[sena-labs]

Summary

Audit remediation across the OWUI runtime, maintenance tooling, tests and docs. This branch was pushed on 2026-10-12 and never opened as a PR; it is opened as a draft so CI runs and the owner can decide on the merge.

Full findings and remediation map: docs/FINDINGS-REMEDIATION.md. Live verification log: docs/LIVE-VERIFICATION-2026-10-12.md. User-visible changes are recorded under [Unreleased] in CHANGELOG.md.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• Breaking change: minimum supported Open WebUI is now 0.11.4
• Documentation update
• Test improvement

Changes Made

• Security: credential normalization, bearer-safe transport errors, tool arguments limited to public schema fields, stricter video URL validation, model metadata and grants preserved during icon sync.
• Runtime fixes: stream/SSE parsing unified, citations and quota footers, media preflight and recovery, TTS cleaning, privacy/ZDR options forwarded.
• CI: ruff + mypy static gates on the hashed requirements-ci.txt snapshot; new test_regressions.py.
• 54d67c1 merges current main (pydantic 2.14.0 chore(deps): bump pydantic from 2.13.5 to 2.14.0 in the python-dependencies group #27, codeql-action pin chore(deps): bump the github-actions group across 1 directory with 2 updates #28). The only conflict was the generated requirements-ci.txt, regenerated with the documented command:
  uv pip compile --python-version 3.10 --generate-hashes --no-header --output-file requirements-ci.txt requirements-ci.in

Testing

Run locally on the merged head (54d67c1), Python 3.14, pip install --require-hashes -r requirements-ci.txt:

• Assertion suite passes (python test_pipe.py)
• Regressions pass (python -m unittest test_maintenance test_alignment test_regressions)
• Static checks pass (ruff check .: all checks passed; mypy: no issues)
• OWUI compatibility smoke: runs in CI on this PR
• User-visible changes recorded in CHANGELOG.md