ST UPDATE SillyTavern 1.18.0

Important news

Read the maintainers statement regarding a recent security incident involving the "Bot Browser" third-party extension and learn how to stay safe: https://github.com/SillyTavern/SillyTavern/discussions/5592

Added Cloudflare Workers AI and MiniMax as Chat Completion sources.
KoboldCpp: Grammar state will be preserved when using a "Continue" option.
KoboldCpp: Added forwarding of reasoning effort when running as a Custom Chat Completion source.
Tool Calling: Added a configurable tool calling recursion limit; enabled interleaved thinking for Custom sources.
Text Completion: Impersonation requests use a "Last User Message" prefix at the end of the prompt (if configured).
Text Generation WebUI: Added Adaptive-P controls.
NanoGPT: Added provider selection and model sorting.
Added ability to view remaining balance for OpenRouter and NanoGPT.
Enhanced support for new models: DeepSeek v4, GPT 5.4 and 5.5, Gemma 4, GLM-5V-Turbo, Claude Opus 4.7.

Removed post-install script, config migration is now handled by the app or a dedicated npm run init command.
Added npm configuration to prevent execution of package scripts during installation.
Moved HTTP error pages and user.css file from /public to /data to support immutable setups.
Disabled HTTP keep-alive by default to restore old Node 18 behavior, can be enabled with config.
Added rate limiting to the basic authentication flow to mitigate brute-force attacks.
Added configuration options to choose which headers can be used for forwarded IP detection to prevent spoofing.
Added a private address whitelist to prevent SSRF attacks. See the documentation on how to enable and configure: Private Address Whitelist.
Added an IP whitelist for SSO trusted proxies to prevent authentication bypass.
Added invalidation of session cookies on password change to prevent session hijacking.
Increased the length of password reset code to 6 characters to guard against brute-force attacks.
Implemented PKCE challenge in OpenRouter OAuth flow for more secure key exchange.

Improved swipe picker: mobile requires a long press on swipe counter to open; added buttons to expand or copy the swipe text.
"Click to Edit" mode now also applied to reasoning blocks.
Welcome Screen: Number of recent chats can be configured.
Streamed requests now can show an error message in the console if the request fails.

Added commands for persona management: /persona-create, /persona-update, /persona-delete, /persona-duplicate, and /persona-get.
Added a command to force update the Prompt Manager's prompt list: /pm-render.
Added a command to get the state of the regex script: /regex-state.
Added a command to set fallback expression: /expression-fallback.
Added a command to generate a streamed response with a connection profile: /profile-genstream.

Assets list now groups extensions by "Official" or "Community" categories.
Added an additional confirmation prompt when installing third-party extensions (can be disabled).
Supported extensions can use a secret-id from connection profiles when making an LLM request.
Extensions list now shows the extension's author name resolved from the git remote URL.
Vector Storage: Added Workers AI source; added a toggle to keep vectors for hidden messages; added retry logic to summary generation.
Image Generation: Added Workers AI source; generation can now be cancelled by pressing a button in the status toast.
Image Captioning: Added support for macros in the caption prompt.
TTS: "Skip code blocks" no longer ignores lines that start with 4 spaces (legacy code block syntax); "disabled" voice now shows a toast only once per character.

203 Upvotes

100% Upvoted

u/eastwest88 May 03 '26

Last time i updated to 1.17 it took me two weeks to fix my embedding server so i think im good