RAG Pipeline Utils v3.8.2 released with security fixes

Tier C · Keep an eye on it – Check if you’re affected

Who’s exposed: Users of affected retrievers, guardrails, plugins, AuditLogger, DevServer

Tier C because: Hits tech teams

Reach

Attack

Damage

Fix

What to do

Upgrade RAG Pipeline Utils to v3.8.2 or later if you are on v3.8.1 or earlier

The Brief

RAG Pipeline Utils v3.8.2 is a security release that fixes issues in several components, including vector-store retrievers, HybridRetriever with access control, GuardrailsPipeline, plugins, AuditLogger and DevServer.
RAG Pipeline Utils v3.8.3 contains only documentation and package metadata changes, with no code changes.
The security fixes are in v3.8.2, so users on v3.8.1 or earlier should upgrade.

Why it matters

If you use RAG Pipeline Utils 3.8.1 or earlier with any of the affected components, you should upgrade to get the security fixes. The 3.8.3 release only changes the npm page.

The checklist behind the tier

Checklist · 1 of 10 yes

Yes	Hits tech teams	Developer library for building RAG pipelines, used by teams building software.
No	Core infrastructure	A single RAG utilities npm package, not software nearly every team runs.
No	Popular tool	Niche RAG helper package with no known broad adoption; not a mainstream platform.
No	Exploited in the wild	DEV Community v3.8.2 post: security release only; no observed attacks reported.
No	Public exploit	DEV Community v3.8.2 post: security fixes described; no exploit code or PoC mentioned.
No	Remote, no login	DEV Community v3.8.2 post: affected components are retrievers, plugins, DevServer; no unauthenticated remote access stated.
No	Full takeover	DEV Community v3.8.2 post: lists security fixes without describing code execution or takeover.
No	Secrets exposed	DEV Community v3.8.2 post: no mention of stolen credentials, keys or data exposure.
No	Supply chain	DEV Community v3.8.3 post: documentation and metadata only; no compromised or malicious package reported.
No	No fix yet	DEV Community v3.8.2 post: security fixes released; v3.8.3 recommended for npm install.

Timeline

Nov 8
v3.8.2 security release with fixes published
Nov 8
v3.8.3 published with documentation and package metadata changes only
Nov 8 · 8:59 PM
DEV Community: javascript
RAG Pipeline Utils v3.8.2: Security Fixes and a Re-ingest Check
Nov 8 · 10:05 PM
DEV Community: javascript
RAG Pipeline Utils v3.8.3: A Clearer npm Page (No Code Changes)

Full coverage · 2 sources

DEV Community: javascript
RAG Pipeline Utils v3.8.3: A Clearer npm Page (No Code Changes)
2h ago ↗
DEV Community: javascript
RAG Pipeline Utils v3.8.2: Security Fixes and a Re-ingest Check
3h ago ↗

First seen 3h ago · 2 sources · Full story page · How tiers are decided