v4.9.0

## Warning
Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration).

See the assets to download this version and install.

## What's Changed
* chore(opal): build with tsdown and TypeScript 7 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14776
* test(ods): raise ods test coverage to 90% by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14771
* fix(llm): send output_config effort on Claude 5 turns after a tool call [mirror of #14062 for edits] by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14812
* ci: raise the arm64 model-server build volume to 60gb by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14834
* ci(go): cache Go build and test results across runs by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14836
* fix(connectors): share Teams channels with their members, not the tenant by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14840
* fix(files): validate file references at access boundaries by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14824
* fix(oauth): validate endpoints and bind callbacks to their owner by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14831
* fix(users): restrict test provisioning and scoped directory fields by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14819
* fix(gateway): meter disconnected streams and restrict shared references by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14826
* fix(llm): honor reasoning off on adaptive-thinking Claude models by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14839
* fix(tools): encode request parameters and bound search waits by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14813
* fix(search): filter tag suggestions by document access by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14818
* feat(connectors): index Teams threads per message and checkpoint per channel page by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14842
* fix(connectors): cap downloads and protect temporary credentials by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14821
* fix(permissions): count oversized ACLs as sync errors by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14811
* feat(tools): an empty source selection searches nothing by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14820
* fix(clients): protect navigation and sensitive request data by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14833
* fix(llm): send explicit reasoning none for OpenAI models that support it by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14810
* fix(connectors): restore file connector access for group managers by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14767
* feat(chat): add experimental search receipts to internal search responses by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14849
* fix(logging): keep request secrets and internal traces private by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14823
* docs(hierarchy): explain unfiltered MIT connector visibility by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14815
* ci(preview): build previews for pull requests, not every branch push by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14852
* refactor(cli): order struct fields to remove padding by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14872
* refactor(terraform): order struct fields for tight memory alignment by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14873
* refactor(ods): order struct fields for tight memory layout by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14874
* feat(web): chat-scoped search filters, orthogonal to the tool trinary by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14846
* fix(web): point the Coda connector docs link at a page that exists by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14876
* fix(web): tools popover polish by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14850
* fix(auth): tenant-aware websocket auth; fixes craft HMR preview on multi-tenant by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14875
* fix(auth): stop pinning a DB connection for the whole streaming response by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14871
* feat(connectors): index files posted in Teams channels behind an attachments option by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14851
* chore(deps): bump anyio to 4.14.2 for GHSA-82r6-8w77-94w6 by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14889
* fix(lint): apply ruff dict.fromkeys autofixes in zoom connector by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14890
* chore: rm `jmelahman` mentions by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/14897
* feat(admin): add a copy button to the reset password modal by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14892
* fix(slack): close socket clients for deleted Slack bots by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14886
* test(connectors): pick the Outlook fixture meeting by subject by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14896
* fix(tenants): scope index scans and cache tier lookup misses by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14827
* chore(dev): upgrade onyx-devtools to 0.13.8 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/14902
* fix(metrics): restore DB connection metrics under external poolers and sharding by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14895
* chore: add Google Drive partial-visibility test expectations by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14907
* fix: GitHub mcp form token exchange [edit of #14906] by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14909
* feat: for edits option in ods run-ci by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/13363
* fix(sidebar): highlight search tab while the search command menu is open by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14935
* feat(connectors): index the images pasted into Teams messages by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14856
* fix(llm): show the model id in the provider model list by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14936
* perf(llm): disable LiteLLM per-chunk streaming logging by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14937
* revert: remove experimental search receipts from internal search responses (#14849) by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14938
* fix(llm): floor reasoning off at low for Gemini 3.7+ Flash by @devin-ai-integration[bot] in https://github.com/onyx-dot-app/onyx/pull/14945
* refactor(search): remove the dead bypass_acl flag by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14943
* refactor(file_processing): share the WebVTT transcript parser and let it keep speakers by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14861
* fix(cost): stop recording $0 for gateway models litellm cannot price by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14947
