v4.7.0

## Warning
Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration).

See the assets to download this version and install.

## What's Changed
* feat(terraform): add Terraform provider for declarative Onyx configuration by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13856
* chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /terraform-provider-onyx by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13964
* chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /terraform-provider-onyx by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13963
* chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 in /terraform-provider-onyx by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13967
* feat(auth): SSRF guard for admin-configured IdP URLs by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13935
* fix(web): remove the phantom tab stop on recent chat rows by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13965
* fix(craft): surface cloud Google grant limits in rendered skills by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/13929
* feat(settings): expose accessible LLM Gateway models by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13968
* feat(users): invite modal email field matches the tag-input mocks by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13974
* chore(helm): publish charts via release assets and OCI by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13966
* feat(web): enable the jsx-a11y oxlint plugin by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13962
* fix(ci): unbreak the Helm chart release workflow by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13982
* fix(web): type-check app navigation routes and query keys by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13986
* feat(auth): per-tenant SSO provider config by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13938
* fix(ci): stop pushing buildx attestations to the ephemeral registry by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13996
* fix(web): stop vimium hinting icons inside buttons by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13994
* feat(ods): add `ods release cloud` to cut the next cloud tag off main by @acaprau in https://github.com/onyx-dot-app/onyx/pull/13975
* fix(llm): parse LM Studio option-object capabilities by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13981
* fix(usage): persist and price cache-write tokens by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13635
* feat(auth): cloud SSO login core (workspace pin + session override) by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13936
* feat(auth): cloud SSO login UI by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13937
* fix(celery): make Redis Sentinel work for beat and the result backend by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13987
* feat(notifications): add severity tier and min_severity filtering by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13988
* feat(connectors): loud admin alerts for failing and invalid connectors by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13990
* refactor(web): drive the banner queue from notification severity by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/13989
* chore(dev): upgrade onyx-devtools to 0.12.0 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14000
* fix(web): make code block inner radius concentric with its wrapper by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/13999
* feat(web): enforce anti-slop lint rules on src/ and lib/ by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14006
* chore(llms): update recommended models by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14015
* feat(permissions):new group based permission system by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/10172
* chore(helm): bump code-interpreter subchart to 0.4.6 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14019
* feat(craft): add built-in craft-documentation skill by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13075
* fix(desktop): open window.open links in the browser again by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14021
* fix(web): accept @dnd-kit/sortable v9 and v10 as opal peers by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14023
* feat(connector-stability): credential capability report table by @acaprau in https://github.com/onyx-dot-app/onyx/pull/13969
* chore(lint): enable perflint ruff rules by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14025
* feat(connector-stability): credential capability report accessors by @acaprau in https://github.com/onyx-dot-app/onyx/pull/13973
* fix(scim): carry the tenant in the SCIM token by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14016
* feat(connector-stability): blocking-path capability report recorder by @acaprau in https://github.com/onyx-dot-app/onyx/pull/13971
* fix(connector-stability): label perm-sync recordings with their own trigger by @acaprau in https://github.com/onyx-dot-app/onyx/pull/13997
* test(integration): fail collection if an integration test mocks by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14018
* feat: add PKCE support to connector OAuth by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13983
* feat: add Salesforce OAuth credential lifecycle by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13985
* feat: enable Salesforce OAuth connector setup by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13992
* fix: support Salesforce OAuth permission checks by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13993
* test: cover Salesforce OAuth setup by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13995
* feat(sso): add the verified login-domain catalog by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14026
* feat(sso): verify login domains by DNS and route cloud SSO users by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/13939
* feat(sso): domain verification and login UI for cloud OIDC SSO by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14027
* fix(usage): never block chat on legacy cost budget periods by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14042
* fix(auth): bind the tenant when sending a verification email by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14043
* fix(terraform-provider): replace role with group_ids for API keys by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14029
* test(salesforce): use an http URL to exercise the HTTPS rejection by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14048
* fix(backend): normalise pinned agents into a table, and seed them at creation by @raunakab in https://github.com/onyx-dot-app/onyx/pull/13972
* fix(health): report not-ready when the request threadpool is saturated by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14052
* fix(llm): let the backend decide which reasoning levels a model offers by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14020
* refactor(health): move the readiness check to /health/ready by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14059
* refactor(terraform): adopt the AWS modules Onyx runs in production by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14047
* feat(db): add per-model reasoning and temperature settings columns by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14069
* fix(billing): invalidate billing cache on control-plane tier push by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/12971
* refactor(craft): redesign admin apps management page by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14045
* feat(craft): expose credential placeholder keys on external app admin response by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14049
* chore(craft): add storybook coverage for craft apps admin components by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14050
