Skip to content

LightRAG

v1.5.4 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo RAG & Retrieval
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

genai llm gpt-4 graphrag knowledge-graph large-language-models
+1 more
retrieval-augmented-generation

Affected surfaces

auth rce_ssrf

Summary

AI summary

Updates What's New, parser, and webui across a mixed release.

Full changelog

What's New

  • feat(parser): native engine support for Markdown parsing, including embedded base64 images and .textpack bundle image integration by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3280
  • feat(parser): per-file engine parameters via hint/rule (Phase 2 — MinerU + Docling) by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3284
  • perf(webui): made graph rendering more efficient -> large knowledge graphs now usable by @Xaverrrrr in https://github.com/HKUDS/LightRAG/pull/3304

What's Changed

  • Add parameterized parser hints for chunk strategy tuning by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3282
  • feat(chunker): add drop_references option to P chunking strategy by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3285
  • feat(webui): reorder query modes and warn on lower-quality modes by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3287
  • fix(mineru): drop page_number items from blocks content by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3288
  • fix(storage): handle set ids in delete (Issue #3286) by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3289
  • Fixed typo (Dokcer -> Docker) by @aleksvujic in https://github.com/HKUDS/LightRAG/pull/3291
  • refactor(parser): move all chunking out of the docx parser by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3295
  • fix(api): stop guest tokens from bypassing X-API-Key auth by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3319
  • fix(api): don't pair wildcard CORS origin with credentials by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3317
  • docs(README): add optional HVTracker trust badge by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/3320
  • fix(sidecar): prevent path traversal in asset materialization by @VectorPeak in https://github.com/HKUDS/LightRAG/pull/3316

New Contributors

  • @VectorPeak made their first contribution in https://github.com/HKUDS/LightRAG/pull/3316

Full Changelog: https://github.com/HKUDS/LightRAG/compare/v1.5.3...v1.5.4

Security Fixes

  • Fix: guest tokens can no longer bypass X-API-Key authentication
  • Fix: wildcard CORS origin is not paired with credentials to prevent abuse
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track LightRAG

Get notified when new releases ship.

Sign up free

About LightRAG

[EMNLP2025] "LightRAG: Simple and Fast Retrieval-Augmented Generation"

All releases →

Related context

Earlier breaking changes

  • v1.5.3 One-time automatic migration copies legacy collection to model‑suffixed schema on upgrade.
  • v1.5.0rc3 Removes deprecated `QueryParam.model_func` field from lightrag/base.py.
  • v1.5.0rc3 Deprecates the `ENTITY_TYPES` environment variable; replace with ENTITY_TYPE_PROMPT_FILE.
  • v1.5.0rc2 ENTITY_TYPES environment variable deprecated; replace with ENTITY_TYPE_PROMPT_FILE before upgrading.

Beta — feedback welcome: [email protected]