pgvector-haystack 6.1.0__tar.gz → 6.3.0__tar.gz

{pgvector_haystack-6.1.0 → pgvector_haystack-6.3.0}/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [integrations/pgvector-v6.2.0] - 2026-03-02
+
+### 🐛 Bug Fixes
+
+- Add metadata field-name validation using regex in `PGVectorDocumentStore` filters to prevent SQL injection vectors. (#2881)
+- Remove NUL bytes when converting from haystack to pg documents (#2892)
+
+### 📚 Documentation
+
+- Simplify pydoc configs (#2855)
+
+### 🧪 Testing
+
+- Replacing each `DocumentStore` specific tests and used the generalised ones from `haystack.testing.document_store` (#2812)
+
+
+## [integrations/pgvector-v6.1.0] - 2026-01-28
+
+### 🚀 Features
+
+- Adding count, filtering and metadata related operations to `PGVectorDocumentStore` (#2768)
+
+
 ## [integrations/pgvector-v6.0.0] - 2026-01-12
 
 ### 🧹 Chores

{pgvector_haystack-6.1.0 → pgvector_haystack-6.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pgvector-haystack
-Version: 6.1.0
+Version: 6.3.0
 Summary: An integration of pgvector (vector search extension for Postgres) with Haystack
 Project-URL: Source, https://github.com/deepset-ai/haystack-core-integrations
 Project-URL: Documentation, https://github.com/deepset-ai/haystack-core-integrations/blob/main/integrations/pgvector/README.md
@@ -18,7 +18,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
 Requires-Python: >=3.10
-Requires-Dist: haystack-ai>=2.22.0
+Requires-Dist: haystack-ai>=2.24.0
 Requires-Dist: pgvector>=0.3.0
 Requires-Dist: psycopg[binary]
 Description-Content-Type: text/markdown

pgvector_haystack-6.3.0/pydoc/config_docusaurus.yml

@@ -0,0 +1,15 @@
+loaders:
+  - modules:
+      - haystack_integrations.components.retrievers.pgvector.embedding_retriever
+      - haystack_integrations.components.retrievers.pgvector.keyword_retriever
+      - haystack_integrations.document_stores.pgvector.document_store
+    search_path: [../src]
+processors:
+  - type: filter
+    documented_only: true
+    skip_empty_modules: true
+renderer:
+  description: Pgvector integration for Haystack
+  id: integrations-pgvector
+  filename: pgvector.md
+  title: Pgvector

{pgvector_haystack-6.1.0 → pgvector_haystack-6.3.0}/pyproject.toml

@@ -22,7 +22,11 @@ classifiers = [
   "Programming Language :: Python :: Implementation :: CPython",
   "Programming Language :: Python :: Implementation :: PyPy",
 ]
-dependencies = ["haystack-ai>=2.22.0", "pgvector>=0.3.0", "psycopg[binary]"]
+dependencies = [
+  "haystack-ai>=2.24.0",
+  "pgvector>=0.3.0",
+  "psycopg[binary]"
+]
 
 [project.urls]
 Source = "https://github.com/deepset-ai/haystack-core-integrations"
@@ -45,7 +49,7 @@ installer = "uv"
 dependencies = ["haystack-pydoc-tools", "ruff"]
 
 [tool.hatch.envs.default.scripts]
-docs = ["pydoc-markdown pydoc/config_docusaurus.yml"]
+docs = ["haystack-pydoc pydoc/config_docusaurus.yml"]
 fmt = "ruff check --fix {args}; ruff format {args}"
 fmt-check = "ruff check {args} && ruff format --check {args}"
 

{pgvector_haystack-6.1.0 → pgvector_haystack-6.3.0}/src/haystack_integrations/document_stores/pgvector/converters.py

