pgvector-haystack 8.1.0__tar.gz → 8.1.2__tar.gz

{pgvector_haystack-8.1.0 → pgvector_haystack-8.1.2}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [integrations/pgvector-v8.1.1] - 2026-10-21
+
+### 🐛 Bug Fixes
+
+- *(pgvector)* Pass document ids as a bound parameter in delete_docum… (#4135)
+
+
+## [integrations/pgvector-v8.1.0] - 2026-10-20
+
+### 🚀 Features
+
+- *(pgvector)* Make PgvectorDocumentStore connection overridable for PostgreSQL-backed stores (#4129)
+
+
 ## [integrations/pgvector-v8.0.0] - 2026-10-16
 
 ### 🧪 Testing

{pgvector_haystack-8.1.0 → pgvector_haystack-8.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pgvector-haystack
-Version: 8.1.0
+Version: 8.1.2
 Summary: An integration of pgvector (vector search extension for Postgres) with Haystack
 Project-URL: Source, https://github.com/deepset-ai/haystack-core-integrations
 Project-URL: Documentation, https://github.com/deepset-ai/haystack-core-integrations/blob/main/integrations/pgvector/README.md

{pgvector_haystack-8.1.0 → pgvector_haystack-8.1.2}/src/haystack_integrations/document_stores/pgvector/document_store.py

@@ -678,8 +678,10 @@ class PgvectorDocumentStore:
             k: v for k, v in self.hnsw_index_creation_kwargs.items() if k in HNSW_INDEX_CREATION_VALID_KWARGS
         }
         if valid_kwargs:
-            kwargs_str = ", ".join(f"{k} = {v}" for k, v in valid_kwargs.items())
-            sql_create_hnsw_index += SQL(" WITH ({})").format(SQL(kwargs_str))
+            # the names are allowlisted; pass the values as literals, so they are never interpreted as SQL
+            sql_create_hnsw_index += SQL(" WITH ({})").format(
+                SQL(", ").join(SQL("{} = {}").format(SQL(k), SQLLiteral(v)) for k, v in valid_kwargs.items())
+            )
 
         return sql_set_hnsw_ef_search, sql_hnsw_index_exists, sql_drop_hnsw_index, sql_create_hnsw_index
 
@@ -1023,18 +1025,19 @@ class PgvectorDocumentStore:
         if not document_ids:
             return
 
-        document_ids_str = ", ".join(f"'{document_id}'" for document_id in document_ids)
-
-        delete_sql = SQL("DELETE FROM {schema_name}.{table_name} WHERE id IN ({document_ids_str})").format(
+        # pass the ids as a bound parameter, so they are never interpreted as SQL
+        delete_sql = SQL("DELETE FROM {schema_name}.{table_name} WHERE id = ANY(%s)").format(
             schema_name=Identifier(self.schema_name),
             table_name=Identifier(self.table_name),
-            document_ids_str=SQL(document_ids_str),
         )
 
         self._ensure_db_setup()
         assert self._cursor is not None
         self._execute_sql(
-            cursor=self._cursor, sql_query=delete_sql, error_msg="Could not delete documents from PgvectorDocumentStore"
+            cursor=self._cursor,
+            sql_query=delete_sql,
+            params=(document_ids,),
+            error_msg="Could not delete documents from PgvectorDocumentStore",
         )
 
     async def delete_documents_async(self, document_ids: list[str]) -> None:
@@ -1046,12 +1049,10 @@ class PgvectorDocumentStore:
         if not document_ids:
             return
 
-        document_ids_str = ", ".join(f"'{document_id}'" for document_id in document_ids)
-
-        delete_sql = SQL("DELETE FROM {schema_name}.{table_name} WHERE id IN ({document_ids_str})").format(
+        # pass the ids as a bound parameter, so they are never interpreted as SQL
+        delete_sql = SQL("DELETE FROM {schema_name}.{table_name} WHERE id = ANY(%s)").format(
             schema_name=Identifier(self.schema_name),
             table_name=Identifier(self.table_name),
-            document_ids_str=SQL(document_ids_str),
         )
 
         await self._ensure_db_setup_async()
@@ -1059,6 +1060,7 @@ class PgvectorDocumentStore:
         await self._execute_sql_async(
             cursor=self._async_cursor,
             sql_query=delete_sql,
+            params=(document_ids,),
             error_msg="Could not delete documents from PgvectorDocumentStore",
         )
 
