Skip to content

weaviate

v1.37.10 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Vector Databases
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

approximate-nearest-neighbor-search generative-search grpc hnsw hybrid-search image-search
+13 more
information-retrieval mlops nearest-neighbor-search neural-search recommender-system search-engine semantic-search semantic-search-engine similarity-search vector-db vector-search-engine vectors weaviate

Affected surfaces

auth rbac rce_ssrf deps

Summary

AI summary

Broad release touches New Features none, hfresh, hnsw, and bm25.

Full changelog

Breaking Changes

none

New Features

none

Fixes

  • Fix goroutine leak in listing all s3 backups by @dirkkul in https://github.com/weaviate/weaviate/pull/11702
  • Increase timeout for ObjectTTL test in case multi node cluster is not ready yet by @dirkkul in https://github.com/weaviate/weaviate/pull/11651
  • fix: shebang in tools/dev/run_dev_server.sh script by @antas-marcin in https://github.com/weaviate/weaviate/pull/11722
  • Reduce goroutines spawned by cyclemanager by @dirkkul in https://github.com/weaviate/weaviate/pull/11701
  • Gut the replicated indices queue feature due to lack of use by @tsmith023 in https://github.com/weaviate/weaviate/pull/11654
  • Switch cycle manager to backoff on idle by @dirkkul in https://github.com/weaviate/weaviate/pull/11703
  • test(replication): stabilize TestReadRepairDeleteOnConflict against node-boot timing by @jeroiraz in https://github.com/weaviate/weaviate/pull/11748
  • Dont timeout shard halting in unrelated unittest by @dirkkul in https://github.com/weaviate/weaviate/pull/11727
  • Fix wrong authz check for get groups for role by @dirkkul in https://github.com/weaviate/weaviate/pull/11728
  • Fix backup concurrency calculation by @dirkkul in https://github.com/weaviate/weaviate/pull/11733
  • Optimize async replication to use efficient property unmarshalling by @dirkkul in https://github.com/weaviate/weaviate/pull/11761
  • Enforce tenant cap in RAFT by @dirkkul in https://github.com/weaviate/weaviate/pull/11752
  • feat(module): add generative-deepseek module by @antas-marcin in https://github.com/weaviate/weaviate/pull/11769
  • fix(shard): make initTargetVector idempotent to prevent double-create by @amourao in https://github.com/weaviate/weaviate/pull/11584
  • fix(dynamic): serialize config updates and Iterate against the flat->hnsw upgrade by @amourao in https://github.com/weaviate/weaviate/pull/11582
  • fix(hnsw): read compression config under compressActionLock in insert validation by @amourao in https://github.com/weaviate/weaviate/pull/11583
  • backport: feat: add location configuration to text2vec-google module (#8418) by @antas-marcin in https://github.com/weaviate/weaviate/pull/11762
  • feat: add support for endpoint setting in OpenAI client by @antas-marcin in https://github.com/weaviate/weaviate/pull/11763
  • feat(generative-google): add support for location setting by @antas-marcin in https://github.com/weaviate/weaviate/pull/11766
  • fix(bm25): record max-impact pair on memtable BlockEntry by @amourao in https://github.com/weaviate/weaviate/pull/11780
  • feat: add support for dimensions setting in text2vec-aws module by @antas-marcin in https://github.com/weaviate/weaviate/pull/11764
  • fix(usage-limits): tenant cap rejects ingest into existing tenants by @aliszka in https://github.com/weaviate/weaviate/pull/11765
  • Add missing forwarding of property names by @dirkkul in https://github.com/weaviate/weaviate/pull/11782
  • security(modules): validate X-*-BaseURL request headers to close SSRF bypass by @spiros-spiros in https://github.com/weaviate/weaviate/pull/11683
  • hfresh: increase searchProbe default to 256 by @asdine in https://github.com/weaviate/weaviate/pull/11793
  • fix: route multivector queue deletes through DeleteMulti by @asdine in https://github.com/weaviate/weaviate/pull/11794
  • chore(generative-deepseek): add support for stop setting in module settings by @antas-marcin in https://github.com/weaviate/weaviate/pull/11796
  • hfresh: defer queue registration until restore completes by @asdine in https://github.com/weaviate/weaviate/pull/11795
  • Remove flaky assertion for dynamic index by @trengrj in https://github.com/weaviate/weaviate/pull/11801
  • fix(backup): return 5xx for operational failures by @gkampitakis in https://github.com/weaviate/weaviate/pull/11803
  • Skip malformed runtime config values by @dirkkul in https://github.com/weaviate/weaviate/pull/11614
  • hfresh: fix reassign queue recovery hints by @asdine in https://github.com/weaviate/weaviate/pull/11821
  • perf(bm25): faster varint decoding (reservoir + 64-bit reads) by @amourao in https://github.com/weaviate/weaviate/pull/11770
  • perf(bm25): Tier-1 allocation cuts in the BlockMax WAND hot path by @amourao in https://github.com/weaviate/weaviate/pull/11772
  • fix(hnsw): stop dropping nodes at snapshot block boundaries by @asdine in https://github.com/weaviate/weaviate/pull/11829
  • security: bump golang.org/x/net and golang.org/x/crypto libs by @antas-marcin in https://github.com/weaviate/weaviate/pull/11840
  • hfresh: reduce task dedup memory by @asdine in https://github.com/weaviate/weaviate/pull/11827
  • Fix backup RBAC checks by @dirkkul in https://github.com/weaviate/weaviate/pull/11123
  • chore(deps): remove github.com/puzpuzpuz/xsync/v4 dependency by @antas-marcin in https://github.com/weaviate/weaviate/pull/11843
  • Snapshot in-place-mutated bbolt files during active-shard backup by @tsmith023 in https://github.com/weaviate/weaviate/pull/11832
  • fix(usage): don't abort the whole usage report in case of missing tenant by @antas-marcin in https://github.com/weaviate/weaviate/pull/11849
  • perf(async-rep): reuse a single cursor across the hashbeat digest scan by @jeroiraz in https://github.com/weaviate/weaviate/pull/11833
  • fix(hnsw): parallel-cursor prefill for unbounded uncompressed vector cache by @etiennedi in https://github.com/weaviate/weaviate/pull/11838

Full Changelog: https://github.com/weaviate/weaviate/compare/v1.37.9...v1.37.10

Security Fixes

  • Validate X-*-BaseURL request headers to close SSRF bypass

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track weaviate

Get notified when new releases ship.

Sign up free

About weaviate

Weaviate is an open-source vector database that stores both objects and vectors, allowing for the combination of vector search with structured filtering with the fault tolerance and scalability of a cloud-native database​.

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]