Update getmeili/meilisearch Docker tag to v1.48.2

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
getmeili/meilisearch	minor	v1.15.1 → v1.48.2

---

Release Notes

meilisearch/meilisearch (getmeili/meilisearch)

v1.48.2: 🫎

Compare Source

Meilisearch v1.48.2 and Meilisearch v1.47.1 address CVE-2026-57823 and CVE-2026-57824.
We recommend updating if you are in one of the following situations:

1. You have API keys where indexes is not ["*"] and where actions contains more permissions than: ["search", "documents.*", "indexes.*", "tasks.cancel", "tasks.delete", "tasks.get", "settings.*", "stats.*", "fields.post"]
2. You have search tenant tokens and either an embedder or a chat workspace

• We recommend that users of Meilisearch v1.48 update to Meilisearch v1.48.2
• We recommend that users of Meilisearch v1.47 or lower update to Meilisearch v1.47.1

These versions both fix the following:

1. CVE-2026-57824: Improper authentication leads to privilege escalation: an authenticated user with an index-scoped API and the appropriate set of actions could use global actions to read and write the global state of the Meilisearch instance. Possibly impacted users of Meilisearch Cloud were contacted ahead-of-time.
2. CVE-2026-57823: Improper authentication leads to information disclosure: a user with a search tenant token could get some limited information about the existence of a document outside of the scope of the search rules attached to the tenant token, an indirect information about the content of the document.

We detected no trace of exploitation of these vulnerabilities.

We thank PuH4ck3rX for reporting these vulnerabilities ❤️

v1.48.1: 🫎

Compare Source

Revert #​6432 due to a dumpless upgrade bug report.

Full Changelog: meilisearch/meilisearch@v1.48.0...v1.48.1

v1.48.0: 🫎​

Compare Source

✨ Enhancement

[Experimental] Render 🫎​ template route

by @​Mubelotix in #​5765

Introduces a new POST /render-template route that can be used to render any template or fragment on any input and associated renderRoute experimental feature that gates access to the route.

This route can be used to test document templates and fragments before and after having configured an embedder.

A body payload for the route is of the form:

{
  "template": /* templateTarget object */,
  "input": /* inputTarget object or null */
}

where template describes the template or fragment to render, and input describes what to use to render the template.

Upon calling this route, Meilisearch responds with:

{
  "template": "{{doc.text}}",
  "rendered": "template text after rendering using the input"
}

where template contains the unrendered base text of the document template, or the unrendered base JSON object of a fragment, and rendered contains the result of rendering the template of the chosen input.

If input is null in the request, then rendered is null in the response, and the route can be used solely to retrieve a template or fragment from the settings of an index.

Before calling the route

The API of this route is subject to change, so before calling this route, please enable the renderRoute experimental feature:

PATCH /experimental-features --json '{"renderRoute": true}'

Examples

1. Rendering a document from an index on a document template from an embedder of that index

request

// POST /render-template

{
  "template": {
    "kind": "documentTemplate",
    "indexUid": "movies",
    "embedder": "myMoviesEmbedder"
  },
  "input": {
    "kind": "indexDocument",
    "indexUid": "movies",
    "id": "2"
}

response

{
  "template": "A movie titled {{doc.title}} whose description starts with {{doc.overview|truncatewords:10}}",
  "rendered": "A movie titled Ariel whose description starts with Taisto Kasurinen is a Finnish coal miner whose father has..."
}

2. Rendering an inline document on a fragment from an embedder of an index

request

// POST /render-template

{
  "template": { 
    "kind": "indexingFragment", 
    "indexUid": "dogs", 
    "embedder": "multi",
    "fragment": "captionedImage" 
  },
  "input": { 
    "kind": "inlineDocument", 
    "inline": { // pass your document inline as a JSON object
      "kind": "dog",
      "name": "iko",
      "breed": "jack russell",
      "mime": "image/png",
      "image": "/9j/4AAQSk..."
    } 
  }
}

response

{
  "template": {
    "content": [
      {
        "type": "text",
        "text": "A picture of a {{doc.kind}} of breed {{doc.breed}}"
      },
      {
        "type": "image_base64",
        "image_base64": "data:{{doc.mime}};base64,{{doc.image}}"
      }
    ]
  },
  "rendered": {
    "content": [
      {
        "type": "text",
        "text": "A picture of a dog of breed jack russell"
      },
      {
        "type": "image_base64",
        "image_base64": "data:image/png;base64,/9j/4AAQSk..."
      }
    ]
  }
}

3. Rendering a search query on a search fragment from a multimodal embedder of an index

request

// POST /render-template
{
  "template": { 
    "kind": "searchFragment", 
    "indexUid": "testIndex", 
    "embedder": "testEmbedder",
    "fragment": "justBreed"
  },
  "input": {
    "kind": "inlineSearch",
    "inline": { // pass the search query inline
      "q": "unused",
      "media": {
        "name": "iko",
        "breed": "jack russell"
      },
      "filter": "ignored"
    }
  }
}

response

    {
      "template": "It's a {{ media.breed }}",
      "rendered": "It's a jack russell"
    }