@@ -1403,26 +1405,31 @@ class PgvectorDocumentStore:
             msg = f"vector_function must be one of {VALID_VECTOR_FUNCTIONS}, but got {vector_function}"
             raise ValueError(msg)
 
-        # the vector must be a string with this format: "'[3,1,2]'"
-        query_embedding_for_postgres = f"'[{','.join(str(el) for el in query_embedding)}]'"
+        # the vector must be a string with this format: "'[3.0,1.0,2.0]'"; the elements are converted to floats
+        # and the string is passed as a literal, so it is never interpreted as SQL
+        try:
+            query_embedding_for_postgres = SQLLiteral(f"[{','.join(str(float(el)) for el in query_embedding)}]")
+        except (TypeError, ValueError) as e:
+            msg = "query_embedding must be a list of floats"
+            raise TypeError(msg) from e
 
         # to compute the scores, we use the approach described in pgvector README:
         # https://github.com/pgvector/pgvector?tab=readme-ov-file#distances
         # cosine_similarity and inner_product are modified from the result of the operator
         if vector_function == "cosine_similarity":
-            score_definition = f"1 - (embedding <=> {query_embedding_for_postgres}) AS score"
-            order_by_definition = f"embedding <=> {query_embedding_for_postgres}"
+            score_definition = SQL("1 - (embedding <=> {}) AS score").format(query_embedding_for_postgres)
+            order_by_definition = SQL("embedding <=> {}").format(query_embedding_for_postgres)
         elif vector_function == "inner_product":
-            score_definition = f"(embedding <#> {query_embedding_for_postgres}) * -1 AS score"
-            order_by_definition = f"embedding <#> {query_embedding_for_postgres}"
+            score_definition = SQL("(embedding <#> {}) * -1 AS score").format(query_embedding_for_postgres)
+            order_by_definition = SQL("embedding <#> {}").format(query_embedding_for_postgres)
         elif vector_function == "l2_distance":
-            score_definition = f"embedding <-> {query_embedding_for_postgres} AS score"
-            order_by_definition = f"embedding <-> {query_embedding_for_postgres}"
+            score_definition = SQL("embedding <-> {} AS score").format(query_embedding_for_postgres)
+            order_by_definition = SQL("embedding <-> {}").format(query_embedding_for_postgres)
 
         sql_select = SQL("SELECT *, {score} FROM {schema_name}.{table_name}").format(
             schema_name=Identifier(self.schema_name),
             table_name=Identifier(self.table_name),
-            score=SQL(score_definition),
+            score=score_definition,
         )
 
         sql_where_clause: Composed | SQL = SQL("")
@@ -1432,7 +1439,7 @@ class PgvectorDocumentStore:
 
         sql_sort = SQL(" ORDER BY {order_by} ASC LIMIT {top_k}").format(
             top_k=SQLLiteral(top_k),
-            order_by=SQL(order_by_definition),
+            order_by=order_by_definition,
         )
 
         sql_query = sql_select + sql_where_clause + sql_sort

{pgvector_haystack-8.1.0 → pgvector_haystack-8.1.2}/tests/test_document_store.py

@@ -205,6 +205,21 @@ def test_init(monkeypatch):
     assert document_store.keyword_index_name == "my_keyword_index"
 