* feat(db): add chat_message request params column by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14070
* refactor(ods): use fastwalk for recursive directory walks by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14077
* fix(terraform): relax the provider pin on modules that work with aws 6.x by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14080
* feat(ods): add `ods lint tf` and `ods fmt tf` by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14079
* fix(terraform): widen only s3, not every module that happened to validate by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14083
* fix(scim): survive Entra soft-delete tombstones and heal rename collisions by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14074
* fix(terraform): allow aws 6.x on postgres, which is already running there by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14089
* feat(web): let admins turn the reasoning control off by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14071
* chore(deps): bump terser from 5.49.0 to 5.49.2 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13898
* chore(deps): bump @radix-ui/react-scroll-area from 1.2.15 to 1.2.18 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13899
* chore(deps-dev): bump @types/node from 26.1.1 to 26.1.2 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13901
* chore(dev): upgrade onyx-devtools to 0.12.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14084
* chore(deps): bump actions/stale from 10.3.0 to 11.0.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13896
* chore(deps): bump dompurify from 3.4.12 to 3.4.13 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13904
* chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13897
* chore(deps): bump github.com/moby/buildkit from 0.30.0 to 0.31.1 in /tools/ods by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14091
* feat(craft): allow model switching mid-session by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14090
* docs(terraform): explain how to consume the AWS modules by ref by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14094
* feat(ods): print the deployment run URL after `ods release cloud` by @acaprau in https://github.com/onyx-dot-app/onyx/pull/14055
* chore(deps-dev): bump ruff from 0.16.0 to 0.16.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13906
* perf(ods): format Terraform files concurrently in ods fmt tf by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14098
* fix(scim): refuse rename adoption of privileged accounts by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14096
* chore(deps): bump @radix-ui/react-visually-hidden from 1.2.6 to 1.2.11 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13902
* fix: prune unowned hierarchy nodes on connector delete by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14076
* fix: Jira poll windows skip updates in non-UTC timezones by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14114
* fix(billing): resolve trialing cloud tenants to their contractual tier by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14046
* feat(ods): add `ods release --check` and use it in deployment.yml by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14072
* docs(skills): require `ods audit` before merging Dependabot PRs by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14108
* perf(docker): install only the Playwright headless shell by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14121
* feat(groups): show default groups to admins, members-only by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14031
* fix(gitbook): parse all block types with a recursive renderer by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/14085
* fix(gitbook): handle rate limits and fail loudly on page errors by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/14086
* feat(gitbook): index page descriptions by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/14087
* feat(scim): match users by provisioned userName, not account email by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14097
* feat(craft): make opencode disabled-tools list configurable via PostHog by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/13811
* feat(llm): enforce per-model reasoning caps, defaults, and temperature defaults by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14078
* test: scope the integration-test chromium download to web_search by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14124
* feat(scim): drive the login email from the emails attribute by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14110
* feat(chat): capture and persist the request params behind each message by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14095
* ci: run one model server for integration tests by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14126
* chore(ci): stop generating the OpenAPI client for tests by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14125
* perf(compose): poll healthchecks faster during startup by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14127
* feat(chat): show each response's own model on the Retry button by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14073
* feat(terraform): add the Azure vnet module by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14099
* perf(gha): drop unused Playwright install from external dep tests by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14133
* feat(terraform): add the Azure storage module by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14100
* feat(terraform): add the Azure postgres module by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14101
* feat(terraform): add the Azure redis module by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14102
* feat(terraform): add the Azure aks module by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14103
* feat(terraform): add the Azure waf module by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14104
* feat(terraform): add the Azure onyx composition and README by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14105
* chore: bump sandbox opencode to 1.18.19 (message-ID rollover fix) by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14130
* chore(gha): remove unnecessary `alembic heads --verbose` by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14136
* fix(pre-commit): stop ripsecrets flagging non-secrets by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14137
* fix(file-processing): filter junk images from PDFS by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/14113
* feat(chat): implicit preferred-response selection for multi-model chat by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14067
* refactor(oauth): share authorization attempts across OAuth flows by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14122
* fix(mcp): make OAuth authorization resumable by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14123
* refactor(mcp): isolate OAuth SDK integration by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14134
* feat(permissions): restore admin promote/demote and show default groups by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14116
* feat(groups): tag managers in the group member list by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14140
* feat(groups): keep every standard user in at least one group by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14142
* chore(tracing): migrate the Langfuse client to v4 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14143
* refactor(web): clean up how the active agent is resolved by @raunakab in https://github.com/onyx-dot-app/onyx/pull/13960
* chore(dev): upgrade onyx-devtools to 0.12.2 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14145
