weaviate

v1.38.3 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 17d Vector Databases

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

approximate-nearest-neighbor-search generative-search grpc hnsw hybrid-search image-search

+13 more

information-retrieval mlops nearest-neighbor-search neural-search recommender-system search-engine semantic-search semantic-search-engine similarity-search vector-db vector-search-engine vectors weaviate

Affected surfaces

auth rbac

ReleasePort's take

Light signal

editorial:auto 11d

Weaviate v1.38.3 adds a runtime toggle for the GraphQL API and introduces a `/grpc-web` endpoint.

Why it matters: The new GraphQL runtime toggle enables dynamic feature control; adding /grpc‑web expands client integration options.

Summary

AI summary

Broad release touches New Features none, bm25, async-replication, and queue.

Changes in this release

Type	Severity	Summary	CVE
Feature
Feature	Medium	Adds runtime toggle for GraphQL API. Adds runtime toggle for GraphQL API. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Adds `/grpc-web` endpoint. Adds `/grpc-web` endpoint. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Enables namespace graduation using backup/restore. Enables namespace graduation using backup/restore. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Low	Matches colon‑containing user/group IDs literally for global callers in namespaces. Matches colon‑containing user/group IDs literally for global callers in namespaces. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Feature	Low	Propagates raw on‑disk object bytes in async replication. Propagates raw on‑disk object bytes in async replication. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Performance
Performance	Medium	Improves BM25 query performance by tightening block‑entry scanning. Improves BM25 query performance by tightening block‑entry scanning. Source: llm_adapter@2026-07-15 Confidence: high	—
Performance	Medium	Optimizes async‑replication by batching hashtree‑root pre‑filter for many‑tenant clusters. Optimizes async‑replication by batching hashtree‑root pre‑filter for many‑tenant clusters. Source: llm_adapter@2026-07-15 Confidence: high	—
Performance	Low	Uses delimiter listing in AllBackups to avoid full object scan for Azure backup. Uses delimiter listing in AllBackups to avoid full object scan for Azure backup. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Performance	Low	Defers tombstone checks from advance‑time to scoring in BM25. Defers tombstone checks from advance‑time to scoring in BM25. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Performance	Low	Optimizes query‑setup path in BM25 round‑6. Optimizes query‑setup path in BM25 round‑6. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Performance	Low	Elides matched‑branch sort in BM25 round‑7. Elides matched‑branch sort in BM25 round‑7. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Performance	Low	Implements lock‑free atomic segment refcount in LSMKV. Implements lock‑free atomic segment refcount in LSMKV. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Performance	Low	Uses dense/sorted‑pairs property‑length representation. Uses dense/sorted‑pairs property‑length representation. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Performance	Low	Serializes direct‑array compaction via EncodePairs. Serializes direct‑array compaction via EncodePairs. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Performance	Low	Uses hard‑links during replica movement to avoid compaction halting. Uses hard‑links during replica movement to avoid compaction halting. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Performance	Low	Avoids pausing compaction in ApplyToObjectDigests. Avoids pausing compaction in ApplyToObjectDigests. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix
Bugfix	Medium	Fixes potential deadlock in backup for large clusters. Fixes potential deadlock in backup for large clusters. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixes replica‑movement restore crashloop and chained‑move data loss. Fixes replica‑movement restore crashloop and chained‑move data loss. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixes RBAC leak in node handler. Fixes RBAC leak in node handler. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixes queue recovery from corrupt chunk headers instead of failing to load. Fixes queue recovery from corrupt chunk headers instead of failing to load. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixes async‑indexing vector queue staying paused forever after a failed index upgrade. Fixes async‑indexing vector queue staying paused forever after a failed index upgrade. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Ensures rf=1 writes go through replicator if active operation for the shard exists. Ensures rf=1 writes go through replicator if active operation for the shard exists. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Medium	Fixes EC in namespace tests. Fixes EC in namespace tests. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Medium	Returns proper error code from shard endpoints when index is not found. Returns proper error code from shard endpoints when index is not found. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Medium	Corrects node handler return types. Corrects node handler return types. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Medium	Fixes multi‑role delete operation. Fixes multi‑role delete operation. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Low	Persists advanced update time when object content is unchanged. Persists advanced update time when object content is unchanged. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Low	Fixes more error codes in REST handler. Fixes more error codes in REST handler. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Low	Resolves data race error in TestIndex_UsageForCollection_MissingShardFiles. Resolves data race error in TestIndex_UsageForCollection_MissingShardFiles. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—
Bugfix	Low	Fixes partial permission removal from role. Fixes partial permission removal from role. Source: granite4.1:30b@2026-07-16-audit Confidence: low	—

