fix: send the query embedding as a vector in external pgvector retrieval

backend/open_webui/__init__.py

@@ -1,6 +1,6 @@
 import base64
 import os
-import random
+import secrets
 import sys
 from pathlib import Path
 from typing import Annotated
@@ -45,7 +45,7 @@ def serve(
             if key_length < 1:
                 raise ValueError('WEBUI_SECRET_KEY_LENGTH must be a positive integer')
             typer.echo(f'Generating a new secret key and saving it to {KEY_FILE}')
-            KEY_FILE.write_bytes(base64.b64encode(random.randbytes(key_length)))
+            KEY_FILE.write_bytes(base64.b64encode(secrets.token_bytes(key_length)))
         typer.echo(f'Loading WEBUI_SECRET_KEY from {KEY_FILE}')
         os.environ['WEBUI_SECRET_KEY'] = KEY_FILE.read_text()
 

backend/open_webui/config.py

@@ -1675,43 +1675,13 @@ def reachable(host: str, port: int) -> bool:
 
 DEFAULT_PINNED_MODELS = os.getenv('DEFAULT_PINNED_MODELS', None)
 
+# None uses the frontend's localized defaults; an empty list disables suggestions.
 try:
-    default_prompt_suggestions = JSONCodec.loads(os.getenv('DEFAULT_PROMPT_SUGGESTIONS', '[]'))
+    DEFAULT_PROMPT_SUGGESTIONS = JSONCodec.loads(os.getenv('DEFAULT_PROMPT_SUGGESTIONS', 'null'))
 except Exception as e:
     log.exception(f'Error loading DEFAULT_PROMPT_SUGGESTIONS: {e}')
-    default_prompt_suggestions = []
-if default_prompt_suggestions == []:
-    default_prompt_suggestions = [
-        {
-            'title': ['Help me study', 'vocabulary for a college entrance exam'],
-            'content': "Help me study vocabulary: write a sentence for me to fill in the blank, and I'll try to pick the correct option.",
-        },
-        {
-            'title': ['Give me ideas', "for what to do with my kids' art"],
-            'content': "What are 5 creative things I could do with my kids' art? I don't want to throw them away, but it's also so much clutter.",
-        },
-        {
-            'title': ['Tell me a fun fact', 'about the Roman Empire'],
-            'content': 'Tell me a random fun fact about the Roman Empire',
-        },
-        {
-            'title': ['Show me a code snippet', "of a website's sticky header"],
-            'content': "Show me a code snippet of a website's sticky header in CSS and JavaScript.",
-        },
-        {
-            'title': [
-                'Explain options trading',
-                "if I'm familiar with buying and selling stocks",
-            ],
-            'content': "Explain options trading in simple terms if I'm familiar with buying and selling stocks.",
-        },
-        {
-            'title': ['Overcome procrastination', 'give me tips'],
-            'content': 'Could you start by asking me about instances when I procrastinate the most and then give me some suggestions to overcome it?',
-        },
-    ]
+    DEFAULT_PROMPT_SUGGESTIONS = None
 
-DEFAULT_PROMPT_SUGGESTIONS = default_prompt_suggestions
 DEFAULT_PROMPT_SUGGESTIONS_I18N = {}
 
 try:

backend/open_webui/env.py

@@ -388,6 +388,14 @@ def parse_section(section):
 except ValueError:
     REDIS_RESPONSE_STREAM_TTL = 3600
 
+# Seconds a task survives without a heartbeat. 0 disables expiry.
+try:
+    REDIS_TASK_TTL = int(os.getenv('REDIS_TASK_TTL', '300'))
+    if REDIS_TASK_TTL != 0 and REDIS_TASK_TTL < 60:
+        REDIS_TASK_TTL = 300
+except ValueError:
+    REDIS_TASK_TTL = 300
+
 REDIS_SENTINEL_HOSTS = os.getenv('REDIS_SENTINEL_HOSTS', '')
 REDIS_SENTINEL_PORT = os.getenv('REDIS_SENTINEL_PORT', '26379')
 
@@ -485,6 +493,12 @@ def parse_section(section):
 WEBSOCKET_REDIS_URL = os.getenv('WEBSOCKET_REDIS_URL', REDIS_URL)
 WEBSOCKET_REDIS_CLUSTER = os.getenv('WEBSOCKET_REDIS_CLUSTER', str(REDIS_CLUSTER)).lower() == 'true'
 
