8 posts tagged with "Security"

A security release. Upgrade now if you use the vector-store retrievers (QdrantRetriever, PineconeRetriever, WeaviateRetriever, PgVectorRetriever) or HybridRetriever with access control, GuardrailsPipeline, plugins from .ragrc.json or hub install, AuditLogger, DevServer or @devilsdev/rag-mcp-server, and re-ingest vector-store documents whose acl or requiredRole is set at the top level. Some changes in access control can hide documents that were visible before.

npm install @devilsdev/rag-pipeline-utils@^3.8.2
# and, if you use the MCP server:
npx @devilsdev/rag-mcp-server@3.8.2 ./docs

If you install @devilsdev/rag-core, rag-guardrails, rag-connectors or rag-eval directly, upgrade them to 3.8.2 as well.

A security release. Upgrade now if you use RetrievalGuard access control, plugin signature verification, the development server (DevServer) or @devilsdev/rag-mcp-server, and re-ingest FileVectorStore indexes whose documents set acl or requiredRole at the top level. One change in access control can hide documents that were visible before.

npm install @devilsdev/rag-pipeline-utils@^3.8.1
# and, if you use the MCP server:
npx @devilsdev/rag-mcp-server@3.8.1 ./docs

v3.7.1 is a patch release with no breaking changes. It fixes a slow pattern in QueryPlanner that a long query could use to tie up a server, and two ways a crafted __proto__ key could write to Object.prototype in the CLI. It also gives the npm page a new README. Upgrading is recommended if you pass user queries to QueryPlanner.

npm install @devilsdev/rag-pipeline-utils@^3.7.1

v3.0.2 updates csv-parse to 7.x for a security advisory and adds a recorded demo of rag-pipeline eval to the README. There are no API changes.

npm install @devilsdev/rag-pipeline-utils@^3.0.2

v3.0.1 fixes five problems found while checking the whole documentation site against 3.0.0. One is a security fix, so please upgrade:

npm install @devilsdev/rag-pipeline-utils@^3.0.1

There are no API changes. If you use PluginHub, PluginCertification or AnthropicConnector, read the sections below.

v2.5.0 is a consolidation release. The CLI now does real work end to end, every pipeline stage can be cancelled, grounding metrics measure what they claim to, and modules that were simulations are now clearly separated in an /experimental entry point. Several of these changes alter scores and defaults, so please read the upgrade notes before you update.

Production RAG systems handle sensitive data and require comprehensive security measures. This post shares hard-earned lessons from securing RAG deployments at scale, covering authentication, input validation, data privacy, and threat mitigation.

RAG Pipeline Utils v2.3.1 delivers advanced security enhancements and production hardening improvements. This patch release includes critical updates to JWT validation, path traversal defense mechanisms, and race condition mitigation.