v0.28.0

Release Notes

feat(mcp): scope custom tool queries to a tenant from a verified token claim (#738, #745) @vishal-bala

Custom tool profiles can scope every query to a tenant read from the caller's verified token, with lock.inject. The injected field is never offered to the model, and the server refuses to start an injecting profile when authentication is off, when it runs over stdio, or when another tool can reach the same index without the tenant scope.

redisvl.query.filter.is_match_all_filter is now public. It returns True for a filter that would match every document, including None, "*" and an uninitialised FilterExpression.

refactor(index): explicit client ownership and removal of the deprecated connection APIs (#726, #727, #728) @vishal-bala

SearchIndex and AsyncSearchIndex accept a new owns_client argument controlling whether the index closes its Redis client when it is disconnected or garbage collected. The default is unchanged: an index closes a client it created itself and never one passed as redis_client. Pass owns_client=True to hand over a client you created, or owns_client=False to keep one the index would otherwise close.

The deprecated connection APIs are removed. Each removed keyword now raises TypeError naming its replacement, where previously the index keywords were silently ignored and url failed with an unrelated error from redis-py.

Removed	Use instead
SearchIndex.connect(), SearchIndex.set_client() and their AsyncSearchIndex counterparts	redis_client or redis_url in the constructor, with owns_client=True if the index should close a client you supplied
connection_args and redis_kwargs on the index constructors	connection_kwargs, with the same value
RedisConnectionFactory.connect()	get_redis_connection() or get_async_redis_connection()
url on all five connection factory functions	redis_url

AsyncSearchIndex no longer converts a sync Redis client for you. Pass an async client, or convert a non-cluster client yourself with RedisConnectionFactory.sync_to_async_redis(). Passing the wrong flavour of client to either index class now raises TypeError at construction rather than failing at first use; an async client passed to SearchIndex previously raised ValueError.

Three further behaviour changes can surface errors earlier than before:

• url previously took precedence over redis_url on the async factory, so an AsyncSearchIndex built with both redis_url and a url inside connection_kwargs connected to the latter. That combination now raises.
• An index given a redis_client and no redis_url raises RedisVLError when it tries to reconnect after that client is closed, instead of falling back to REDIS_URL.
• A cache built from a redis_url raises ConnectionError when its async client is created rather than at the first command, so an unreachable server surfaces at construction.

fix(schema): use longitude first for GEO coordinates (#747) @fallintoplace

GEO validation and schema inference now expect "longitude,latitude", the order Redis uses, instead of rejecting valid values such as -122.4194,37.7749. Values stored as "latitude,longitude" now fail validation when the longitude is beyond ±90; Redis was already misplacing or skipping them, so swap the order and reload. A swapped pair with both numbers within ±90 still passes, so validation cannot confirm that existing data is correct.

fix(router): reject an empty reference id instead of matching every one (#718) @vishal-bala

SemanticRouter.get_route_references and delete_route_references now raise ValueError when passed an empty reference id. Previously the empty id rendered as a match-all filter and resolved to one arbitrary reference, so get_route_references returned a reference that was never requested and delete_route_references deleted one and reported success. Calls with real reference ids are unaffected, as are whitespace-only ids, which have always matched nothing.

fix(types): stop the deprecation decorators erasing wrapped signatures (#739) @vishal-bala

Type checkers now see real signatures for the vectorizer embed and embed_many methods, both SearchIndex constructors, SemanticCache, SemanticRouter and MessageHistory, all of which the deprecation decorators previously erased. Calls passing arguments those functions do not accept may newly fail type checking.

perf(schema): cache compiled JSONPath expressions in document validation (#735) @vishal-bala

Loading documents into a JSON index with validate_on_load=True is substantially faster. JSONPath expressions derived from the schema are now compiled once and reused, instead of being re-parsed for every field of every document.

deps: drop the protobuf upper bound from the vertexai and all extras (#734) @vishal-bala

The protobuf upper bound has been removed from the vertexai and all extras. Installations that previously could not resolve alongside a newer protobuf are no longer constrained by RedisVL; google-cloud-aiplatform continues to supply its own bound.

---

🚀 Enhancement

• feat(mcp): scope custom tool queries to a tenant from a verified token claim #745 @vishal-bala
• fix(schema): use longitude first for GEO coordinates #747 @fallintoplace
• refactor(connection): remove RedisConnectionFactory.connect and the url= keyword #728 @vishal-bala
• refactor(index): remove connect, set_client, connection_args, redis_kwargs #727 @vishal-bala
• feat(index): owns_client for explicit Redis client ownership handover #726 @vishal-bala
• feat(mcp): add the security core for auth-claim tenant injection #738 @vishal-bala

🐛 Bug Fix

• fix(types): stop the deprecation decorators erasing wrapped signatures #739 @vishal-bala
• fix: remove mutable default arguments in SemanticRouter (follow-up to #700) #737 @harshadkhetpal
• fix(ci): stop a LangCache outage failing tests and skipping the Redis matrix #740 @vishal-bala
• fix(router): reject an empty reference id instead of matching every one #718 @vishal-bala
• fix(mcp): fail closed when the tool scope gate cannot reach its auth config #716 @vishal-bala

🏎 Performance

• perf(schema): cache compiled JSONPath expressions in document validation #735 @vishal-bala

🔩 Dependency Updates

• chore(deps): bump virtualenv from 21.7.12 to 21.7.13 in the uv group across 1 directory #749 @dependabot
• chore(deps): bump the uv group across 1 directory with 4 updates #744 @dependabot
• deps: drop the protobuf upper bound from the vertexai and all extras #734 @vishal-bala
• chore(deps): bump anyio from 4.13.0 to 4.14.2 in the uv group across 1 directory #741 @dependabot
• chore(deps): bump soupsieve from 2.8.4 to 2.9 in the uv group across 1 directory #736 @dependabot

CI/CD Changes

• ci: make the redis:latest matrix legs advisory #733 @vishal-bala