Skip to content

meilisearch

v1.47.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Search Engines
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

ai api app-search database enterprise-search faceting
+13 more
full-text-search fuzzy-search geosearch hybrid-search instantsearch search search-as-you-type search-engine semantic-search site-search typo-tolerance vector-db vectors

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 1mo

The release prevents shell injection in GitHub Actions release workflows and updates several error codes.

Why it matters: Mitigates a critical security risk (severity 90) by preventing shell injection in CI pipelines; also alters MultiSearch<Error> ↔ Search<Error> mappings that may affect automation logic.

Summary

AI summary

Updates 🌈 Enhancements, Other changes, and 🦋 Fixes across a mixed release.

Changes in this release

Security Critical

Prevents shell injection in GitHub Actions release workflows.

Prevents shell injection in GitHub Actions release workflows.

Source: llm_adapter@2026-06-15

Confidence: high

 —
Breaking High

Changes a few error codes, e.g., `MultiSearch<Error>` ↔ `Search<Error`.

Changes a few error codes, e.g., `MultiSearch<Error>` ↔ `Search<Error`.

Source: llm_adapter@2026-06-15

Confidence: high

 —
Feature Medium

Adds search personalization support for federated search requests.

Adds search personalization support for federated search requests.

Source: llm_adapter@2026-06-15

Confidence: high

 —
Feature Medium

Makes the new settings indexer feature‑complete, improving scaling and cancellation.

Makes the new settings indexer feature‑complete, improving scaling and cancellation.

Source: llm_adapter@2026-06-15

Confidence: high

 —
Feature Medium

Exposes additional Prometheus metrics for document throughput and debugging.

Exposes additional Prometheus metrics for document throughput and debugging.

Source: llm_adapter@2026-06-15

Confidence: high

 —
Dependency Low

Replaces custom hf‑hub git dependency with the official one.

Replaces custom hf‑hub git dependency with the official one.

Source: llm_adapter@2026-06-15

Confidence: high

 —
Deprecation Low

Removes the unused `vectorStoreBackend` setting.

Removes the unused `vectorStoreBackend` setting.

Source: llm_adapter@2026-06-15

Confidence: high

 —
Bugfix Medium

Ensures attributeRank/wordPosition in rankingRules no longer removes hits.

Ensures attributeRank/wordPosition in rankingRules no longer removes hits.

Source: llm_adapter@2026-06-15

Confidence: high

 —
Bugfix Medium

Correctly applies `searchCutoffMs` when embedding documents.

Correctly applies `searchCutoffMs` when embedding documents.

Source: llm_adapter@2026-06-15

Confidence: high

 —
Bugfix Medium

Handles filters containing `'` in remote federated or `useNetwork: true` search requests.

Handles filters containing `'` in remote federated or `useNetwork: true` search requests.

Source: llm_adapter@2026-06-15

Confidence: high

 —
Full changelog

🌈 Enhancements

Search personalization on federated search

We now support using the search personalization feature on federated search requests.

Like page/hitPerPage or limit/offset, the personalization option must be specified in the federation attribute to work properly.
Otherwise, an error will be returned reminding you to move the attribute in federation.

By @ManyTheFish in https://github.com/meilisearch/meilisearch/pull/6414

The new settings indexer is feature complete 🎉

  • We now better support the tokenizer-related settings
  • We improved the quality of the new settings indexer to enhance the engine's performance when changing the locales, the dictionary, synonyms, stop words, separator, and non-separator tokens.
  • This makes the new settings indexer feature-complete, meaning that, unless you set the MEILI_EXPERIMENTAL_NO_EDITION_2024_FOR_SETTINGS environment variable to true, all settings tasks can now be handled by the new settings indexer, bringing a better scaling behavior, much faster cancellation, and a more precise progress view.

By @Kerollmops in https://github.com/meilisearch/meilisearch/pull/6409

Observability improvements

We expose more Prometheus metrics to improve observability, specifically to show more metrics on document throughput and ease debugging.

By @Kerollmops in https://github.com/meilisearch/meilisearch/pull/6430

🦋 Fixes

  • Putting attributeRank/ wordPosition before words in the rankingRules list will no longer remove hits from the response, by @pjdurden in https://github.com/meilisearch/meilisearch/pull/6437
  • Meilisearch will no longer ignore the searchCutoffMs in some conditions when embedding documents, by @dureuill in https://github.com/meilisearch/meilisearch/pull/6447
  • Meilisearch will no longer fail to proxy a search request with a filter containing a ' during remote federated search or useNetwork: true search requests, by @dureuill in https://github.com/meilisearch/meilisearch/pull/6445

🔒 Security

  • CI: Prevent shell injection in GitHub Actions release workflows by @curquiza in https://github.com/meilisearch/meilisearch/pull/6420

🔩 Misc. changes

Search implementation refactor

Refactor the search pipeline to mutualize the code.
The new implementation will always perform a federated search under the hood, and then the output will be transformed into the expected route's output.

Noticeable changes from the user perspective:

  • Some error messages have been modified
  • Small breaking change: a few error codes change, such as MultiSearch<Error> <--> Search<Error>

Other changes

  • Make it easier and less error-prone to declare a type that is used as a body parameter on a Meilisearch endpoint, by @dureuill in https://github.com/meilisearch/meilisearch/pull/6429
  • Remove the now unused vectorStoreBackend setting from the settings, by @Kerollmops in https://github.com/meilisearch/meilisearch/pull/6399
  • Replace custom hf-hub git dependency by the official one by @Kerollmops in https://github.com/meilisearch/meilisearch/pull/6442
  • Update Python SDK test CI by @Strift in https://github.com/meilisearch/meilisearch/pull/6439
  • Refactor the code to use the MustStopProcessing type everywhere by @Kerollmops in https://github.com/meilisearch/meilisearch/pull/6423

New Contributors

  • @pjdurden made their first contribution in https://github.com/meilisearch/meilisearch/pull/6437

Full Changelog: https://github.com/meilisearch/meilisearch/compare/v1.46.1...v1.47.0

Breaking Changes

  • Error codes for MultiSearch and Search routes have changed (small breaking change).

Security Fixes

  • CI: Prevent shell injection in GitHub Actions release workflows
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track meilisearch

Get notified when new releases ship.

Sign up free

About meilisearch

A lightning-fast search engine API bringing AI-powered hybrid search to your sites and applications.

All releases →

Related context

Earlier breaking changes

  • v1.50.0 `selector` of an `Action` now requires mandatory `id` field in dynamic search rules.
  • v1.50.0 `filter.attributePatterns` replaced with `filter.query` in listing dynamic search rules endpoint.
  • v1.50.0 `conditions.query.words` replaces `contains` in QueryCondition of dynamic search rules.
  • v1.50.0 `conditions` changed from array to object with `query` and `time` fields in dynamic search rules.
  • v1.50.0 `priority` replaced with `precedence` in dynamic search rules.

Beta — feedback welcome: [email protected]