Full changelog

Breaking Changes

none

New Features

none

Fixes

fix(backup-azure): use delimiter listing in AllBackups to avoid full object scan by @gkampitakis in https://github.com/weaviate/weaviate/pull/11669
perf(bm25): defer tombstone checks from advance-time to scoring by @amourao in https://github.com/weaviate/weaviate/pull/11774
perf(bm25): tighten block-entry scanning in the WAND loop by @amourao in https://github.com/weaviate/weaviate/pull/11775
perf(bm25): round-6 query-setup path optimization by @amourao in https://github.com/weaviate/weaviate/pull/11776
perf(bm25): round-7 matched-branch sort elision by @amourao in https://github.com/weaviate/weaviate/pull/11777
perf(lsmkv): lock-free atomic segment refcount by @amourao in https://github.com/weaviate/weaviate/pull/11771
Ensure that rf=1 writes go through replicator if active op for the shard by @tsmith023 in https://github.com/weaviate/weaviate/pull/11867
perf: dense/sorted-pairs property-length representation by @amourao in https://github.com/weaviate/weaviate/pull/11753
perf: direct-array compaction serialization via EncodePairs by @amourao in https://github.com/weaviate/weaviate/pull/11754
Fix EC in namespace tests by @dirkkul in https://github.com/weaviate/weaviate/pull/11871
fix: persist advanced update time when object content is unchanged by @jeroiraz in https://github.com/weaviate/weaviate/pull/11866
Namespaces: Match colon-containing user/group ids literally for global callers by @dirkkul in https://github.com/weaviate/weaviate/pull/11868
Return proper error code from shard endpoints when index is not found by @dirkkul in https://github.com/weaviate/weaviate/pull/11875
Fix more error codes in REST handler by @dirkkul in https://github.com/weaviate/weaviate/pull/11878
fix: TestIndex_UsageForCollection_MissingShardFiles data race error by @antas-marcin in https://github.com/weaviate/weaviate/pull/11887
Fix node handler return types by @dirkkul in https://github.com/weaviate/weaviate/pull/11888
test(replication): wait for shard readiness after restart in TestReadRepairDeleteOnConflict by @jeroiraz in https://github.com/weaviate/weaviate/pull/11886
[feat] Use hard-links during replica movement to avoid compaction halting by @tsmith023 in https://github.com/weaviate/weaviate/pull/11226
Delete rfc.md for replica movement with hard-link snapshots by @tsmith023 in https://github.com/weaviate/weaviate/pull/11891
Fix partial permission removal from role by @dirkkul in https://github.com/weaviate/weaviate/pull/11885
Fix potential deadlock in backup in big clusters by @dirkkul in https://github.com/weaviate/weaviate/pull/11890
feat(async-rep): propagate raw on-disk object bytes by @jeroiraz in https://github.com/weaviate/weaviate/pull/11853
Avoid pausing compaction in ApplyToObjectDigests by @jeroiraz in https://github.com/weaviate/weaviate/pull/11896
Fix multi-role delete by @dirkkul in https://github.com/weaviate/weaviate/pull/11904
fix(hnsw): guard insert-path compression-state reads under compressActionLock by @amourao in https://github.com/weaviate/weaviate/pull/11597
Add gate to disallow global non-operator users by @dirkkul in https://github.com/weaviate/weaviate/pull/11908
Fix replica-movement restore crashloop and chained-move data loss by @tsmith023 in https://github.com/weaviate/weaviate/pull/11895
perf(bm25): gate DoBlockMaxWand prune-branch repair on needFullSort by @amourao in https://github.com/weaviate/weaviate/pull/11915
Fix/hnsw maintenance flag leak by @abdelr in https://github.com/weaviate/weaviate/pull/11898
Deny operator only surface to namespaced users by @dirkkul in https://github.com/weaviate/weaviate/pull/11922
gh-7461 use automaxprocs to set GOMAXPROCS (cgroup v2 support) [backport v1.36] by @Joe-Weaviate in https://github.com/weaviate/weaviate/pull/11918
chore: fix flakiness of TestAuthzReplicationReplicate by @tsmith023 in https://github.com/weaviate/weaviate/pull/11926
chore: add detailed error logging to TestReplicationTestSuite by @tsmith023 in https://github.com/weaviate/weaviate/pull/11927
Fix/hnsw search entrypoint prereqs by @abdelr in https://github.com/weaviate/weaviate/pull/11923
Return 500 instead of nil Responder on getGroups controller error by @dirkkul in https://github.com/weaviate/weaviate/pull/11933
Fix/hnsw repair global entrypoint by @abdelr in https://github.com/weaviate/weaviate/pull/11910