* fix(auth): log the IdP's response when the authorization code exchange fails by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14146
* refactor(web): flatten the /admin/configuration/* routes by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14149
* feat(web): model settings popover in the LLM provider modal by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14131
* ci: deploy full-stack previews to the local-preview server by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14030
* feat(auth): optional audience and issuer enforcement for JWT auth by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14151
* feat(web): reach projects from a folded sidebar by @raunakab in https://github.com/onyx-dot-app/onyx/pull/13943
* chore(mobile): upgrade to Expo SDK 57 and refresh dependencies by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14166
* fix: oidc self deadlock by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14181
* fix(terraform): eight Azure module fixes found by the first real apply by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14156
* fix(llms): downgrade required tool_choice to auto for GLM models by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14192
* feat(auth): move JWT auth settings to DB-backed security settings by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14153
* refactor(web): move the IconButton call sites to Opal Button by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14163
* feat(web): admin caps and defaults in the session model pane by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14132
* feat(admin): JWT auth settings on the Security & Hardening page by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14155
* feat(ods): watch the cloud release build and print the bump PR by @acaprau in https://github.com/onyx-dot-app/onyx/pull/14056
* fix(chat): sample the incognito sweep from a subquery so DISTINCT stays valid Postgres by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14194
* fix(web): stop the usage settings screenshot from flaking by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14195
* feat(cli): model switcher via /model with current model in the status bar by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14162
* fix: resume OAuth shared drive pagination from checkpoint page token by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14180
* fix(terraform): let Onyx run on Azure Managed Redis by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14200
* Revert "feat(web): reach projects from a folded sidebar (#13943)" by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14203
* chore(llms): update recommended models by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14190
* fix: recognize compose.override.yml and the .yaml spellings too by @sudoleg in https://github.com/onyx-dot-app/onyx/pull/14202
* feat(ods): move cloud release under `ods deploy cloud`, add --attach by @acaprau in https://github.com/onyx-dot-app/onyx/pull/14057
* feat(terraform): add onyx_credential and onyx_connector, and harden the client by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14207
* feat: read a single document set by id by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14211
* feat(ods): check-getattr command to ban the getattr builtin in backend python by @acaprau in https://github.com/onyx-dot-app/onyx/pull/13685
* fix: keep the embedding provider key when a client writes the mask back by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14210
* refactor(opal): restore the LineItemButton padding prop and sidebar spacing by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14213
* fix(opal): re-export the open and partial-open folder icons by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14214
* feat(gateway): make LLM gateway available on Business by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14215
* ci: skip local preview builds for merge-queue branches by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14216
* fix(slackbot): honor invite-only for Slack auto-provisioning by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14208
* fix(mcp): limit API request timeout to tool calls by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14206
* fix(ods): check-lazy-imports fails loudly on bad selectors and unreadable files by @acaprau in https://github.com/onyx-dot-app/onyx/pull/14201
* chore(repo): move loadtest and profiling into tools/ by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14152
* refactor(admin): move the invite-only toggle to Security & Hardening by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14212
* fix(web): resolve the open chat when it belongs to a project by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14230
* fix(web): send chat navigation to /app instead of /chat by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14231
* feat(web): reach projects from a folded sidebar by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14217
* chore(dev): upgrade onyx-devtools to 0.13.0 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14234
* fix(web): sit the New Project button properly beside its title by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14169
* chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/13907
* refactor(permissions): remove leftover UserRole references by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14188
* feat(audit): emit audit events for group permission and membership changes by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14238
* refactor(web): consolidate the project feature into `lib/projects/` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14233
* feat(chat): narrow-screen response carousel drives the implicit pick by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14068
* chore: finish Salesforce OAuth review follow-ups by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14219
* feat(terraform): deny non-TLS access on every S3 module bucket by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14236
* fix(opal): anchor SidebarTab tooltips to the control so the row never remounts by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/14245
* fix(whitelabeling): honor custom logo and name on auth pages, add login subtitle by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14244
* refactor(web): migrate every button onto opal and delete the old one by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14243
* chore(web): delete the dead button stylesheet by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14248
* feat(chat): sticky panel headers and whole-card response selection by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14075
* chore(skills): vendor greptile skills and add a weekly vendored-skills sync by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14254
* fix(user-files): skip embedded-image caps when image extraction is off by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/14251
* feat(web): add next-intl i18n infrastructure by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14252
* feat(terraform-provider): add onyx_cc_pair and onyx_document_set by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14220
* refactor(web): `refresh/LineItem` -> `opal/LineItemButton` migration (pt1) by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14256
* refactor(opal): give rounding a numeric scale by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14259
* ci: replace EE CODEOWNERS entries with an org-membership check by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14262
* refactor(web): put `lib/tools/` on the standard layout by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14265
* feat(chat): per-user default temperature and reasoning level by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14264