+# publishes room-targeted emits on per-room redis channels so instances skip
+# messages for rooms without local members; must be identical across the fleet
+# (toggle with a full restart, not a rolling one), set false for the previous
+# shared-channel-only delivery
+WEBSOCKET_REDIS_ROOM_CHANNELS = os.getenv('WEBSOCKET_REDIS_ROOM_CHANNELS', 'True').lower() == 'true'
+
 websocket_redis_lock_timeout = os.getenv('WEBSOCKET_REDIS_LOCK_TIMEOUT', '60')
 
 try:
@@ -1048,7 +1062,9 @@ def _parse_ssl_env(value: str) -> 'bool | _ssl.SSLContext':
 # Opt in to CPython's in-place string append optimization for streamed responses.
 # Off by default for a staged rollout. Only a host already out of memory can lose
 # text here; the default path (a full copy per chunk) raises there too.
-ENABLE_CHAT_RESPONSE_STREAM_INPLACE_APPEND = os.getenv('ENABLE_CHAT_RESPONSE_STREAM_INPLACE_APPEND', 'False').lower() == 'true'
+ENABLE_CHAT_RESPONSE_STREAM_INPLACE_APPEND = (
+    os.getenv('ENABLE_CHAT_RESPONSE_STREAM_INPLACE_APPEND', 'False').lower() == 'true'
+)
 
 # When enabled, uses a hardcoded extension-to-MIME dictionary as a last-resort
 # fallback when both mimetypes.guess_type() and file.meta.content_type fail to

backend/open_webui/internal/db.py

@@ -348,23 +348,28 @@ def like(pattern, value, escape=None):
             if compiled is False:
                 return False
             if compiled is None:
-                regex = []
+                segments = ['']
                 escaped = False
                 for char in pattern:
                     if escape and not escaped and char == escape:
                         escaped = True
                         continue
-                    regex.append(
-                        '.*' if not escaped and char == '%' else '.' if not escaped and char == '_' else re.escape(char)
-                    )
+                    if not escaped and char == '%':
+                        segments.append('')
+                    else:
+                        segments[-1] += '.' if not escaped and char == '_' else re.escape(char)
                     escaped = False
                 if escaped:
                     compiled = False
                     if len(compiled_patterns) >= 512:
                         compiled_patterns.clear()
                     compiled_patterns[key] = compiled
                     return False
-                compiled = re.compile(''.join(regex), re.DOTALL)
+                # Atomic groups pin each middle segment to its first match, so '%' never backtracks.
+                regex = segments[0] + ''.join(f'(?>.*?{segment})' for segment in segments[1:-1])
+                if len(segments) > 1:
+                    regex += '.*' + segments[-1]
+                compiled = re.compile(regex, re.DOTALL)
                 if len(compiled_patterns) >= 512:
                     compiled_patterns.clear()
                 compiled_patterns[key] = compiled

backend/open_webui/main.py

@@ -74,6 +74,7 @@
     seed_registered_defaults,
 )
 from open_webui.constants import ERROR_MESSAGES, TASKS
+from open_webui.utils.recurrence import RecurrenceEvaluationTimeout
 from open_webui.env import (
     USE_SLIM,
     AIOHTTP_CLIENT_SESSION_SSL,
@@ -107,12 +108,14 @@
     MAX_BODY_LOG_SIZE,
     # Redis
     REDIS_KEY_PREFIX,
+    REDIS_TASK_TTL,
     REDIS_URL,
     RESET_CONFIG_ON_START,
     SAFE_MODE,
     SCIM_TOKEN,
     VERSION,
     WEBSOCKET_HEARTBEAT_INTERVAL,
+    WEBSOCKET_MANAGER,
     # Admin Account Runtime Creation
     WEBUI_ADMIN_EMAIL,
     WEBUI_ADMIN_NAME,
@@ -189,6 +192,7 @@
     get_user_id_from_session_pool,
     periodic_session_pool_cleanup,
     periodic_usage_pool_cleanup,
+    redis_event_listener,
 )
 from open_webui.socket.main import (
     app as socket_app,
@@ -200,6 +204,7 @@
     list_task_ids_by_item_id,
     list_tasks,
     redis_task_command_listener,
+    redis_task_heartbeat,
     stop_item_tasks,
     stop_task,
 )  # Import from tasks.py
@@ -259,7 +264,7 @@
     encrypt_data,
     get_oauth_client_info_with_dynamic_client_registration,
     get_oauth_client_info_with_static_credentials,
-    recover_static_oauth_client_metadata,
+    recover_oauth_client_metadata,
     resolve_oauth_client_info,
 )
 from open_webui.utils.plugin import install_tool_and_function_dependencies
@@ -386,6 +391,11 @@ async def lifespan(app: FastAPI):
 