 
+@pytest.mark.usefixtures("patches_for_unit_tests")
+def test_build_hnsw_queries_passes_creation_kwargs_as_literals():
+    document_store = PgvectorDocumentStore(
+        search_strategy="hnsw",
+        hnsw_index_creation_kwargs={"m": 32, "ef_construction": "64); DROP TABLE haystack; --", "unknown": 1},
+    )
+
+    *_, sql_create_hnsw_index = document_store._build_hnsw_queries()
+
+    assert (
+        "SQL(' WITH ('), Composed([Composed([SQL('m'), SQL(' = '), Literal(32)]), SQL(', '), "
+        "Composed([SQL('ef_construction'), SQL(' = '), Literal('64); DROP TABLE haystack; --')])]), SQL(')')"
+    ) in repr(sql_create_hnsw_index)
+
+
 @pytest.mark.usefixtures("patches_for_unit_tests")
 def test_init_invalid_vector_type():
     with pytest.raises(ValueError, match=r"vector_type must be one of.*"):
@@ -323,18 +338,18 @@ def test_check_and_build_embedding_retrieval_query_rejects_invalid_vector_functi
     [
         (
             "cosine_similarity",
-            "1 - (embedding <=> '[0.1,0.2]') AS score",
-            "embedding <=> '[0.1,0.2]'",
+            "Composed([SQL('1 - (embedding <=> '), Literal('[0.1,2.0]'), SQL(') AS score')])",
+            "Composed([SQL('embedding <=> '), Literal('[0.1,2.0]')])",
         ),
         (
             "inner_product",
-            "(embedding <#> '[0.1,0.2]') * -1 AS score",
-            "embedding <#> '[0.1,0.2]'",
+            "Composed([SQL('(embedding <#> '), Literal('[0.1,2.0]'), SQL(') * -1 AS score')])",
+            "Composed([SQL('embedding <#> '), Literal('[0.1,2.0]')])",
         ),
         (
             "l2_distance",
-            "embedding <-> '[0.1,0.2]' AS score",
-            "embedding <-> '[0.1,0.2]'",
+            "Composed([SQL('embedding <-> '), Literal('[0.1,2.0]'), SQL(' AS score')])",
+            "Composed([SQL('embedding <-> '), Literal('[0.1,2.0]')])",
         ),
     ],
 )
@@ -344,21 +359,29 @@ def test_check_and_build_embedding_retrieval_query_orders_by_distance_operator(
     mock_store.embedding_dimension = 2
 
     sql_query, params = mock_store._check_and_build_embedding_retrieval_query(
-        query_embedding=[0.1, 0.2],
+        query_embedding=[0.1, 2],
         vector_function=vector_function,
         top_k=5,
     )
 
     rendered = repr(sql_query)
-    assert score_sql in rendered
-    assert "SQL(' ORDER BY ')" in rendered
-    assert f'SQL("{order_by_sql}")' in rendered
-    assert "SQL(' ASC LIMIT ')" in rendered
-    assert "Literal(5)" in rendered
-    assert "ORDER BY score" not in rendered
+    assert f"SQL('SELECT *, '), {score_sql}" in rendered
+    assert f"SQL(' ORDER BY '), {order_by_sql}, SQL(' ASC LIMIT '), Literal(5)" in rendered
     assert params == ()
 
 
+@pytest.mark.parametrize("bad_element", ["0.1]'); DROP TABLE haystack; --", None])
+def test_check_and_build_embedding_retrieval_query_rejects_non_numeric_elements(mock_store, bad_element):
+    mock_store.embedding_dimension = 2
+
+    with pytest.raises(TypeError, match="query_embedding must be a list of floats"):
+        mock_store._check_and_build_embedding_retrieval_query(
+            query_embedding=[bad_element, 0.2],
+            vector_function="cosine_similarity",
+            top_k=5,
+        )
+
+
 @pytest.mark.parametrize(
     "bad_field",
     [
@@ -491,16 +514,16 @@ def test_halfvec_hnsw_write_documents(document_store_w_halfvec_hnsw_index: Pgvec
 
