## danny-avila/LibreChat — v0.8.6-rc1…v0.8.6

_140 commits._

### Features
- **💠 feat: Extend `thinkingLevel` Support to Gemma 4 Models (#13088)** (b61d537)
- **🪪 feat: MCP OAuth - Support `audience` parameter for Auth0/Cognito-style providers (#13402)** (c6a6f2e)
- **📡 feat: Add Configurable HyperDX Browser Real User Monitoring (#13287)** (71a7c9c)
- **🧠 feat: Add Claude Opus 4.8 Support (#13380)** (62dff69)
- **⏱️ refactor: Optimistically Show New Chats In Sidebar (#13298)** (05bb690)
- **🛰️ feat: Support Gemini Tool Combinations (#13273)** (4f5486c)
- **🪙 feat: Add AWS Bedrock API key support (#8690)** (53e7c41)
- **🛂 feat: Add AWS Profile Support for Bedrock Credentials (#10504)** (294bf7c)
- **🆔 feat: Built-in Build Metadata for Support Triage (#12756)** (6d6ea08)
- **📜 feat: Add Explicit new Skill Route from Agent Builder (#13119)** (058cd52)
- **⚖️ feat: Add Operational Prometheus Metrics (#13265)** (2ce3921)
- **🛣️ feat: Add MCP Remote Proxy Support (#13076)** (05a3d1e)
- **⚡ feat: Add Gemini 3.5 Flash Support (#13231)** (12a4412)
- **🩺 feat: Add Explicit Readiness Endpoints (#13212)** (9cb650d)
- **🍪 feat: Add Session Cookie Secure Override (#13189)** (909329a)
- **📡 feat: Add Backend OpenTelemetry Tracing (#12909)** (050b7fd)
- **🧾 feat: Add Structured Logging Context (#13110)** (7f58e4c)
- **📈 feat: Add Prometheus Metrics Endpoint + AWS Credential Providers (#13111)** (34dd8d5)
- **🚧 feat: Support Guardrail Config Option `streamProcessingMode` (#12815)** (83ea3ef)

### Fixes
- **📌 fix: Preserve Ephemeral Agent Selections on Optimistic Hydration (#13433)** (fd5d441)
- **🪪 fix: Use Shared IdP Avatar Processing (#13422)** (de760f6)
- **📄 fix: Harden Configured Rich Text Rendering (#13423)** (68d5958)
- **🧼 fix: Sanitize User Response Fields (#13421)** (75baa5b)
- **🛂 fix: Enforce MCP Permissions for Agent Tools (#13174)** (100871c)
- **🏟️ fix: Restrict MCP OAuth Audience in User-Managed Configs (#13418)** (5bfef51)
- **🔒 fix: Strip post-login fields from unauthenticated /api/config response (#13102)** (6db059b)
- **📬 fix: Honor Admin-Panel `allowedDomains` Override at Registration (#13204)** (6a04fb8)
- **💰 fix: Load app config in `set-balance` script to respect balance settings (#12669)** (3487672)
- **🪪 fix: Preserve Trusted Registration Provider Overrides (#13307)** (b01d34a)
- **🔑 fix: support 'userinfo' in OPENID_REQUIRED_ROLE_TOKEN_KIND (#13182)** (d75d261)
- **🖼️ fix: Preserve Model Spec Icon URLs (#13370)** (069d867)
- **🪃 fix: Retry MCP OAuth Token Refresh Without Scope on Server Rejection (#13412)** (a83bcb3)
- **🧟 fix: Reap Hung In-Memory Generations for Redis Failsafe Parity (#13396)** (a14344d)
- **⚓ fix: Skip Retention for Persistent Agent Resource Files (#13394)** (f8d7d7f)
- **🪨 fix: Preserve Bedrock Guardrail Config (#13381)** (786dae4)
- **📋 fix: Cap Default Limit on Agent List Queries (#13382)** (94c7312)
- **🪡 fix: Artifact Edit Saves (#13358)** (0d981b0)
- **🛡️ fix: Harden Model Spec Icon Rendering (#13356)** (3544cd9)
- **📎 fix: Preserve Gemini PDF Media Blocks (#13357)** (f95fa55)
- **✂️ fix: Truncate Long MCP Server Titles In Builder Panel (#13321)** (7181958)
- **🖱️ fix: Add MCP Hover Action Background (#13319)** (5820efb)
- **🪢 fix: Coerce Tool Execution Args By Schema (#13310)** (abfe7d1)
- **🧯 fix: Suppress Google Service Key Noise (#13322)** (cb23d6b)
- **⏭️ fix: Avoid False Resume Submission Stale Detection (#13297)** (6f7dc1b)
- **🧵 fix: Prevent Message Loading Race During Streaming (#13295)** (f2be5ba)