4. Rendering an inline document on the document template from the chat settings of an index

request

// POST /render-template

{
  "template": {
    "kind": "chatDocumentTemplate",
    "indexUid": "movies"
	// no embedder to specify since chat document template is global to index
  },
  "input": {
    "kind": "indexDocument",
    "indexUid": "movies",
    "id": "2"
}

response

{
  "template": "{% for field in fields %}{% if field.is_searchable and field.value != nil %}{{ field.name }}: {{ field.value }}\n{% endif %}{% endfor %}",
  "rendered": "id: 2\ntitle: Ariel\noverview: Taisto Kasurinen is a Finnish coal miner whose father has just committed suicide and who is framed for a crime he did not commit. In jail, he starts to dream about leaving the country and starting a new life. He escapes from prison but things don't go as planned...\ngenres: DramaCrimeComedy\nposter: https://image.tmdb.org/t/p/w500/ojDg0PGvs6R9xYFodRct2kdI6wC.jpg\nrelease_date: 593395200\n"
}

5. Rendering a document from an index on an inline document template

request

// POST /render-template

{
  "template": {
    "kind": "inlineDocumentTemplate",
    "inline": "You can pass templates inline as well: nice to test them! {{doc.id}}"
  },
  "input": {
    "kind": "indexDocument",
    "indexUid": "movies",
    "id": "2"
}

response

{
  "template": "You can pass templates inline as well: nice to test them! {{doc.id}}",
  "rendered": "You can pass templates inline as well: nice to test them! 2"
}

6. Rendering an inline document on an inline indexing fragment

request

// POST /render-template

{
  "template": {
    "kind": "inlineFragment",
    "inline": {
      "json_maps": "supported for fragments",
      "any_string": "is in liquid format: {{doc.test}}"
    }
  },
  "input": {
     "kind": "inlineDocument",
    "inline": {
      "test": true
    }
  }
}

response

{
  "template": {
    "json_maps": "supported for fragments",
    "any_string": "is in liquid format: {{doc.test}}"
  },
  "rendered": {
    "json_maps": "supported for fragments",
    "any_string": "is in liquid format: true"
  }
}

[Experimental] Only support foreign filters on retrieval routes

by @​ManyTheFish in #​6446

Foreign filters are meant to be used in a retrieval context (search, get document...), but all the actions related to writing or modifying a document could have several unexpected behaviors if foreign filters are accepted.
We prefer forbidding the usage of this feature on the writing routes.

The following routes do not support Foreign-filter anymore:

• Edit documents by function: POST /indexes/{index_uid}/documents/edit
• Delete documents by filter: POST /indexes/{index_uid}/documents/delete
• Export to a remote Meilisearch: POST /export

Additional change: we now ensure that the experimental features are checked when parsing a filter

🪲 Bug fixes

• Support prefix search on words registered in the disableOnAttributes and disableOnNumbers settings by @​antcybersec in #​6432
• Add missing logs in search performance details @​ManyTheFish in #​6457
• Ensure the index map budget is a multiplier of the OS page size by @​genisis0x in #​6454

🔒 Security

• Reduce risk of vulnerability exploits on GHA by @​curquiza in #​6451

🔩 Miscellaneous

• Replace the queueDocumentsFetch experimental feature with disableDocumentsFetchQueue converting the feature from an opt-in to an opt-out
  By @​ManyTheFish in #​6456
• Bump and removes unused dependencies by @​Kerollmops in #​6444
• Fix Ollama embeddings changes to fix CI tests by @​Kerollmops in #​6450

❤️ Thanks again to @​genisis0x and @​antcybersec

v1.47.1: 🦇

Compare Source

Meilisearch v1.48.2 and Meilisearch v1.47.1 address CVE-2026-57823 and CVE-2026-57824.
We recommend updating if you are in one of the following situations:

1. You have API keys where indexes is not ["*"] and where actions contains more permissions than: ["search", "documents.*", "indexes.*", "tasks.cancel", "tasks.delete", "tasks.get", "settings.*", "stats.*", "fields.post"]
2. You have search tenant tokens and either an embedder or a chat workspace

• We recommend that users of Meilisearch v1.48 update to Meilisearch v1.48.2
• We recommend that users of Meilisearch v1.47 or lower update to Meilisearch v1.47.1

These versions both fix the following:

1. CVE-2026-57824: Improper authentication leads to privilege escalation: an authenticated user with an index-scoped API and the appropriate set of actions could use global actions to read and write the global state of the Meilisearch instance. Possibly impacted users of Meilisearch Cloud were contacted ahead-of-time.
2. CVE-2026-57823: Improper authentication leads to information disclosure: a user with a search tenant token could get some limited information about the existence of a document outside of the scope of the search rules attached to the tenant token, an indirect information about the content of the document.