 @pytest.mark.integration
 def test_hnsw_index_recreation():
-    def get_index_oid(document_store, schema_name, index_name):
-        sql_get_index_oid = """
-            SELECT c.oid
+    def get_index_oid_and_reloptions(document_store, schema_name, index_name):
+        sql_get_index_oid_and_reloptions = """
+            SELECT c.oid, c.reloptions
             FROM pg_class c
             JOIN pg_namespace n ON n.oid = c.relnamespace
             WHERE c.relkind = 'i'
             AND n.nspname = %s
             AND c.relname = %s;
         """
-        return document_store._cursor.execute(sql_get_index_oid, (schema_name, index_name)).fetchone()[0]
+        return document_store._cursor.execute(sql_get_index_oid_and_reloptions, (schema_name, index_name)).fetchone()
 
     # create a new schema
     connection_string = "postgresql://postgres:postgres@localhost:5432/postgres"
@@ -519,19 +542,53 @@ def test_hnsw_index_recreation():
     ds1 = PgvectorDocumentStore(**params)
     ds1._ensure_db_setup()
 
-    # get the hnsw index oid
+    # get the hnsw index oid and options
     hnws_index_name = "haystack_hnsw_index"
-    first_oid = get_index_oid(ds1, ds1.schema_name, hnws_index_name)
+    first_oid, first_reloptions = get_index_oid_and_reloptions(ds1, ds1.schema_name, hnws_index_name)
+    assert first_reloptions is None
 
-    # create second document store with recreation enabled
-    ds2 = PgvectorDocumentStore(**params, hnsw_recreate_index_if_exists=True)
+    # create second document store with recreation enabled and custom index creation kwargs
+    ds2 = PgvectorDocumentStore(
+        **params, hnsw_recreate_index_if_exists=True, hnsw_index_creation_kwargs={"m": 32, "ef_construction": 128}
+    )
     ds2._ensure_db_setup()
 
-    # get the index oid
-    second_oid = get_index_oid(ds2, ds2.schema_name, hnws_index_name)
+    # get the index oid and options
+    second_oid, second_reloptions = get_index_oid_and_reloptions(ds2, ds2.schema_name, hnws_index_name)
 
-    # verify that oids differ
+    # verify that oids differ and the recreated index uses the new kwargs
     assert second_oid != first_oid, "Index was not recreated (OID remained the same)"
+    assert sorted(second_reloptions) == ["ef_construction=128", "m=32"]
+
+    # Clean up: drop the schema after the test
+    with psycopg.connect(connection_string, autocommit=True) as conn:
+        conn.execute(f"DROP SCHEMA IF EXISTS {schema_name} CASCADE")
+
+
+@pytest.mark.integration
+def test_hnsw_index_creation_kwargs_values_are_not_interpreted_as_sql():
+    connection_string = "postgresql://postgres:postgres@localhost:5432/postgres"
+    schema_name = "test_schema_hnsw_kwargs_injection"
+    with psycopg.connect(connection_string, autocommit=True) as conn:
+        conn.execute(f"DROP SCHEMA IF EXISTS {schema_name} CASCADE")
+        conn.execute(f"CREATE SCHEMA {schema_name}")
+        conn.execute(f"CREATE TABLE {schema_name}.canary (id int)")
+
+    document_store = PgvectorDocumentStore(
+        connection_string=Secret.from_token(connection_string),
+        schema_name=schema_name,
+        table_name="haystack_test_hnsw_kwargs_injection",
+        search_strategy="hnsw",
+        hnsw_index_creation_kwargs={"m": f"16); DROP TABLE {schema_name}.canary; --"},
+    )
+
+    # the value is passed as a literal, so PostgreSQL rejects it as an invalid value for "m"
+    with pytest.raises(DocumentStoreError, match="Could not create HNSW index"):
+        document_store._ensure_db_setup()
+
+    with psycopg.connect(connection_string) as conn:
+        canary = conn.execute("SELECT to_regclass(%s)", (f"{schema_name}.canary",)).fetchone()[0]
+    assert canary is not None
 
