SWIRL Community 4.5.0.7

SWIRL Community 4.5.0.7 — Security Patch
Fixes #1941:

• OIDC privilege escalation: sign-in no longer provisions superuser/staff accounts, and no longer sets a shared hardcoded password.
• Cross-user Microsoft token fallback: M365 token lookup is now strictly scoped to the requesting user; removed the fallback that could use another user's credentials.

No schema or dependency changes. Upgrade recommended for any deployment using OIDC sign-in or M365 connectors.

SWIRL Community 4.5.0.6

SWIRL Community 4.5.0.6

Fixes the AI Summary 'appears then swaps to a different summary' bug surviving 4.5.0.5.

• Galaxy: AI Summary toggle no longer triggers a duplicate search.
• Backend: per-search_id lock guarantees one RAG completion per search, even under concurrent requests.

⚠️ No DB migration. Drop-in for any 4.5.0.x.

docker pull swirlai/swirl-search:latest

SWIRL Community 4.5.0.5

SWIRL Community 4.5.0.5 — RAG cache regression fix

Follow-up patch on top of 4.5.0.4 that fixes a long-standing RAG UX bug exposed by 4.5.0.4 smoke testing: intermittent: the AI Summary appears, then a few seconds later gets replaced by a different AI Summary.

⭐ PLEASE STAR OUR REPO: https://github.com/swirlai/swirl-search
🌐 PLEASE VISIT OUR WEBSITE: https://www.swirlaiconnect.com/

---

What's fixed

Backend — swirl/views_helpers/search_rag.py (SearchRag.get_rag_result()):

• The cache check now correctly treats an empty rag_query_items (the typical state of Galaxy's follow-up GET /sapi/detail-search-rag/?search_id=…) as 'no filter requested, serve whatever's stored' rather than 'items changed, regenerate'.

Upgrading

⚠️ No database migration required. 4.5.0.5 is a drop-in replacement for 4.5.0.4 (and for any earlier 4.5.0.x).

Docker users:

docker pull swirlai/swirl-search:latest

See the Docker Build Guide for the SBOM / vulnerability inspection commands.

SWIRL Community 4.5.0.4

SWIRL Community 4.5.0.4 — Auth-chain regression fix

This release resolves an issue introduced in SWIRL 4.5.0.3.

⭐ PLEASE STAR OUR REPO: https://github.com/swirlai/swirl-search
🌐 PLEASE VISIT OUR WEBSITE: https://www.swirlaiconnect.com/

---

Fixed

• SWIRL now quietly ignores stale credentials your browser may be carrying and just uses your active login session instead of throwing you out.

Upgrading

⚠️ No database migration required. 4.5.0.4 is a drop-in replacement for 4.5.0.3 (and for 4.5.0.2 if you skipped 4.5.0.3).

Docker users:

docker pull swirlai/swirl-search:latest

See the Docker Build Guide for the SBOM / vulnerability inspection commands.

SWIRL Community 4.5.0.2

SWIRL Community 4.5.0.2

Targeted patch that adds the optional AI instruction field on the search form, resolves minor RAG/UX issues in the bundled Galaxy UI, and pins major dependencies to prevent surprise version jumps.

⭐ PLEASE STAR OUR REPO: https://github.com/swirlai/swirl-search
🌐 PLEASE VISIT OUR WEBSITE: https://www.swirlaiconnect.com/

---

New Features

This version of SWIRL offers a separate field for entering instructions to the LLM.

When you click the Generate button, it will provide those instructions along with the most relevant search results to the LLM, thus separating the retrieval and instructions, and guiding the response:

All responses will include citations. Click them to verify the results.

To ask a follow up question, change the question in the instruction box, and click Generate again.

Improvements

• History toggle moved to the left of the SWIRL logo
• Login page logo refreshed to the canonical Galaxy logo
• Key package versions now pinned in requirements.txt

Bill of Materials (BOM)

To obtain the Bill of Materials for SWIRL Community:

docker scout sbom swirlai/swirl-search:latest

Upgrading

⚠️ No database migration required. 4.5.0.2 is a drop-in replacement for 4.5.0.1.