We detected no trace of exploitation of these vulnerabilities.

We thank PuH4ck3rX for reporting these vulnerabilities ❤️

v1.47.0: 🦇

Compare Source

🌈 Enhancements

Search personalization on federated search

We now support using the search personalization feature on federated search requests.

Like page/hitPerPage or limit/offset, the personalization option must be specified in the federation attribute to work properly.
Otherwise, an error will be returned reminding you to move the attribute in federation.

By @​ManyTheFish in #​6414

The new settings indexer is feature complete 🎉

• We now better support the tokenizer-related settings
• We improved the quality of the new settings indexer to enhance the engine's performance when changing the locales, the dictionary, synonyms, stop words, separator, and non-separator tokens.
• This makes the new settings indexer feature-complete, meaning that, unless you set the MEILI_EXPERIMENTAL_NO_EDITION_2024_FOR_SETTINGS environment variable to true, all settings tasks can now be handled by the new settings indexer, bringing a better scaling behavior, much faster cancellation, and a more precise progress view.

By @​Kerollmops in #​6409

Observability improvements

We expose more Prometheus metrics to improve observability, specifically to show more metrics on document throughput and ease debugging.

By @​Kerollmops in #​6430

🦋 Fixes

• Putting attributeRank/ wordPosition before words in the rankingRules list will no longer remove hits from the response, by @​pjdurden in #​6437
• Meilisearch will no longer ignore the searchCutoffMs in some conditions when embedding documents, by @​dureuill in #​6447
• Meilisearch will no longer fail to proxy a search request with a filter containing a ' during remote federated search or useNetwork: true search requests, by @​dureuill in #​6445

🔒 Security

• CI: Prevent shell injection in GitHub Actions release workflows by @​curquiza in #​6420

🔩 Misc. changes

Search implementation refactor

Refactor the search pipeline to mutualize the code.
The new implementation will always perform a federated search under the hood, and then the output will be transformed into the expected route's output.

Noticeable changes from the user perspective:

• Some error messages have been modified
• Small breaking change: a few error codes change, such as MultiSearch<Error> <--> Search<Error>

Other changes

• Make it easier and less error-prone to declare a type that is used as a body parameter on a Meilisearch endpoint, by @​dureuill in #​6429
• Remove the now unused vectorStoreBackend setting from the settings, by @​Kerollmops in #​6399
• Replace custom hf-hub git dependency by the official one by @​Kerollmops in #​6442
• Update Python SDK test CI by @​Strift in #​6439
• Refactor the code to use the MustStopProcessing type everywhere by @​Kerollmops in #​6423

New Contributors

• @​pjdurden made their first contribution in #​6437

Full Changelog: meilisearch/meilisearch@v1.46.1...v1.47.0

v1.46.1: 🦆

Compare Source

Queue documents fetch routes

Add an experimental feature, queueDocumentsFetch, forcing the routes GET indexes/:uid/documents and POST indexes/:uid/documents/fetch to wait in the search queue if there is no available thread to process them.

v1.46.0: 🦆

Compare Source

This release introduces fixes for a regression in v1.45.0, where we were batching deletions by filter with other deletions or additions. It also enables the new settings indexer to support more parameters, making the engine faster to index documents when those settings are specified.

✨ Enhancement

• Support exact and disable on numbers in the new settings indexer by @​Kerollmops in #​6398
  Introduce support for exact words and disable-on-words parameters in the new settings indexer, making the engine more efficient when changing these settings.

• Support computing prefixes in the new settings indexer by @​Kerollmops in #​6391
  Support for the prefix search settings in the new settings indexer, so that changing this parameter makes the engine more efficient.

🪲 Bug fixes

• Better limit read bytes when creating the S3 multipart part by @​Kerollmops in #​6405
  This fixes an issue we had with the multipart part size by ensuring we never construct a part larger than the defined multipart part size. With this fix, we always create a multipart with the provided multipart part size, except for the last part. Thanks, @​vidit-virmani, for the help investigating the issue.

• Batch of documentDeletionByFilter with documentAdditionOrUpdate by @​Kerollmops and @​ManyTheFish in #​6415
  Correctly implement the support for auto-batching deletion by filter with document replacement and updates. This fixes a regression introduced in v1.45.0.

• Fix a panic with incomplete filters by @​Kerollmops in #​6421
  Fixes an internal panic when a filter is incomplete by returning an error instead.

🔒 Security

• Bump tar from 0.4.45 to 0.4.46 by @​dependabot[bot] in #​6418

🔩 Miscellaneous

• OpenAPI CI: disable rule to avoid crash (workaround) by @​curquiza in #​6417
• Remove milli benchmarks by @​Kerollmops in #​6419
• Add precision in the index swap documentation by @​ManyTheFish in #​6408
• Fix broken links in the documentation by @​Kerollmops in #​6406

v1.45.2: 🦒

Compare Source

🪲 Bug Fixes

• Fix internal vector stores quantization config desync by @​Kerollmops in #​6411
  We noticed issues when dumpless upgrading databases containing embedders from versions older than v1.33.1. This version fixes those databases by removing the corrupted embeddings from the impacted indexes.

