v4.7.14

onyx-dot-app/onyxv4.7.14Oct 22, 2026by github-actions[bot]

Upgrading?

Release notes summary

v4.7.14 is a maintenance/hotfix release on the v4.7 line, focused on stability, security, and dependency hygiene rather than new functionality. It fixes permission-sync behavior around inactive cc_pairs and failed group syncs, patches a Pillow security advisory, and pins several frontend and backend dependencies to known-good versions. A CI flake affecting OpenSearch disk-watermark checks is also addressed.

Key Highlights

  • Permission sync fix: inactive cc_pairs are now skipped and failed group syncs back off instead of retrying aggressively
  • Security patch: Pillow bumped to 13.0.0 to address GHSA-8g5g-8vmr-9782
  • Dependency pins across the stack, including certifi 2026.10.19, next 16.4.1, @sentry/nextjs 10.75.2, and dompurify 3.4.17
  • CI stabilization: OpenSearch disk-watermark flakes on test runners are suppressed
  • Cherry-picked hotfixes, including per-run CVE alert posts, carried over to the v4.7 release branch

Full Release Notes

See the assets to download this version and install.

## What's Changed
* fix(perm-sync): skip inactive cc_pairs and back off failed group syncs (#16024) to release v4.7 in https://github.com/onyx-dot-app/onyx/pull/16034
* chore(hotfix): cherry-pick #16063 to release v4.7 in https://github.com/onyx-dot-app/onyx/pull/16073
* chore(hotfix): cherry-pick #16077 cve-alerts per-run posts to release v4.7 in https://github.com/onyx-dot-app/onyx/pull/16088
* fix(deps): pin certifi to 2026.10.19 everywhere to release v4.7 in https://github.com/onyx-dot-app/onyx/pull/16338
* fix(deps): bump pillow to 13.0.0 for GHSA-8g5g-8vmr-9782 (#16342) to release v4.7 in https://github.com/onyx-dot-app/onyx/pull/16347
* fix(ci): stop OpenSearch disk-watermark flakes on test runners (#15628) to release v4.7 in https://github.com/onyx-dot-app/onyx/pull/16327
* fix(deps): pin next to 16.4.1 to release v4.7 in https://github.com/onyx-dot-app/onyx/pull/16530
* fix(deps): pin @sentry/nextjs to 10.75.2 to release v4.7 in https://github.com/onyx-dot-app/onyx/pull/16525
* fix(deps): pin dompurify to 3.4.17 to release v4.7 in https://github.com/onyx-dot-app/onyx/pull/16529
* chore(deps): update node base image digests (#16505) to release v4.7 in https://github.com/onyx-dot-app/onyx/pull/16520

**Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.7.13...v4.7.14

Related Repositories