     # Clean up: drop the schema after the test
     with psycopg.connect(connection_string, autocommit=True) as conn:
@@ -605,6 +662,27 @@ def test_delete_documents_empty_list_is_noop(document_store: PgvectorDocumentSto
     assert after == before
 
 
+@pytest.mark.integration
+def test_delete_documents_with_quotes_in_ids(document_store: PgvectorDocumentStore):
+    """
+    The ids are passed as a bound parameter, so quotes in them are not interpreted as SQL.
+    """
+    docs = [
+        Document(id="O'Brien", content="quote in id"),
+        Document(id="x') OR ('1'='1", content="injection-shaped id"),
+        Document(id="1", content="hello"),
+        Document(id="2", content="world"),
+    ]
+    document_store.write_documents(docs)
+
+    document_store.delete_documents(["O'Brien"])
+    assert sorted(doc.id for doc in document_store.filter_documents()) == ["1", "2", "x') OR ('1'='1"]
+
+    # only matches the document with this exact id, instead of every document
+    document_store.delete_documents(["x') OR ('1'='1"])
+    assert sorted(doc.id for doc in document_store.filter_documents()) == ["1", "2"]
+
+
 @pytest.mark.integration
 def test_update_by_filter_empty_meta_raises_error(document_store: PgvectorDocumentStore):
     docs = [Document(content="Doc 1", meta={"category": "A"})]

{pgvector_haystack-8.1.0 → pgvector_haystack-8.1.2}/tests/test_document_store_async.py

@@ -189,6 +189,27 @@ class TestDocumentStoreAsync(
         """
         await document_store.delete_table_async()  # if throw error, test fails
 
+    async def test_delete_documents_async_with_quotes_in_ids(self, document_store: PgvectorDocumentStore):
+        """
+        The ids are passed as a bound parameter, so quotes in them are not interpreted as SQL.
+        """
+        docs = [
+            Document(id="O'Brien", content="quote in id"),
+            Document(id="x') OR ('1'='1", content="injection-shaped id"),
+            Document(id="1", content="hello"),
+            Document(id="2", content="world"),
+        ]
+        await document_store.write_documents_async(docs)
+
+        await document_store.delete_documents_async(["O'Brien"])
+        remaining = await document_store.filter_documents_async()
+        assert sorted(doc.id for doc in remaining) == ["1", "2", "x') OR ('1'='1"]
+
+        # only matches the document with this exact id, instead of every document
+        await document_store.delete_documents_async(["x') OR ('1'='1"])
+        remaining = await document_store.filter_documents_async()
+        assert sorted(doc.id for doc in remaining) == ["1", "2"]
+
     async def test_close_async_and_reopen(self, document_store: PgvectorDocumentStore):
         assert await document_store.count_documents_async() == 0
         assert document_store._async_connection is not None
@@ -205,9 +226,9 @@ class TestDocumentStoreAsync(
 @pytest.mark.integration
 @pytest.mark.asyncio
 async def test_hnsw_index_recreation():
-    async def get_index_oid(cursor, document_store, schema_name, index_name):
-        sql_get_index_oid = SQL("""
-            SELECT c.oid
+    async def get_index_oid_and_reloptions(cursor, document_store, schema_name, index_name):
+        sql_get_index_oid_and_reloptions = SQL("""
+            SELECT c.oid, c.reloptions
             FROM pg_class c
             JOIN pg_namespace n ON n.oid = c.relnamespace
             WHERE c.relkind = 'i'
@@ -215,15 +236,16 @@ async def test_hnsw_index_recreation():
             AND c.relname = %s;
         """)
         result = await document_store._execute_sql_async(
-            cursor=cursor, sql_query=sql_get_index_oid, params=(schema_name, index_name)
+            cursor=cursor, sql_query=sql_get_index_oid_and_reloptions, params=(schema_name, index_name)
         )
-        return (await result.fetchone())[0]
+        return await result.fetchone()
 
