Skip to content

weaviate

v1.38.2 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Vector Databases
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

approximate-nearest-neighbor-search generative-search grpc hnsw hybrid-search image-search
+13 more
information-retrieval mlops nearest-neighbor-search neural-search recommender-system search-engine semantic-search semantic-search-engine similarity-search vector-db vector-search-engine vectors weaviate

Affected surfaces

auth deps

Summary

AI summary

Optimize async replication, enforce tenant caps, add generative-deepseek and location support modules, improve hnsw/hfresh/bm25 performance, fix SSRF bypass and backup handling.

Full changelog

Breaking Changes

none

New Features

none

Fixes

  • Optimize async replication to use efficient property unmarshalling by @dirkkul in https://github.com/weaviate/weaviate/pull/11761
  • Enforce tenant cap in RAFT by @dirkkul in https://github.com/weaviate/weaviate/pull/11752
  • feat(module): add generative-deepseek module by @antas-marcin in https://github.com/weaviate/weaviate/pull/11769
  • fix(shard): make initTargetVector idempotent to prevent double-create by @amourao in https://github.com/weaviate/weaviate/pull/11584
  • fix(dynamic): serialize config updates and Iterate against the flat->hnsw upgrade by @amourao in https://github.com/weaviate/weaviate/pull/11582
  • fix(hnsw): read compression config under compressActionLock in insert validation by @amourao in https://github.com/weaviate/weaviate/pull/11583
  • backport: feat: add location configuration to text2vec-google module (#8418) by @antas-marcin in https://github.com/weaviate/weaviate/pull/11762
  • feat: add support for endpoint setting in OpenAI client by @antas-marcin in https://github.com/weaviate/weaviate/pull/11763
  • feat(generative-google): add support for location setting by @antas-marcin in https://github.com/weaviate/weaviate/pull/11766
  • fix(bm25): record max-impact pair on memtable BlockEntry by @amourao in https://github.com/weaviate/weaviate/pull/11780
  • feat: add support for dimensions setting in text2vec-aws module by @antas-marcin in https://github.com/weaviate/weaviate/pull/11764
  • fix(usage-limits): tenant cap rejects ingest into existing tenants by @aliszka in https://github.com/weaviate/weaviate/pull/11765
  • Fix panic in db.WaitForLocalInflightWrites by @tsmith023 in https://github.com/weaviate/weaviate/pull/11784
  • Add missing forwarding of property names by @dirkkul in https://github.com/weaviate/weaviate/pull/11782
  • security(modules): validate X-*-BaseURL request headers to close SSRF bypass by @spiros-spiros in https://github.com/weaviate/weaviate/pull/11683
  • hfresh: increase searchProbe default to 256 by @asdine in https://github.com/weaviate/weaviate/pull/11793
  • fix: route multivector queue deletes through DeleteMulti by @asdine in https://github.com/weaviate/weaviate/pull/11794
  • chore(generative-deepseek): add support for stop setting in module settings by @antas-marcin in https://github.com/weaviate/weaviate/pull/11796
  • hfresh: defer queue registration until restore completes by @asdine in https://github.com/weaviate/weaviate/pull/11795
  • Remove flaky assertion for dynamic index by @trengrj in https://github.com/weaviate/weaviate/pull/11801
  • fix(backup): return 5xx for operational failures by @gkampitakis in https://github.com/weaviate/weaviate/pull/11803
  • Skip malformed runtime config values by @dirkkul in https://github.com/weaviate/weaviate/pull/11614
  • Fix namespace test that is flaky due to EC by @dirkkul in https://github.com/weaviate/weaviate/pull/11806
  • Block ShardReplicationFSM.AllPeersAtLeast on visible peers by @tsmith023 in https://github.com/weaviate/weaviate/pull/11787
  • Print weaviate testcontainer logs on namespace-test error by @dirkkul in https://github.com/weaviate/weaviate/pull/11823
  • hfresh: fix reassign queue recovery hints by @asdine in https://github.com/weaviate/weaviate/pull/11821
  • perf(bm25): faster varint decoding (reservoir + 64-bit reads) by @amourao in https://github.com/weaviate/weaviate/pull/11770
  • perf(bm25): Tier-1 allocation cuts in the BlockMax WAND hot path by @amourao in https://github.com/weaviate/weaviate/pull/11772
  • fix(hnsw): stop dropping nodes at snapshot block boundaries by @asdine in https://github.com/weaviate/weaviate/pull/11829
  • security: bump golang.org/x/net and golang.org/x/crypto libs by @antas-marcin in https://github.com/weaviate/weaviate/pull/11840
  • hfresh: reduce task dedup memory by @asdine in https://github.com/weaviate/weaviate/pull/11827
  • Fix backup RBAC checks by @dirkkul in https://github.com/weaviate/weaviate/pull/11123
  • chore(deps): remove github.com/puzpuzpuz/xsync/v4 dependency by @antas-marcin in https://github.com/weaviate/weaviate/pull/11843
  • Snapshot in-place-mutated bbolt files during active-shard backup by @tsmith023 in https://github.com/weaviate/weaviate/pull/11832
  • replica-movement: forbid certain schema mutations during movements by @tsmith023 in https://github.com/weaviate/weaviate/pull/11503
  • fix(usage): don't abort the whole usage report in case of missing tenant by @antas-marcin in https://github.com/weaviate/weaviate/pull/11849
  • perf(async-rep): reuse a single cursor across the hashbeat digest scan by @jeroiraz in https://github.com/weaviate/weaviate/pull/11833
  • fix(hnsw): parallel-cursor prefill for unbounded uncompressed vector cache by @etiennedi in https://github.com/weaviate/weaviate/pull/11838
  • perf(bm25): WAND scoring-loop & data-structure optimizations by @amourao in https://github.com/weaviate/weaviate/pull/11773

Full Changelog: https://github.com/weaviate/weaviate/compare/v1.38.1...v1.38.2

Security Fixes

  • Validate X-*-BaseURL request headers to close SSRF bypass
  • Bump golang.org/x/net and golang.org/x/crypto libs for security updates
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track weaviate

Get notified when new releases ship.

Sign up free

About weaviate

Weaviate is an open-source vector database that stores both objects and vectors, allowing for the combination of vector search with structured filtering with the fault tolerance and scalability of a cloud-native database​.

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]