SWIRL Community 4.5.0.1

🔒 SWIRL Community 4.5.0.1 — Security Patch

This release re-freezes Python dependencies to clear ~30 vulnerabilities reported by Docker Scout. No SWIRL application code changed.

⭐ PLEASE STAR OUR REPO: https://github.com/swirlai/swirl-search
🌐 PLEASE VISIT OUR WEBSITE: https://www.swirlaiconnect.com/

---

Updates

⚠️ 2 critical CVEs addressed (CVSS ≥ 9.0):

• nltk 3.9.2 → 3.9.4 — CVE-2025-14009 (CVSS 10.0)
• litellm 1.83.0 → 1.83.10 — CVE-2026-42208 (CVSS 9.3)

Plus 26 high-severity CVEs across Django, urllib3, cryptography, ujson, pyOpenSSL, lxml, PyJWT, pyasn1, azure-core, cbor2, protobuf, orjson, and previously-transitive wheel + jaraco.context.

Some upstream constraints forced additional version moves:

• openai 2.9.0 → 2.24.0 — required by litellm 1.83.10
• snowflake-connector-python 3.17.3 → 4.5.0 — required for cffi 2.0.0 (which cryptography 46.0.5 requires)
• cffi 1.17.1 → 2.0.0

The OpenAI integration path has been re-validated against both OpenAI and Anthropic models via LiteLLM.

Deferred

• twisted 25.5.0 → 26.4.0 — fix is currently only available as a release candidate (26.4.0rc2). Will be picked up in 4.5.1 / 4.6 once 26.4.0 final ships. The associated CVE-2026-42304 (CVSS 7.5) is acknowledged but does not affect the SWIRL request path in normal deployment.

Upgrading

⚠️ No database migration required. 4.5.0.1 is a drop-in replacement for 4.5.0.0.

SWIRL Community 4.5

Team SWIRL is delighted to announce the general availability of SWIRL 4.5!

⭐ PLEASE STAR OUR REPO: https://github.com/swirlai/swirl-search
🌐 PLEASE VISIT OUR WEBSITE: https://www.swirlaiconnect.com/

---

This version of SWIRL Community adds support for multiple RAG LLMs and major updates to the Galaxy UI and SWIRL administrative console, including basic analytics and a bult-in log viewer.

New Features

🔹 Support for executing RAG with most LLMs

SWIRL Community now supports most LLMs for AI Insight generation, including OpenAI, Azure/OpenAI, Claude, Gemini, local models running ollama, and many more! The redesigned AI Summary block now includes a thinking indicator, citation favicons, and tighter result-card layout.

🔹 New MCP server

Drop SWIRL into Claude Desktop, Claude Code, Cursor, or any MCP client through the new swirl-mcp-server adapter. One tool call (search(query="...", rag=true)) returns a generated answer with sources, federated across every connector you've configured — without any data leaving your network.

{
  "mcpServers": {
    "swirl": {
      "command": "swirl-mcp",
      "env": {
        "SWIRL_BASE_URL": "http://localhost:8000",
        "SWIRL_USERNAME": "<your-swirl-username>",
        "SWIRL_PASSWORD": "<your-swirl-password>"
      }
    }
  }
}

🔹 You can now edit SearchProviders and AIProviders from the admin console

The new form includes support for pasting JSON, bulk editing, and more!

🔹 You can now view logs right from the admin console

🔹 You can now view activity analytics from the admin console

Improvements

🔹 The revised source selector now groups sources by tag, and shows the tag selected.

🔹 Canonical SearchProvider naming

All shipped SearchProviders are now named with a consistent Type: "Source scheme - Articles" - arXiv, Web - Google PSE, Docs - SWIRL, Email - M365 Outlook, Code - GitHub, etc. Existing tag-prefix syntax (arxiv:, sharepoint:, github:, etc.) keeps working unchanged.