* feat(web): options button selects the model it configures by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14266
* feat(web): add language picker wired to the user language preference by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14253
* refactor(i18n): backend owns the NEXT_LOCALE cookie by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14268
* fix(web): use a pointer cursor across the whole InputSelect item by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14269
* feat(web): i18n extraction wave 1 — Settings, Auth, account popover by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14258
* feat(terraform-provider): add onyx_persona and onyx_custom_tool by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14267
* feat(web): i18n extraction wave 2a — chat shell and composer by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14287
* chore(deps): bump next from 16.2.12 to 16.3.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14277
* chore(deps-dev): bump @types/node from 26.1.2 to 26.2.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14279
* chore(deps): bump terser from 5.49.2 to 5.50.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14280
* chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14275
* chore(deps): bump react-dropzone from 14.4.1 to 20.1.0 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14281
* chore(deps): bump j178/prek-action from 2.0.4 to 3.0.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14283
* chore(deps): bump highlight.js from 11.11.1 to 11.12.0 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14276
* feat(terraform-provider): add onyx_mcp_server by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14289
* chore(deps-dev): bump accelerate from 1.6.0 to 1.14.0 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14285
* chore(deps): bump google-genai from 1.52.0 to 2.18.1 by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14286
* chore(ci): replace Vercel preview deployment with self-hosted preview by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14294
* feat(web): i18n extraction wave 2b — message renderers by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14290
* refactor(web): move the tools popover into lib/tools by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14295
* feat(terraform-provider): add onyx_user_group by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14299
* feat(web): i18n extraction wave 3a — admin views and nav by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14300
* refactor(web): move the language setting into its own card by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14307
* chore(lint): enable ruff C901 (complex-structure) by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14298
* feat(web): i18n extraction wave 3b — admin routes by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14308
* chore(web): give Opal's hooks a barrel by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14310
* ci(terraform-provider): run the acceptance suite against a real stack by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14309
* feat(web): i18n extraction wave 3c — actions, modals, sections by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14311
* refactor(web): give the search filters a home by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14321
* feat(opal): share one instance of a hook across a subtree by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14312
* feat(web): CJK font fallbacks and line breaking by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14322
* feat(terraform-provider): keep secrets out of state with write-only attributes by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14317
* feat(craft): artifact index and action receipt schema with DAL by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14319
* fix(opal): make tooltip content readable in light mode by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14339
* fix(web): give docx previews a paper page so dark mode is readable by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14343
* feat(web): share one search selection across the input bar by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14340
* fix(perm-sync): release the DB session before the connector crawl by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14342
* feat(craft): sandbox outputs manifest by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14325
* chore(devops): enforce `ods check-getattr` via pre-commit by @acaprau in https://github.com/onyx-dot-app/onyx/pull/14263
* feat(connector-stability): read-only credential capability report endpoints by @acaprau in https://github.com/onyx-dot-app/onyx/pull/14028
* fix(mcp): store each MCP tool once when a connect fires two refreshes (#14348) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14350
* fix(web): keep the saved embedding provider when re-indexing (#14329) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14352
* perf(auth): use conditional requests for the disposable email domain fetch (#14356) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14358
* chore(devops): drop sandbox from the image audit matrix (#14354) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14355
* perf(auth): refresh disposable email domains in the background (#14357) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14360
* fix(llm): isolate Bedrock sync calls from litellm's shared HTTP pool (#14362) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14363
* chore(web): upgrade Next.js to 16.3.3 (#14368) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14370
* fix(web): never enable auto mode for custom LLM providers (#14369) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14371
* fix(highspot): remove stale 403 xfail and fix flaky poll_source test (#14382) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14398
* fix(web): treat enterprise-settings 404 as CE, not a fatal error (#14413) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14414
* chore(deps): bump nltk to 3.10.3 (PYSEC-2026-3735) (#14400) to release v4.7 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14419
* chore(docker): refresh the DHI base image digests for openssl 3.5.7 (#14428) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14432
* fix(web): Unpin the first column in chat markdown tables (#14425) to release v4.7 by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14436
* fix(web): persist a reasoning level chosen before the first message (#14448) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14449
* fix(hubspot): pass a request timeout to every HubSpot SDK call (#14453) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14457
* feat(llm): admin toggle to hide provider grouping in the model selector (#14473) to release v4.7 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14475
* fix(auth): rewrite a same-provider link when the IdP re-issues its subjects (#14485) to release v4.7 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14500
* chore(deps): upgrade gitpython: 3.1.58->3.1.61 (#14497) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14503
* refactor(deps): drop the unstructured package (#14494) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14505
* fix(appearance): Give the chat footer 500 characters (#14499) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14509
* chore(hotfix): cherry-pick 2 commits to release v4.7 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14513
* fix(auth): keep oidc_expiry current when a concurrent request already refreshed the token (#14507) to release v4.7 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14514

## New Contributors
* @sudoleg made their first contribution in https://github.com/onyx-dot-app/onyx/pull/14202

**Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.6.0...v4.7.0