@@ -1,3 +1,4 @@
+from dataclasses import replace
 from typing import Any
 
 from haystack import logging
@@ -22,6 +23,9 @@ def _from_haystack_to_pg_documents(documents: list[Document]) -> list[dict[str,
         db_document["blob_meta"] = Jsonb(blob.meta) if blob and blob.meta else None
         db_document["blob_mime_type"] = blob.mime_type if blob and blob.mime_type else None
         db_document["meta"] = Jsonb(db_document["meta"])
+        # PostgreSQL text fields cannot contain NUL (0x00) bytes, removing NUL bytes
+        if content := db_document["content"]:
+            db_document["content"] = content.replace("\x00", "")
 
         if "sparse_embedding" in db_document:
             sparse_embedding = db_document.pop("sparse_embedding", None)
@@ -65,7 +69,7 @@ def _from_pg_to_haystack_documents(documents: list[dict[str, Any]]) -> list[Docu
 
         if blob_data:
             blob = ByteStream(data=blob_data, meta=blob_meta, mime_type=blob_mime_type)
-            haystack_document.blob = blob
+            haystack_document = replace(haystack_document, blob=blob)
 
         haystack_documents.append(haystack_document)
 

{pgvector_haystack-6.1.0 → pgvector_haystack-6.3.0}/src/haystack_integrations/document_stores/pgvector/filters.py

@@ -1,12 +1,14 @@
 # SPDX-FileCopyrightText: 2023-present deepset GmbH <info@deepset.ai>
 #
 # SPDX-License-Identifier: Apache-2.0
+
 from datetime import datetime
 from itertools import chain
 from typing import Any, Literal
 
 from haystack.errors import FilterError
-from psycopg.sql import SQL, Composed
+from psycopg.sql import SQL, Composable, Composed, Identifier
+from psycopg.sql import Literal as SQLLiteral
 from psycopg.types.json import Jsonb
 
 # we need this mapping to cast meta values to the correct type,
@@ -45,13 +47,13 @@ def _convert_filters_to_where_clause_and_params(
     else:
         query, values = _parse_logical_condition(filters)
 
-    where_clause = SQL(f" {operator} ") + SQL(query)
+    where_clause = SQL(f" {operator} ") + query
     params = tuple(value for value in values if value != NO_VALUE)
 
     return where_clause, params
 
 
-def _parse_logical_condition(condition: dict[str, Any]) -> tuple[str, list[Any]]:
+def _parse_logical_condition(condition: dict[str, Any]) -> tuple[Composed, list[Any]]:
     if "operator" not in condition:
         msg = f"'operator' key missing in {condition}"
         raise FilterError(msg)
@@ -81,17 +83,14 @@ def _parse_logical_condition(condition: dict[str, Any]) -> tuple[str, list[Any]]
         values = list(chain.from_iterable(values))
 
     if operator == "AND":
-        sql_query = f"({' AND '.join(query_parts)})"
-    elif operator == "OR":
-        sql_query = f"({' OR '.join(query_parts)})"
-    else:
-        msg = f"Unknown logical operator '{operator}'"
-        raise FilterError(msg)
+        sql_query = SQL("(") + SQL(" AND ").join(query_parts) + SQL(")")
+    else:  # operator == "OR"
+        sql_query = SQL("(") + SQL(" OR ").join(query_parts) + SQL(")")
 
     return sql_query, values
 
 
-def _parse_comparison_condition(condition: dict[str, Any]) -> tuple[str, list[Any]]:
+def _parse_comparison_condition(condition: dict[str, Any]) -> tuple[Composed, list[Any]]:
     field: str = condition["field"]
     if "operator" not in condition:
         msg = f"'operator' key missing in {condition}"
@@ -107,28 +106,37 @@ def _parse_comparison_condition(condition: dict[str, Any]) -> tuple[str, list[An
     value: Any = condition["value"]
 
     if field.startswith("meta."):
-        field = _treat_meta_field(field, value)
+        sql_field: Composable = _treat_meta_field(field, value)
+    else:
+        sql_field = Identifier(field)
 
-    field, value = COMPARISON_OPERATORS[operator](field, value)
-    return field, [value]
+    sql_expr, value = COMPARISON_OPERATORS[operator](sql_field, value)
+    return sql_expr, [value]
 
 
-def _treat_meta_field(field: str, value: Any) -> str:
+def _treat_meta_field(field: str, value: Any) -> Composed:
     """
-    Internal method that modifies the field str
-    to make the meta JSONB field queryable.
+    Internal method that returns a psycopg Composed object
+    to make the meta JSONB field queryable safely.
+
+    Uses psycopg.sql.Literal to embed the field name, preventing SQL injection
+    via metadata field names without requiring regex validation.
+
+    Use the ->> operator to access keys in the meta JSONB field.
 