     if app.state.redis is not None:
         app.state.redis_task_command_listener = asyncio.create_task(redis_task_command_listener(app))
+        if REDIS_TASK_TTL > 0:
+            app.state.redis_task_heartbeat = asyncio.create_task(redis_task_heartbeat(app))
+
+    if WEBSOCKET_MANAGER == 'redis':
+        app.state.redis_event_listener = asyncio.create_task(redis_event_listener())
 
     app.state.periodic_usage_pool_cleanup = asyncio.create_task(periodic_usage_pool_cleanup())
     app.state.periodic_session_pool_cleanup = asyncio.create_task(periodic_session_pool_cleanup())
@@ -473,6 +483,12 @@ async def lifespan(app: FastAPI):
     if hasattr(app.state, 'redis_task_command_listener'):
         app.state.redis_task_command_listener.cancel()
 
+    if hasattr(app.state, 'redis_task_heartbeat'):
+        app.state.redis_task_heartbeat.cancel()
+
+    if hasattr(app.state, 'redis_event_listener'):
+        app.state.redis_event_listener.cancel()
+
     app.state.periodic_usage_pool_cleanup.cancel()
     app.state.periodic_session_pool_cleanup.cancel()
     app.state.scheduler_worker_loop.cancel()
@@ -495,6 +511,12 @@ async def lifespan(app: FastAPI):
     lifespan=lifespan,
 )
 
+
+@app.exception_handler(RecurrenceEvaluationTimeout)
+async def recurrence_timeout_handler(request: Request, exc: RecurrenceEvaluationTimeout):
+    return JSONResponse(status_code=400, content={'detail': str(exc)})
+
+
 # Used by readiness checks to gate traffic until startup work is done.
 app.state.startup_complete = False
 
@@ -614,9 +636,7 @@ async def initialize_runtime_config(app: FastAPI):
             if server_id and auth_type in ('oauth_2.1', 'oauth_2.1_static'):
                 try:
                     oauth_client_info = resolve_oauth_client_info(tool_server_connection)
-                    oauth_client_info = await recover_static_oauth_client_metadata(
-                        tool_server_connection, oauth_client_info
-                    )
+                    oauth_client_info = await recover_oauth_client_metadata(tool_server_connection, oauth_client_info)
                     oauth_client_info = apply_connection_oauth_options(tool_server_connection, oauth_client_info)
                     app.state.oauth_client_manager.add_client(
                         f'mcp:{server_id}',

backend/open_webui/models/access_grants.py

@@ -686,8 +686,7 @@ async def get_users_with_access(
         Get all users who have the specified permission on a resource.
         Returns a list of UserModel instances.
         """
-        from open_webui.models.groups import Groups
-        from open_webui.models.users import UserModel, Users
+        from open_webui.models.users import Users
 
         async with get_async_db_context(db) as db:
             result = await db.execute(
@@ -699,27 +698,69 @@ async def get_users_with_access(
             )
             grants = result.scalars().all()
 
-            # Check for public access
-            for grant in grants:
-                if grant.principal_type == 'user' and grant.principal_id == '*':
-                    result = await Users.get_users(filter={'roles': ['!pending']}, db=db)
-                    return result.get('users', [])
-
-            user_ids_with_access = set()
-
-            for grant in grants:
-                if grant.principal_type == 'user':
-                    user_ids_with_access.add(grant.principal_id)
-                elif grant.principal_type == 'group':
-                    group_user_ids = await Groups.get_group_user_ids_by_id(grant.principal_id, db=db)
-                    if group_user_ids:
-                        user_ids_with_access.update(group_user_ids)
+            user_ids_with_access = await self.get_user_ids_by_access_grants(grants, permission, db=db)
 
             if not user_ids_with_access:
                 return []
 
             return await Users.get_users_by_user_ids(list(user_ids_with_access), db=db)
 