- **🧩 fix: Add REDIS_CLUSTER_SAFE_DELETE Flag for ElastiCache Serverless CROSSSLOT Errors (#13275)** (9cd2fc2)
- **🪡 fix: Prevent Hover Actions Flash While Streaming (#13285)** (9c4049b)
- **🪟 fix: Apply Admin-Panel Config Overrides To YAML-Defined MCP Servers (#13173)** (2bcf3e8)
- **🧾 fix: Validate Bedrock User Credentials (#13279)** (a9a332a)
- **🏣 fix: Reject System Tenant In Auth Context (#13278)** (1693b58)
- **🧷 fix: Pin MCP OAuth Client Secrets (#13276)** (5071b2b)
- **🧱 fix: Validate Bedrock User Credentials (#13277)** (af90211)
- **🧷 fix: Harden MCP Proxy SSRF Checks (#13274)** (7cd467a)
- **📡 fix: Tighten Streaming Message Cache Preservation (#13271)** (1e0ffcf)
- **🪨 fix: Normalize Empty MCP Tool Descriptions to `undefined` for Bedrock Compat. (#13217)** (7f0fde2)
- **🪬 fix: Skip MCP Tools When Required Custom User Vars Are Unset (#13152)** (1746153)
- **🛂 fix: Detect OAuth Errors From HTTP 400 Responses (#11961)** (abda15f)
- **🪪 fix: Allow Optional client_secret for MCP OAuth (#12460)** (fb851ca)
- **🪪 fix: Support OpenID PKCE Without Client Secret (#12364)** (5d393ad)
- **⌛ fix: Use JWT exp claim for MCP when OAuth token omits expires_in (#13248)** (01af63c)
- **🪪 fix: Prevent MCP Server Name Collisions (#13256)** (bd64251)
- **🪪 fix: Consolidate MCP OAuth Policy (#13254)** (d462bf4)
- **🛡️ fix: Harden MCP OAuth Request Handling (#13264)** (c1e071b)
- **🧵 fix: Preserve Streaming Messages During Stale Refetch (#13247)** (34a6931)
- **📦 chore: bump `@librechat/agents` to v3.1.90 and npm audit fix (#13242)** (40a3df3)
- **🍞 fix: don't show 'deleting file' toast on attached files (#13239)** (a865d40)
- **📡 fix: Respect Custom Endpoint Stream Usage Opt-In (#13237)** (cfe0f9f)
- **🧩 fix: Support DocumentDB Prompt Group Lookup (#13232)** (d7482eb)
- **🏃 fix: Improve OpenID Lookup Planning (#13229)** (cbdfe46)
- **🦣 fix: Response Size Limits for Streamable HTTP MCP Responses (#13219)** (1ed84ee)
- **🪪 fix: Add Admin Panel SSO URL Config (#13220)** (830d124)
- **🧯 fix: Harden Data Retention Semantics (#13049)** (9dd062e)
- **📡 fix: Handle Pre-Session 406 for Optional SSE MCP Stream (#13202)** (2418f85)
- **⛴️ fix: Stop Double-Wrapping configYamlContent in Helm ConfigMap (#13198)** (0b5530b)
- **🧭 fix: Reduce MCP Registry ACL Lookups (#13195)** (749eb06)
- **📦 chore: npm audit fix, bump otel & `@librechat/agents` (#13186)** (fdffa9a)
- **🪪 fix: Scope Message Conversation Access (#13183)** (5b66196)
- **🗂️ fix: Scope Handoff Agent Context Docs (#13167)** (68eac10)
- **🔍 fix: Prefer LibreChat Web Search over Anthropic's when Both Selected (#13166)** (394839a)
- **🧽 fix: Strip Admin OAuth Redirect Params (#13181)** (77c523e)
- **🪪 fix: Resolve Group-Scoped Config Overrides (#13176)** (c342e23)
- **🤝 fix: Honor OPENID_REUSE_TOKENS in Admin OAuth Exchange (#13154)** (ac163c2)
- **🛡️ fix: Escape People Picker Search Regex (#13169)** (89d10a0)
- **🧭 fix: Tighten Action OAuth Endpoint Validation (#13142)** (b549966)
- **🛰️ fix: Redact Outbound Telemetry URL Queries (#13133)** (27266bb)
- **🗝️ fix: Protect Model Spec Instructions (#13125)** (ca8c212)
- **🛡️ fix: Sanitize Agent List Skill Scope (#13122)** (62da4c2)
- **🏷️ fix: Harden Helm Chart Tag Parsing (#13123)** (5f7092e)
- **🧹 fix: Reset Redis Reorder State After Last Unsubscribe (#13117)** (7e4c5d9)
- **🧰 fix: Scope MCP Registry Initialization To Config Fingerprints (#13115)** (9e8b8c3)

### Backend
- **✨ v0.8.6 (#13302)** (566e20b)
- **📦 chore: Bump `@librechat/agents` to v3.2.1** (0cba4d1)
- **🗄️ refactor: Honor All-Data Retention for Agent Files (#13424)** (e3cc2a9)