Full Changelog: meilisearch/meilisearch@v1.45.1...v1.45.2

v1.45.1: 🦒

Compare Source

🪲 Bug Fixes

• Revert autobatch deletions by filter with additions by @​kerollmops in #​6412

Full Changelog: meilisearch/meilisearch@v1.45.0...v1.45.1

v1.45.0: 🦒

Compare Source

Meilisearch v1.45.0 mainly improves indexing performance when changing settings and also improves document fetch performance.

✨ Enhancement

• Autobatch deletions by filter with additions by @​Kerollmops in #​6389
  While Meilisearch tries to improve indexing speed when users add documents and mix those additions with deletions via a filter, it is still an anti-pattern to interleave both. It is recommended to delete documents by ID whenever possible, as the engine is optimized to merge them, thereby drastically speeding up indexation.
• Improve settings indexing performance & visibility
  We are introducing support for more settings in the nez settings indexer. If you find any bugs, please report them on GitHub. You can disable the new settings indexer by setting the environment variable like this: MEILI_EXPERIMENTAL_NO_EDITION_2024_FOR_SETTINGS=true or use the equivalent dedicated CLI parameter.
  • Support non-extracting parameters by @​Kerollmops in #​6393
    Changing one of the following settings is now directly handled by the new settings indexer: displayed fields, synonyms, the primary key, authorize typos, min word len one and two typos, max values per facet, sort facet values by, pagination max total hits, search cut off, chat, and foreign keys.
  • Support the global facet search by @​Kerollmops in #​6390
    Meilisearch can use the new settings indexer when the settings change the facet search root boolean parameter.

🪲 Bug Fixes

• Fetching documents no longer blocks the actix worker @​dureuill in #​6402
• Fix an internal error when changing the binary quantization by @​Kerollmops in #​6396
  We fixed an issue where users were changing the binary-quantized boolean in embedder configurations. The change corrupted the database, making it impossible to change the quantization in the future. Users had to create a binary-quantized embedder from scratch, or they could never change it again.

🔩 Miscellaneous

• Make timeout test less flaky on Windows by @​dureuill in #​6388

Full Changelog: meilisearch/meilisearch@v1.44.0...v1.45.0

v1.44.0

Compare Source

Meilisearch v1.44.0 adds remote federated facet search, indexing performance improvements, and other improvements and bugfixes. It also contains a couple of breaking changes, detailed below.

Breaking changes

• When using the network experimental feature, with sharding enabled (leader is not null in the network configuration), POST /indexes/{indexUid}/facet-search calls now default to a remote federated facet search, fetching and merging results from all shards in the network.
• The timeout for calling an external REST embedder at search time is now tied to the searchCutOffMs defined in the index, rather than fixed.
  • If you observe missing semantic results after upgrading, or HTTP 500 errors for pure semantic search, please increase the value of the search cutoff in the index settings.
  • By @​dureuill in #​6377

🌈 Improvements

Remote facet search

Meilisearch now has the ability to search across all shards of a network during facet search via the existing dedicated facet search route.

• If you are using the network experimental feature and have a leader defined for your network, remote calls are now the default for calls to POST /indexes/{indexUid}/facet-search
• The behavior can be controlled explicitly via the new useNetwork parameter of the facet search object.

By @​dureuill in #​6375

Reduce memory usage of the indexing

Reduces allocated memory when computing prefixes and speeds up some operations to avoid unnecessary deserialization.

If you still see high memory usage while the engine is post-processing, we recommend using the --experimental-reduce-indexing-memory-usage option.

By @​Kerollmops in #​6334

Improve GeoJSON indexing performance

This PR upgrades the cellulite library to a version that includes a GeoJSON indexing optimization. With this change, GeoJSON indexing avoids reprocessing documents that were already indexed in dense cells, and only handles newly added documents incrementally as they descend through the recursive cell tree.

By @​YoEight in #​6374

Human-formatted sizes and detailed DB sizes in stats

Adds two new query parameters to GET /indexes/{indexUid}/stats and GET /stats:

• showInternalDatabaseSizes: boolean, optional, defaults to false. When present, the index stat objects in responses of the stat routes now contain an additional internalDatabaseSizes key, whose value is a dictionary of the internal database names and their current size in the index, like in the stats object of a batch.
• sizeFormat: human or raw: optional, defaults to raw. When present and set to human, then all database sizes in responses of the stat routes will be returned as a string containing an appropriate unit (MiB, GiB, etc). When missing or set to raw, then the current behavior of expressing the size in bytes as a number is retained.

