🔒 Security
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) (high severity, CVSS 7.1), dependency advisory GHSA-cx6f-vjhg-g3cc / CVE-2026-115586.
Upgrading is strongly recommended.
Highlights
- Vector Store: Now defaults to the SQLite vector store and avoids starting Docker without embeddings.
- Dependencies: Virtualenv version locked to 21.14.13 to address GHSA-cx6f-vjhg-g3cc.
- SBOM: CycloneDX SBOM and Docker image attestation published with each release.
What's Changed
- feat(vectors)!: default to the sqlite vector store and never start Docker without embeddings by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3407
- fix(deps): lock virtualenv 21.14.13 to clear GHSA-cx6f-vjhg-g3cc by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3428
- ci(release): publish a CycloneDX SBOM with each binary and an SBOM attestation with the Docker image by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/3427
Full Changelog: https://github.com/vitali87/code-graph-rag/compare/v0.2.24...v0.3.2
