047
* chore(deps-dev): bump vite from 8.0.16 to 8.1.3 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13043
* chore(deps-dev): bump jest and @types/jest in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13042
* chore(deps-dev): bump @types/node from 25.9.1 to 26.1.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13041
* chore(deps): bump helm/chart-testing-action from 2e2940618cb426dce2999631d543b53cdcfc8527 to d6db0ca01d3598ea552ccf97edb5de6fe6b54ce0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13038
* feat(skills): support duplicate skill names by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13225
* chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /tools/ods by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13274
* chore(deps): bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13039
* chore(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13040
* chore(deps): bump pillow from 12.2.0 to 12.3.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13214
* chore(deps): bump gitpython from 3.1.50 to 3.1.52 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13271
* feat(helm): distroless model-server chart — nonroot + 0.7.0 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/12788
* chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13272
* fix(desktop): show Onyx icon in the Linux About dialog by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13276
* chore(deps-dev): bump pypdf from 6.13.3 to 6.14.2 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13048
* feat(ods): run bun install when desktop workspace deps are missing by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13279
* feat(image-gen): add Gemini 3 Pro Image (GA), hide discontinued preview by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13284
* chore(dev): upgrade onyx-devtools to 0.10.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/13286
* feat(connectors): add include_attachments setting to Confluence connector by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13283
* feat: efficient token tracking by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13275
* feat(file_store): add native Azure Blob Storage backend by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13280
* feat(mcp): emit craft-enabled MCP servers into opencode config by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13158
* feat(reindex): sweep docs a port copy resurrects after a delete by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/12733
* feat(userfile-port): scope-polymorphic PortAttempt + helpers by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/12766
* feat(index-settings): re-indexing progress banner by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/12849
* chore: remove unused mouse tracking hook by @romitg2 in https://github.com/onyx-dot-app/onyx/pull/13296
* feat: per-user usage + cost tracking — enforcement (3/4) [edit of #11888] by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13222
* feat(skills): review uploads before creation by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13281
* fix(sync): release PG connection before document-index I/O in metadata sync task by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13290
* fix(auth): tolerate OIDC IdPs that omit email_verified, strict as per-provider opt-in by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13300
* feat(telemetry): daily version heartbeat for self-hosted instances by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13317
* feat(sharepoint): support OneDrive for Business and personal SharePoint site indexing [mirror of #13253 for edits] by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13303
* chore(deploy): remove unused docker-compose.prod-cloud.yml by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13325
* docs(agents): refresh AGENTS.md, split backend standards into backend/AGENTS.md by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13301
* feat(mcp): proxy-authoritative per-tool approvals for craft MCP by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13168
* fix(security): stop logging verify token / unsanitized PAT name (ENG-4306, ENG-4307) by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13328
* feat: OpenAI-compatible Onyx LLM gateway endpoint by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13248
* fix(image-gen): stream keepalives so LB idle timeouts don't kill slow generations by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13282
* feat(hooks): drive endpoint SSRF validation from ssrf_protection_level by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/13321
* refactor(craft): decouple external apps from skills by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13320
* fix(telemetry): version heartbeat tests fail in CI where DISABLE_TELEMETRY is set by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13337
* fix(db): make external app downgrade resilient by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13338
* fix: confluence dc link by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13341
* feat(reindex-port): PAUSED status scaffolding + pause-aware reporting by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/12922
* feat(mcp): Frontend for Craft MCP by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13291
* fix(chat): ensure agent persists correctly after page refresh by @raunakab in https://github.com/onyx-dot-app/onyx/pull/13355
* feat(mcp): hot-reload craft MCP servers into running sandboxes by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13293
* fix(logging): clarify that LICENSE_ENFORCEMENT_ENABLED does not mean the deployment is Enterprise by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13356
* fix(llm): route Azure responses-bridge calls to the v1 responses surface by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13340
* chore: enable claude-security plugin in shipped Claude Code settings by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13360
* fix(llm): don't send reasoning_effort to o1-mini / o1-preview by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13334
* chore(craft): bump sandbox onyx-cli pin to 1.2.3 by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13358
* feat(craft): fail fast when SANDBOX_API_SERVER_URL lacks its API path prefix by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13357
* refactor(craft): decouple custom app creation from skills by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13339
* feat: mcp shared api key header [edit of #13278] by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13335