     # create a new schema
     connection_string = "postgresql://postgres:postgres@localhost:5432/postgres"
     schema_name = "test_schema"
     async with await psycopg.AsyncConnection.connect(connection_string, autocommit=True) as conn:
-        await conn.execute(f"CREATE SCHEMA IF NOT EXISTS {schema_name}")
+        await conn.execute(f"DROP SCHEMA IF EXISTS {schema_name} CASCADE")
+        await conn.execute(f"CREATE SCHEMA {schema_name}")
 
     # create a first document store and trigger the creation of the hnsw index
     params = {
@@ -235,23 +257,58 @@ async def test_hnsw_index_recreation():
     ds1 = PgvectorDocumentStore(**params)
     await ds1._ensure_db_setup_async()
 
-    # get the hnsw index oid
+    # get the hnsw index oid and options
     hnws_index_name = "haystack_hnsw_index"
-    first_oid = await get_index_oid(
+    first_oid, first_reloptions = await get_index_oid_and_reloptions(
         cursor=ds1._async_cursor, document_store=ds1, schema_name=ds1.schema_name, index_name=hnws_index_name
     )
+    assert first_reloptions is None
 
-    # create second document store with recreation enabled
-    ds2 = PgvectorDocumentStore(**params, hnsw_recreate_index_if_exists=True)
+    # create second document store with recreation enabled and custom index creation kwargs
+    ds2 = PgvectorDocumentStore(
+        **params, hnsw_recreate_index_if_exists=True, hnsw_index_creation_kwargs={"m": 32, "ef_construction": 128}
+    )
     await ds2._ensure_db_setup_async()
 
-    # get the index oid
-    second_oid = await get_index_oid(
+    # get the index oid and options
+    second_oid, second_reloptions = await get_index_oid_and_reloptions(
         cursor=ds2._async_cursor, document_store=ds2, schema_name=ds2.schema_name, index_name=hnws_index_name
     )
 
-    # verify that oids differ
+    # verify that oids differ and the recreated index uses the new kwargs
     assert second_oid != first_oid, "Index was not recreated (OID remained the same)"
+    assert sorted(second_reloptions) == ["ef_construction=128", "m=32"]
+
+    # Clean up: drop the schema after the test
+    async with await psycopg.AsyncConnection.connect(connection_string, autocommit=True) as conn:
+        await conn.execute(f"DROP SCHEMA IF EXISTS {schema_name} CASCADE")
+
+
+@pytest.mark.integration
+@pytest.mark.asyncio
+async def test_hnsw_index_creation_kwargs_values_are_not_interpreted_as_sql():
+    connection_string = "postgresql://postgres:postgres@localhost:5432/postgres"
+    schema_name = "test_schema_hnsw_kwargs_injection_async"
+    async with await psycopg.AsyncConnection.connect(connection_string, autocommit=True) as conn:
+        await conn.execute(f"DROP SCHEMA IF EXISTS {schema_name} CASCADE")
+        await conn.execute(f"CREATE SCHEMA {schema_name}")
+        await conn.execute(f"CREATE TABLE {schema_name}.canary (id int)")
+
+    document_store = PgvectorDocumentStore(
+        connection_string=Secret.from_token(connection_string),
+        schema_name=schema_name,
+        table_name="haystack_test_hnsw_kwargs_injection",
+        search_strategy="hnsw",
+        hnsw_index_creation_kwargs={"m": f"16); DROP TABLE {schema_name}.canary; --"},
+    )
+
+    # the value is passed as a literal, so PostgreSQL rejects it as an invalid value for "m"
+    with pytest.raises(DocumentStoreError, match="Could not create HNSW index"):
+        await document_store._ensure_db_setup_async()
+
+    async with await psycopg.AsyncConnection.connect(connection_string) as conn:
+        canary = await (await conn.execute("SELECT to_regclass(%s)", (f"{schema_name}.canary",))).fetchone()
+    assert canary[0] is not None
 
     # Clean up: drop the schema after the test
     async with await psycopg.AsyncConnection.connect(connection_string, autocommit=True) as conn: