Skip to content

v1.3.0 - Low Rider

Latest
Latest

Choose a tag to compare

View all tags
@orneryd orneryd released this 05 Sep 13:54
1.3.0
f6e66f5

[v1.3.0] - Low Rider - 9/5/2026

Lowrider v1.3.0 improves security, retrieval quality, storage performance, localization, and per-database configuration.

Important

This release fixes an authorization vulnerability affecting authenticated read-only users. Upgrading is strongly recommended.

Security

HTTP Cypher authorization

Fixed an authorization bypass in the Neo4j-compatible HTTP transaction API that could allow authenticated users with read-only database access to execute data-changing compound Cypher statements.

Authorization is now enforced consistently across:

  • Autocommit transactions
  • Explicit transaction open, execute, and commit paths
  • Registered procedures
  • Nested Cypher statements
  • Read, write, schema, and administrator permissions

Reported by Sevban Dönmez (jankesec). See the associated security advisory and CVE for affected versions, severity, and technical details.

Dependency updates

Browserslist is pinned to the patched 4.28.8 release. Go modules, UI packages, lock files, and container build dependencies have also been refreshed.

Highlights

Per-database configuration

Database-scoped settings now use a canonical typed registry shared by validation, resolution, administration, and SHOW SETTING[S].

Supported improvements include:

  • Live embedding, search-index, and reranker reconfiguration
  • Live query-cache capacity and TTL changes
  • Clear pendingRestart reporting
  • Persistent per-database overrides
  • Independent BM25, vector, and metadata limits
  • auto, memory, and disk vector-storage selection

Better retrieval controls

db.retrieve now supports opt-in failClosed behavior for workloads that must reject unusable embeddings instead of silently falling back.

Additional controls include:

  • Candidate depth
  • RRF weighting
  • Score thresholds
  • Property filters
  • Explicit fallback behavior
  • Strict numeric validation

Faster, more predictable search

  • BM25 V2 now uses exact, language-neutral Unicode normalization by default.
  • Prefix matching is opt-in.
  • Reciprocal-rank fusion runs in parallel.
  • IVF-PQ uses bounded adaptive overfetch.
  • File-backed vectors use fixed-stride records and direct ordinal offsets.
  • Query ordering and cache behavior are deterministic.

Production localization

NornicDB now includes embedded en-US and es-ES, catalogs across:

  • CLI commands
  • HTTP, GraphQL, Bolt, MCP, and gRPC
  • Authentication and Cypher errors
  • Search, storage, replication, and retention
  • Runtime logs and structured events

Language selection supports configuration, environment variables, OS preferences, HTTP headers, and protocol metadata.

Reliability And Operations

  • WAL compaction now writes atomic, checksummed streaming snapshots.
  • Recovery processes snapshots and WAL entries incrementally with bounded memory.
  • Failed recovery preserves source data and records a recovery manifest.
  • Multi-database limits and access controls now cover protocol and background paths.
  • Headless mode no longer exposes the GraphQL Playground or other browser-only surfaces.

Authentication Improvements

  • Local browser authentication works over http://localhost.
  • Session cookies remain HttpOnly and SameSite=Lax.
  • Cookies use Secure automatically for direct HTTPS and TLS-terminating proxies reporting X-Forwarded-Proto: https.
  • Initial administrator creation is idempotent.
  • Passwords continue to be stored as salted bcrypt hashes.
  • Restarting NornicDB never overwrites an administrator password changed after bootstrap.

Upgrade Notes

  • Upgrade ASAP because this release contains an authorization security fix.
  • BM25 prefix matching is now disabled by default. Set NORNICDB_BM25_PREFIX_MAX_EXPANSIONS to retain bounded prefix expansion.
  • Authenticated deployments using public listeners must use secure transport and explicit CORS origins.
  • The documented initial admin / password credentials remain available for local bootstrap but emit a warning until changed.
  • Existing JSON snapshots remain readable by the new streaming recovery implementation.

For the complete change history, see CHANGELOG.md.

What's Changed

  • feat(search): improve language-neutral BM25 retrieval by @orneryd in #304
  • feat: i18n foundations by @orneryd in #305
  • Database-scoped settings, isolation, and durable recovery by @orneryd in #331
  • feat(search): add opt-in db.retrieve failClosed by @rezamohamed in #334

New Contributors

Full Changelog: v1.2.3...1.3.0

Contributors

orneryd and rezamohamed
Assets 9
Loading