     Examples:
     >>> _treat_meta_field(field="meta.number", value=9)
-    "(meta->>'number')::integer"
+    Composed([SQL('(meta->>'), Literal('number'), SQL(')::integer')])
 
     >>> _treat_meta_field(field="meta.name", value="my_name")
-    "meta->>'name'"
-    """
+    Composed([SQL('meta->>'), Literal('name')])
 
-    # use the ->> operator to access keys in the meta JSONB field
+    """
     field_name = field.split(".", 1)[-1]
-    field = f"meta->>'{field_name}'"
+
+    # Use SQLLiteral to safely embed the field name as a SQL string literal,
+    # preventing SQL injection via metadata field names.
+    composed: Composed = SQL("meta->>") + SQLLiteral(field_name)
 
     # meta fields are stored as strings in the JSONB field,
     # so we need to cast them to the correct type
@@ -137,25 +145,24 @@ def _treat_meta_field(field: str, value: Any) -> str:
         type_value = PYTHON_TYPES_TO_PG_TYPES.get(type(value[0]))
 
     if type_value:
-        field = f"({field})::{type_value}"
+        composed = SQL("(") + composed + SQL(f")::{type_value}")
 
-    return field
+    return composed
 
 
-def _equal(field: str, value: Any) -> tuple[str, Any]:
+def _equal(field: Composable, value: Any) -> tuple[Composed, Any]:
     if value is None:
-        # NO_VALUE is a placeholder that will be removed in _convert_filters_to_where_clause_and_params
-        return f"{field} IS NULL", NO_VALUE
-    return f"{field} = %s", value
+        return SQL("{} IS NULL").format(field), NO_VALUE
+    return SQL("{} = %s").format(field), value
 
 
-def _not_equal(field: str, value: Any) -> tuple[str, Any]:
+def _not_equal(field: Composable, value: Any) -> tuple[Composed, Any]:
     # we use IS DISTINCT FROM to correctly handle NULL values
     # (not handled by !=)
-    return f"{field} IS DISTINCT FROM %s", value
+    return SQL("{} IS DISTINCT FROM %s").format(field), value
 
 
-def _greater_than(field: str, value: Any) -> tuple[str, Any]:
+def _greater_than(field: Composable, value: Any) -> tuple[Composed, Any]:
     if isinstance(value, str):
         try:
             datetime.fromisoformat(value)
@@ -168,11 +175,10 @@ def _greater_than(field: str, value: Any) -> tuple[str, Any]:
     if type(value) in [list, Jsonb]:
         msg = f"Filter value can't be of type {type(value)} using operators '>', '>=', '<', '<='"
         raise FilterError(msg)
+    return SQL("{} > %s").format(field), value
 
-    return f"{field} > %s", value
 
-
-def _greater_than_equal(field: str, value: Any) -> tuple[str, Any]:
+def _greater_than_equal(field: Composable, value: Any) -> tuple[Composed, Any]:
     if isinstance(value, str):
         try:
             datetime.fromisoformat(value)
@@ -185,11 +191,10 @@ def _greater_than_equal(field: str, value: Any) -> tuple[str, Any]:
     if type(value) in [list, Jsonb]:
         msg = f"Filter value can't be of type {type(value)} using operators '>', '>=', '<', '<='"
         raise FilterError(msg)
-
-    return f"{field} >= %s", value
+    return SQL("{} >= %s").format(field), value
 
 
-def _less_than(field: str, value: Any) -> tuple[str, Any]:
+def _less_than(field: Composable, value: Any) -> tuple[Composed, Any]:
     if isinstance(value, str):
         try:
             datetime.fromisoformat(value)
@@ -202,11 +207,10 @@ def _less_than(field: str, value: Any) -> tuple[str, Any]:
     if type(value) in [list, Jsonb]:
         msg = f"Filter value can't be of type {type(value)} using operators '>', '>=', '<', '<='"
         raise FilterError(msg)
+    return SQL("{} < %s").format(field), value
 
-    return f"{field} < %s", value
 
-
-def _less_than_equal(field: str, value: Any) -> tuple[str, Any]:
+def _less_than_equal(field: Composable, value: Any) -> tuple[Composed, Any]:
     if isinstance(value, str):
         try:
             datetime.fromisoformat(value)
@@ -219,39 +223,37 @@ def _less_than_equal(field: str, value: Any) -> tuple[str, Any]:
     if type(value) in [list, Jsonb]:
         msg = f"Filter value can't be of type {type(value)} using operators '>', '>=', '<', '<='"
         raise FilterError(msg)
-
-    return f"{field} <= %s", value
+    return SQL("{} <= %s").format(field), value
 
