This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+13 more
Affected surfaces
Summary
AI summaryFixes and performance improvements across lsmkv, memberlist, db, monitoring, telemetry, HNSW, GraphQL, backup, cyclemanager, dependency updates.
Full changelog
Breaking Changes
none
New Features
none
Fixes
- Do not load all lazy shards for property add by @dirkkul in https://github.com/weaviate/weaviate/pull/12184
- fix(usage): abort in-flight usage scan when its collection is dropped by @antas-marcin in https://github.com/weaviate/weaviate/pull/12187
- Do not load lazy loaded shards on backup restore by @dirkkul in https://github.com/weaviate/weaviate/pull/12186
- Stop commit log churn flaking vector storage size test by @dirkkul in https://github.com/weaviate/weaviate/pull/12231
- Backport to v1.36: fix flaky TestMakeUnboundedChannel_CapShrink by @asdine in https://github.com/weaviate/weaviate/pull/12236
- backport: fix(memberlist): retry on join with deadline by @moogacs in https://github.com/weaviate/weaviate/pull/12241
- perf(inverted): add EncodeInto for BlockEntry and BlockData by @amourao in https://github.com/weaviate/weaviate/pull/12150
- perf(lsmkv): pass data start offset to MarshalSortedKeys by @amourao in https://github.com/weaviate/weaviate/pull/12151
- fix(lsmkv): capture values in keyOnly map cursor so keys aren't dropped by @amourao in https://github.com/weaviate/weaviate/pull/12152
- perf(lsmkv): add reusable decode helpers for inverted node data by @amourao in https://github.com/weaviate/weaviate/pull/12154
- perf(lsmkv): add EncodeAppend arena-append primitive to varenc by @amourao in https://github.com/weaviate/weaviate/pull/12149
- perf(lsmkv): add reusable encode pipeline for inverted compaction by @amourao in https://github.com/weaviate/weaviate/pull/12160
- fix(memberlist): don't fail startup when a single node can't join (self-heal) by @moogacs in https://github.com/weaviate/weaviate/pull/12243
- fix(test): join usage poll goroutines so they cannot assert after test completion by @antas-marcin in https://github.com/weaviate/weaviate/pull/12237
- test(async-repl): gate scheduler close tests on dispatch round-trips, not channel-buffer sampling by @jeroiraz in https://github.com/weaviate/weaviate/pull/12250
- fix(db): ABBA deadlock between updateReplicationConfig and lazy shard load wedges RAFT FSM by @jfrancoa in https://github.com/weaviate/weaviate/pull/12238
- perf(lsmkv): wire inverted compaction through the reusable encode pipeline by @amourao in https://github.com/weaviate/weaviate/pull/12161
- perf(lsmkv): reuse decode buffers in the inverted cursor by @amourao in https://github.com/weaviate/weaviate/pull/12163
- perf(lsmkv): reuse the propLengthsView across inverted compaction nodes by @amourao in https://github.com/weaviate/weaviate/pull/12233
- refactor(lsmkv): extract inverted block codec into inverted/blockenc by @amourao in https://github.com/weaviate/weaviate/pull/12244
- fix(lsmkv): repair stable/v1.37 build broken by the v1.36 merge (blockenc.PackedDecode) by @jeroiraz in https://github.com/weaviate/weaviate/pull/12257
- Key the auth singleflight on the key, not just the user by @dirkkul in https://github.com/weaviate/weaviate/pull/12270
- Fix RBAC regexp by @dirkkul in https://github.com/weaviate/weaviate/pull/12251
- feat(monitoring): unified background-process activity + duration metrics by @moogacs in https://github.com/weaviate/weaviate/pull/12275
- Make number of files that are deduplicated in incremental backups configurable by @dirkkul in https://github.com/weaviate/weaviate/pull/12234
- fix(db): shut down vector index when its queue creation fails to avoid orphaning it by @antas-marcin in https://github.com/weaviate/weaviate/pull/12192
- cyclemanager: replace per-tick due-scan with a due-heap scheduler by @aliszka in https://github.com/weaviate/weaviate/pull/12099
- Update GRPC dependency by @dirkkul in https://github.com/weaviate/weaviate/pull/12311
- feat(telemetry): persistent cluster and node identity for correlatable telemetry by @moogacs in https://github.com/weaviate/weaviate/pull/12296
- Reduce heap usage in HNSW condensor by @dirkkul in https://github.com/weaviate/weaviate/pull/12306
- AddMultiVector idempotence fix by @trengrj in https://github.com/weaviate/weaviate/pull/12170
- Drop fmt.Sprintf from commit-log path builders to save allocations by @dirkkul in https://github.com/weaviate/weaviate/pull/12310
- Use a view instead of copy in hnsw packed connection by @dirkkul in https://github.com/weaviate/weaviate/pull/12309
- Reduce allocations for auto schema time/uuid parsing by @dirkkul in https://github.com/weaviate/weaviate/pull/12301
- refact(telemetry) gate cluster-id commit on telemetry being enabled by @moogacs in https://github.com/weaviate/weaviate/pull/12326
- fix(graphql): reject non-object variables instead of panicking by @moogacs in https://github.com/weaviate/weaviate/pull/12332
- Don't discard teardown work when one shutdown step fails by @dirkkul in https://github.com/weaviate/weaviate/pull/12333
- Improve segment index performance by using van Emde Boas layout by @dirkkul in https://github.com/weaviate/weaviate/pull/12327
- Fix bugs in index shutdown by @dirkkul in https://github.com/weaviate/weaviate/pull/12331
- Drop derived file names when recovering an aborted compaction by @dirkkul in https://github.com/weaviate/weaviate/pull/12336
- Fix shard shutdown backup and wrong error return by @dirkkul in https://github.com/weaviate/weaviate/pull/12337
- chore(deps): bump golang.org/x/net to v0.56.0 and golang.org/x/text to v0.39.0 (CVE-2026-46600, CVE-2026-56852) by @etiennedi in https://github.com/weaviate/weaviate/pull/12347
- deps: adjust go dependencies in sub projects by @antas-marcin in https://github.com/weaviate/weaviate/pull/12362
- Release shard references exactly once per acquire by @dirkkul in https://github.com/weaviate/weaviate/pull/12363
- fix(replica): never use a search result as a read-repair payload by @etiennedi in https://github.com/weaviate/weaviate/pull/12355
Full Changelog: https://github.com/weaviate/weaviate/compare/v1.37.13...v1.37.14
Security Fixes
- dep: golang.org/x/net v0.56.0, golang.org/x/text v0.39.0 – addresses CVE-2026-46600 and CVE-2026-56852
- CVE-2026-56852
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About weaviate
Weaviate is an open-source vector database that stores both objects and vectors, allowing for the combination of vector search with structured filtering with the fault tolerance and scalability of a cloud-native database.
Beta — feedback welcome: [email protected]