RAG Pipeline Utils v3.8.2: Security Fixes and a Re-ingest Check

A security release. Upgrade now if you use the vector-store retrievers (QdrantRetriever, PineconeRetriever, WeaviateRetriever, PgVectorRetriever) or HybridRetriever with access control, GuardrailsPipeline, plugins from .ragrc.json or hub install, AuditLogger, DevServer or @devilsdev/rag-mcp-server, and re-ingest vector-store documents whose acl or requiredRole is set at the top level. Some changes in access control can hide documents that were visible before.

npm install @devilsdev/rag-pipeline-utils@^3.8.2
# and, if you use the MCP server:
npx @devilsdev/rag-mcp-server@3.8.2 ./docs

If you install @devilsdev/rag-core, rag-guardrails, rag-connectors or rag-eval directly, upgrade them to 3.8.2 as well.

Security

Five advisories are fixed in this release. Each one lists the affected
versions and workarounds for anyone who can't upgrade yet.

• Access control in the vector stores and HybridRetriever (RetrievalGuard with enforceACL): a document whose acl or requiredRole was set at its top level could be returned to users without the role when it was stored in QdrantRetriever, PineconeRetriever, WeaviateRetriever or PgVectorRetriever, or merged by HybridRetriever. This completes the 3.8.1 fix for the built-in stores. GHSA-234f-v76m-p9wc
• GuardrailsPipeline: streamed answers skipped the output checks (PII redaction, groundedness and length checks, strict-mode blocking), a blocked answer's text could still be returned in its guard summary, and with some custom pipelines the retrieval guard silently didn't run. GHSA-whr9-r3mv-2565
• Plugins: plugins listed in .ragrc.json were loaded without the documented signature verification, and hub install's checks could miss a plugin's entry file and ran its contract check with your full environment, credentials included. GHSA-m9gh-5x7v-rqj2
• Denial of service and the dev server: some inputs made text checks, plugin archive extraction and the MCP server's tools take seconds to minutes of CPU time, and a DevServer bound to all interfaces skipped its Host-header check for requests from the local machine. GHSA-4jh4-qv86-j2gw
• AuditLogger: deleted, reordered or truncated audit records weren't detected, and a missing tenant filter could return other tenants' events. GHSA-89fq-598q-39wc

After upgrading

• Re-ingest vector-store documents with top-level restrictions. QdrantRetriever, PineconeRetriever, WeaviateRetriever and PgVectorRetriever now store a document's top-level acl and requiredRole. Documents stored by earlier versions were saved without them, so upgrading alone doesn't restrict those documents. See Do I need to re-ingest? to check a store. Thanks to a reader for suggesting the re-ingest check.
• Upgrading from 3.8.0 or earlier? Also re-ingest FileVectorStore indexes whose documents set acl or requiredRole at the top level (fixed in 3.8.1).

Changed

Some of these change behaviour:

• HybridRetriever keeps the restrictions of every copy of a document it merges, which can hide documents that were visible before. The role rag:no-access is reserved: it restricts a document to no one.
• GuardrailsPipeline buffers streamed answers when a post-generation guard is set and releases them as one chunk after the check, returns blocked results without text, and withholds results the retrieval guard couldn't check.
• Plugins configured in .ragrc.json are verified before they load; unsigned plugins still load, with a one-time warning, unless you set requireSignedPlugins.
• hub install scans more and passes less, and hub certify scans the entry file the same way.
• @devilsdev/rag-mcp-server limits tool inputs and check time. Each limit can be raised with a CLI flag or environment variable (see the package README).
• DevServer checks the Host header of loopback requests whatever it is bound to.
• AuditLogger chains and verifies its records, stores a signing key when none is configured, and validates tenant filters.

The full list is in the CHANGELOG.

---

Originally published on the rag-pipeline-utils blog.