Starstruk Logo MarkStarstruk

v4.1.1

tobias-kirschstein/ggheadv4.1.1Jun 12, 2026by github-actions[bot]

AI Summary

This release focuses on security consolidation and hardening, including the integration of SSRF protection into a single admin setting, URL validation across fetch paths, and hardening default object storage credentials. It also includes various fixes for LLM routing and web UI components.

Key Highlights

  • Consolidated SSRF protection into a single admin setting
  • Applied URL validation across all fetch paths
  • Hardened default MinIO/S3 object-storage credentials
  • Require USER_AUTH_SECRET on non-dev deployments
  • Sanitized docx-preview output in file preview modal

New Features

  • Consolidated SSRF protection into admin setting
  • URL validation across all fetch paths
  • Sanitized docx-preview output

Full Release Notes

## Warning
Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. [See additional documentation here](https://docs.onyx.app/admins/advanced_configs/opensearch_document_index_migration#opensearch-document-index-migration).

See the assets to download this version and install.

## What's Changed
* feat(security): consolidate SSRF protection into one admin setting (#11881) to release v4.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/11970
* fix(web-connector): apply URL validation across all fetch paths (#11973) to release v4.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/11989
* fix(llm): route Claude Fable 5 / Mythos 5 through adaptive thinking (#11992) to release v4.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/11995
* fix(security): harden default MinIO/S3 object-storage credentials (#12003) to release v4.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/12018
* fix(security): require USER_AUTH_SECRET on non-dev deployments (#12038) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12042
* fix(web): don't shrink custom placeholders in PasswordInputTypeIn (#12041) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12046
* fix(web): sanitize docx-preview output in file preview modal (#12043) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12047


**Full Changelog**: https://github.com/onyx-dot-app/onyx/compare/v4.1.0...v4.1.1