* refactor(connectors): split the Teams connector into one module per content type by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14956
* fix(nrf): search results washed out and unscrollable on the extension new tab page by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14957
* fix(drupal-wiki): stop a failed page fetch from pruning the page by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14959
* feat(ods): install onyx-llm-context skills as Cursor rules by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14944
* feat(ods): install onyx-llm-context for Codex via a compiled local file by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14946
* fix(connectors): make DocumentFailure.document_id match Document.id by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14962
* ci(preview): report a failed preview instead of leaving a stale success by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14967
* refactor(opal): unify the input-select family by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14646
* perf(llm): initialize litellm once per process, not once per message by @Danelegend in https://github.com/onyx-dot-app/onyx/pull/14964
* fix(indexing): never caption with a vision model nobody chose by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14965
* refactor(opal): split `InputTypeInTag` from `InputMultiSelect` + regroup inputs by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14970
* feat(connectors): index Teams meeting transcripts as their own documents by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14863
* refactor(web): `lib/indexing/` becomes `lib/searchSettings/` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14982
* feat(ods): install-skill updates the checkout by default by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14971
* perf(connectors): share Teams threads with a group, not a list of people by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14928
* fix(web): hide craft_file from the Add Connector page by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14991
* refactor(web): rename lib/search/interfaces.ts to types.ts by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14994
* feat: let the chat widget forward end-user JWTs by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14968
* feat(opal): clickable `SelectCards` are keyboard-operable by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14997
* feat: add Salesforce packaged ECA metadata by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14953
* perf(llm): send a plain request from invoke() when streaming is not needed by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/14954
* feat(chat): answer-completeness reminder for search-backed turns by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/14960
* feat(connectors): reskin the connector catalog by @raunakab in https://github.com/onyx-dot-app/onyx/pull/14993
* feat(admin): indexing status page moves to `/admin/indexing-status` + minor UI touches by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15000
* docs: refresh README and Simplified Chinese translation by @yuhongsun96 in https://github.com/onyx-dot-app/onyx/pull/15005
* chore: document Salesforce ECA releases by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15006
* feat(llm): add Vercel AI Gateway as a built-in provider by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14969
* fix(tests): name models LiteLLM still knows in the model capability tests by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15009
* feat(connectors): index the chat of Teams meetings by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14929
* perf(connectors): stop the Teams permission sync re-reading threads, and prune channels side by side by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/14958
* feat(reindex): verify ported documents before the index swap by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14463
* fix(pruning): read indexed ids before the crawl, not after it by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14975
* fix(reindex): clear stale connector alerts and harden reclaim tests by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14527
* fix(chrome-extension): only accept new tab messages from the Onyx origin by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15023
* fix(api): return a generic body for unhandled server errors by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14985
* fix(auth): rate-limit JWT public key refetches by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14989
* fix(auth): block password login and reset for service accounts by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14987
* fix(usage): enforce LLM budgets on the Slack bot, /search, and the gateway by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15024
* fix(access): scope generated files to the chat session that produced them by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/14999
* fix(craft): stop event pumps when a stream ends by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14984
* fix(cli): keep remote serve sessions off the host config by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14986
* feat(connectors): collapse connector creation into one form instead of multiple steps by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15028
* fix(usage): hold service accounts to global budgets only by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15030
* refactor(connectors): organize all connector-related items into `lib/connectors/` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15035
* feat(chrome-ext): managed policy for Onyx URL and new-tab toggle; strip trailing slashes by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15027
* fix(nrf): open SSO sign-in in a new tab when embedded in the extension by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15034
* fix(security): scope Slack chat-seed to Slack-owned sessions (ENG-4294) by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13324
* fix(security): verify project ownership in move_chat_session (ENG-4297) by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/13327
* chore(chrome-ext): remove unused isDomainManaged helper by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15037
* fix(mcp): single-flight SDK-driven OAuth refresh across concurrent tool calls by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15040
* feat(opal): the settings header takes a list of actions by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15038
* fix(db): warm up only the connections the pool can hold by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15042
* fix(loadtest): make search scenarios actually exercise retrieval by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/14983
