v1.18.2

abi/screenshot-to-codev1.18.2Jun 4, 2026by timvisee

AI Summary

This release focuses on performance improvements for shard recovery operations, fixes several critical bugs in the optimizer and snapshot transfer mechanisms, and addresses security vulnerabilities related to authentication and memory safety.

Key Highlights

Log slow operations during shard WAL recovery
Fixed potential infinite loop in the optimizer
Fixed REST auth whitelist bypass on crafted paths
Fixed out-of-bounds heap read in malicious snapshots

Full Release Notes

# Change log

## Improvements

* https://github.com/qdrant/qdrant/pull/9282 - Log slow operations during shard WAL recovery
* https://github.com/qdrant/qdrant/pull/9137 - Clear cache of ID tracker after building a segment
* https://github.com/qdrant/qdrant/pull/9138 - Don't rebuild payload index if changing `on_disk` flag

## Bug Fixes

* https://github.com/qdrant/qdrant/pull/9285 - Fix potential infinite loop in optimizer when using multi vectors with `prevent_unoptimized`
* https://github.com/qdrant/qdrant/pull/9217 - Clean up unfinished segment optimizations on cancellation, don't load them on restart
* https://github.com/qdrant/qdrant/pull/9260 - Fix MatchAny with an empty list being rejected on integer index
* https://github.com/qdrant/qdrant/pull/9239 - Add timeout to shard snapshot streaming endpoint, drop connections not actively read from
* https://github.com/qdrant/qdrant/pull/9215 - Fix abort transfer with resharding not being idempotent
* https://github.com/qdrant/qdrant/pull/9237 - Fix reporting old progress in new snapshot transfers
* https://github.com/qdrant/qdrant/pull/9226 - Fix WAL lock error on Android platforms

## Security

* https://github.com/qdrant/qdrant/pull/9254 - Fix REST auth whitelist bypass on specially crafted paths, resolve route before authorizing
* https://github.com/qdrant/qdrant/pull/9268 - Fix out of bound heap read with malicious snapshot by rejecting incorrect length