Note for integrations: The keys in internalDatabaseSizes are subject to change and should not be exposed as a strongly typed object. This is the same as the existing internalDatabaseSizes in batch stats.

Adding showInternalDatabaseSizes to an index stats

// curl -X GET "http://localhost:7700/indexes/movies/stats?showInternalDatabaseSizes=true"
{
  "numberOfDocuments": 31944,
  "rawDocumentDbSize": 20594688,
  "avgDocumentSize": 636,
  "isIndexing": false,
  "internalDatabaseSizes": {
    "wordPairProximityDocids": 100827136,
    "documents": 20594688,
    "wordPositionDocids": 18694144,
    "wordFidDocids": 10715136,
    "wordPrefixPositionDocids": 10256384,
    "wordDocids": 9453568,
    "wordPrefixFidDocids": 4603904,
    "wordPrefixDocids": 3424256,
    "main": 1425408,
    "externalDocumentsIds": 999424,
    "fieldIdWordCountDocids": 245760,
    "exactWordPrefixDocids": 16384,
    "celluliteMetadata": 16384
  },
  "numberOfEmbeddings": 0,
  "numberOfEmbeddedDocuments": 0,
  "fieldDistribution": {
    "genres": 31944,
    "id": 31944,
    "overview": 31944,
    "poster": 31944,
    "release_date": 31944,
    "title": 31944
  }
}

Adding showInternalDatabaseSizes and sizeFormat=human to global stats

// curl -X GET "http://localhost:7700/stats?showInternalDatabaseSizes=true&sizeFormat=human"
{
  "databaseSize": "351.38 MiB",
  "usedDatabaseSize": "350.64 MiB",
  "lastUpdate": "2026-04-16T13:07:02.74243Z",
  "indexes": {
    "comics": {
      "numberOfDocuments": 31944,
      "rawDocumentDbSize": "23.14 MiB",
      "avgDocumentSize": "751 B",
      "isIndexing": false,
      "internalDatabaseSizes": {
        "wordPairProximityDocids": "98.06 MiB",
        "documents": "23.14 MiB",
        "wordPositionDocids": "17.22 MiB",
        "wordFidDocids": "10.36 MiB",
        "wordPrefixPositionDocids": "9.47 MiB",
        "wordDocids": "8.97 MiB",
        "wordPrefixFidDocids": "4.36 MiB",
        "wordPrefixDocids": "3.27 MiB",
        "main": "1.36 MiB",
        "externalDocumentsIds": "944 KiB",
        "fieldIdWordCountDocids": "240 KiB",
        "exactWordPrefixDocids": "16 KiB",
        "celluliteMetadata": "16 KiB"
      },
      "numberOfEmbeddings": 0,
      "numberOfEmbeddedDocuments": 0,
      "fieldDistribution": {
        "genres": 31944,
        "id": 31944,
        "overview": 31944,
        "poster": 31944,
        "release_date": 31944,
        "title": 31944
      }
    },
    "movies": {
      "numberOfDocuments": 31944,
      "rawDocumentDbSize": "19.64 MiB",
      "avgDocumentSize": "636 B",
      "isIndexing": false,
      "internalDatabaseSizes": {
        "wordPairProximityDocids": "96.16 MiB",
        "documents": "19.64 MiB",
        "wordPositionDocids": "17.83 MiB",
        "wordFidDocids": "10.22 MiB",
        "wordPrefixPositionDocids": "9.78 MiB",
        "wordDocids": "9.02 MiB",
        "wordPrefixFidDocids": "4.39 MiB",
        "wordPrefixDocids": "3.27 MiB",
        "main": "1.36 MiB",
        "externalDocumentsIds": "976 KiB",
        "fieldIdWordCountDocids": "240 KiB",
        "exactWordPrefixDocids": "16 KiB",
        "celluliteMetadata": "16 KiB"
      },
      "numberOfEmbeddings": 0,
      "numberOfEmbeddedDocuments": 0,
      "fieldDistribution": {
        "genres": 31944,
        "id": 31944,
        "overview": 31944,
        "poster": 31944,
        "release_date": 31944,
        "title": 31944
      }
    }
  }
}

The call without any parameters is the same as in previous versions.