 
-def _not_in(field: str, value: Any) -> tuple[str, list]:
+def _not_in(field: Composable, value: Any) -> tuple[Composed, list]:
     if not isinstance(value, list):
         msg = f"{field}'s value must be a list when using 'not in' comparator in Pinecone"
         raise FilterError(msg)
-
-    return f"{field} IS NULL OR {field} != ALL(%s)", [value]
+    return SQL("{} IS NULL OR {} != ALL(%s)").format(field, field), [value]
 
 
-def _in(field: str, value: Any) -> tuple[str, list]:
+def _in(field: Composable, value: Any) -> tuple[Composed, list]:
     if not isinstance(value, list):
         msg = f"{field}'s value must be a list when using 'in' comparator in Pinecone"
         raise FilterError(msg)
 
     # see https://www.psycopg.org/psycopg3/docs/basic/adapt.html#lists-adaptation
-    return f"{field} = ANY(%s)", [value]
+    return SQL("{} = ANY(%s)").format(field), [value]
 
 
-def _like(field: str, value: Any) -> tuple[str, Any]:
+def _like(field: Composable, value: Any) -> tuple[Composed, Any]:
     if not isinstance(value, str):
         msg = f"{field}'s value must be a str when using 'LIKE' "
         raise FilterError(msg)
-    return f"{field} LIKE %s", value
+    return SQL("{} LIKE %s").format(field), value
 
 
-def _not_like(field: str, value: Any) -> tuple[str, Any]:
+def _not_like(field: Composable, value: Any) -> tuple[Composed, Any]:
     if not isinstance(value, str):
         msg = f"{field}'s value must be a str when using 'LIKE' "
         raise FilterError(msg)
-    return f"{field} NOT LIKE %s", value
+    return SQL("{} NOT LIKE %s").format(field), value
 
 
 COMPARISON_OPERATORS = {

{pgvector_haystack-6.1.0 → pgvector_haystack-6.3.0}/tests/test_converters.py

@@ -30,6 +30,13 @@ def test_from_haystack_to_pg_documents():
             embedding=[0.7, 0.8, 0.9],
             score=0.7,
         ),
+        Document(
+            id="4",
+            content="This is another text\x00",
+            meta={"meta_key": "meta_value"},
+            embedding=[0.7, 0.8, 0.9],
+            score=0.8,
+        ),
     ]
 
     pg_docs = _from_haystack_to_pg_documents(haystack_docs)
@@ -64,6 +71,16 @@ def test_from_haystack_to_pg_documents():
     assert pg_docs[2]["embedding"] == [0.7, 0.8, 0.9]
     assert "score" not in pg_docs[2]
 
+    assert pg_docs[3]["id"] == "4"
+    assert pg_docs[3]["content"] == "This is another text"
+    assert pg_docs[3]["blob_data"] is None
+    assert pg_docs[3]["blob_meta"] is None
+    assert pg_docs[3]["blob_mime_type"] is None
+    assert "dataframe" not in pg_docs[3]
+    assert pg_docs[3]["meta"].obj == {"meta_key": "meta_value"}
+    assert pg_docs[3]["embedding"] == [0.7, 0.8, 0.9]
+    assert "score" not in pg_docs[3]
+
 
 def test_from_pg_to_haystack_documents():
     pg_docs = [

{pgvector_haystack-6.1.0 → pgvector_haystack-6.3.0}/tests/test_document_store.py

@@ -9,14 +9,30 @@ import pytest
 from haystack.dataclasses.document import ByteStream, Document
 from haystack.document_stores.errors import DocumentStoreError, DuplicateDocumentError
 from haystack.document_stores.types import DuplicatePolicy
-from haystack.testing.document_store import CountDocumentsTest, DeleteDocumentsTest, WriteDocumentsTest
+from haystack.testing.document_store import (
+    CountDocumentsTest,
+    DeleteAllTest,
+    DeleteByFilterTest,
+    DeleteDocumentsTest,
+    FilterableDocsFixtureMixin,
+    UpdateByFilterTest,
+    WriteDocumentsTest,
+)
 from haystack.utils import Secret
 
