Impact Score: 5/10
Meilisearch: v1.33.1 🐞
Source available — automated, not human-reviewed
Component: meilisearch · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Meilisearch v1.33.1. Source highlight: In Meilisearch v1.33.1, we released a security fix that affected the dump import, improvements to vector store relevance in massive databases, and a fix related to ranking scores.
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
⚡ Performance & Enhancements (1)
- We updated the vector store to trigger linear scanning even on bigger databases, leading to improved performance and so better result quality when the search cutoff is reached. This applies in particular when the number of filtered candidates is small relative to the number of documents in the index
🔧 Bug Fixes & Patches (3)
- Cloud users: you don't need to do anything. We found no evidence of exploitation of this vulnerability on Meilisearch Cloud.
- Open-source users: if you allow importing dumps from an untrusted source, we recommend you update to v1.33.1
- We fixed a bug where only the first non-blocking buckets were taken for the non-final ranking rules. This improves the quality of search results when the search cutoff triggers, especially when vector search and a sort are involved
📄 View Raw Release Notes (Original Developer Log)
In Meilisearch v1.33.1, we released a security fix that affected the dump import, improvements to vector store relevance in massive databases, and a fix related to ranking scores.
### 🔐 Security Fix
- Cloud users: you don't need to do anything. We found no evidence of exploitation of this vulnerability on Meilisearch Cloud.
- Open-source users: if you allow importing dumps from an untrusted source, we recommend you update to v1.33.1
All versions of Meilisearch before v1.33.0 are vulnerable to a path traversal vulnerability involving the dump import functionality.
Importing a specially crafted dump could result in giving access to the Meilisearch instance to arbitrary, specifically formatted files, present on the file system of the Meilisearch instance.
### ✨ Enhancements
* We updated the vector store to trigger linear scanning even on bigger databases, leading to improved performance and so better result quality when the search cutoff is reached. This applies in particular when the number of filtered candidates is small relative to the number of documents in the index by @Kerollmops in https://github.com/meilisearch/meilisearch/pull/6113.
### 🐛 Bug Fixes
* We fixed a bug where only the first non-blocking buckets were taken for the non-final ranking rules. This improves the quality of search results when the search cutoff triggers, especially when vector search and a sort are involved by @Kerollmops in https://github.com/meilisearch/meilisearch/pull/6113.
**Full Changelog**: https://github.com/meilisearch/meilisearch/compare/v1.33.0...v1.33.1