v3.7.1

A patch release with no breaking changes: security fixes from a review of every open code-scanning alert, and a new npm page. Upgrading is recommended if you pass user queries to QueryPlanner.

npm install @devilsdev/rag-pipeline-utils@^3.7.1

Security

• QueryPlanner no longer slows to a halt on long runs of spaces. Its clause patterns tried every way to split a run of whitespace: 4,000 spaces took 21 seconds, and the time grew with the cube of the length. Whitespace runs are now read as one space, so 200,000 characters of any shape plan in well under a second. QueryPlanner is exported from the main entry and /edge and is given user queries.
• rag-pipeline plugin install rejects "stage": "__proto__". A plugin declaring that stage wrote to Object.prototype in the CLI process.
• rag-pipeline config set ignores a __proto__ key inside the value, which was merged into Object.prototype.

Fixed

• The eval Markdown report escapes backslashes, so \| no longer breaks a table cell.

Changed

• A new README on npm, written for developers meeting the library for the first time.

The review covered 52 alerts: 19 fixed here, 27 false alarms dismissed with reasons, and the 6 still open are repository settings and an example that has no lockfile on purpose. The scoped packages, @devilsdev/rag-mcp-server and create-rag-pipeline are released at 3.7.1 too. Full details: CHANGELOG · Blog post