* refactor(web): migrate PasswordInputTypeIn consumers to Opal by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/12981
* fix(web): hide zero-tool MCP servers in agent editor Actions by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13369
* fix(security): stop compiling user search query as a regex — ReDoS (ENG-4296) by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13326
* fix: form-encoded MCP OAuth refresh responses [edit of #13331] by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13336
* perf: optimize list_all_users user listing by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13370
* fix(e2e): deflake share-modal-link-created visual screenshot by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13376
* perf: stop search_chats from blocking the event loop with sync DB I/O by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13379
* chore: put repo venv on PATH for Claude Code shells via SessionStart hook by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13380
* fix(auth): refresh OAuth tokens with the SSO provider row's credentials by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13346
* refactor(craft): make external app skills first-class by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13373
* fix(mcp): require stored tokens for per-user OAuth "connected" status by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13381
* refactor: consolidate API routing on ONYX_SERVER_URL by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13375
* fix: expand $PATH at hook time in Claude Code SessionStart env hook by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13386
* feat(craft): surface external app skills in skills UI by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13374
* fix: add retriever to impersonation list when retrieving permissions by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13395
* fix: run Claude Code venv PATH hook portably under /bin/sh by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13396
* feat(helm): retune chart defaults from fleet evidence + SIZING.md (0.8.0) by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13392
* feat(terraform): t-shirt sizing (small/medium/large) for the AWS stack by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13382
* chore(llms): update recommended models by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/13408
* fix(web): anchor the Add Model tooltip to the add button by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13409
* fix(notion): add slim retrieval so pruning streams IDs instead of full content by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13397
* feat(db): add chat_session.reasoning_effort_override column by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13377
* refactor: remove dead include_onyxbot_flows option by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13411
* fix(llm): isolate Anthropic sync calls from litellm's shared HTTP pool by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13295
* perf(db): add composite index on chat_session (user_id, onyxbot_flow, time_updated DESC) by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13391
* fix(craft): support Claude 5 adaptive thinking by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13415
* feat(craft): manage external app skill associations by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13394
* chore(dev): upgrade devcontainer image by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/13414
* fix(mcp): stop emitting unauthenticated MCP servers into craft sessions by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13413
* fix(model selection): emit display-cased vendor from the backend by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13418
* chore(deps): bump nltk from 3.9.4 to 3.10.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13388
* feat(llm): per-session reasoning effort control and provider-rejection fallback by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13378
* chore(deps): bump quinn-proto from 0.11.14 to 0.11.16 in /desktop/src-tauri by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13421
* chore(deps): bump httplib2 from 0.31.0 to 0.32.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13423
* feat(log export): Add API endpoint for getting a zip of logs by @acaprau in https://github.com/onyx-dot-app/onyx/pull/13398
* feat(craft): add external app skill association UI by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13410
* chore(deps): bump gitpython from 3.1.52 to 3.1.54 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13422
* feat(web): reasoning level and temperature controls in the model selector by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13365
* perf(db): add index on chat_message (chat_session_id) by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13424
* fix(ttl): register EE TTL tasks on the light worker app by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13426
* feat: route Craft sandboxes through the Onyx LLM gateway by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13249
* feat: gateway-backed Craft model picker by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13250
* chore(log export): Enforce enterprise tier by @acaprau in https://github.com/onyx-dot-app/onyx/pull/13433
* feat(helm): configurable celery beat schedule path + extraArgs (chart 0.8.1) by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13439
* feat(log export): Add admin panel page and download button by @acaprau in https://github.com/onyx-dot-app/onyx/pull/13399
* chore(deps-dev): bump postcss from 8.5.15 to 8.5.19 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13308
* chore(deps-dev): bump storybook from 8.6.18 to 10.5.0 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13313
* chore(deps): bump @radix-ui/react-avatar from 1.2.0 to 1.2.2 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13315
* chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13305
* chore(deps): bump actions/setup-go from 6.4.0 to 7.0.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13306
* chore(deps): bump tauri-apps/tauri-action from 0.6.2 to 1.0.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13304
* chore(deps): bump motion from 12.42.0 to 12.42.2 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13316
* chore(deps-dev): bump vite from 8.1.3 to 8.1.5 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13307
* feat(tracing): record effective LLM request params on generation spans by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13444
* chore(deps): bump next from 16.2.10 to 16.2.11 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13345
