Skip to content

v6.3.0 Release

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Nov 16:59
v6.3.0
18efc91
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

6.3.0 fixes a bug where Pinecone clients in one JVM with different API keys could share an index connection, and upgrades Netty, Jackson and Guava to fix 33 published advisories in the versions 6.2.0 shipped with, one of them critical. There are no API changes, so code written for 6.2.0 compiles unchanged. Read "Changes in behavior" before upgrading if your application closes Index or AsyncIndex objects, creates more than one Pinecone client, or pins Netty or Guava itself. If you verify artifact signatures, note that 6.3.0 is signed with a new key; the old one expired.

Fixes

  • Index connections are no longer shared across clients with different settings. In 6.2.0, every Index and AsyncIndex opened for the same index name shared one gRPC channel, no matter which Pinecone client opened it. A second client with a different API key reused the first client's channel, so its data-plane calls went to the first client's index host with the first client's key, and its TLS setting and response metadata listener were ignored. Only applications that build more than one Pinecone client with different settings were affected. Connections are now shared only when the index name, API key, index host, TLS setting, source tag and listener all match. (678c3e0)
  • Closing one index object no longer breaks the others. In 6.2.0, close() on one Index shut down the channel that every other Index and AsyncIndex for that index name was still using. The channel now shuts down when the last object using it is closed, and calling close() again has no effect. (678c3e0)
  • Batch upsert with a null namespace writes to the default namespace. upsert(List<VectorWithUnsignedIndices>, String) on Index and AsyncIndex threw NullPointerException for a null namespace. It now behaves like the single-vector overloads. (76f0b1e)
  • The API key no longer appears in PINECONE_DEBUG logs. With PINECONE_DEBUG=true, control-plane request logs now show the Api-Key header as ██ instead of the key. Requests are sent with the key as before. (d741246)
import io.pinecone.clients.Index;
import io.pinecone.clients.Pinecone;
import java.util.Arrays;

// Reads the API key from the environment.
Pinecone pc = new Pinecone.Builder(System.getenv("PINECONE_API_KEY")).build();

Index writer = pc.getIndexConnection("example-index");
Index reader = pc.getIndexConnection("example-index"); // shares writer's channel

writer.upsert("v1", Arrays.asList(1.0f, 2.0f, 3.0f));
writer.close(); // 6.2.0 also closed reader's channel

reader.queryByVector(5, Arrays.asList(1.0f, 2.0f, 3.0f)); // 6.3.0: still works
reader.close(); // last holder: the channel shuts down

Changes in behavior

  • Close every Index and AsyncIndex you open. A channel stays open until the last object using it is closed, so one object that is never closed now keeps it open. Both classes implement AutoCloseable; opening them in try-with-resources is the simplest way to be sure. Pinecone itself holds no connection and has no close().
  • Don't use an index object after closing it. While another object still shares the channel, calls on a closed object may still succeed; once the channel has shut down, they fail.
  • Clients with different API keys, hosts or source tags open separate connections. Each distinct combination now holds its own gRPC channel, where 6.2.0 held one per index name.
  • Clients share a connection only if they pass the same listener object. Building many clients, each with a new lambda or method reference such as metrics::record, opens one channel per client. To share one channel, store the listener in a field and pass that same object to every builder.
  • Netty and Guava are now direct compile-scope dependencies. The POM declares netty-codec-http2, netty-handler-proxy and netty-transport-native-unix-common at 4.1.137.Final and guava at 33.7.2-android, so builds resolve the patched versions instead of the older ones gRPC 1.60.2 brings in. In Maven, a version you declare yourself still wins, so raise any Netty or Guava pin to at least these versions to get the fixes; mvn dependency:tree -Dincludes=io.netty,com.google.guava shows what you resolve. Gradle picks the highest version unless you force one. gRPC stays at 1.60.2, which requires the Netty 4.1 line.

Security

Dependencies that ship with the client, from the version 6.2.0 resolved to the version 6.3.0 resolves:

Build tooling only, not part of the published artifact: Gradle build-time copies of commons-io (CVE-2024-47554), plexus-utils (CVE-2025-67030) and Log4j (CVE-2025-68161, CVE-2026-34477, CVE-2026-34480, CVE-2026-49844) were upgraded.

No Dependabot alerts were open against the client's dependencies when 6.3.0 was prepared.

Signing key changed

6.3.0 and later are signed with a new key. If you verify artifact signatures, trust this key:

  • Fingerprint: 68D9 DCB2 AB93 7981 13C2 9B8D A87E C316 B916 2471
  • User ID: Pinecone.io Ops <ops@pinecone.io>
  • Fetch it with gpg --keyserver keyserver.ubuntu.com --recv-keys 68D9DCB2AB93798113C29B8DA87EC316B9162471; it is also on keys.openpgp.org.

6.2.0 and earlier were signed with 2CFDEE6F36609094, which expired on 2026-05-27 and is retired. Their signatures still verify only against that old key.

Other improvements

  • Javadoc for Pinecone, Index, AsyncIndex, Inference, the configuration classes and the exceptions is rewritten, with examples that compile in CI. It ships in the -javadoc.jar.
  • The README is rewritten, and its snippets and examples compile in CI.

Upgrading

Change the version and rebuild, then check your code against "Changes in behavior".

<dependency>
  <groupId>io.pinecone</groupId>
  <artifactId>pinecone-client</artifactId>
  <version>6.3.0</version>
</dependency>
implementation "io.pinecone:pinecone-client:6.3.0"

Full Changelog: v6.2.0...v6.3.0

Assets 2
Loading