chore: add back EventuallyWithT to TestAuthzReplicationReplicate assertions by @tsmith023 in https://github.com/weaviate/weaviate/pull/11945
Retry go modules downloads in CI by @dirkkul in https://github.com/weaviate/weaviate/pull/11942
Remove .Error() from test assert to avoid panics in test by @tsmith023 in https://github.com/weaviate/weaviate/pull/11950
hfresh: increase searchProbe default to 256 by @asdine in https://github.com/weaviate/weaviate/pull/11955
chore(metric): fix metric name typo by @moogacs in https://github.com/weaviate/weaviate/pull/11953
perf(replication): share one zstd encoder in REST client instead of sync.Pool by @jeroiraz in https://github.com/weaviate/weaviate/pull/11960
perf(async-replication): allocate propagation buffers per-hashBeat, not per-range by @jeroiraz in https://github.com/weaviate/weaviate/pull/11961
Revert "Fix/hnsw search entrypoint prereqs" by @antas-marcin in https://github.com/weaviate/weaviate/pull/11969
Revert "Fix/hnsw repair global entrypoint" by @antas-marcin in https://github.com/weaviate/weaviate/pull/11971
Optimize cycle manager for large MT collections by @dirkkul in https://github.com/weaviate/weaviate/pull/11958
fix(backup): make halt-for-transfer inactivity monitor race-free by @jeroiraz in https://github.com/weaviate/weaviate/pull/11965
Additional validation on PQ query vector length by @trengrj in https://github.com/weaviate/weaviate/pull/11954
Incremental backups: Bugfix collection by @dirkkul in https://github.com/weaviate/weaviate/pull/11972
hfresh: fix quantizer initialization race by @asdine in https://github.com/weaviate/weaviate/pull/12000
Namespace local roles by @dirkkul in https://github.com/weaviate/weaviate/pull/11873
Fix RBAC class-getter memo key mismatch in gRPC service by @dirkkul in https://github.com/weaviate/weaviate/pull/12001
Resolve class only once on GRPC layer by @dirkkul in https://github.com/weaviate/weaviate/pull/12003
Narrow traverser single-class reads to a class getter by @dirkkul in https://github.com/weaviate/weaviate/pull/12005
[Reindex Fixes A] fix: idempotent recovery-swap marking after mid-FINALIZING restart by @etiennedi in https://github.com/weaviate/weaviate/pull/11976
[Reindex Fixes A] test: harden multinode reindex tests against weak-VM timing by @etiennedi in https://github.com/weaviate/weaviate/pull/11538
[Reindex Fixes A] test: tolerate transient /v1/tasks 500s after node restarts by @etiennedi in https://github.com/weaviate/weaviate/pull/11530
[Reindex Fixes A] fix: class DELETE racing a draining reindex worker re-created the class dir by @etiennedi in https://github.com/weaviate/weaviate/pull/11539
fix(queue): recover from corrupt chunk headers instead of failing to load by @asdine in https://github.com/weaviate/weaviate/pull/12006
Add percentage eager shards loaded to raft waiting for database to restore log by @tsmith023 in https://github.com/weaviate/weaviate/pull/11952
Add weaviate_ prefix to new metric that was missed by @tsmith023 in https://github.com/weaviate/weaviate/pull/12013
test(ci): split go-client-group-2 into group-2 (usage) and group-3 by @antas-marcin in https://github.com/weaviate/weaviate/pull/11946
fix(bm25): dedup duplicate properties (last boost wins) by @etiennedi in https://github.com/weaviate/weaviate/pull/12004
fix(bm25): propagate combineResults error (was silent empty results) by @etiennedi in https://github.com/weaviate/weaviate/pull/12007
fix(async-indexing): vector queue stays paused forever after a failed index upgrade by @etiennedi in https://github.com/weaviate/weaviate/pull/11983
perf(usage): replace per-shard jitter with bounded concurrent shard readers by @antas-marcin in https://github.com/weaviate/weaviate/pull/11902
fix(lsmkv): pass k1/b in correct order when flushing block-max impacts by @amourao in https://github.com/weaviate/weaviate/pull/12022
fix(auth-broker): retry on 429 http status code by @gkampitakis in https://github.com/weaviate/weaviate/pull/12025
perf(async-replication): batched hashtree-root pre-filter for many-tenant clusters by @jeroiraz in https://github.com/weaviate/weaviate/pull/11968
fix(async-replication): hoist hashtree-init wait out of RLock in merge paths by @jeroiraz in https://github.com/weaviate/weaviate/pull/12027