 from haystack_integrations.document_stores.pgvector import PgvectorDocumentStore
 
 
 @pytest.mark.integration
-class TestDocumentStore(CountDocumentsTest, WriteDocumentsTest, DeleteDocumentsTest):
+class TestDocumentStore(
+    CountDocumentsTest,
+    DeleteAllTest,
+    DeleteByFilterTest,
+    DeleteDocumentsTest,
+    FilterableDocsFixtureMixin,
+    UpdateByFilterTest,
+    WriteDocumentsTest,
+):
     def test_write_documents(self, document_store: PgvectorDocumentStore):
         docs = [Document(id="1")]
         assert document_store.write_documents(docs) == 1
@@ -53,13 +69,6 @@ class TestDocumentStore(CountDocumentsTest, WriteDocumentsTest, DeleteDocumentsT
             same_connection = document_store._connection
             assert same_connection is document_store._connection
 
-    def test_delete_all_documents(self, document_store: PgvectorDocumentStore) -> None:
-        document_store.write_documents([Document(id=str(i)) for i in range(10)])
-        document_store.delete_all_documents()
-        assert document_store.count_documents() == 0
-        document_store.write_documents([Document(id="1")])
-        assert document_store.count_documents() == 1
-
     def test_invalid_connection_string(self, monkeypatch):
         monkeypatch.setenv("PG_CONN_STR", "invalid_connection_string")
         document_store = PgvectorDocumentStore()
@@ -262,215 +271,6 @@ def test_delete_table_first_call(document_store):
     document_store.delete_table()  # if throw error, test fails
 
