This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+1 more
Affected surfaces
ReleasePort's take
Moderate signalMilvus v1.5.3 performs a one‑time automatic migration that copies legacy collections to model‑suffixed schemas during upgrade.
Why it matters: The migration runs once on upgrade; plan for schema changes and test the new collection layout before deploying production workloads.
Summary
AI summaryBroad release touches What's New, milvus, deps, and concurrency.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixes Cypher injection vulnerability in Neo4j labelFilter binding. Fixes Cypher injection vulnerability in Neo4j labelFilter binding. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Breaking | High |
One-time automatic migration copies legacy collection to model‑suffixed schema on upgrade. One-time automatic migration copies legacy collection to model‑suffixed schema on upgrade. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Feature | Low |
Adds offline VDB rebuild capability for vector drift recovery. Adds offline VDB rebuild capability for vector drift recovery. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Feature | Low |
Makes MAX_ASYNC a true cross‑worker limit under Gunicorn with aggregated queue stats. Makes MAX_ASYNC a true cross‑worker limit under Gunicorn with aggregated queue stats. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Feature | Low |
Shows server mode (uvicorn/gunicorn) and worker count in status output. Shows server mode (uvicorn/gunicorn) and worker count in status output. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Bugfix | Medium |
Mitigates out‑of‑memory risk by bounding data‑node memory during Milvus schema migration. Mitigates out‑of‑memory risk by bounding data‑node memory during Milvus schema migration. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Bugfix | Medium |
Ensures MongoClient is closed on ClientManager release to prevent resource leaks. Ensures MongoClient is closed on ClientManager release to prevent resource leaks. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Bugfix | Medium |
Clears legacy workspace rows in Qdrant/PostgreSQL on drop to avoid resurrected data. Clears legacy workspace rows in Qdrant/PostgreSQL on drop to avoid resurrected data. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Bugfix | Medium |
Survives transient connection failures during Milvus schema migration. Survives transient connection failures during Milvus schema migration. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Bugfix | Medium |
Loads source collection before migration query_iterator to avoid missing data. Loads source collection before migration query_iterator to avoid missing data. Source: llm_adapter@2026-06-14 Confidence: high |
— |
Full changelog
⚠️ Upgrade Notes (existing Milvus deployments)
Due to PR #3228, upgrading an existing Milvus deployment triggers a one-time automatic migration on the next initialize_storages(): the legacy collection is copied into the new model-suffixed collection (schema-upgraded and byte-truncated) before the service becomes ready. Plan for the extra startup time and write throughput on large collections.
- The migration runs only once. After the suffixed collection exists, every subsequent startup validates and loads it directly and does not re-scan or re-migrate the legacy collection.
- The legacy data is never deleted automatically. For safety the old {workspace}_{namespace} collection is kept, not dropped, so vector storage is temporarily duplicated after the upgrade. This is intentional — the migration does not reclaim the space for you.
- Action required: once you have confirmed the migration succeeded and the new system works correctly against the model-suffixed collection, manually drop the old {workspace}_{namespace} collection yourself to reclaim storage. Until you do, the duplicated vectors remain on disk.
- Legacy collections whose data is incompatible (different vector dimension, or an old simple schema with no vector field) are not migrated; a fresh suffixed collection is created instead and the legacy data is left untouched.
What's New
- feat(tools): add offline VDB rebuild for vector drift recovery by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3243
- feat(concurrency): make MAX_ASYNC a true cross-worker limit under gunicorn + aggregated queue stats by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3253
- refact(Milvus): Fix Milvus dynamic field overflow + isolate collections by embedding model by @ye-guan-xing in https://github.com/HKUDS/LightRAG/pull/3228
What's Changed
- fix(pipeline): retry malformed multimodal analysis JSON by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3242
- Add workspace path traversal validation by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3244
- 🐛 fix(mongo): close MongoClient on ClientManager release by @skymacro in https://github.com/HKUDS/LightRAG/pull/3251
- Fix Qdrant/PostgreSQL resurrecting cleared data: clear workspace's legacy rows on drop by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3254
- fix(neo4j): bind APOC labelFilter as parameter to prevent Cypher injection by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3257
- fix(milvus): survive transient connection failures during schema migration by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3258
- fix(milvus): bound data-node memory during schema migration (OOM mitigation) by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3259
- fix(milvus): load source collection before migration query_iterator by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3260
- refactor(concurrency): use asyncio.get_running_loop().time() in async contexts by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3264
- feat(status): show server mode (uvicorn/gunicorn) and worker count by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3265
- feat(webui): inject two one-time system-suggested user prompts by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3266
- chore(deps): bump the react group in /lightrag_webui with 2 updates by @dependabot[bot] in https://github.com/HKUDS/LightRAG/pull/3247
- chore(deps): bump the frontend-minor-patch group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/HKUDS/LightRAG/pull/3250
- chore(deps-dev): bump typescript-eslint from 8.60.0 to 8.60.1 in /lightrag_webui in the build-tools group by @dependabot[bot] in https://github.com/HKUDS/LightRAG/pull/3249
- chore(deps): bump the ui-components group across 1 directory with 13 updates by @dependabot[bot] in https://github.com/HKUDS/LightRAG/pull/3270
- fix(parser): strip C0 control separators from parsed body before persist by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3272
- chore(pipeline): remove dead _write_lightrag_document_from_content_list by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3273
- fix(bedrock): use modelId for Cohere embeddings invoke_model call by @kimnamu in https://github.com/HKUDS/LightRAG/pull/3268
- fix: centralize sync-wrapper event-loop guard with accurate errors by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3271
- fix(mineru): surface backend transport failures in doc_status error_msg by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3274
- fix(llm): close Anthropic AsyncClient on error and non-streaming return by @skymacro in https://github.com/HKUDS/LightRAG/pull/3261
- fix: DRY refactor of WebUI NDJSON stream parsing by @returnSGD in https://github.com/HKUDS/LightRAG/pull/3269
- chore: bump pre-commit hooks (ruff v0.6.4 → v0.15.17) and reformat by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3276
- docs: add Japanese README by @eltociear in https://github.com/HKUDS/LightRAG/pull/3275
New Contributors
- @ye-guan-xing made their first contribution in https://github.com/HKUDS/LightRAG/pull/3228
- @skymacro made their first contribution in https://github.com/HKUDS/LightRAG/pull/3251
- @kimnamu made their first contribution in https://github.com/HKUDS/LightRAG/pull/3268
- @returnSGD made their first contribution in https://github.com/HKUDS/LightRAG/pull/3269
Full Changelog: https://github.com/HKUDS/LightRAG/compare/v1.5.2...v1.5.3
Breaking Changes
- One-time automatic migration on upgrade copies legacy Milvus collections into new model-suffixed collections; requires manual drop of old collections to reclaim storage.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About LightRAG
[EMNLP2025] "LightRAG: Simple and Fast Retrieval-Augmented Generation"
Related context
Earlier breaking changes
Beta — feedback welcome: [email protected]