* feat(craft): distinguish external apps from MCP servers by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13434
* fix(build): remove dev tools from the default backend image, publish a -dev variant by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13441
* fix(web): separate slider captions from tick labels in model selector by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13449
* chore(deps): bump prometheus-fastapi-instrumentator from 8.0.0 to 8.0.2 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13046
* chore(dependabot): ignore types-* stub packages in uv updates by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13454
* fix(llm): detect Claude model identity in deployment_name too by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13443
* fix(chat): explain empty attachments to the model instead of silent emptiness by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13446
* test(craft): cover config reconciliation on session reuse by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13450
* chore(deps-dev): remove unused pandas-stubs by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13460
* fix(auth): password auth kill switch for SSO cutover by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/12887
* fix(tools): disabling web search puts open_url in indexed-only mode by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13442
* chore: exclude sharepoint site from tests by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13447
* feat(log export): Prevent concurrent exports by @acaprau in https://github.com/onyx-dot-app/onyx/pull/13431
* chore(deps-dev): bump oxfmt from 0.56.0 to 0.59.0 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13463
* fix(ci): coordinate Kubernetes startup migrations by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13474
* feat(craft): Prometheus telemetry for sandbox provisioning latency by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13470
* fix(web): apply oxfmt 0.59 formatting by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13481
* chore(deps-dev): bump ruff to 0.16.0 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13479
* fix(storybook): align @storybook/* addon versions with storybook 10.5.0 by @claude[bot] in https://github.com/onyx-dot-app/onyx/pull/13482
* feat(auth): per-provider PKCE and scope overrides on SSO provider rows by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13364
* chore(build): publish -dev tags for the web, model-server, and sandbox images by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13478
* feat(llm): add Portkey as a built-in LLM provider (3 API modes) by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/12965
* chore(deps): bump dompurify from 3.4.11 to 3.4.12 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13268
* chore(deps): bump pillow from 12.2.0 to 12.3.0 in /backend/onyx/server/features/build/sandbox/image by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13389
* feat(skills): import skills from GitHub by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13427
* chore(deps): bump dompurify from 3.4.11 to 3.4.12 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13457
* ci(storybook): add advisory Storybook build to presubmit by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13483
* chore(deployment): stop advertising env-based SSO setup in templates and installers by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13292
* chore(claude): add merge-dependabot-prs skill by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13484
* chore(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13462
* chore(deps-dev): bump @tailwindcss/postcss from 4.3.2 to 4.3.3 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13461
* chore(deps): bump aws-actions/configure-aws-credentials from 6.2.0 to 6.2.2 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13458
* chore(deps): bump @radix-ui/react-scroll-area from 1.2.12 to 1.2.15 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13459
* chore(deps): bump hashicorp/setup-terraform from 4.0.0 to 4.0.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13455
* chore(deps): bump @dnd-kit/sortable from 8.0.0 to 10.0.0 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13466
* chore(deps-dev): bump hubspot-api-client from 11.1.0 to 12.0.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13467
* chore(deps): bump mcp from 1.27.0 to 1.28.1 in /backend/requirements by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13099
* fix(web): don't flash raw 'Loading...' text in connector access selector by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13488
* feat(connectors): allow GitHub connector to index files from a specific branch by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13486
* fix(web): size the model picker list pane to its content (#13597) to release v4.5 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/13599
* fix(chat): classify model refusals instead of generic EmptyLLMResponseError (#13332) to release v4.5 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13629
* fix: hierarchynodes accessible private connectors (#13625) to release v4.5 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/13644
* chore: add refusal reasons (#13628) to release v4.5 by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13647
* chore(hotfix): cherry-pick 7 commits to release v4.5 by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13656
* fix: knowledge pane query filters (#13665) to release v4.5 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/13669
* feat(llm): admin-selectable API mode for Bifrost (chat completions / responses) (#13642) to release v4.5 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/13675
* fix(llm): harden litellm responses bridge for gateway streaming variants (#13668) to release v4.5 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13679
* fix(slack): correct link, email, code and list rendering in bot answers (#13626) to release v4.5 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/13718
* chore(hotfix): cherry-pick 8 commits to release v4.5 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13719
* fix(auth): treat the backend login redirect as SSO callback success (#13509) to release v4.5 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13720

## New Contributors
* @mvanhorn made their first contribution in https://github.com/onyx-dot-app/onyx/pull/12299
* @romitg2 made their first contribution in https://github.com/onyx-dot-app/onyx/pull/13296

**Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.4.0...v4.5.0