🔹 Updated re-ranking model with performance improvements
🔹 Better error handling during AI insight generation
🔹 Processing status displayed during RAG
🔹 Major overhaul of Galaxy
🔹 Major overhaul of Administrative console

Fixes

🔹 Security Vulnerabilities - CVEs addressed across base image + dependency upgrades

🔹 Galaxy UI: AI Summary no longer clobbers aiModel after handleRagResponse returns, notification-bell and AI-Provider 404 noise silenced in browser console, print-header 404 silenced, M365 bare-search default mixer correcte, several rendering and contrast fixes

🔹 Search & RAG: tag-prefix queries (Code:, Issues:, PRs:, HashID:, Wallet:, EPMC:, etc.) restored as first-class routing tags, Internet Archive no longer mishandles NOT queries (previous Web tag removed to fix this), rag_timeout URL-param plumbing tightened end-to-end

Upgrading

⚠️ Version 4.5 introduces a database migration (0003_add_aiprovider) to support the new AIProvider admin. Run python swirl.py setup (or restart the Docker container, which runs setup automatically) to apply it.

If you have a long-running deployment with custom SearchProvider / AIProvider names, review swirl_sync.py before upgrading.

Documentation

📘 SWIRL's documentation site has been updated for 4.5, including the new MCP Server Guide, refreshed SearchProviders reference, and a top-level Troubleshooting page.

# SWIRL Community 4.4.0.1 HOTFIX Release Announcement

This release fixes an issue where the SWIRL app would fail to start without certain configuration items specified in the environment. They are no longer required.

⭐ PLEASE STAR OUR REPO: https://github.com/swirlai/swirl-search
🌐 PLEASE VISIT OUR WEBSITE: https://www.swirlaiconnect.com/

# 🚀 SWIRL Community 4.4 Release Announcement

Team SWIRL is excited to announce the release of SWIRL AI Search 4.4, Community Edition.

⭐ PLEASE STAR OUR REPO: https://github.com/swirlai/swirl-search
🌐 PLEASE VISIT OUR WEBSITE: https://www.swirlaiconnect.com/

---

New Features

🔹 The source selector now supports partial selection per the CUA protocol

🔹 SearchProvider tags are now clickable in the source selector

Improvements

🔹 Community Edition RAG now supports all OpenAI and Azure/OpenAI models

The following RAG configuration options are now supported in the .env file:

# Model usage
SWIRL_RAG_MODEL='gpt-4.1'
SWIRL_REWRITE_MODEL='gpt-4.1'
SWIRL_QUERY_MODEL='gpt-4.1'

# RAG token and results budgets
SWIRL_RAG_TOK_MAX=15000
SWIRL_RAG_MAX_TO_CONSIDER=15

🔹 Updated the SWIRL Docker image to the lastest Debian Trixie base image.

🔹 Validated SWIRL on Python 3.13.9.

Fixes

🔹 Security Vulnerabilities

• 1 Critical CVE addressed
• 9 High CVEs addressed

🔹 Galaxy UI

• The "Manage SWIRL" link is now available only for Superusers
• Page titles were shortend

Upgrading

⚠️ Version 4.4 does not require database migration.

---

Documentation

📘 SWIRL’s documentation site has been updated reflecting the new features above.

🚀 SWIRL Community 4.3 Release Announcement

Team SWIRL is announcing the release of SWIRL AI Search 4.3, Community Edition.

⭐ PLEASE STAR OUR REPO: https://github.com/swirlai/swirl-search
🌐 PLEASE VISIT OUR WEBSITE: https://www.swirlaiconnect.com/

---

New Features & Improvements

🔹 OpenAI & Azure/OpenAI configuration in Community Edition

Community users can now select any OpenAI or Azure/OpenAI model, including the newly released GPT-5

INFO 2025-08-20 15:51:53 rag_prompt RagPrompt : max_tokens:3800 num_tokens 3754 is_full:False
INFO 2025-08-20 15:51:53 openai get model AZUREAI gpt-5

🔹 Galaxy UI

• New: Search result cards now display the Author value
• Improvement: Logged-in username now shown in the User Profile menu
• Improvement: Added Support Ticket link to the Help/Info menu in Community Edition
• Improvement: Updated Support Resources link in the Help/Info menu
• Improvement: Upgraded Yarn compiler to v4.9.2 with updated dependencies

Fixes

🔹 Galaxy UI

• Resolved multiple issues with result item selection UI/UX
• Date sorting fix: “View By” menu is now retained even when no results have Date Published values
• Fixed an issue with the &rag_timeout= URL parameter

Upgrading

⚠️ Version 4.3 does not require database migration.

---

Documentation

📘 SWIRL’s documentation site has been updated reflecting the new features above.