A security release. Upgrade now if you use RetrievalGuard access control, plugin signature verification, the development server ( DevServer ) or @devilsdev/rag-mcp-server , and re-ingest FileVectorStore indexes whose documents set acl or requiredRole at the top level. One change in access control can hide documents that were visible before.

npm install @devilsdev/rag-pipeline-utils@^3.8.1 # and, if you use the MCP server: npx @devilsdev/[email protected] ./docs

Enter fullscreen mode

Exit fullscreen mode

Security

Four advisories are fixed in this release. Each one lists the affected

versions and workarounds for anyone who can't upgrade yet.

Access control ( RetrievalGuard with enforceACL , and the built-in MemoryRetriever , FileVectorStore and BM25Search ): a document restricted to a role could be passed to users without that role, depending on where the restriction was set on the document and how the user's permissions were passed in.…