pgvector-haystack 8.1.0__tar.gz → 8.1.1__tar.gz

{pgvector_haystack-8.1.0 → pgvector_haystack-8.1.1}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [integrations/pgvector-v8.1.0] - 2026-10-20
+
+### 🚀 Features
+
+- *(pgvector)* Make PgvectorDocumentStore connection overridable for PostgreSQL-backed stores (#4129)
+
+
 ## [integrations/pgvector-v8.0.0] - 2026-10-16
 
 ### 🧪 Testing

{pgvector_haystack-8.1.0 → pgvector_haystack-8.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pgvector-haystack
-Version: 8.1.0
+Version: 8.1.1
 Summary: An integration of pgvector (vector search extension for Postgres) with Haystack
 Project-URL: Source, https://github.com/deepset-ai/haystack-core-integrations
 Project-URL: Documentation, https://github.com/deepset-ai/haystack-core-integrations/blob/main/integrations/pgvector/README.md

{pgvector_haystack-8.1.0 → pgvector_haystack-8.1.1}/src/haystack_integrations/document_stores/pgvector/document_store.py

@@ -1023,18 +1023,19 @@ class PgvectorDocumentStore:
         if not document_ids:
             return
 
-        document_ids_str = ", ".join(f"'{document_id}'" for document_id in document_ids)
-
-        delete_sql = SQL("DELETE FROM {schema_name}.{table_name} WHERE id IN ({document_ids_str})").format(
+        # pass the ids as a bound parameter, so they are never interpreted as SQL
+        delete_sql = SQL("DELETE FROM {schema_name}.{table_name} WHERE id = ANY(%s)").format(
             schema_name=Identifier(self.schema_name),
             table_name=Identifier(self.table_name),
-            document_ids_str=SQL(document_ids_str),
         )
 
         self._ensure_db_setup()
         assert self._cursor is not None
         self._execute_sql(
-            cursor=self._cursor, sql_query=delete_sql, error_msg="Could not delete documents from PgvectorDocumentStore"
+            cursor=self._cursor,
+            sql_query=delete_sql,
+            params=(document_ids,),
+            error_msg="Could not delete documents from PgvectorDocumentStore",
         )
 
     async def delete_documents_async(self, document_ids: list[str]) -> None:
@@ -1046,12 +1047,10 @@ class PgvectorDocumentStore:
         if not document_ids:
             return
 
-        document_ids_str = ", ".join(f"'{document_id}'" for document_id in document_ids)
-
-        delete_sql = SQL("DELETE FROM {schema_name}.{table_name} WHERE id IN ({document_ids_str})").format(
+        # pass the ids as a bound parameter, so they are never interpreted as SQL
+        delete_sql = SQL("DELETE FROM {schema_name}.{table_name} WHERE id = ANY(%s)").format(
             schema_name=Identifier(self.schema_name),
             table_name=Identifier(self.table_name),
-            document_ids_str=SQL(document_ids_str),
         )
 
         await self._ensure_db_setup_async()
@@ -1059,6 +1058,7 @@ class PgvectorDocumentStore:
         await self._execute_sql_async(
             cursor=self._async_cursor,
             sql_query=delete_sql,
+            params=(document_ids,),
             error_msg="Could not delete documents from PgvectorDocumentStore",
         )
 

{pgvector_haystack-8.1.0 → pgvector_haystack-8.1.1}/tests/test_document_store.py

@@ -605,6 +605,27 @@ def test_delete_documents_empty_list_is_noop(document_store: PgvectorDocumentSto
     assert after == before
 
 
+@pytest.mark.integration
+def test_delete_documents_with_quotes_in_ids(document_store: PgvectorDocumentStore):
+    """
+    The ids are passed as a bound parameter, so quotes in them are not interpreted as SQL.
+    """
+    docs = [
+        Document(id="O'Brien", content="quote in id"),
+        Document(id="x') OR ('1'='1", content="injection-shaped id"),
+        Document(id="1", content="hello"),
+        Document(id="2", content="world"),
+    ]
+    document_store.write_documents(docs)
+
+    document_store.delete_documents(["O'Brien"])
+    assert sorted(doc.id for doc in document_store.filter_documents()) == ["1", "2", "x') OR ('1'='1"]
+
+    # only matches the document with this exact id, instead of every document
+    document_store.delete_documents(["x') OR ('1'='1"])
+    assert sorted(doc.id for doc in document_store.filter_documents()) == ["1", "2"]
+
+
 @pytest.mark.integration
 def test_update_by_filter_empty_meta_raises_error(document_store: PgvectorDocumentStore):
     docs = [Document(content="Doc 1", meta={"category": "A"})]

{pgvector_haystack-8.1.0 → pgvector_haystack-8.1.1}/tests/test_document_store_async.py

@@ -189,6 +189,27 @@ class TestDocumentStoreAsync(
         """
         await document_store.delete_table_async()  # if throw error, test fails
 
+    async def test_delete_documents_async_with_quotes_in_ids(self, document_store: PgvectorDocumentStore):
+        """
+        The ids are passed as a bound parameter, so quotes in them are not interpreted as SQL.
+        """
+        docs = [
+            Document(id="O'Brien", content="quote in id"),
+            Document(id="x') OR ('1'='1", content="injection-shaped id"),
+            Document(id="1", content="hello"),
+            Document(id="2", content="world"),
+        ]
+        await document_store.write_documents_async(docs)
+
+        await document_store.delete_documents_async(["O'Brien"])
+        remaining = await document_store.filter_documents_async()
+        assert sorted(doc.id for doc in remaining) == ["1", "2", "x') OR ('1'='1"]
+
+        # only matches the document with this exact id, instead of every document
+        await document_store.delete_documents_async(["x') OR ('1'='1"])
+        remaining = await document_store.filter_documents_async()
+        assert sorted(doc.id for doc in remaining) == ["1", "2"]
+
     async def test_close_async_and_reopen(self, document_store: PgvectorDocumentStore):
         assert await document_store.count_documents_async() == 0
         assert document_store._async_connection is not None