DB-GPT

v0.8.1 Security

This release patches 3 CVEs for security teams tracking exposure across their dependency inventory.

Published 1mo AI Agents & Assistants

View tool

3 patched CVEs

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs CVE-2022-33891 EPSS 93% CVE-2026-42208 EPSS 87% CVE-2026-42271 EPSS 80%

3 CVEs patched

Topics

agents bgi database deepseek llm gpt-4

+3 more

private security vicuna

Affected surfaces

auth

Summary

AI summary

Updates 🐞 Bug fixes, ✨ Enhancements, and 👥 New Contributors across a mixed release.

Full changelog

✨ Enhancements

Support Schedule task and MCP connector (#3095)
add CLIENT SETNAME to Valkey vector store client (#3090)
upgrade MiniMax default model to M3 (#3093)
Harden ~/.dbgpt/configs/<profile>.toml file permissions to 0o600 (#3077)
adds context management, task-plan tracking, and the corresponding frontend UI. (#3053)
Implement VARBINARY and BINARY types for StarRocks (#3062)
add Valkey cache integration (#3057)
make distance metric configurable (#3044)
add Valkey vector store integration (#3051)
add LiteLLM as an embedded AI gateway provider (#3043)
Adds support for vector search with Qdrant (#3034)
add openGauss datasource support (#3007)
cache ConnectorManager.get_connector with TTL (~63s -> <10ms on warm cache) (#3046)

🐞 Bug fixes

require local runtime opt-in (#3092)
support DeepSeek V4 Pro (#3079)
use size chunking by default for markdown knowledge (Fixes #3030) (#3033)
restrict personal skill script execution (#3071)
validate example file names (#3066)
validate skill upload filenames (#3065)
handle knowledge space id responses (#3070)
constrain python upload filenames (#3064)
tolerate multi-step ReAct output (#3074)
Implement VARBINARY and BINARY types for StarRocks (#3062)
tell LLM the table list is a TOP-K subset, not the full DB (#3045)
fix the insufficient length of the content column in the gpts_messages table (#3055)
make MilvusStore compatible with milvus 2.5+ (#3042)
per-chunk error tolerance + per-db indexing lock (#3040)
override get_fields() for MSSQL with SQL Server-correct INFORMATION_SCHEMA (#3039)
add authentication dependency to knowledge module endpoints (#3038)
BranchOperator incorrectly skips shared downstream nodes (fixes #2935) (#3035)
honor configured Tongyi embedding model name (Fixes #3029) (#3032)
use explicit UTF-8 encoding when writing code_interpreter temp script (#3023)
Fix DuckDB datasource creation from Web UI (#3009)

👥 New Contributors

@Aalron
@Anush008
@Artoriasn
@Goodnight77
@JAE0Y2N
@RheagalFire
@atao2004
@daric93
@github0070070
@hankchrome
@he-yufeng
@mryanzhicong
@wolfkill

Thank you to all our contributors for making this release possible!
@Aalron, @Anush008, @Aries-ckt, @Artoriasn, @Goodnight77, @JAE0Y2N, @RheagalFire, @atao2004, @chenliang15405, @daric93, @github0070070, @hankchrome, @he-yufeng, @honglei, @mryanzhicong, @octo-patch and @wolfkill

中文发版说明： https://www.yuque.com/eosphoros/dbgpt-docs/cehdiidrbm8kw1md
Release Note：http://docs.dbgpt.cn/docs/next/changelog/Released_V0.8.1

Security Fixes

Harden ~/.dbgpt/configs/.toml file permissions to 0o600

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track DB-GPT

Get notified when new releases ship.

About DB-GPT

open-source agentic AI data assistant for the next generation of AI + Data products.

All releases →