fix(async-replication): don't let TimeBased repair clobber a newer local write by @jeroiraz in https://github.com/weaviate/weaviate/pull/12028
fix(replication): avoid nil-pointer deref in read-repair when a live winner's refetch fails by @jeroiraz in https://github.com/weaviate/weaviate/pull/12030
fix(queue): salvage and quarantine torn sealed chunks by @asdine in https://github.com/weaviate/weaviate/pull/12012
feat: implement runtime toggle for GraphQL API by @amourao in https://github.com/weaviate/weaviate/pull/11930
Reuse consistent view for fetches of multiple objects by @dirkkul in https://github.com/weaviate/weaviate/pull/12010
fix(queue): validate chunk record count and length against file size by @asdine in https://github.com/weaviate/weaviate/pull/12009
fix(queue): back off on recoverable task errors, contain task and dispatch panics by @asdine in https://github.com/weaviate/weaviate/pull/12023
perf(bm25): approximate object count for IDF, reuse query stats on blockmax fallback by @amourao in https://github.com/weaviate/weaviate/pull/12017
fix(async-replication): serialize hashtree rebuild against shard shutdown by @jeroiraz in https://github.com/weaviate/weaviate/pull/12031
fix(async-replication): deregister under the write lock and keep replication on while overrides are active by @jeroiraz in https://github.com/weaviate/weaviate/pull/12034
fix(async-replication): close hashtree-init channel on early goroutine exit to unblock parked merges by @antas-marcin in https://github.com/weaviate/weaviate/pull/12037
fix(bm25): apply propertyBoost to WAND pivot and block-impact bounds by @amourao in https://github.com/weaviate/weaviate/pull/12018
fix(async-replication): repair REST root-prefilter JSON and bound request size by @jeroiraz in https://github.com/weaviate/weaviate/pull/12048
Bound halt-for-transfer backup preparation by @asdine in https://github.com/weaviate/weaviate/pull/11947
Fix geo queue backup preparation timeout by @asdine in https://github.com/weaviate/weaviate/pull/12055
feat: introduce /grpc-web endpoint by @tsmith023 in https://github.com/weaviate/weaviate/pull/12024
fix(replica): harden async-replication and replica read/write paths by @jeroiraz in https://github.com/weaviate/weaviate/pull/12044
fix(lsmkv): guard nil logger in GetConsistentView slow-lock warning by @amourao in https://github.com/weaviate/weaviate/pull/12060
Fix RBAC leak in node handler by @dirkkul in https://github.com/weaviate/weaviate/pull/12002
perf(bm25): cursor tombstone and filter probes in block-max WAND by @amourao in https://github.com/weaviate/weaviate/pull/12046
chore(wf): update slack notify template by @moogacs in https://github.com/weaviate/weaviate/pull/12064
fix(hfresh): normalize vectors during reassign by @asdine in https://github.com/weaviate/weaviate/pull/12068
Optimize shard gauge allocations by @dirkkul in https://github.com/weaviate/weaviate/pull/12067
Wrap ErrNotFound in GetShardsQueueSize so a non-existing index returns 404, not 500 by @jfrancoa in https://github.com/weaviate/weaviate/pull/12040
feat: namespace graduation using backup/restore by @tsmith023 in https://github.com/weaviate/weaviate/pull/11924
perf(shard): lazy load empty multi-tenant shards at startup by @moogacs in https://github.com/weaviate/weaviate/pull/12061
Avoid target node collisions when creating replication ops in test by @tsmith023 in https://github.com/weaviate/weaviate/pull/12074
perf(usage): make shard concurrency a usage node wide constraint by @antas-marcin in https://github.com/weaviate/weaviate/pull/12071
review(usage): guard semaphore capacity, drop FIFO claim, shorten test timeout by @antas-marcin in https://github.com/weaviate/weaviate/pull/12083
fix(async-repl): respect parent index ctx on deletion by @moogacs in https://github.com/weaviate/weaviate/pull/12079

New Contributors

@Joe-Weaviate made their first contribution in https://github.com/weaviate/weaviate/pull/11918

Full Changelog: https://github.com/weaviate/weaviate/compare/v1.38.2...v1.38.3

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track weaviate

Get notified when new releases ship.

About weaviate

Weaviate is an open-source vector database that stores both objects and vectors, allowing for the combination of vector search with structured filtering with the fault tolerance and scalability of a cloud-native database.

All releases →