- **🧠 refactor: Memoize MCP Permission Checks Per Request (#13419)** (479e9d5)
- **🔧 chore: Drop duplicate `getAppConfig` import in `set-balance.js` (#13417)** (820bc3b)
- **📦 chore: Bump `@hyperdx/browser` to v0.24.0 (#13416)** (e21872f)
- **✂️ chore: Strip Session JWT Forwarding from Browser RUM (#13414)** (444d923)
- **📦 chore: Bump `@librechat/agents` to v3.2.0** (ee709c8)
- **🧮 chore: Update Gemma Context Token Defaults (#13410)** (cb6bd71)
- **🪪 feat: Accept Multiple OpenID JWT Audiences (#13404)** (a16f08a)
- **📦 chore: Update `@librechat/agents` to v3.1.99** (cfee8c7)
- **♊ feat: Model-Aware Max Output Tokens for Google/Gemini (#13390)** (06a6c42)
- **📤 refactor: Align Mention Options With Model Selector (#13397)** (56a203e)
- **🧠 refactor: Replay DeepSeek `reasoning_content` via OpenRouter (#13368)** (6d9c019)
- **📦 chore: bump `@librechat/agents` to v3.1.97** (f28599e)
- **🐢 ci: Raise test-packages-api timeout to 20 min (#13326)** (7ab9254)
- **📦 chore: bump `@librechat/agents` to v3.1.96** (190cdee)
- **🌍 i18n: Update translation.json with latest translations (#13325)** (9cf805c)
- **📦 chore: bump `@librechat/agents` to v3.1.94 (#13306)** (ee66e43)
- **📦 chore: bump `@librechat/agents`, `qs`, `langfuse` (#13299)** (a008001)
- **🧬 refactor: Derive Latest Message From Cache (#13294)** (a8c43a4)
- **🌍 i18n: Update translation.json with latest translations (#13291)** (cdcedc1)
- **🌍 i18n: Update translation.json with latest translations (#13283)** (385c7ab)
- **🌐 chore: Guard Locize Reviewer Request (#13286)** (ee21205)
- **🪤 chore: Prevent CI Path Argument Injection (#13284)** (a7c18f5)
- **🎨 ci: Check Prettier Formatting Drift on Package Changes (#13282)** (9799f7e)
- **🎨 chore: prettier --write all workspaces (#13281)** (83c7d63)
- **🚦 ci: Enforce ESLint on Package Changes (#13280)** (202a179)
- **🖲️ feat: Trace SSE Stream Lifecycle with OTel (#13266)** (03b477a)
- **🗂️ refactor: Clarify Code Sandbox File Guidance (#13236)** (b9d4a59)
- **🌍 i18n: Update translation.json with latest translations (#13230)** (c345fd6)
- **🧵 chore: Raise MCP SSE Line Default (#13224)** (f34150e)
- **🗂️ feat: Allow Disabling File Log Transports (#13215)** (799a080)
- **🧪 ci: Stabilize Virtualized Agent Grid Tests (#13214)** (8310e9a)
- **🪂 feat: Graceful HTTP shutdown on SIGTERM/SIGINT (#13211)** (679672a)
- **🛟 refactor: Gracefully Skip Unavailable Web Search Rerankers (#13191)** (2414e9c)
- **👟 feat: Eager Execution of Tool Calls (#13192)** (9107000)
- **📦 chore: Bump `@librechat/agents` to v3.1.88 (#13187)** (75d196f)
- **🕵🏻 ci: Improve Flaky Subagents Test (#13185)** (d80f7f0)
- **🛡️ chore: Harden CI Supply Chain Workflows (#13090)** (21574f0)
- **🧹 chore: Type Agent MCP lean projection in ServerConfigsDB (#13171)** (6466263)
- **🌍 i18n: Update translation.json with latest translations (#13128)** (d2958bc)
- **⏩ refactor: Speed Up Subagent Ticker Refresh (#13141)** (f3b165e)
- **🪵 chore: Restore Winston Format Factory Shape In Test Mocks (#13139)** (5b11a5a)
- **🛟 test: Restore Playwright Smoke E2E (#13020)** (b993d9f)
- **🏷️ feat: Hide Model Spec Badge Rows (#13124)** (738ed00)
- **🗂️ refactor: Collapse Generated File Chips (#13116)** (176e077)
- **🛡️ feat: Bedrock Guardrail Config Environment Variable Resolution (#11717)** (c582e87)
- **📸 refactor: Refresh Shared Links With Latest Snapshot (#13095)** (ae75fb6)
- **🌍 i18n: Update translation.json with latest translations (#13107)** (e0a4e53)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/danny-avila/LibreChat?utm_source=github-action)._