 
-@pytest.mark.integration
-def test_delete_by_filter(document_store: PgvectorDocumentStore):
-    docs = [
-        Document(content="Doc 1", meta={"category": "A", "year": 2023}),
-        Document(content="Doc 2", meta={"category": "B", "year": 2023}),
-        Document(content="Doc 3", meta={"category": "A", "year": 2024}),
-    ]
-    document_store.write_documents(docs)
-    assert document_store.count_documents() == 3
-
-    deleted_count = document_store.delete_by_filter(filters={"field": "meta.category", "operator": "==", "value": "A"})
-    assert deleted_count == 2
-    assert document_store.count_documents() == 1
-
-    remaining_docs = document_store.filter_documents()
-    assert len(remaining_docs) == 1
-    assert remaining_docs[0].meta["category"] == "B"
-
-    deleted_count = document_store.delete_by_filter(filters={"field": "meta.year", "operator": "==", "value": 2023})
-    assert deleted_count == 1
-    assert document_store.count_documents() == 0
-
-
-@pytest.mark.integration
-def test_delete_by_filter_no_matches(document_store: PgvectorDocumentStore):
-    docs = [
-        Document(content="Doc 1", meta={"category": "A"}),
-        Document(content="Doc 2", meta={"category": "B"}),
-    ]
-    document_store.write_documents(docs)
-    assert document_store.count_documents() == 2
-
-    deleted_count = document_store.delete_by_filter(filters={"field": "meta.category", "operator": "==", "value": "C"})
-    assert deleted_count == 0
-    assert document_store.count_documents() == 2
-
-
-@pytest.mark.integration
-def test_delete_by_filter_advanced_filters(document_store: PgvectorDocumentStore):
-    docs = [
-        Document(content="Doc 1", meta={"category": "A", "year": 2023, "status": "draft"}),
-        Document(content="Doc 2", meta={"category": "A", "year": 2024, "status": "published"}),
-        Document(content="Doc 3", meta={"category": "B", "year": 2023, "status": "draft"}),
-    ]
-    document_store.write_documents(docs)
-    assert document_store.count_documents() == 3
-
-    # AND condition
-    deleted_count = document_store.delete_by_filter(
-        filters={
-            "operator": "AND",
-            "conditions": [
-                {"field": "meta.category", "operator": "==", "value": "A"},
-                {"field": "meta.year", "operator": "==", "value": 2023},
-            ],
-        }
-    )
-    assert deleted_count == 1
-    assert document_store.count_documents() == 2
-
-    # OR condition
-    deleted_count = document_store.delete_by_filter(
-        filters={
-            "operator": "OR",
-            "conditions": [
-                {"field": "meta.category", "operator": "==", "value": "B"},
-                {"field": "meta.status", "operator": "==", "value": "published"},
-            ],
-        }
-    )
-    assert deleted_count == 2
-    assert document_store.count_documents() == 0
-
-
-@pytest.mark.integration
-def test_update_by_filter(document_store: PgvectorDocumentStore):
-    docs = [
-        Document(content="Doc 1", meta={"category": "A", "status": "draft"}),
-        Document(content="Doc 2", meta={"category": "B", "status": "draft"}),
-        Document(content="Doc 3", meta={"category": "A", "status": "draft"}),
-    ]
-    document_store.write_documents(docs)
-    assert document_store.count_documents() == 3
-
-    # update status for category="A" documents
-    updated_count = document_store.update_by_filter(
-        filters={"field": "meta.category", "operator": "==", "value": "A"}, meta={"status": "published"}
-    )
-    assert updated_count == 2
-
-    # verify
-    published_docs = document_store.filter_documents(
-        filters={"field": "meta.status", "operator": "==", "value": "published"}
-    )
-    assert len(published_docs) == 2
-    for doc in published_docs:
-        assert doc.meta["category"] == "A"
-        assert doc.meta["status"] == "published"
-
-    # Verify category B still has draft status
-    draft_docs = document_store.filter_documents(filters={"field": "meta.status", "operator": "==", "value": "draft"})
-    assert len(draft_docs) == 1
-    assert draft_docs[0].meta["category"] == "B"
-
-
-@pytest.mark.integration
-def test_update_by_filter_multiple_fields(document_store: PgvectorDocumentStore):
-    docs = [
-        Document(content="Doc 1", meta={"category": "A", "year": 2023}),
-        Document(content="Doc 2", meta={"category": "A", "year": 2023}),
-        Document(content="Doc 3", meta={"category": "B", "year": 2024}),
-    ]
-    document_store.write_documents(docs)
-    assert document_store.count_documents() == 3
-
-    # update multiple fields for category="A" documents
-    updated_count = document_store.update_by_filter(
-        filters={"field": "meta.category", "operator": "==", "value": "A"},
-        meta={"status": "published", "priority": "high", "reviewed": True},
-    )
-    assert updated_count == 2
-
-    # verify
-    published_docs = document_store.filter_documents(filters={"field": "meta.category", "operator": "==", "value": "A"})
-    assert len(published_docs) == 2
-    for doc in published_docs:
-        assert doc.meta["status"] == "published"
-        assert doc.meta["priority"] == "high"
-        assert doc.meta["reviewed"] is True
-        assert doc.meta["year"] == 2023  # Original field should still be present
-
-    # verify category B was not updated
-    b_docs = document_store.filter_documents(filters={"field": "meta.category", "operator": "==", "value": "B"})
-    assert len(b_docs) == 1
-    assert "status" not in b_docs[0].meta
-    assert "priority" not in b_docs[0].meta
-
-
-@pytest.mark.integration
-def test_update_by_filter_no_matches(document_store: PgvectorDocumentStore):
-    docs = [
-        Document(content="Doc 1", meta={"category": "A"}),
-        Document(content="Doc 2", meta={"category": "B"}),
-    ]
-    document_store.write_documents(docs)
-    assert document_store.count_documents() == 2
-
-    # update documents with category="C" (no matches)
-    updated_count = document_store.update_by_filter(
-        filters={"field": "meta.category", "operator": "==", "value": "C"}, meta={"status": "published"}
-    )
-    assert updated_count == 0
-    assert document_store.count_documents() == 2
-
-    # verify no documents were updated
-    published_docs = document_store.filter_documents(
-        filters={"field": "meta.status", "operator": "==", "value": "published"}
-    )
-    assert len(published_docs) == 0
-
-
-@pytest.mark.integration
-def test_update_by_filter_advanced_filters(document_store: PgvectorDocumentStore):
-    docs = [
-        Document(content="Doc 1", meta={"category": "A", "year": 2023, "status": "draft"}),
-        Document(content="Doc 2", meta={"category": "A", "year": 2024, "status": "draft"}),
-        Document(content="Doc 3", meta={"category": "B", "year": 2023, "status": "draft"}),
-    ]
-    document_store.write_documents(docs)
-    assert document_store.count_documents() == 3
-
-    # AND condition
-    updated_count = document_store.update_by_filter(
-        filters={
-            "operator": "AND",
-            "conditions": [
-                {"field": "meta.category", "operator": "==", "value": "A"},
-                {"field": "meta.year", "operator": "==", "value": 2023},
-            ],
-        },
-        meta={"status": "published"},
-    )
-    assert updated_count == 1
-
-    # verify only one document was updated
-    published_docs = document_store.filter_documents(
-        filters={"field": "meta.status", "operator": "==", "value": "published"}
-    )
-    assert len(published_docs) == 1
-    assert published_docs[0].meta["category"] == "A"
-    assert published_docs[0].meta["year"] == 2023
-
-    # OR condition
-    updated_count = document_store.update_by_filter(
-        filters={
-            "operator": "OR",
-            "conditions": [
-                {"field": "meta.category", "operator": "==", "value": "B"},
-                {"field": "meta.year", "operator": "==", "value": 2024},
-            ],
-        },
-        meta={"featured": True},
-    )
-    assert updated_count == 2
-
-    featured_docs = document_store.filter_documents(filters={"field": "meta.featured", "operator": "==", "value": True})
-    assert len(featured_docs) == 2
-
-
 @pytest.mark.integration
 def test_update_by_filter_empty_meta_raises_error(document_store: PgvectorDocumentStore):
     docs = [Document(content="Doc 1", meta={"category": "A"})]

