Skip to content

v3.8.1

Latest
Latest

Choose a tag to compare

View all tags
@alikahwaji alikahwaji released this 07 Nov 04:13
· 8 commits to main since this release
v3.8.1
a9febeb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A patch release with security fixes. Upgrade now if you use RetrievalGuard access control, PluginSignatureVerifier, DevServer or @devilsdev/rag-mcp-server. One change in access control can hide documents that were visible before; see below.

npm install @devilsdev/rag-pipeline-utils@^3.8.1
# and, if you use the MCP server:
npx @devilsdev/rag-mcp-server@3.8.1 ./docs

Security

Four advisories, fixed in this release:

Each advisory lists the affected versions and workarounds for anyone who can't upgrade yet.

After upgrading

  • Re-ingest FileVectorStore indexes whose documents set acl or requiredRole at the top level (not in metadata). Index files written by earlier versions don't contain that field, so upgrading alone doesn't restrict those documents. Documents with the restriction in metadata, and the in-memory stores (MemoryRetriever, BM25Search), need no action beyond upgrading.

Changed

  • RetrievalGuard now requires every restriction a document sets. A document can set requiredRole or acl at its top level, in metadata and on doc; access now requires meeting each one that is set (any one role of a list is enough for that list). This can hide documents that were visible before. If some of your documents set restrictions in more than one place, check that they set the ones you mean.

The scoped packages, @devilsdev/rag-mcp-server and create-rag-pipeline are released at 3.8.1 too. Full details: CHANGELOG

Assets 2
Loading