weaviate

v1.38.7 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 23h Vector Databases

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

approximate-nearest-neighbor-search generative-search grpc hnsw hybrid-search image-search

+13 more

information-retrieval mlops nearest-neighbor-search neural-search recommender-system search-engine semantic-search semantic-search-engine similarity-search vector-db vector-search-engine vectors weaviate

Affected surfaces

deps

Summary

AI summary

Broad release touches New Features none, telemetry, deps, and Breaking Changes none.

Full changelog

Breaking Changes

none

New Features

none

Fixes

Fix empty range results served after enable-rangeable reindex with INDEX_RANGEABLE_IN_MEMORY=true by @byronvoorbach in https://github.com/weaviate/weaviate/pull/12215
chore(rplc-mvmnt): remove SyncShards in favour of node local Shard.drop by @tsmith023 in https://github.com/weaviate/weaviate/pull/12217
Fix namespace regexp by @dirkkul in https://github.com/weaviate/weaviate/pull/12292
Make number of files that are deduplicated in incremental backups configurable by @dirkkul in https://github.com/weaviate/weaviate/pull/12234
fix(db): shut down vector index when its queue creation fails to avoid orphaning it by @antas-marcin in https://github.com/weaviate/weaviate/pull/12192
Namespace: Add endpoints for suspend by @dirkkul in https://github.com/weaviate/weaviate/pull/12291
cyclemanager: replace per-tick due-scan with a due-heap scheduler by @aliszka in https://github.com/weaviate/weaviate/pull/12099
fix(replica-fast): avoid nil-deref panics in filepath.WalkDir callbacks by @tsmith023 in https://github.com/weaviate/weaviate/pull/12300
Update GRPC dependency by @dirkkul in https://github.com/weaviate/weaviate/pull/12311
feat(telemetry): persistent cluster and node identity for correlatable telemetry by @moogacs in https://github.com/weaviate/weaviate/pull/12296
Reduce heap usage in HNSW condensor by @dirkkul in https://github.com/weaviate/weaviate/pull/12306
AddMultiVector idempotence fix by @trengrj in https://github.com/weaviate/weaviate/pull/12170
Drop fmt.Sprintf from commit-log path builders to save allocations by @dirkkul in https://github.com/weaviate/weaviate/pull/12310
Use a view instead of copy in hnsw packed connection by @dirkkul in https://github.com/weaviate/weaviate/pull/12309
Reduce allocations for auto schema time/uuid parsing by @dirkkul in https://github.com/weaviate/weaviate/pull/12301
refact(telemetry) gate cluster-id commit on telemetry being enabled by @moogacs in https://github.com/weaviate/weaviate/pull/12326
fix(lsmkv): purge stale GlobalBucketRegistry entries on every teardown path by @tsmith023 in https://github.com/weaviate/weaviate/pull/12188
fix(graphql): reject non-object variables instead of panicking by @moogacs in https://github.com/weaviate/weaviate/pull/12332
Don't discard teardown work when one shutdown step fails by @dirkkul in https://github.com/weaviate/weaviate/pull/12333
Improve segment index performance by using van Emde Boas layout by @dirkkul in https://github.com/weaviate/weaviate/pull/12327
Fix bugs in index shutdown by @dirkkul in https://github.com/weaviate/weaviate/pull/12331
Drop derived file names when recovering an aborted compaction by @dirkkul in https://github.com/weaviate/weaviate/pull/12336
Fix shard shutdown backup and wrong error return by @dirkkul in https://github.com/weaviate/weaviate/pull/12337
chore(deps): bump golang.org/x/net to v0.56.0 and golang.org/x/text to v0.39.0 (CVE-2026-46600, CVE-2026-56852) by @etiennedi in https://github.com/weaviate/weaviate/pull/12347
deps: adjust go dependencies in sub projects by @antas-marcin in https://github.com/weaviate/weaviate/pull/12362
Release shard references exactly once per acquire by @dirkkul in https://github.com/weaviate/weaviate/pull/12363
fix(replica): never use a search result as a read-repair payload by @etiennedi in https://github.com/weaviate/weaviate/pull/12355

Full Changelog: https://github.com/weaviate/weaviate/compare/v1.38.6...v1.38.7

Security Fixes

dep: golang.org/x/net CVE-2026-46600
dep: golang.org/x/text CVE-2026-56852

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track weaviate

Get notified when new releases ship.

About weaviate

Weaviate is an open-source vector database that stores both objects and vectors, allowing for the combination of vector search with structured filtering with the fault tolerance and scalability of a cloud-native database.

All releases →