+    async def get_user_ids_by_access_grants(
+        self,
+        access_grants: list[AccessGrantModel],
+        permission: str = 'read',
+        db: AsyncSession | None = None,
+    ) -> set[str]:
+        """Get user IDs with the specified permission, including public and group grants."""
+        from open_webui.models.groups import Groups
+        from open_webui.models.users import Users
+
+        async with get_async_db_context(db) as db:
+            user_ids = set()
+            group_ids = []
+            for grant in access_grants:
+                if grant.permission != permission:
+                    continue
+                if grant.principal_type == PRINCIPAL_TYPE_USER:
+                    if grant.principal_id == WILDCARD_PRINCIPAL_ID:
+                        result = await Users.get_users(filter={'roles': ['!pending']}, db=db)
+                        return {user.id for user in result.get('users', [])}
+                    user_ids.add(grant.principal_id)
+                elif grant.principal_type == PRINCIPAL_TYPE_GROUP:
+                    group_ids.append(grant.principal_id)
+
+            if group_ids:
+                group_user_ids = await Groups.get_group_user_ids_by_ids(group_ids, db=db)
+                for members in group_user_ids.values():
+                    user_ids.update(members)
+            return user_ids
+
+    async def get_revoked_user_ids_by_resource(
+        self,
+        resource_type: str,
+        resource_id: str,
+        previous_access_grants: list[AccessGrantModel],
+        permission: str = 'read',
+        db: AsyncSession | None = None,
+    ) -> set[str]:
+        """Get user IDs that lost the specified permission after a resource's grants changed."""
+        async with get_async_db_context(db) as db:
+            access_grants = await self.get_grants_by_resource(resource_type, resource_id, db=db)
+            previous_principals = {
+                (grant.principal_type, grant.principal_id)
+                for grant in previous_access_grants
+                if grant.permission == permission
+            }
+            principals = {
+                (grant.principal_type, grant.principal_id) for grant in access_grants if grant.permission == permission
+            }
+            if previous_principals <= principals or (PRINCIPAL_TYPE_USER, WILDCARD_PRINCIPAL_ID) in principals:
+                return set()
+
+            previous_user_ids = await self.get_user_ids_by_access_grants(previous_access_grants, permission, db=db)
+            user_ids = await self.get_user_ids_by_access_grants(access_grants, permission, db=db)
+            return previous_user_ids - user_ids
+
     def has_permission_filter(
         self,
         db,

backend/open_webui/models/automations.py

@@ -312,6 +312,7 @@ async def claim_due(self, now_ns: int, limit: int = 10, db: Optional[AsyncSessio
             rows = result.scalars().all()
 
             from open_webui.utils.automations import next_run_ns
+            from open_webui.utils.recurrence import RecurrenceEvaluationTimeout
 
             # Batch-fetch user timezones so rescheduling respects each
             # user's local timezone instead of falling back to server time.
@@ -323,13 +324,20 @@ async def claim_due(self, now_ns: int, limit: int = 10, db: Optional[AsyncSessio
                 tz_result = await db.execute(select(User.id, User.timezone).where(User.id.in_(user_ids)))
                 timezone_by_user_id = {uid: tz for uid, tz in tz_result.all()}
 
+            claimed = []
             for row in rows:
+                try:
+                    next_run_at = await next_run_ns(row.data.get('rrule', ''), tz=timezone_by_user_id.get(row.user_id))
+                except RecurrenceEvaluationTimeout:
+                    log.warning('Skipping automation %s: recurrence evaluation timed out', row.id)
+                    continue
                 row.last_run_at = now_ns
-                row.next_run_at = next_run_ns(row.data.get('rrule', ''), tz=timezone_by_user_id.get(row.user_id))
+                row.next_run_at = next_run_at
+                claimed.append(row)
 
             await db.commit()
 
-            return [AutomationModel.model_validate(r) for r in rows]
+            return [AutomationModel.model_validate(r) for r in claimed]
 
 
 ####################