$ the-wire · showcase
Open WebUI 0.9.4 ships scroll fix, async health checks
By RepoJournal · Filed · About Open WebUI
Open WebUI released 0.9.4 with a scroll fix and asynchronous database pings for health checks, while two privilege escalations were closed.
Open WebUI released 0.9.4, bundling a scroll fix and the changes from 0.9.3 [1], including an asynchronous database ping for health checks that stops blocking the event loop, and a fix that prevents speech-to-text from blocking the uvicorn event loop [1]. The release notes describe the version as "fix: bump to 0.9.4, changelog for scroll fix" [2].
Two privilege escalations were closed. The previously unauthenticated GET /api/v1/retrieval/ status endpoint was removed; it returned the live RAG pipeline configuration (CHUNK_SIZE, RAG_TEMPLATE, RAG_EMBEDDING_ENGINE, etc.) without authentication, while every adjacent endpoint requires an admin [3]. Also, the calendar router now gates public sharing behind the sharing.public_calendars permission, preventing a verified non-admin owner from attaching a wildcard user grant to make calendars publicly shareable [4].
Action items
- → Upgrade to Open WebUI 0.9.4 before your next deploy to get the scroll fix and performance patches open-webui/open-webui [immediate]
- → Inspect any deployments that relied on GET /api/v1/retrieval/ for status, as the endpoint is removed open-webui/open-webui [immediate]
- → Review calendar sharing grants after upgrading to ensure only intended calendars are public open-webui/open-webui [plan]
References
- [1] 0.9.3 (#24482) ↗ open-webui/open-webui
- [2] fix: bump to 0.9.4, changelog for scroll fix ↗ open-webui/open-webui
- [3] chore: remove unauthenticated dead-code GET /api/v1/retrieval/ status endpoint (#24497) ↗ open-webui/open-webui
- [4] fix: gate public sharing of calendars behind sharing.public_calendars permission (#24493) ↗ open-webui/open-webui