// curl -X GET "http://localhost:7700/stats"
{
  "databaseSize": 368443392,
  "usedDatabaseSize": 367673344,
  "lastUpdate": "2026-04-16T13:07:02.74243Z",
  "indexes": {
    "comics": {
      "numberOfDocuments": 31944,
      "rawDocumentDbSize": 24264704,
      "avgDocumentSize": 751,
      "isIndexing": false,
      "numberOfEmbeddings": 0,
      "numberOfEmbeddedDocuments": 0,
      "fieldDistribution": {
        "genres": 31944,
        "id": 31944,
        "overview": 31944,
        "poster": 31944,
        "release_date": 31944,
        "title": 31944
      }
    },
    "movies": {
      "numberOfDocuments": 31944,
      "rawDocumentDbSize": 20594688,
      "avgDocumentSize": 636,
      "isIndexing": false,
      "numberOfEmbeddings": 0,
      "numberOfEmbeddedDocuments": 0,
      "fieldDistribution": {
        "genres": 31944,
        "id": 31944,
        "overview": 31944,
        "poster": 31944,
        "release_date": 31944,
        "title": 31944
      }
    }
  }
}

By @​dureuill in #​6338

🦋 Fixes

• Settings changes performed via a settings subroute (not the "all settings" route) are now correctly propagated to other remotes on the network. By @​dureuill in #​6380
• The chat route no longer fails in some condition when using Mistral as a provider. By @​renezander030 in #​6327
• Prevent accidentally renaming a remote when modifying the network configuration. By @​dureuill in #​6370

🔩 Miscellaneous changes

• Replace boolean by PatternMatch for searchable by @​ManyTheFish in #​6344
• Add query to federated search metadata by @​StephaneRob in #​6371
• Remove issue template for feature issues by @​curquiza in #​6372
• Improve the documentation of the health route by @​Kerollmops in #​6376

New Contributors

• @​renezander030 made their first contribution in #​6327
• @​quyentonndbs made their first contribution in #​6382

Full Changelog: meilisearch/meilisearch@v1.43.1...v1.44.0

v1.43.1

Compare Source

Meilisearch v1.43.1 contains a security fix for an authenticated SSRF vulnerability.

No exploitation was found on Meilisearch Cloud. Cloud users are not required to update.

We recommend that self-hosting users upgrade if they allow third parties to configure Meilisearch instances.

We thank Sion Park (@​tldhs1144), who reported the issue and suggested a fix, for improving the security of Meilisearch ❤️

v1.43.0

Compare Source

🌈 Enhancements

New settings indexer

The new settings indexer, a more efficient version of our internal indexer for index settings modifications, now supports filterable, sortable, facet search, and custom (asc/desc) attributes in addition to the already-supported searchable, exact, proximity precision, and embedders.

• For Meilisearch Cloud users, the new settings indexer is disabled by default and can be enabled on a case-by-case basis for scaling purposes.
• For OSS users, the new settings indexer can be disabled by setting the MEILI_EXPERIMENTAL_NO_EDITION_2024_FOR_SETTINGS to true.

By @​Kerollmops in #​6124

Improve facet search indexing performance

We reduced the time to generate the internal data structures for the facet search to work. We were previously doing a couple of full scans on the internal entries and replaced these with scans on specific entries, only the ones dedicated to the facet searchable fields.

By @​Kerollmops in #​6325

Improve task queue compaction integration

The GET /health route now returns HTTP 500 after a successful task queue compaction, to signal that Meilisearch should be restarted so that tasks can be enqueued again.

For Meilisearch Cloud users, this ensures that compacting the task queue will automatically restart the instance after the compaction.

🦋 Fixes

Fix lexicographic filters on strings

Fixes a bug where string facet values appearing in <, <=, >, >= and IN filters were not normalized before comparison to facet values.

This would cause some values in documents (e.g. 2026-01-01T00:00:00) to appear to be higher than their filter counterpart, due to being normalized (e.g. like 2026-01-01t00:00:00).

Thanks to @​njaard for reporting the issue ❤️

By @​dureuill in #​6340

Fix typo tolerance v1.41 regression

Fixes the WordDelta::added_or_deleted_words function.

By @​Kerollmops in #​6350.

Thanks to @​vladradin99 and @​snurfer0 for reporting the issue in #​6349 and #​6324 ❤️

🔩 Miscellaneous

• Introduce a meilitool command to export an index words FST by @​Kerollmops in #​6332
• Add riscv64 to release binary matrix via cross-rs by @​gounthar in #​6296
• Fix docs related to task cancelation and deletion by @​curquiza in #​6353
• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in #​6303
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​5964
• Bump thin-vec from 0.2.14 to 0.2.16 by @​dependabot[bot] in #​6339
• Bump docker/setup-buildx-action from 3 to 4 by @​dependabot[bot] in #​6304
• Bump rustls-webpki from 0.103.10 to 0.103.13 by @​dependabot[bot] in #​6347
• Bump actix-http from 3.11.2 to 3.12.1 by @​dependabot[bot] in #​6348
• Bump sigstore/cosign-installer from 3.10.0 to 4.1.1 by @​dependabot[bot] in #​6301
• Bump supercharge/mongodb-github-action from 1.12.0 to 1.12.1 by @​dependabot[bot] in #​6302

Thanks again @​gounthar, @​njaard, @​vladradin99 and @​snurfer0 for your contributions ❤️

