Quivr 2.0.1
2.0.1 is a security release. It changes no API, no configuration and no stored data. Upgrade any 2.0.0 installation to it.
Security fixes
- Weaviate 1.39.13 replaces 1.39.10 as the search database. It rejects TLS certificate chains built on the eight leaked eMudhra intermediate certificates (CVE-2026-111943). Weaviate uses TLS for backups, OIDC and model modules.
- Python 3.12.16 replaces 3.12.15 in the core, plugin and CPU embedding images (CVE-2026-115557).
libbrotli11.0.9-2+deb12u1 is now in the TEI embedding image (CVE-2026-111497).
Upgrade from 2.0.0
- Back up the search database volume, as before any database upgrade.
- Deploy the 2.0.1 images and the new Weaviate pin from
deploy/infrastructure.json. For a single-machine installation, use the 2.0.1 compose bundle attached to this release. - Keep the same Weaviate volume.
Weaviate 1.39.10 to 1.39.13 is a patch upgrade within one minor version, so the stored data stays as it is: no re-indexing and no Quivr migration. The test that upgrades a 1.37.15 volume through 1.38.20 to 1.39.13, then checks lexical, semantic and hybrid search, passes on this release.
The release images are signed and carry SBOMs, as described in Security of Quivr releases.