v1.5.4 — Stability & Integrations

Release Date: 2026-09-04
Changes: v1.5.3 → v1.5.4

Pull Requests: #2538, #3161, #3274, #3453, #3496, #3536, #3715, #3884, #4108, #4132, #4188, #4222, #4440, #4465, #4487, #4519, #4525, #4528, #4531, #4534, #4560, #4561, #4563, #4567, #4569, #4573, #4575, #4576, #4577, #4578, #4585, #4587, #4588, #4593, #4596, #4598, #4603, #4606, #4607, #4608, #4609, #4610, #4611, #4612, #4619, #4620, #4624, #4627, #4634, #4635, #4638, #4639, #4640, #4642, #4644, #4645, #4646, #4647, #4652, #4653, #4657, #4662, #4663, #4664, #4666, #4667, #4669, #4670, #4671, #4672, #4676, #4679, #4682, #4687, #4692, #4696, #4824, #4825, #4840, #4844, #4846, #4847, #4848, #4852, #4855, #4856, #4857, #4858, #4864, #4870, #4880, #4882, #4892

Summary

This patch release focuses on reliability, data-ingestion convenience, and front-end polish. It fixes several migration, logging, and provenance issues, adds small but helpful API and Docker conveniences for ingestion tools, and includes a broad set of frontend updates and bug fixes.

Highlights

• Docker image now installs the 'dlt' extra so common data-ingestion tools work out of the box.
• API add endpoint accepts raw_data strings and git repo URLs to simplify adding datasets programmatically.
• Multiple fixes to migrations, logging, and provenance to improve stability during upgrades and concurrent operations.
• Frontend reorganizations and numerous UI fixes that improve dataset, dashboard, and integration workflows.
• Security and safety hardening: API tokens are redacted in startup logs and local file-root access is disabled by default.

Breaking Changes

• Removed 'repositories' parameter — The 'repositories' parameter was removed from the affected API/CLI calls. If you relied on that parameter, update your integrations to the new calling pattern (check the OpenAPI or SDK docs for the updated signature).
• COGNEE_ALLOWED_LOCAL_FILE_ROOTS default changed — The configuration COGNEE_ALLOWED_LOCAL_FILE_ROOTS is now disabled by default. If you previously used this to allow local file access, explicitly re-enable it in your configuration and verify permitted paths.

New Features

• DLT extra in Docker image — The official Docker image now installs the 'dlt' extra (an optional set of packages used for data loading). This means connectors or ingestion flows that rely on that extra will work without requiring you to manually install extra packages in your container.
• Add endpoint accepts raw data and repo URLs — The API that adds data now accepts raw_data as a string (so you can POST text directly) and also accepts repository clone URLs. This makes it easier to programmatically add data from a git repo or inline text without pre-uploading files.
• Frontend refinements and new pages — The web UI received large updates across the dashboard, datasets, integrations, and business/canvas pages. These changes reorganize lists and panels, improve upload flows, and enhance onboarding steps to make everyday tasks clearer and smoother.

Improvements

• Migrations run once per process — Relational database migrations are now performed only once for a process, reducing duplicate work and race conditions during startup.
• Logging initialization refined — Logging is initialized exactly once per process and verbose/quiet logging toggles that caused confusion were removed. This reduces duplicate log entries and makes logs easier to read.
• DLT ingestion delimiter handling — The dlt-based ingestion pipeline now correctly handles files that use different delimiters (commas, tabs, etc.), so mixed-source CSV/TSV files import more reliably.
• FastAPI empty-data crash fixed — A FastAPI bug that could crash on empty request data has been fixed, improving API robustness for edge cases.
• Demo CLI shows example answers without extra LLM calls — The CLI demo mode now displays stored demo answers fully, without reaching out to language models, making demos faster and offline-friendly.
• LanceDB predicate quoting — IDs in LanceDB retrieval predicates are quoted properly to avoid query errors for certain id formats.
• Read EMBEDDING_API_BASE as alias — The EMBEDDING_API_BASE environment variable is now recognized as an endpoint alias, simplifying alternate endpoint configurations.
• Provenance cleanup — Fixes to provenance handling stop duplicate ownership of edges created from chunked content and declare correct defaults in the model so provenance migrations behave consistently.
• Update authorization and ownership fixes — Incremental updates are now authorized by dataset ACL (access control list), the chunk-budget lookup resolves as the dataset owner, and the original dataset owner is retained on full-rebuild fallbacks.

Performance

• Reduced provenance lock contention — The checkpoint was moved out of the provenance lock, lowering lock contention and improving concurrency when many operations write provenance metadata.
• More robust write ordering — The graph is now written before vectors during storage operations, reducing the chance of partial writes and improving overall data consistency during ingestion.
• Database provisioning streamlined — Dataset databases are provisioned by dataset id only, simplifying provisioning logic and reducing overhead during environment setup.

Security

• API token redaction in start-up echo — The entrypoint no longer prints plaintext --api-token in its launch echo; tokens are redacted so they won't leak in logs.
• Local file roots disabled by default — The COGNEE_ALLOWED_LOCAL_FILE_ROOTS setting is now disabled by default to reduce accidental exposure of local filesystem paths to the server.
• Skip tenant permission grant for local sentinel — The frontend/server now skips an automatic tenant permission grant when running a local sentinel instance, preventing unexpected permission changes in development runs.

Bug Fixes

• Removed a 'quiet' logging mode that suppressed helpful messages and caused confusion.
• Fixed an issue where repositories parameter was removed incorrectly in some calls — callback surfaces updated to match the new calling pattern.
• Fixed FastAPI crash on empty data payloads.
• Redacted the --api-token argument in startup output.
• Fixed dlt ingestion to correctly handle multiple file delimiters.
• Fixed DTO refactor regressions and synchronized OpenAPI extras with the running app so docs and API match.
• Fixed chunk-produced provenance edges being double-owned.
• Fixed an issue ensuring the chunk-budget lookup resolves with the correct dataset owner context.
• Fixed several frontend bugs across dataset, dashboard, and integration pages (upload progress, modals, list rendering, and connectors).
• Fixed read behavior for EMBEDDING_API_BASE so the alternate endpoint configuration behaves correctly.

Technical Changes

• Refactored migrations: one frozen schema module is used for both revisions and dialect choice is decided from the database bind; several migration re-parenting changes to maintain a single head after recent merges.
• Numerous CI and test updates: reorganization of test suites, nightly/test splits, and added e2e routing tests for serve().
• OpenAPI sync and documentation tweaks: small blurb fixes and spec extras were synchronized with the running app.
• Various internal refactors and cleanup: re-parenting agent migrations, provisioning changes, and multiple test fixture fixes.

Dependency Updates

Updated:

• limits: >=4.4.1,<5 → >=4.4.1,<6
• litellm: >=1.83.7 → >=1.83.7,<1.97.0

Compatibility

— The Cognee Team · 2026-09-04