Full Changelog: meilisearch/meilisearch@v1.42.1...v1.43.0

v1.42.1: 🦑​

Compare Source

🪲 Bug fixes

Fix issues when using the legacy settings indexer

By @​dureuill and @​ManyTheFish in #​6331

• When using the experimental feature "multimodal", removing a fragment would cause an internal error in subsequent search requests
• When using the experimental feature "multimodal", modifying fragments would sometimes cause an internal error at indexing time
• regenerate: false would be ignored when modifying embedder settings
• When a nested field was declared as searchable, it would not be indexed if its parents were not declared as searchable

🔩 Miscellaneous

• Add new CI run that tests the stable settings indexer by @​dureuill in #​6331

v1.42.0: 🦑​

Compare Source

✨ Enhancement

Introduce the RemoteAvailability struct to support query fallback

By @​Kerollmops in #​6306

We introduce a new fallback system for the sharding and replication enterprise edition feature, along with a way to determine which remote is available. The engine can avoid machines that are unavailable for a period and resume querying them once they're back online.

The following snippet shows what the /network route looks like now that this PR exposes the remote statuses/availabilities.

"remotes": {
	"prod2": {
	  "url": "http://localhost:7702",
	  "searchApiKey": "mykey",
	  "writeApiKey": "mykey",
	  "status": "available"
	},
	"prod3": {
	  "url": "http://localhost:7703",
	  "searchApiKey": "mykey",
	  "writeApiKey": "mykey",
	  "status": "unavailable"
	}
}

🔬 Experimental: Document join Filtering

By @​ManyTheFish in #​6314

This enhancement extends the Cross-index document hydration introduced in v1.39.0 by allowing the user to filter on the foreign indexes to retrieve the documents.

📓 Note: This implementation doesn't support a remote sharding environment

foreignKeys experimental feature

TheforeignKeys experimental feature must be activated to use the foreign filters:

curl -X PATCH 'http://127.0.0.1:7700/experimental-features' \
  -H 'Content-Type: application/json' \
  --data-binary '{"foreignKeys": true}'

foreignKeys + filter index setting

To be able to use the foreign filters, the related field must be set as a foreignKey and as a filterableAttribute in /indexes/{index_uid}/settings:

{
	// new setting, an array of foreign keys that allows multiple foreign relationships between indexes
	"foreignKeys":  [
		{
			// the path in the JSON document containing foreign document ids
			"fieldName": "actors",
			
			// the UID of the foreign index containing the documents to fetch during hydration
	        "foreignIndexUid": "actors"
		}
	],
	// the actors field must be filterable on equality
	"filterableAttributes": [
		{
	    	"attributePatterns": ["actors"],
	     	"features": {
				"facetSearch": false,
				"filter": {
					"equality": true,
					"comparison": false
				}
			}
		}
	]
}

filtering using the _foreign filter

On the search route, a new _foreign verb has been introduced and should be used as follows:

{
	"q": "<query>",

	// filters on the movie index:
	// genres = action
    // AND
    // the foreign documents from the actor index match:  birthday STARTS WITH \"1958-\" AND popularity >= 3.5
	"filter": "genres = action AND _foreign(actors, birthday STARTS WITH \"1958-\" AND popularity >= 3.5)"
}

Note: nesting foreign filters is not supported and will return an error

Example of usage

Prerequisites

• Meilisearch running on 127.0.0.1:7700 on the document-join-hydration branch.

Step 1: Enable Foreign Keys Feature

curl -X PATCH 'http://127.0.0.1:7700/experimental-features' \
  -H 'Content-Type: application/json' \
  --data-binary '{"foreignKeys": true}'

Step 2: Create Indexes

Create the actors index

curl -X POST 'http://127.0.0.1:7700/indexes' \
  -H 'Content-Type: application/json' \
  --data-binary '{"uid": "actors", "primaryKey": "id"}'

Create the movies index

curl -X POST 'http://127.0.0.1:7700/indexes' \
  -H 'Content-Type: application/json' \
  --data-binary '{"uid": "movies", "primaryKey": "id"}'

Step 3: Add Documents to the actors Index

curl -X POST 'http://127.0.0.1:7700/indexes/actors/documents' \
  -H 'Content-Type: application/json' \
  --data-binary '[
  {"id": 1, "name": "Tom", "familyName": "Hanks", "birthDate": "1956-07-09"},
  {"id": 2, "name": "Meryl", "familyName": "Streep", "birthDate": "1949-06-22"},
  {"id": 3, "name": "Leonardo", "familyName": "DiCaprio", "birthDate": "1974-11-11"},
  {"id": 4, "name": "Emma", "familyName": "Watson", "birthDate": "1990-04-15"}
]'