* fix(whitelabeling): use the custom app name in every catalog string by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15049
* feat(security): workspace toggle for connector group restrictions by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15031
* feat(connectors): the create-connector header icons render to spec by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15055
* fix(tools): bound open_url response bodies and block IPv6 IMDS by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14990
* fix(cli): title the chat session after a one-shot ask by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15059
* fix(connectors): bound and monitor server-supplied retry delays by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14988
* fix(chat): keep file names and extensions on chat file downloads by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15044
* fix(files): bound archive expansion and skill frontmatter parsing by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14866
* fix(ods): pin fork CI promotion to the confirmed commit by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14865
* feat(helm): default readiness probes, drain on shutdown, opt-in PDBs by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15047
* fix: SharePoint libraries whose URL differs from their display name by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15058
* fix(persona): reject deletion of built-in agents by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15068
* fix(mcp): use non-blocking async lock in SDK auth flow by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15050
* test(usage): stop budget tests leaking enabled limits and spend into the shared DB by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15071
* feat(ci): weekly model-catalog sync (models.dev + litellm + OpenRouter) by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15002
* refactor(llm): replace litellm model-cost table with vendored catalog by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15003
* fix(opal): `ShadowDiv` paints a real shadow; labelled rows paint their switch's hover by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15070
* refactor(mcp): move MCP into `lib/mcp/` and clean up the agent editor's MCP card by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15072
* fix(federated): stop returning OAuth tokens from the callback by @rohoswagger in https://github.com/onyx-dot-app/onyx/pull/15069
* fix(deployment): pull MinIO from our own Docker Hub mirror by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15086
* fix(authz): check credential ownership and scoped-manager cc_pair access by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/14678
* fix(connectors): one shared Graph refusal classifier for Microsoft by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15054
* fix(logging): drop query strings from uvicorn access and websocket logs by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15043
* feat(chat): answer-coverage guidance for search-backed turns by @Bo-Onyx in https://github.com/onyx-dot-app/onyx/pull/15067
* refactor(llm): give invoke() one total timeout by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15051
* fix(llm): merge split responses and map mid-stream errors by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15060
* feat(connectors): SYNC_RESTRICTED access type and data-access groups by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15032
* refactor(opal): rename `inputs/selects/` to `inputs/dropdowns/` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15102
* fix(chat): drop doubled whitespace when stripping XML tool-call blocks by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15095
* fix(enterprise-settings): remove the Hide Onyx Branding toggle by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15112
* feat(opal): the dropdown family as four components by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15107
* feat(connectors): data-access group picker for perm-synced connectors by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15033
* refactor(web): replace the legacy `InputSelect` with Opal's `InputSingleSelect` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15104
* feat(opal): dropdown search, foldable dividers, one keyboard model, rows on LineItemButton by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15115
* fix(cc-pair): let group managers see indexing errors by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/15082
* refactor(web): organize `lib/languageModels/`'s `types.ts`, named list hooks, `components/` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15126
* fix(web): address review follow-ups from the lib/languageModels cleanup by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15127
* feat(config): env-overridable permission sync and document sync lock TTLs by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15063
* fix(opal): InputTypeIn value text uses the main-ui-body preset by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15130
* chore(deployment): expose the SharePoint file size cap in the templates by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15144
* feat(terraform): add GCP vpc module by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15133
* feat(terraform): add GCP gcs module by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15134
* feat(terraform): add GCP postgres module by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15135
* feat(terraform): add GCP redis module by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15136
* feat(terraform): add GCP gke module by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15137
* feat(terraform): add GCP cloud-armor module by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15138
* feat(terraform): add GCP onyx composition and README by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15139
* fix(opal): a select inside a label toggles once per click by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15146
* fix(terraform): GCP module review fixes and workload identity ordering by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15148
* feat(cache): optional per-client operation timeout for cache backends by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15149
* fix(redis): apply retry settings to connection pools by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15150
* feat(web): create new `SimpleModelSelector` component by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15116
* docs(terraform): GCP and Azure modules have been applied to live projects by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15155
* feat(code-interpreter): integrate Code Interpreter 0.4.8 with admission retries by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15131
* chore: reuse slack test channels and sweep leaked ones by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15132
