v0.9.31

airweave-ai/airweavev0.9.31Mar 16, 2026by felixschmetz

AI Summary

Significant update focusing on security hardening, OAuth improvements, and performance optimizations.

Key Highlights

Replaced Math.random with CSPRNG for better security
Patched critical zlib vulnerability (CVE-2026-22184) in Alpine images
Reduced OAuth session TTL to 5 minutes
Eliminated N+1 source-connection requests on collection list pages

New Features

Added SSRF protection
Added claim-token verification for OAuth
Implemented refresh token usage for Auth0 renewal
Replaced Vespa visitor-based deletes with query-then-delete-by-ID

Full Release Notes

## What's Changed
* docs: update generated documentation by @github-actions[bot] in https://github.com/airweave-ai/airweave/pull/1624
* fix: replace Math.random with CSPRNG by @hiddeco in https://github.com/airweave-ai/airweave/pull/1604
* fix(docker): patch CVE-2026-22184 zlib critical vulnerability in Alpine images by @orhanrauf in https://github.com/airweave-ai/airweave/pull/1618
* Reduce OAuth session TTLs to 5 minutes by @hiddeco in https://github.com/airweave-ai/airweave/pull/1597
* feat: add SSRF protection by @hiddeco in https://github.com/airweave-ai/airweave/pull/1603
* fix: use refresh tokens for Auth0 renewal by @hiddeco in https://github.com/airweave-ai/airweave/pull/1617
* feat(oauth): add claim-token verification by @hiddeco in https://github.com/airweave-ai/airweave/pull/1620
* docs: cli by @EwanTauran in https://github.com/airweave-ai/airweave/pull/1632
* fix(ci): scope lint to changed lines by @hiddeco in https://github.com/airweave-ai/airweave/pull/1630
* feat: replace Vespa visitor-based deletes with query-then-delete-by-ID by @felixschmetz in https://github.com/airweave-ai/airweave/pull/1598
* fix: derive Connect URL at runtime instead of hardcoded localhost:8082 by @orhanrauf in https://github.com/airweave-ai/airweave/pull/1633
* refactor: carve out ARF & Storage into first-class Code Blue domains by @felixschmetz in https://github.com/airweave-ai/airweave/pull/1596
* perf: eliminate N+1 source-connection requests on collection list pages by @orhanrauf in https://github.com/airweave-ai/airweave/pull/1593


**Full Changelog**: https://github.com/airweave-ai/airweave/compare/v0.9.30...v0.9.31