Step 4: Add Documents to the movies Index

curl -X POST 'http://127.0.0.1:7700/indexes/movies/documents' \
  -H 'Content-Type: application/json' \
  --data-binary '[
  {"id": 1, "title": "Forrest Gump", "description": "The presidencies of Kennedy and Johnson, the Vietnam War, the Watergate scandal and other historical events unfold from the perspective of an Alabama man with an IQ of 75.", "actors": [1]},
  {"id": 2, "title": "The Devil Wears Prada", "description": "A smart but sensible new graduate lands a job as an assistant to Miranda Priestly, the demanding editor-in-chief of a high fashion magazine.", "actors": [2, 4]},
  {"id": 3, "title": "Inception", "description": "A thief who steals corporate secrets through the use of dream-sharing technology is given the inverse task of planting an idea into the mind of a C.E.O.", "actors": [3]},
  {"id": 4, "title": "Cast Away", "description": "A FedEx executive undergoes a physical and emotional transformation after crash landing on a deserted island.", "actors": [1]}
]'

Step 5: Configure Foreign Keys on the movies Index

curl -X PATCH 'http://127.0.0.1:7700/indexes/movies/settings' \
  -H 'Content-Type: application/json' \
  --data-binary '{"foreignKeys": [{"fieldName": "actors", "foreignIndexUid": "actors"}], "filterableAttributes": [{"attributePatterns": ["actors"],"features": {"facetSearch": false,"filter": {"equality": true,"comparison": false}}}]}'

Step 6: Configure filterable on the actors Index

curl -X PATCH 'http://127.0.0.1:7700/indexes/actors/settings' \
  -H 'Content-Type: application/json' \
  --data-binary '{"filterableAttributes": [{"attributePatterns": ["birthDate"],"features": {"facetSearch": false,"filter": {"equality": true,"comparison": false}}}]}'

Step 7: Perform a Federated Search

curl -X POST 'http://127.0.0.1:7700/multi-search' \
  -H 'Content-Type: application/json' \
  --data-binary '{
  "queries": [
    {
      "indexUid": "movies",
      "q": "Forrest",
      "filter": "_foreign(actors, birthDate = \"1956-07-09\")"
    }
  ],
  "federation": {
    "limit": 20,
    "offset": 0
  }
}'

Expected Result

The federated search should return movie documents with the actors array automatically hydrated with full actor objects instead of just IDs:

{
  "hits": [
    {
      "id": 1,
      "title": "Forrest Gump",
      "description": "...",
      "actors": [
        {
          "id": 1,
          "name": "Tom",
          "familyName": "Hanks",
          "birthDate": "1956-07-09"
        }
      ],
      "_federation": {
        "indexUid": "movies",
        "queriesPosition": 0,
        "weightedRankingScore": 0.9848484848484849
      }
    }
  ],
  "processingTimeMs": 208,
  "limit": 20,
  "offset": 0,
  "estimatedTotalHits": 1
}

🪲 Bug fixes

• Fix a race condition when writing network by @​Kerollmops in #​6300

  We fixed a race condition in network topology changes that could cause errors and prevent documents from being correctly indexed. Additionally, we fixed a bug in the networkTopologyChange task batching that was causing it to batch too many task types. We made sure it only batches import tasks, and only those, to avoid out-of-order task processing.

• Throw document template errors when updating the chat settings by @​Kerollmops in #​6321

  We fixed an issue that prevented the engine from explicitly showing the possible document template errors users could encounter when updating the template in the chat settings. The engine now correctly checks for and throws template errors when they are detected.

• Fix: Update Index tasks will be properly forwarded to remote nodes by @​dureuill in #​6299

• Fix action mistake on the chat completions route by @​Kerollmops in #​6290

🔩 Miscellaneous

• Use the latest version of heed with nested rtxns support by @​Kerollmops in #​6316

  This PR bumps the versions of crates that use heed to the latest version, v0.22.1. This version finally stabilized a long-standing piece of work we were doing with Howard Chu: nested read transactions. We no longer have to rely on unstable pre-releases, but rather on a clean, stable version of LMDB (still a fork, but a better one).

• Add section to CONTRIBUTING.md to bump mini-dashboard version and testing section to right place by @​curquiza in #​6195

• Make the no-agent AGENTS.ms more permissive by @​Kerollmops in #​6260

• Remove deleted test commands by @​Strift in #​6283

• Fix OpenAPI schema generation for chat completions route by @​qdequele in #​6274

• Rename OpenAPI route names for search rules and compact by @​qdequele in #​6298

• Update README with new features and demos by @​qdequele in #​6297

• Prevent shell injection in benchmark workflows by @​curquiza & @​Kerollmopsin #​6308 & #​6318

• Rename some of the search performance traces by @​ManyTheFish in #​6323

v1.41.0: 🏈

Compare Source

✨ Enhancement

• Support dynamic search rules with pinning by @​YoEight in #​6182
  Introduce the Dynamic Search Rules (DSR) experimental feature, making it easy to promote the right content for the right searches with flexible, condition-based pinning. In this first version, rules can be triggered by query-based conditions such as empty queries or literal substring matches, as well as time windows. Multiple documents can be pinned in a de

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Oslo)

• Branch creation
  • "before 07:00 on Thursday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.