v1.18.2

sampotts/plyrv1.18.2Jun 4, 2026by timvisee

AI Summary

This release focuses on stability and security improvements, including logging for slow shard WAL recovery operations and clearing caches to optimize performance. It addresses critical security vulnerabilities related to REST authentication whitelist bypass and snapshot handling.

Key Highlights

Logging of slow operations during shard WAL recovery
Fix for REST auth whitelist bypass on crafted paths
Fix for out-of-bounds heap read in snapshot handling
Clear cache of ID tracker after building a segment

Full Release Notes

# Change log

## Improvements

* https://github.com/qdrant/qdrant/pull/9282 - Log slow operations during shard WAL recovery
* https://github.com/qdrant/qdrant/pull/9137 - Clear cache of ID tracker after building a segment
* https://github.com/qdrant/qdrant/pull/9138 - Don't rebuild payload index if changing `on_disk` flag

## Bug Fixes

* https://github.com/qdrant/qdrant/pull/9285 - Fix potential infinite loop in optimizer when using multi vectors with `prevent_unoptimized`
* https://github.com/qdrant/qdrant/pull/9217 - Clean up unfinished segment optimizations on cancellation, don't load them on restart
* https://github.com/qdrant/qdrant/pull/9260 - Fix MatchAny with an empty list being rejected on integer index
* https://github.com/qdrant/qdrant/pull/9239 - Add timeout to shard snapshot streaming endpoint, drop connections not actively read from
* https://github.com/qdrant/qdrant/pull/9215 - Fix abort transfer with resharding not being idempotent
* https://github.com/qdrant/qdrant/pull/9237 - Fix reporting old progress in new snapshot transfers
* https://github.com/qdrant/qdrant/pull/9226 - Fix WAL lock error on Android platforms

## Security

* https://github.com/qdrant/qdrant/pull/9254 - Fix REST auth whitelist bypass on specially crafted paths, resolve route before authorizing
* https://github.com/qdrant/qdrant/pull/9268 - Fix out of bound heap read with malicious snapshot by rejecting incorrect length