v0.2.5

Tencent/WeKnorav0.2.5Dec 22, 2025by lyingbug

AI Summary

WeKnora v0.2.5 is a significant security and feature-focused release that introduces in-input knowledge base and file selection, API key authentication, and user registration controls. The update also includes major security enhancements with rebuilt SQL validation using PostgreSQL's official parser and MCP transport security improvements to prevent command injection attacks.

Key Highlights

In-Input Knowledge Base and File Selection - select knowledge bases and files directly within the input box with @mention support
API Key Authentication Support with optimized Swagger documentation and disabled access in non-production by default
Major security enhancements including SQL validation rebuilt with PostgreSQL official parser and MCP stdio transport security validation
User registration control via new DISABLE_REGISTRATION environment variable
Streaming rendering mechanism optimized for token-by-token Markdown content parsing

Breaking Changes

Removed legacy vlm_model_id field from knowledge_bases table (force removal)
Disabled Ollama option for ReRank models in model management
Swagger documentation access disabled in non-production environments by default

New Features

In-Input Knowledge Base and File Selection with dynamic placeholder text
API Key authentication mechanism
User Registration Control (DISABLE_REGISTRATION env variable)
User Conversation Model Selection with store two-way binding
MCP stdio transport security validation to prevent command injection
SQL security validation using PostgreSQL official parser
Security policy updated with vulnerability reporting guidelines
Streaming rendering mechanism optimized for token-by-token Markdown parsing
FAQ import progress refactored to use Redis for task state storage
Enhanced knowledge base and search functionality logic

Full Release Notes

## [0.2.5] - 2025-12-22

### 🚀 New Features
- **NEW**: In-Input Knowledge Base and File Selection
  - Support selecting knowledge bases and files directly within the input box
  - Display @mentioned knowledge bases and files in message stream
  - Dynamic placeholder text based on knowledge base and web search status

- **NEW**: API Key Authentication Support
  - Added API Key authentication mechanism
  - Optimized Swagger documentation security configuration
  - Disabled Swagger documentation access in non-production environments by default

- **NEW**: User Registration Control
  - Added `DISABLE_REGISTRATION` environment variable to control user registration

- **NEW**: User Conversation Model Selection
  - Added user conversation model selection state management with store two-way binding

### 🔒 Security Enhancements
- **ENHANCED**: MCP stdio transport security validation to prevent command injection attacks
- **ENHANCED**: SQL security validation rebuilt using PostgreSQL official parser for enhanced query protection
- **ENHANCED**: Security policy updated with vulnerability reporting guidelines

### ⚡ Improvements
- **IMPROVED**: Streaming rendering mechanism optimized for token-by-token Markdown content parsing
- **IMPROVED**: FAQ import progress refactored to use Redis for task state storage
- **IMPROVED**: Enhanced knowledge base and search functionality logic

### 🐛 Bug Fixes
- **FIXED**: Corrected knowledge ID retrieval in FAQ import tasks
- **FIXED**: Force removal of legacy vlm_model_id field from knowledge_bases table
- **FIXED**: Disabled Ollama option for ReRank models in model management with tooltip