Open WebUI
Open WebUI refactors core repository
Open WebUI maintainer Timothy Jaeryang Baek pushed a refactor commit to the project's core repository.
read --wire →
$ tail -f topics/ai.log
AI / ML news, every morning.
Daily updates from the AI and machine-learning ecosystem - PyTorch, Hugging Face, the Anthropic and OpenAI SDKs, local LLMs, and the agent frameworks.
256 updates across 10 projects this week.
Your week in AI / ML, every Monday.
One calm review of what shipped across AI / ML - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top AI / ML projects - refine anytime. · Read a sample issue →
Recent wires
Open WebUI
Open WebUI refactors core codebase
Open WebUI shipped a refactor of its core codebase.
read --wire →
Open WebUI
Open WebUI patches three terminal path and file-access security holes
Three merged commits close authorization and injection gaps in file access, proxy path decoding, and terminal WebSocket handling.
read --wire →
Open WebUI
Open WebUI ships a refactor commit
Open WebUI landed a refactor commit consolidating internal changes.
read --wire →
Open WebUI
Open WebUI refactors internal codebase
Open WebUI shipped a refactor commit touching the core repository under 'refac'.
read --wire →
Open WebUI
Open WebUI repository refactor lands
A refactor commit in Open WebUI landed with no added features or fixes, only internal restructuring.
read --wire →
Open WebUI
Open WebUI 0.9.6 ships with incremental knowledge base sync and RAG ACL fix
Open WebUI 0.9.6 lands with a companion knowledge base sync tool, a blocking signup bug fix, and a critical RAG ACL security patch.
read --wire →
Open WebUI
Open WebUI removes hardcoded WEBUI_SECRET_KEY fallback, closes bypass_system_prompt hole
Open WebUI dropped the hardcoded WEBUI_SECRET_KEY default and moved bypass_system_prompt off the query string, closing two security gaps.
read --wire →
Open WebUI
Open WebUI patches auth bypass and knowledge-base BOLA
Open WebUI shipped fixes for two access-control vulnerabilities, including a request smuggling-style auth bypass and a broken-object-level-authorization flaw that leaked file metadata.
read --wire →
Open WebUI
Open WebUI refactors codebase, updates knowledge.py
Open WebUI shipped a refactor and a knowledge.py update that touch core internals.
read --wire →
Open WebUI
Open WebUI fixes startup crash from stale redis_sentinels reference
A one-line fix in Open WebUI resolves a NameError that crashed the server at startup when the renamed redis_sentinels variable was still referenced in session_cleanup_lock.
read --wire →
Open WebUI
Fix SSRF redirect in OAuth picture fetch
Open WebUI patched a server-side request forgery in OAuth picture fetching by disabling redirect following.
read --wire →
Open WebUI
Workspace skills now drive sidebar visibility
Users granted only workspace.skills permissions will see the Workspace menu entry and no longer bounce out of /workspace.
read --wire →
Open WebUI
Open WebUI patches folder_id authorization and tool_servers bypass
Two security fixes close validation gaps on chat creation and tool server enforcement in Open WebUI.
read --wire →
Open WebUI
Open WebUI commits modernize type annotations
Timothy Jaeryang Baek shipped two refactoring commits to Open WebUI, moving the codebase towards PEP 604 and PEP 585 type annotations.
read --wire →
Open WebUI
Open WebUI retires Peewee migration layer
Open WebUI deprecated its Peewee migration layer, completing the switch to Alembic for all schema management.
read --wire →
Open WebUI
Open WebUI 0.9.5 ships with security hardening across image URLs, tool permissions, and iframe CSP
Open WebUI released 0.9.5 [ref:4] alongside three security-focused changes that tighten URL validation, align tool update permissions, and introduce a configurable iframe content security policy.
read --wire →
Open WebUI
Open WebUI 0.9.4 ships scroll fix, async health checks
Open WebUI released 0.9.4 with a scroll fix and asynchronous database pings for health checks, while two privilege escalations were closed.
read --wire →
OpenClaw
Catalog refreshes stop hiding failures; APFS checkpoints survive live logs
Model catalog refreshes now report and preserve discovery failures instead of silently replacing learned models, while OCM gains automated checked releases after main merges.
read --wire →
OpenClaw
Gateway fixes bind cancellations to exact live runs; hot reload keeps webhook retries
OpenClaw's gateway now aborts the precise live run when a task is cancelled and keeps webhook ingress retryable during hot reload.
read --wire →