{pgvector_haystack-6.1.0 → pgvector_haystack-6.3.0}/tests/test_filters.py

@@ -1,7 +1,13 @@
+# SPDX-FileCopyrightText: 2023-present deepset GmbH <info@deepset.ai>
+#
+# SPDX-License-Identifier: Apache-2.0
+
 import pytest
 from haystack.dataclasses.document import Document
 from haystack.testing.document_store import FilterDocumentsTest
-from psycopg.sql import SQL
+from psycopg.adapt import Transformer
+from psycopg.sql import SQL, Composed
+from psycopg.sql import Literal as SQLLiteral
 
 from haystack_integrations.document_stores.pgvector.filters import (
     FilterError,
@@ -13,6 +19,11 @@ from haystack_integrations.document_stores.pgvector.filters import (
 )
 
 
+def _render(composed: Composed) -> str:
+    """Render a psycopg Composed object to a plain SQL string for assertions."""
+    return composed.as_string(Transformer())
+
+
 @pytest.mark.integration
 class TestFilters(FilterDocumentsTest):
     def assert_documents_are_equal(self, received: list[Document], expected: list[Document]):
@@ -129,19 +140,26 @@ class TestFilters(FilterDocumentsTest):
 
 
 def test_treat_meta_field():
-    assert _treat_meta_field(field="meta.number", value=9) == "(meta->>'number')::integer"
-    assert _treat_meta_field(field="meta.number", value=[1, 2, 3]) == "(meta->>'number')::integer"
-    assert _treat_meta_field(field="meta.name", value="my_name") == "meta->>'name'"
-    assert _treat_meta_field(field="meta.name", value=["my_name"]) == "meta->>'name'"
-    assert _treat_meta_field(field="meta.number", value=1.1) == "(meta->>'number')::real"
-    assert _treat_meta_field(field="meta.number", value=[1.1, 2.2, 3.3]) == "(meta->>'number')::real"
-    assert _treat_meta_field(field="meta.bool", value=True) == "(meta->>'bool')::boolean"
-    assert _treat_meta_field(field="meta.bool", value=[True, False, True]) == "(meta->>'bool')::boolean"
+    cast_integer = SQL("(") + SQL("meta->>") + SQLLiteral("number") + SQL(")::integer")
+    no_cast_name = SQL("meta->>") + SQLLiteral("name")
+    cast_real = SQL("(") + SQL("meta->>") + SQLLiteral("number") + SQL(")::real")
+    cast_boolean = SQL("(") + SQL("meta->>") + SQLLiteral("bool") + SQL(")::boolean")
+
+    assert _treat_meta_field(field="meta.number", value=9) == cast_integer
+    assert _treat_meta_field(field="meta.number", value=[1, 2, 3]) == cast_integer
+    assert _treat_meta_field(field="meta.name", value="my_name") == no_cast_name
+    assert _treat_meta_field(field="meta.name", value=["my_name"]) == no_cast_name
+    assert _treat_meta_field(field="meta.number", value=1.1) == cast_real
+    assert _treat_meta_field(field="meta.number", value=[1.1, 2.2]) == cast_real
+    assert _treat_meta_field(field="meta.bool", value=True) == cast_boolean
+    assert _treat_meta_field(field="meta.bool", value=[True, False]) == cast_boolean
 
