Skip to main content

RAG Pipeline Utils v3.0.1: No Default Plugin Registry, Audit Logs and Claude Defaults

· 3 min read
Ali Kahwaji
Ali Kahwaji
Creator & Maintainer of RAG Pipeline Utils

v3.0.1 fixes five problems found while checking the whole documentation site against 3.0.0. One is a security fix, so please upgrade:

npm install @devilsdev/rag-pipeline-utils@^3.0.1

There are no API changes. If you use PluginHub, PluginCertification or AnthropicConnector, read the sections below.

No default plugin registry​

PluginHub and PluginCertification defaulted to https://registry.rag-pipeline.dev when no registryUrl was given. The project doesn't control that domain (rag-pipeline.dev was not registered when checked on 30 October 2026), so whoever registered it would have received what these classes send:

  • PluginHub attached RAG_PLUGIN_HUB_API_KEY, when set, as a Bearer token to its requests.
  • PluginHub posted usage analytics (search queries and plugin ids) once a minute whenever there were any.
  • PluginCertification posted certification submissions.

The rag-pipeline hub CLI has required an explicit registry since 2.5.0, but the classes kept the old default. In 3.0.1 there is no default anywhere. Pass the registry you use, or set RAG_PLUGIN_REGISTRY:

import { PluginHub } from "@devilsdev/rag-pipeline-utils";

const hub = new PluginHub({ registryUrl: "https://plugins.example.org" });

Without one, requests reject with NO_PLUGIN_REGISTRY and nothing leaves the machine. If you set RAG_PLUGIN_HUB_API_KEY and used PluginHub without a registryUrl on 3.0.0 or earlier, rotate that key as a precaution.

Audit log verification in timezones ahead of UTC​

AuditLogger.verifyIntegrity() is the tamper check for the audit log. Called without a startDate, it could check no logs at all and still report verified: true. Daily files are named by their UTC date, but the code found them by stepping one local day at a time from 1970. In a timezone ahead of UTC with daylight saving, such as New Zealand in summer, the steps landed on the previous UTC day, so today's file was never opened. queryLogs() used the same code and could miss records.

Files are now matched by their UTC date from a listing of the log directory. A test runs both methods in the Pacific/Auckland timezone; CI runs in UTC, where the problem never showed. If you rely on verifyIntegrity(), run it again after upgrading.

AnthropicConnector defaults​

AnthropicConnector defaulted to claude-3-5-sonnet-20241022, which Anthropic retired on 28 October 2025, so a connector created with default settings failed. The default is now claude-sonnet-5-5, Anthropic's recommended replacement.

Changing the model alone wasn't enough. The connector also sent temperature: 0.7, and Claude 4.7 and later models accept only the API's default temperature (1). The connector's default is now 1, and it leaves temperature out of the request at that value. A temperature you set yourself is still sent. Answers were sampled at 0.7 before; pass temperature: 0.7 to keep that on models that accept it. CostCalculator now prices claude-sonnet-5-5 at Anthropic's list price ($2 / $10 per million input / output tokens).

Smaller fixes​

  • new PluginSandbox() (experimental) threw PluginSignatureVerifier is not a constructor in 3.0.0. It constructs again; its execute() is still not functional, as the Experimental modules page says.
  • wrapError left a literal {reason} in messages such as Pipeline execution failed at stage 'retrieval': {reason}. It now fills it from the wrapped error's message.
  • PluginHub's User-Agent reports the installed version instead of 2.1.8.

The full list is in the CHANGELOG.