lia-by-librechat · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026
diff --git a/components/LocalInstallHub.tsx b/components/LocalInstallHub.tsx
@@ -102,7 +102,7 @@ const methods: {
     time: '~20 min',
     difficulty: 'Intermediate',
     prereqs: [
-      { label: 'Node.js v24.16.0', href: 'https://nodejs.org/en/download' },
+      { label: 'Node.js v24.22.1', href: 'https://nodejs.org/en/download' },
       { label: 'Git', href: 'https://git-scm.com/downloads' },
       { label: 'MongoDB', href: '/docs/configuration/mongodb/mongodb_atlas' },
     ],

diff --git a/content/changelog/config_v1.3.18.mdx b/content/changelog/config_v1.3.18.mdx
@@ -0,0 +1,80 @@
+---
+date: 2026-10-23
+title: ⚙️ Config v1.3.18
+version: '1.3.18'
+---
+
+Config `1.3.18` accompanies the pending `v0.8.9-rc1` candidate. The previous config changelog is unchanged. Review the [upgrade guide](/docs/configuration/upgrade) before rolling deployments or rollback.
+
+## Account Security and Credentials
+
+- `credentials.writeFormat` defaults to `v3`; use `legacy` while older readers remain. Existing records are not converted by changing the switch.
+- `TWO_FACTOR_BACKUP_CODE_FORMAT` defaults to strong codes. Legacy codes remain usable; issuing strong codes creates a rollback boundary for older readers.
+- `emailChange.enabled` overrides `ALLOW_EMAIL_CHANGE`; omission preserves the default-on behavior. Keep it off until every node uses address-bound password reset links. `tokenTTLSeconds` defaults to `900`.
+- `ALLOW_PASSKEY_LOGIN` defaults to `false`. `passkeys.perUserMax` overrides `MAX_PASSKEYS_PER_USER` and defaults to `20`.
+- `ENFORCE_TWO_FACTOR_AUTHENTICATION` defaults to `false`. Temporary-code and enrollment-setup budgets are separate process-level limits.
+- `AUDIT_LOG_FAIL_CLOSED` protects system-grant assignments and widening sharing changes by default. Revocations are not blocked by an audit outage.
+- `CONFIG_OVERRIDE_ENV_ALLOWLIST` extends the permitted environment references in admin-written config. Stored credentials require re-entry when their bound destination changes or disappears.
+- `permissions.leaseTtlMs` defaults to `30000` and `leaseWaitMs` to `3000`, bounding contention for sharing updates on deployments without transactions.
+
+## Configuration Profiles
+
+The database Base profile overrides YAML before principal profiles. Removing an override restores inheritance; a tombstone hides inherited values. Atomic per-profile changes support dry-run validation and revision checks. Role rename/delete operations preserve or clean up their dependent profiles and access grants but are not multi-document transactions.
+
+## Interface, Projects, and Data Retention
+
+| Setting                                             | Default / behavior                                                                     |
+| --------------------------------------------------- | -------------------------------------------------------------------------------------- |
+| `projects.maxFiles`                                 | `50`, maximum `500`                                                                    |
+| `projects.maxInstructionsLength`                    | `16000`, maximum `200000`                                                              |
+| `projects.maxDescriptionLength`                     | `1000`, maximum `10000`                                                                |
+| `toolCallPreviews.enabled`                          | `true`; only clients requesting previews receive them                                  |
+| `toolCallPreviews.outputChars`, `argsChars`         | `512` characters each                                                                  |
+| `fileListLimit`                                     | `100` for explicit file-list `limit` requests                                          |
+| `interface.landingHeading`                          | `entity`; `greeting` is an alternative                                                 |
+| `interface.landingFooter`                           | `true`; a custom footer remains independent                                            |
+| `interface.runningChatRename`                       | `true`; turn off during mixed-version title-job rollouts                               |
+| `interface.historyCacheTtlMs`, `historyCacheRecent` | `60000` ms and `1` recently left conversation                                          |
+| `interface.artifactUndocking`, `mascot`             | `true`; users still opt in to the mascot                                               |
+| `interface.replyNotifications`                      | Deployment permission gates; alert preferences remain per device                       |
+| `interface.retentionMode`                           | `temporary`; `all` expires ordinary history and `ephemeral` forces all chats temporary |
+| `langfuse.trace.temporaryChats`                     | `false`                                                                                |
+| `fileConfig.clientImageResize.enabled`              | Omit for the user's choice, on by default; explicit values force it                    |
+
+`interface.theme` accepts a bundled theme name or versioned light/dark definition. It is deployment-owned, outranks stored themes and legacy environment colors, and yields to high-contrast modes.