* fix(opal): foldable dropdown groups stay put while the list is open by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15156
* feat: support multiple document sources by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14763
* feat: add sharing-aware Microsoft Graph delta pages by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14764
* chore: add sanitized OneDrive tenant fixture by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14765
* feat: add OneDrive connector indexing by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14766
* feat: add OneDrive connector admin experience by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14847
* feat: sync OneDrive permissions by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14848
* feat: add OneDrive live coverage and release wiring by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/14854
* fix(zoom): read transcripts from the recording's file list by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14879
* fix(zoom): turn Zoom's refusals into errors an admin can act on by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14880
* fix(zoom): floor the recording listing at Zoom's launch by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14881
* feat(zoom): check credentials, scopes and entitlements before a crawl by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14882
* feat(zoom): add the Zoom connector to the admin UI by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14883
* feat(zoom): scope host and Group discovery to meetings or webinars by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14884
* feat(zoom): prune with a slim connector instead of a full crawl by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14973
* test(zoom): cover pruning and migrate the suite to the new client by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14974
* feat(zoom): read a recording's share settings, viewers and sign-in rules by @Subash-Mohan in https://github.com/onyx-dot-app/onyx/pull/14976
* feat(terraform): opt-in L7 load balancer for GCP so Cloud Armor can attach by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15174
* fix(opal): `InputSwitch` pads its track as the mocks do by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15175
* refactor(web): move the configuration model pickers to `SimpleModelSelector` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15145
* refactor(opal): MessageCard drops its content padding and pairs its two paddings by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15177
* fix(agent-sharing): clear ownership on deactivation and refetch the share modal by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15178
* refactor(llm): move provider request types to model_request by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15158
* feat(llm): GenerationRequest API for LLM.invoke by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15159
* feat(llm): streaming GenerationRequest API for LLM.stream by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15176
* chore(backend): remove production asserts, unused re-exports and empty package files by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15190
* refactor(opal): updated colours on `@opal/Content` by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15180
* feat(cache): renew a key only while it holds an expected value by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15191
* feat(opal): `@opal/Content` takes a `titleColor` override by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15194
* fix(backend): join split surrogate pairs, run every shutdown step, delete a dead thread helper by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15188
* refactor(utils): parse streamed tool arguments with pydantic_core by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15199
* fix(coding-agent): advance sub-turn only for rendered think-step output by @wenxi-onyx in https://github.com/onyx-dot-app/onyx/pull/15097
* fix(opal): fixes for the `inputs/dropdowns` family of components by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15203
* fix(helm): scope pre-delete cleanup to this release and serialize startup migrations by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15045
* fix(helm): harden default pod security and warn on default credentials by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15046
* chore: typed connector config base and registry hook by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15182
* chore: typed configs for chat, email, and meeting connectors by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15183
* chore: typed configs for file storage connectors by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15184
* chore: typed configs for wiki, knowledge base, and web connectors by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15185
* chore: typed configs for ticketing, code, and CRM connectors by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15186
* chore: type OneDrive config and require typed configs for all connectors by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15187
* chore: drop credential kwargs from connector configs by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15189
* feat: support SharePoint exhaustive_ad_enumeration as a connector config field by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15193
* feat(index-settings): stage image processing in the page form by @raunakab in https://github.com/onyx-dot-app/onyx/pull/15179
* fix(widget): fill the inline container and keep typing keys in the widget by @yuhongsun96 in https://github.com/onyx-dot-app/onyx/pull/15211
* fix: renaming a user group no longer drops its connectors by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15214
* chore(deps): bump soupsieve from 2.8.4 to 2.9.2 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15219
* chore(deps): bump urllib3 from 2.7.0 to 2.8.0 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15220
* chore(deps): bump tornado from 6.5.8 to 6.5.10 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15221
* chore(deps): bump click from 8.4.2 to 8.5.0 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15223
* chore(deps): bump mako from 1.3.12 to 1.4.3 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15224
* docs(gcp): make the README Helm values install by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15238
* chore(deps): bump pydantic-settings from 2.14.2 to 2.15.0 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15225
* chore(deps): bump python-multipart from 0.0.31 to 0.0.32 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15226
* build(deps): bump lucide-react from 1.18.0 to 1.45.0 in /backend/onyx/server/features/build/sandbox/image/templates/outputs/web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14899
