Starstruk Logo MarkStarstruk

v2.5.26

milvus-io/milvusv2.5.26Jan 23, 2026by yanliang567

AI Summary

This release includes critical security enhancements and important stability fixes. A key highlight is the addition of security controls for the internal /expr endpoint to prevent potential remote expression execution vulnerabilities.

Key Highlights

  • Added security controls for /expr endpoint to prevent remote expression execution vulnerabilities
  • Upgraded pulsar-client-go to v0.17.0 to fix send buffer race conditions
  • Fixed L0 growing segment data forwarding to use correct bulk delta-load API
  • Fixed Azure blob storage precheck using incorrect bucket configuration
  • Fixed geometry data conversion inconsistencies in WKT/WKB options

Full Release Notes

## v2.5.26

Release date: January 27, 2026

| Milvus Version | Python SDK Version | Node.js SDK Version | Java SDK Version | Go SDK Version |
|:-------------- |:------------------|:--------------------|:-----------------|:---------------|
| 2.5.26         | 2.5.18             | 2.5.13              | 2.5.14           | 2.5.14         |

We are pleased to announce the release of Milvus 2.5.26! This release includes critical security enhancements and important stability fixes. A key highlight is the addition of security controls for the internal `/expr` endpoint to prevent potential remote expression execution vulnerabilities. We have also upgraded the Pulsar client library to fix race conditions, resolved L0 segment data forwarding issues, and fixed Azure storage precheck configuration problems. We strongly recommend all users on the 2.5 branch upgrade to this version.

### Security

- Added security controls for the `/expr` endpoint to prevent remote expression execution vulnerabilities ([#47130](https://github.com/milvus-io/milvus/pull/47130))

### Improvements

- Upgraded pulsar-client-go to v0.17.0 to fix send buffer race conditions ([#47184](https://github.com/milvus-io/milvus/pull/47184))
- Added gRPC metadata header for client request time tracking ([#46946](https://github.com/milvus-io/milvus/pull/46946))

### Bug fixes

- Fixed L0 growing segment data forwarding to use the correct bulk delta-load API ([#47231](https://github.com/milvus-io/milvus/pull/47231))
- Fixed Azure blob storage precheck using incorrect bucket configuration ([#47204](https://github.com/milvus-io/milvus/pull/47204))
- Fixed geometry data conversion inconsistencies in WKT/WKB options ([#46872](https://github.com/milvus-io/milvus/pull/46872))