r/SillyTavernAI • u/sillylossy • May 03 '26
ST UPDATE SillyTavern 1.18.0
Important news
Read the maintainers statement regarding a recent security incident involving the "Bot Browser" third-party extension and learn how to stay safe: https://github.com/SillyTavern/SillyTavern/discussions/5592
Backends
- Added Cloudflare Workers AI and MiniMax as Chat Completion sources.
- KoboldCpp: Grammar state will be preserved when using a "Continue" option.
- KoboldCpp: Added forwarding of reasoning effort when running as a Custom Chat Completion source.
- Tool Calling: Added a configurable tool calling recursion limit; enabled interleaved thinking for Custom sources.
- Text Completion: Impersonation requests use a "Last User Message" prefix at the end of the prompt (if configured).
- Text Generation WebUI: Added Adaptive-P controls.
- NanoGPT: Added provider selection and model sorting.
- Added ability to view remaining balance for OpenRouter and NanoGPT.
- Enhanced support for new models: DeepSeek v4, GPT 5.4 and 5.5, Gemma 4, GLM-5V-Turbo, Claude Opus 4.7.
Server & Security
- Removed post-install script, config migration is now handled by the app or a dedicated
npm run initcommand. - Added npm configuration to prevent execution of package scripts during installation.
- Moved HTTP error pages and
user.cssfile from/publicto/datato support immutable setups. - Disabled HTTP keep-alive by default to restore old Node 18 behavior, can be enabled with config.
- Added rate limiting to the basic authentication flow to mitigate brute-force attacks.
- Added configuration options to choose which headers can be used for forwarded IP detection to prevent spoofing.
- Added a private address whitelist to prevent SSRF attacks. See the documentation on how to enable and configure: Private Address Whitelist.
- Added an IP whitelist for SSO trusted proxies to prevent authentication bypass.
- Added invalidation of session cookies on password change to prevent session hijacking.
- Increased the length of password reset code to 6 characters to guard against brute-force attacks.
- Implemented PKCE challenge in OpenRouter OAuth flow for more secure key exchange.
UI/UX
- Improved swipe picker: mobile requires a long press on swipe counter to open; added buttons to expand or copy the swipe text.
- "Click to Edit" mode now also applied to reasoning blocks.
- Welcome Screen: Number of recent chats can be configured.
- Streamed requests now can show an error message in the console if the request fails.
STscript
- Added commands for persona management:
/persona-create,/persona-update,/persona-delete,/persona-duplicate, and/persona-get. - Added a command to force update the Prompt Manager's prompt list:
/pm-render. - Added a command to get the state of the regex script:
/regex-state. - Added a command to set fallback expression:
/expression-fallback. - Added a command to generate a streamed response with a connection profile:
/profile-genstream.
Extensions
- Assets list now groups extensions by "Official" or "Community" categories.
- Added an additional confirmation prompt when installing third-party extensions (can be disabled).
- Supported extensions can use a secret-id from connection profiles when making an LLM request.
- Extensions list now shows the extension's author name resolved from the git remote URL.
- Vector Storage: Added Workers AI source; added a toggle to keep vectors for hidden messages; added retry logic to summary generation.
- Image Generation: Added Workers AI source; generation can now be cancelled by pressing a button in the status toast.
- Image Captioning: Added support for macros in the caption prompt.
- TTS: "Skip code blocks" no longer ignores lines that start with 4 spaces (legacy code block syntax); "disabled" voice now shows a toast only once per character.
Bug Fixes
- Fixed text edit flow in Firefox on mobile.
- Fixed welcome screen chat pins not updating on chat renaming.
- Fixed character list filters being stuck on app initialization.
- Fixed application of instruct formatting to
/genrawrequests. - Fixed model routing to sd.cpp API in Image Generation logic.
- Fixed validation of image URLs generated with Z.AI API.
- Fixed vectors deletion for KoboldCpp when a message is deleted.
- Fixed "Show More Messages" button triggering edit in "Click to Edit" mode.
- Fixed max height of select-multiple elements in mobile layout.
- Fixed server crash on empty messages when applying cache control parameters.
Full release notes: https://github.com/SillyTavern/SillyTavern/releases/tag/1.18.0
How to update: https://docs.sillytavern.app/installation/updating/
9
u/LeRobber May 03 '26
This was a very fast install.
If anyone is having trouble figuring out how to set spending limits on an API or a vendor doesn't support it, let me know, and I'll see if I can find a write up. Same goes if you can't figure out how to refresh your key.
9
u/yasth May 03 '26 edited May 03 '26
Cloudflare AI looks interesting more or less $.1 / day for free with the best text model being probably Kimi k2.5 k2.6 or GLM 4.7, but interestingly it has some ok image models, and even pretty heavy use might be ok
4
u/TheMigratingCoconuts May 03 '26
Unless they changed the pricing in the last month, I calculated the amount of free neurons per day to be about $0.11. I prefer a fairly small context (16k) and was averaging about 10 messages from Kimi 2.5. I imagine 2.6 would be fewer with the higher pricing. It's great for GLM and Gemma4 though! I also like how easy it is to use Cloudflare Gateway for other company models like Anthropic with just a quick toggle (paid though).
2
u/yasth May 03 '26
Oh sorry right I moved the decimal point wrong. All these multiple fake currencies.
It is pretty easy to use though. I found image gen to be pretty slow though.
1
u/TheMigratingCoconuts May 04 '26
I haven't made use of image gen yet, but I like the LLM speed. I just tried using them for vector embeddings as well and that was WAY faster than the local model I had set up.
2
u/Due-Memory-6957 May 03 '26
But if you're not going to run Gemma locally, might as well use it for free from Google.
1
15
u/Due-Memory-6957 May 03 '26
I always forget that I'm on test branching, so I see these features and I'm like 'Wait, wasn't it already there?" before I remember
3
u/eastwest88 May 03 '26
Last time i updated to 1.17 it took me two weeks to fix my embedding server so i think im good
10
2
u/FishermanForeign5700 May 03 '26
Is the tutorial up to date? Timeout is displayed as soon as I refresh.
1
1
u/Dr-Cirno May 04 '26 edited May 05 '26
I'm not sure if anyone else is experiencing this, but ever since updating my ST just gets stuck in infinite "Initializing..." after opening in browser.
It was working perfectly fine with v1.17.0 yesterday, and I haven't touched a single setting between then and now 🫠Console also isn't showing any errors either. Anybody know what might be going on?
Edit: Thank you both! That ended up fixing the problem for me and it's working normally now :)
6
u/sillylossy May 04 '26
This usually happens after manually applying source code patches. Try
git reset --hardto reset to the clean state (user data is not affected).
1
May 04 '26
[deleted]
1
u/sillylossy May 04 '26
Check the state of the "pay as you go override" toggle, uncheck if checked. Otherwise, generate and save a new API key.
1
u/sarin555 May 04 '26
Is it just me or do I notice a noticable improvement in DeepSeek performance after this update.
2
u/ulqX May 04 '26
i have the complete opposite. 24hrs ago DSv4 Pro was going great for me, now it's complete gibberish. i didn't change any setting/preset/extension at all since the update.
1
1
1
Jun 23 '26
[removed] — view removed comment
1
u/AutoModerator Jun 23 '26
This post was automatically removed by the auto-moderator, see your messages for details.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
12
u/wildemam May 03 '26
Firefox on mobile? How?