* build(deps): bump @base-ui/react from 1.6.0 to 1.8.0 in /backend/onyx/server/features/build/sandbox/image/templates/outputs/web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14900
* chore(deps): bump msgpack from 1.2.1 to 1.2.2 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15222
* fix(db): verify async Postgres TLS like libpq by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15237
* fix(opensearch): write public field on metadata updates by @evan-onyx in https://github.com/onyx-dot-app/onyx/pull/15236
* chore(deps): bump dompurify from 3.4.12 to 3.4.15 in /web by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14799
* chore(deps): bump sharp to 0.35.4 in /web by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15227
* build(deps): bump anyio from 4.13.0 to 4.14.2 in /backend/onyx/server/features/build/sandbox/image by @dependabot[bot] in https://github.com/onyx-dot-app/onyx/pull/14891
* chore(deps): refresh transitive nanoid in /web by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15228
* chore(deps): refresh transitive qs in /web by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15229
* chore(deps): refresh transitive fast-uri in /web by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15230
* chore(deps): refresh transitive js-yaml 3.x in /web by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15231
* chore(deps): refresh transitive brace-expansion in /web by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15232
* chore(deps): refresh transitive browserslist in /web by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15233
* chore(deps): drop the unused nltk dependency by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15234
* chore(deps): bump accelerate from 1.14.0 to 1.15.0 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15235
* chore(deps): bump cryptography to 50.0.0 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15218
* fix(salesforce): order child windows by sortable fields only (#15273) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15275
* chore(deps): update python base image digests (#14697) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15276
* chore(deps): update node base image digests (#14696) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15277
* chore(hotfix): cherry-pick 2 commits to release v4.9 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15287
* chore(hotfix): cherry-pick 2 commits to release v4.9 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15297
* chore(llm): drop Claude Sonnet 4.5 from the provisioning fallback and cache test (#15309) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15313
* fix(search): don't scope search to a source that is the question's topic (#15317) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15355
* fix(deps): pin sentence-transformers to 5.6.0 (#15335) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15368
* chore(deps): bump cryptography from 49.0.0 to 50.0.0 in /backend/onyx/server/features/build/sandbox/image (#13892) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15369
* chore(deps): bump sharp to 0.35.5 (#15359) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15373
* chore(deps): bump fast-uri to 3.1.7 (#15362) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15376
* chore(deps): bump undici to 7.29.1 (#15361) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15377
* chore(deps): bump js-yaml to 4.3.2 / 3.15.2 (#15363) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15378
* chore(deps): bump brace-expansion to 5.0.11 / 1.1.20 (#15364) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15379
* chore(deps): override uuid to 11.1.1 in mobile (#15366) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15386
* chore(deps): bump browserslist to 4.28.7 (#15365) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15387
* chore(deps): bump next to 16.3.8 (#15358) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15391
* chore(deps): bump proxy-addr to 2.0.8 (#15360) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15375
* chore(hotfix): cherry-pick security dependency fixes to release v4.9 by @justin-tahara in https://github.com/onyx-dot-app/onyx/pull/15397
* fix(auth): restart sign-in on a stale SSO state instead of showing the error (#15395) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15403
* chore(hotfix): cherry-pick 4 commits to release v4.9 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15399
* fix(chat): backport file download, upload indicator, code fence, and GPT Image 2.5 fixes to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15416
* chore(hotfix): cherry-pick 2 commits to release v4.9 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15437
* chore(deps): bump fflate to 0.4.9 (#15464) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15468
* chore(deps): bump baseline-browser-mapping to 2.11.0 (#15462) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15469
* chore(deps): bump shell-quote to 1.11.0 (#15465) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15470
* chore(deps): bump compression to 1.8.2 (#15463) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15471
* chore(deps): bump authlib to 1.8.0 (#15466) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15472
* chore(deps): bump pypdf to 6.19.0 (#15467) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15473
* chore(deps): bump nanoid to 3.3.18 (#15478) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15485
* chore(deps): bump fast-uri to 3.1.8 (#15477) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15487
* chore(deps): bump brace-expansion to 5.0.12 / 1.1.21 (#15476) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15490
* chore(deps): bump qs to 6.16.0 (#15482) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15489
* chore(deps): bump postcss-selector-parser to 7.1.3 (#15481) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15488
* chore(deps): bump ip-address to 10.7.1 (#15480) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15486
* chore(deps): bump hono to 4.13.7 (#15479) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15491
* chore(hotfix): cherry-pick 4 commits to release v4.9 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15499
* fix(deps): override tinypool to 2.1.2 to unblock audit (#15573) to release v4.9 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15587
* fix(llm): deliver reasoning effort to models behind OpenAI-compatible providers (#15600) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15607
* fix(chat): render bold-labeled file links as links, not citations (#15599) to release v4.9 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/15618
* feat(ci): a fix opened on main is backported to the four newest release lines (#15591) to release v4.9 by @nmgarza5 in https://github.com/onyx-dot-app/onyx/pull/15634

**Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.8.0...v4.9.0