-    # do not cast the field if its value is not one of the known types, an empty list or None
-    assert _treat_meta_field(field="meta.other", value={"a": 3, "b": "example"}) == "meta->>'other'"
-    assert _treat_meta_field(field="meta.empty_list", value=[]) == "meta->>'empty_list'"
-    assert _treat_meta_field(field="meta.name", value=None) == "meta->>'name'"
+
+def test_treat_meta_field_sql_injection_is_safely_escaped():
+    # SQL injection attempts are safely escaped by SQLLiteral rather than rejected
+    result = _treat_meta_field(field="meta.name' OR 1=1 --", value="x")
+    assert isinstance(result, Composed)
+    assert result == SQL("meta->>") + SQLLiteral("name' OR 1=1 --")
 
 
 def test_comparison_condition_missing_operator():
@@ -201,10 +219,16 @@ def test_logical_condition_nested():
         ],
     }
     query, values = _parse_logical_condition(condition)
-    assert query == (
-        "((meta->>'domain' IS DISTINCT FROM %s OR meta->>'chapter' = ANY(%s)) "
-        "AND ((meta->>'number')::integer >= %s OR meta->>'author' IS NULL OR meta->>'author' != ALL(%s)))"
+    assert isinstance(query, Composed)
+
+    expected_sql = (
+        "("
+        "(meta->>'domain' IS DISTINCT FROM %s OR meta->>'chapter' = ANY(%s))"
+        " AND "
+        "((meta->>'number')::integer >= %s OR meta->>'author' IS NULL OR meta->>'author' != ALL(%s))"
+        ")"
     )
+    assert _render(query) == expected_sql
     assert values == ["science", [["intro", "conclusion"]], 90, [["John", "Jane"]]]
 
 
@@ -217,7 +241,9 @@ def test_convert_filters_to_where_clause_and_params():
         ],
     }
     where_clause, params = _convert_filters_to_where_clause_and_params(filters)
-    assert where_clause == SQL(" WHERE ") + SQL("((meta->>'number')::integer = %s AND meta->>'chapter' = %s)")
+
+    expected_sql = " WHERE ((meta->>'number')::integer = %s AND meta->>'chapter' = %s)"
+    assert _render(where_clause) == expected_sql
     assert params == (100, "intro")
 
 
@@ -230,7 +256,9 @@ def test_convert_filters_to_where_clause_and_params_handle_null():
         ],
     }
     where_clause, params = _convert_filters_to_where_clause_and_params(filters)
-    assert where_clause == SQL(" WHERE ") + SQL("(meta->>'number' IS NULL AND meta->>'chapter' = %s)")
+
+    expected_sql = " WHERE (meta->>'number' IS NULL AND meta->>'chapter' = %s)"
+    assert _render(where_clause) == expected_sql
     assert params == ("intro",)
 
 

pgvector_haystack-6.1.0/pydoc/config_docusaurus.yml

@@ -1,30 +0,0 @@
-loaders:
-- ignore_when_discovered:
-  - __init__
-  modules:
-  - haystack_integrations.components.retrievers.pgvector.embedding_retriever
-  - haystack_integrations.components.retrievers.pgvector.keyword_retriever
-  - haystack_integrations.document_stores.pgvector.document_store
-  search_path:
-  - ../src
-  type: haystack_pydoc_tools.loaders.CustomPythonLoader
-processors:
-- do_not_filter_modules: false
-  documented_only: true
-  expression: null
-  skip_empty_modules: true
-  type: filter
-- type: smart
-- type: crossref
-renderer:
-  description: Pgvector integration for Haystack
-  id: integrations-pgvector
-  markdown:
-    add_member_class_prefix: false
-    add_method_class_prefix: true
-    classdef_code_block: false
-    descriptive_class_title: false
-    descriptive_module_title: true
-    filename: pgvector.md
-  title: Pgvector
-  type: haystack_pydoc_tools.renderers.DocusaurusRenderer