Weaviate

Weaviate has deprecated its GraphQL API. Existing clusters aren’t switched off immediately. Weaviate Cloud has these shutdown dates:

New Cloud clusters already have GraphQL disabled. On December 1, 2026, GraphQL is switched off for clusters that haven’t used it in the last 30 days. On May 1, 2027, it is switched off on all remaining Cloud clusters.

Self-hosted versions released before May 1, 2027 keep GraphQL working.…

Weaviate says it patched its entire customer estate and infrastructure platform to mitigate the risk from eight leaked eMudhra certificates.

The response took less than 17 hours, with Enterprise customers patched within six hours. The work moved almost all of Weaviate's environment to Go 1.27.3.

Original source

Weaviate v1.39.3 and later fix a medium severity authorization flaw in GraphQL's nearObject search operator. The flaw could let a user reconstruct an object's vector from a collection they didn't have permission to read.

Weaviate says Cloud customers and Marketplace customers on AWS, Azure and GCP have already been patched. Its teams are coordinating upgrades with Weaviate Dedicated customers where appropriate.

The security release says a CVE has been requested and is pending assignment.…

Weaviate 1.40 adds PathSeer, a strategy for vector searches that also apply structured filters. It combines approaches from the existing sweeping and ACORN strategies rather than replacing them.

Weaviate's implementation benchmarks report a strong recall-throughput trade-off across the tested workloads, with build time of 1.10× and memory use of 1.06× compared with sweeping or ACORN. It adds no new user-facing tuning settings.…

Weaviate 1.40 makes dropping an unused named vector generally available. It frees that vector's disk space and index memory while keeping the collection's other named vectors and object data.

A drop can't be undone. To restore the vector, you'll need to add it again and re-vectorize or re-import the objects.

The release also makes 4-bit Rotational Quantization generally available. Weaviate reports similar recall to 8-bit RQ with a 45% heap reduction on a 1536-dimension dataset.…

Weaviate has released an Engram plugin for Claude Code for memory that carries across repos and sessions.

It captures work history, such as features you've added, approaches you've chosen, and libraries you've rejected. Weaviate says Claude can recall those decisions when they become relevant elsewhere, such as connecting a frontend to an endpoint added in another repo.

You install the plugin once and keep working. Weaviate says the effect starts to show a few sessions later.

Original source

Weaviate v1.39.3 fixes a high severity credential disclosure vulnerability in text2vec-google, multi2vec-google and generative-google.

An unvalidated apiEndpoint setting could send the operator's Google credential to an arbitrary host. Collection configuration required schema-write privileges, but the generative-google query path needed only ordinary read access to a collection already using that module.…

Weaviate's Engram docs now explain how to check whether a memory has finished processing. Each memories.add request returns a runid you can use to track its status and see which memories were created, updated, or deleted.

The guide covers running, inbuffer, completed, and failed states, plus error details when processing fails.

Most apps don't need to poll. Memories become searchable once processing finishes; the guide recommends checking a specific run when you need confirmation, such as…

Weaviate 1.39 adds 4-bit rotational quantization, a way to compress vectors for search. Weaviate reports similar recall with a 45% heap reduction compared with 8-bit RQ.

To enable it on a new collection, set bits to 4 in the RQ quantizer. You can also update an existing uncompressed collection, and Weaviate will re-encode its vectors in the background.

4-bit RQ requires the hnsw index. A dynamic index can use it only after converting to HNSW.…