Starstruk Logo MarkStarstruk

v1.4.15

HKUDS/LightRAGv1.4.15Apr 19, 2026by danielaskdd

AI Summary

This update adds support for embedding providers that do not support base64 encoding and introduces Docker image signing. It also includes critical security patches for PostgreSQL Cypher injection and parameterized queries.

Key Highlights

  • Added Docker image signing with Cosign
  • Embedding support for providers like Yandex Cloud
  • Fixed PostgreSQL Cypher injection vulnerability
  • Auto-resolution of PostgreSQL vector settings

New Features

  • Non-base64 embedding support
  • PostgreSQL security hardening
  • Cosign image signing

Full Release Notes

## What's New
* ci: sign GHCR docker images with cosign by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2940
* feat(embeddings): added embedding support for providers that don't support base64 encoding (e.g. Yandex Cloud) by @KirillCh143 in https://github.com/HKUDS/LightRAG/pull/2935

## What's Changed
* fix(postgres): remove duplicate SET clause in upsert_edge Cypher query by @sjhddh in https://github.com/HKUDS/LightRAG/pull/2929
* feat(postgres): auto-resolve postgres vector setting by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2933
* fix(postgres): parameterize Cypher write queries to prevent injection by @sjhddh in https://github.com/HKUDS/LightRAG/pull/2931
* fix(graph): return 0 for missing node/edge degree instead of None by @sjhddh in https://github.com/HKUDS/LightRAG/pull/2930
* fix(setup): preserve storage images on compose rewrites by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2934
* Fix local setup device prompt defaults and ordering by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2939
* chore(deps): bump the react group in /lightrag_webui with 3 updates by @dependabot[bot] in https://github.com/HKUDS/LightRAG/pull/2945
* chore(deps-dev): bump the build-tools group in /lightrag_webui with 4 updates by @dependabot[bot] in https://github.com/HKUDS/LightRAG/pull/2946
* chore(deps): bump axios from 1.14.0 to 1.15.0 in /lightrag_webui in the frontend-minor-patch group by @dependabot[bot] in https://github.com/HKUDS/LightRAG/pull/2947
* chore(deps-dev): bump vite from 7.3.2 to 8.0.0 in /lightrag_webui by @dependabot[bot] in https://github.com/HKUDS/LightRAG/pull/2948
* fix(webui): graph settings not persisting when popover closes by @radioflyer28 in https://github.com/HKUDS/LightRAG/pull/2954

## New Contributors
* @KirillCh143 made their first contribution in https://github.com/HKUDS/LightRAG/pull/2935
* @radioflyer28 made their first contribution in https://github.com/HKUDS/LightRAG/pull/2954

**Full Changelog**: https://github.com/HKUDS/LightRAG/compare/v1.4.14...v1.4.15