+
+## Agent and Tool Controls
+
+- `balance.refillMode: add` retains rollover; `reset` replaces the allowance and requires compatible replicas. `balance.display` accepts `credits`, `currency`, or `percent`.
+- `speech.tts.maxInputChars` defaults to `20000`.
+- `passwordHashing.maxWorkers` bounds background hashing; the default is `max(1, min(4, availableParallelism() - 1))`.
+- `timeouts` adds per-operation outbound budgets: `ragMs: 30000`, `ocrMs: 300000`, `actionsMs: 300000`, `moderationMs: 10000`, and `imageFetchMs: 30000`.
+- `endpoints.agents.streamKeepaliveIntervalMs` defaults to `25000`; `0` disables quiet-stream keepalives.
+- `hostFileEdits` bounds host-side edit matching, not attached-worker edits: `maxEdits: 100`, `maxWorkBytes: 67108864`, `maxOccurrences: 100000`, `timeoutMs: 2000`, and `maxConcurrent: 2`.
+- `subagentActivity` adds bounded live replay independent of the completed transcript. Defaults: `replayTtlMs: 300000`, `publicationTimeoutMs: 1000`, `retryAttempts: 3`, `retryBaseDelayMs: 100`, `recoveryDelayMs: 1000`, `memoryMaxStreams: 1000`, and `memoryMaxBytes: 16777216`.
+- `backgroundTasks.completionReceiptBatching` defaults to `true`; disable while incompatible replicas remain.
+- `toolApproval.agentModes` defaults to `false`; `grantLookupTimeoutMs` defaults to `3000`. `allowAlways` defaults to `false`. Administrator ask/deny rules remain authoritative.
+- `endpoints.all` title settings resolve per field; `titleEndpoint` and `titleModel` are selected together from the first layer specifying either.
+- `web_search` gates LibreChat's external search pipeline, not provider-native search. Both require `WEB_SEARCH.USE`, seeded by `interface.webSearch`.
+
+## Attached Workspaces and Pull Requests
+
+Decision protocol v1 is advertised by default. `CODE_ENVIRONMENT_DECISION_VERSION=0` retains the legacy path and disables per-chat machine choice. `statefulCodeSessions.allowEnvironmentSelection` defaults to `true`, with explicit per-agent machine allowlists; `maxEnvironmentChoices` defaults to `32` and supports up to `128`.
+
+Attached environments may set `configSchema.limits.defaultCommandTimeoutMs` and `defaultReadFileLines`; omission keeps `30000` ms and `200` lines. Worker and HTTP ceilings still apply. Upgrade all replicas before using new strict fields. Saved-chat moves and attach/detach remain separate opt-ins.
+
+`endpoints.agents.pullRequests` adds scoped GitHub, GitLab, and Bitbucket lookups, optional per-user OAuth, and optional Redis sharing. It requires compatible worker git reporting and provider credentials; see the [upgrade guide](/docs/configuration/upgrade#connected-coding-and-mcp-apps).
+
+## MCP Apps and OAuth
+
+- New MCP Apps require explicit `mcpSettings.apps: true`. Omission retains legacy inline HTML; `false` disables both.
+- `mcpAppSandbox` configures a deployment-owned dedicated origin and bounded source, storage, admission, active-view, and preview limits.
+- `mcpServers.<name>.oauthPrompt` defaults to `on_start`. `on_use` postpones sign-in only when every selected tool from that server is deferred and a usable `oauthToolCatalog` is available; otherwise turn-start prompting remains.
+
+## Telemetry and Content Protection
+
+- `telemetry.rum.enabled` and `telemetry.rum.sessionReplay.enabled` override environment fallbacks. Replay is a separate opt-in, not general-purpose DLP.
+- `RUM_CLIENT_LOGS` defaults to `false` and is proxy-only. `RUM_SESSION_REPLAY_ENABLED` supersedes the deprecated inverse fallback.
+- Proxy defaults: `RUM_PROXY_BODY_LIMIT=3mb`, `RUM_PROXY_USER_MAX=240`, and `RUM_PROXY_USER_WINDOW=1` minute.
+- `LOG_REDACTION_MAX_NODES` defaults to `5000` per log record.
+- PII `action: redact` can transform fresh text-only interactive Agent submissions with `clientRequestId`; edits, resumes, files, quotes, other endpoints, and other fields retain blocking checks. Encrypted owner-original recovery requires the original `CREDS_KEY`; ordinary exports remain canonical/filtered.