Skip to content

Release v10.2.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Oct 18:51
v10.2.0
5047348

Version 10.2.0 fixes a TLS certificate-verification flaw in the gRPC client and adds full-text match operators to the Field filter builder. It targets the same 2026-07 API as 10.1.0 and removes or renames nothing.

What to do:

  • Upgrade to 10.2.0 if you use the gRPC client.
  • Whichever client you use, upgrade certifi to 2026.10.19 or later.

Security

gRPC users: upgrade to 10.2.0 (RUSTSEC-2026-0382, CVE-2026-111943, 7ecd4b0)

  • Affected: 9.0.0 through 10.1.0, if your code uses pc.index(..., grpc=True), PineconeGRPC, or GrpcIndex/GRPCIndex.
  • Risk: the bundled rustls-webpki can accept certificates chained through emSign intermediates whose private keys are now public. An attacker with those keys and a position on your network path could impersonate your index and read your API key and data.
  • Fix: 10.2.0 bundles rustls-webpki 0.103.16, which rejects those chains.

Everyone, gRPC users included: upgrade certifi (GHSA-6q48-6c7w-9gw2)

  • Affected: all control-plane and data plane REST calls, which go through httpx and trust whichever certifi is installed in your environment.
  • Risk: certifi releases before 2026.10.19 trust the same compromised emSign roots.
  • Why upgrading pinecone isn't enough: the SDK deliberately doesn't pin certifi, so it stays compatible with the other packages in your environment.
  • Action: run pip install --upgrade "certifi>=2026.10.19" (or uv add "certifi>=2026.10.19") and keep that floor in your own dependencies.
  • Custom CA bundles: if you pass ssl_ca_certs or set SSL_CERT_FILE or SSL_CERT_DIR, make sure that bundle no longer trusts the emSign roots.

No action needed for tokio: the bundled tokio moves to 1.51.6 for RUSTSEC-2026-0386. The SDK never calls the affected API.

What's new

Full-text match filters for documents (docs, 9fc62f4)

Narrow document search and fetch results by the words in a text field, not only by exact values. Field gains three methods:

  • match_phrase: the words, in order
  • match_all: every word, in any order
  • match_any: at least one of the words

Things to know:

  • Fields: they work on string fields declared with full_text_search, or with embed/sparse_embed unless you set store_text=False.
  • Methods: use them in the filter of documents.search and documents.fetch. The server rejects them in documents.delete and documents.update.
  • Usage: as with every Field filter, pass the result's .to_dict().
from pinecone import EmbedQuery, Field, Pinecone

pc = Pinecone()
index = pc.index("articles")  # "body" is a string field declared with embed=True

# Semantic search, limited to documents whose body contains "roman aqueduct"
# and whose year metadata is 100 or later.
results = index.documents.search(
    namespace="en",
    top_k=5,
    score_by=[EmbedQuery(field="body", query="how did Rome move water")],
    filter=(Field("body").match_phrase("roman aqueduct") & Field("year").gte(100)).to_dict(),
)

Fixes

  • index.create_namespace(name="__default__") still raises "reserved and cannot be created", but the message no longer claims the namespace always exists. It now explains that this holds only on an index created with dimension/metric, and that on a document index you create it by upserting documents into it. (bbe1282)

Docs

New guides for document indexes:

Upgrading

pip install --upgrade pinecone "certifi>=2026.10.19"
# or
uv add "pinecone>=10.2,<11" "certifi>=2026.10.19"

Full Changelog: v10.1.0...v10.2.0

Assets 10
Loading