This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+13 more
Affected surfaces
Summary
AI summaryBroad release touches New Features none, hfresh, hnsw, and bm25.
Full changelog
Breaking Changes
none
New Features
none
Fixes
- Fix goroutine leak in listing all s3 backups by @dirkkul in https://github.com/weaviate/weaviate/pull/11702
- Increase timeout for ObjectTTL test in case multi node cluster is not ready yet by @dirkkul in https://github.com/weaviate/weaviate/pull/11651
- fix: shebang in tools/dev/run_dev_server.sh script by @antas-marcin in https://github.com/weaviate/weaviate/pull/11722
- Reduce goroutines spawned by cyclemanager by @dirkkul in https://github.com/weaviate/weaviate/pull/11701
- Gut the replicated indices queue feature due to lack of use by @tsmith023 in https://github.com/weaviate/weaviate/pull/11654
- Switch cycle manager to backoff on idle by @dirkkul in https://github.com/weaviate/weaviate/pull/11703
- test(replication): stabilize TestReadRepairDeleteOnConflict against node-boot timing by @jeroiraz in https://github.com/weaviate/weaviate/pull/11748
- Dont timeout shard halting in unrelated unittest by @dirkkul in https://github.com/weaviate/weaviate/pull/11727
- Fix wrong authz check for get groups for role by @dirkkul in https://github.com/weaviate/weaviate/pull/11728
- Fix backup concurrency calculation by @dirkkul in https://github.com/weaviate/weaviate/pull/11733
- Optimize async replication to use efficient property unmarshalling by @dirkkul in https://github.com/weaviate/weaviate/pull/11761
- Enforce tenant cap in RAFT by @dirkkul in https://github.com/weaviate/weaviate/pull/11752
- feat(module): add generative-deepseek module by @antas-marcin in https://github.com/weaviate/weaviate/pull/11769
- fix(shard): make initTargetVector idempotent to prevent double-create by @amourao in https://github.com/weaviate/weaviate/pull/11584
- fix(dynamic): serialize config updates and Iterate against the flat->hnsw upgrade by @amourao in https://github.com/weaviate/weaviate/pull/11582
- fix(hnsw): read compression config under compressActionLock in insert validation by @amourao in https://github.com/weaviate/weaviate/pull/11583
- backport: feat: add location configuration to text2vec-google module (#8418) by @antas-marcin in https://github.com/weaviate/weaviate/pull/11762
- feat: add support for endpoint setting in OpenAI client by @antas-marcin in https://github.com/weaviate/weaviate/pull/11763
- feat(generative-google): add support for location setting by @antas-marcin in https://github.com/weaviate/weaviate/pull/11766
- fix(bm25): record max-impact pair on memtable BlockEntry by @amourao in https://github.com/weaviate/weaviate/pull/11780
- feat: add support for dimensions setting in text2vec-aws module by @antas-marcin in https://github.com/weaviate/weaviate/pull/11764
- fix(usage-limits): tenant cap rejects ingest into existing tenants by @aliszka in https://github.com/weaviate/weaviate/pull/11765
- Add missing forwarding of property names by @dirkkul in https://github.com/weaviate/weaviate/pull/11782
- security(modules): validate X-*-BaseURL request headers to close SSRF bypass by @spiros-spiros in https://github.com/weaviate/weaviate/pull/11683
- hfresh: increase searchProbe default to 256 by @asdine in https://github.com/weaviate/weaviate/pull/11793
- fix: route multivector queue deletes through DeleteMulti by @asdine in https://github.com/weaviate/weaviate/pull/11794
- chore(generative-deepseek): add support for stop setting in module settings by @antas-marcin in https://github.com/weaviate/weaviate/pull/11796
- hfresh: defer queue registration until restore completes by @asdine in https://github.com/weaviate/weaviate/pull/11795
- Remove flaky assertion for dynamic index by @trengrj in https://github.com/weaviate/weaviate/pull/11801
- fix(backup): return 5xx for operational failures by @gkampitakis in https://github.com/weaviate/weaviate/pull/11803
- Skip malformed runtime config values by @dirkkul in https://github.com/weaviate/weaviate/pull/11614
- hfresh: fix reassign queue recovery hints by @asdine in https://github.com/weaviate/weaviate/pull/11821
- perf(bm25): faster varint decoding (reservoir + 64-bit reads) by @amourao in https://github.com/weaviate/weaviate/pull/11770
- perf(bm25): Tier-1 allocation cuts in the BlockMax WAND hot path by @amourao in https://github.com/weaviate/weaviate/pull/11772
- fix(hnsw): stop dropping nodes at snapshot block boundaries by @asdine in https://github.com/weaviate/weaviate/pull/11829
- security: bump golang.org/x/net and golang.org/x/crypto libs by @antas-marcin in https://github.com/weaviate/weaviate/pull/11840
- hfresh: reduce task dedup memory by @asdine in https://github.com/weaviate/weaviate/pull/11827
- Fix backup RBAC checks by @dirkkul in https://github.com/weaviate/weaviate/pull/11123
- chore(deps): remove github.com/puzpuzpuz/xsync/v4 dependency by @antas-marcin in https://github.com/weaviate/weaviate/pull/11843
- Snapshot in-place-mutated bbolt files during active-shard backup by @tsmith023 in https://github.com/weaviate/weaviate/pull/11832
- fix(usage): don't abort the whole usage report in case of missing tenant by @antas-marcin in https://github.com/weaviate/weaviate/pull/11849
- perf(async-rep): reuse a single cursor across the hashbeat digest scan by @jeroiraz in https://github.com/weaviate/weaviate/pull/11833
- fix(hnsw): parallel-cursor prefill for unbounded uncompressed vector cache by @etiennedi in https://github.com/weaviate/weaviate/pull/11838
Full Changelog: https://github.com/weaviate/weaviate/compare/v1.37.9...v1.37.10
Security Fixes
- Validate X-*-BaseURL request headers to close SSRF bypass
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About weaviate
Weaviate is an open-source vector database that stores both objects and vectors, allowing for the combination of vector search with structured filtering with the fault tolerance and scalability of a cloud-native database.
Beta — feedback welcome: [email protected]