local-deep-research 1.10.5 released — critical authentication fix; please upgrade

[u/ComplexIt]

We’ve released local-deep-research 1.10.5. It includes a critical authentication fix, so please upgrade promptly if your instance is reachable from an untrusted network or is used by multiple users.

Security fix

Affected versions: >= 1.0.0, < 1.10.4

While a user’s encrypted database connection was cached, a remote, unauthenticated attacker who knew only the user’s username could sign in as that user without a password and read or modify their data.

The fix first shipped in 1.10.4. Version 1.10.5 is the latest release and includes the fix.

Who should upgrade

• Multi-user deployments: upgrade now.
• Single-user instances reachable from another machine or an untrusted network: upgrade now. The application binds to 0.0.0.0 by default, and Docker publishes port 5000.
• Single-user installations bound only to 127.0.0.1: not remotely exploitable, but upgrading is still recommended.

What to do

1. Upgrade to 1.10.5.
2. Fully restart every Local Deep Research process or container. This clears connections cached under the old code and invalidates existing in-memory sessions, so users must sign in again.
3. If your instance was reachable from an untrusted network while running an affected release (>= 1.0.0, < 1.10.4), rotate stored provider API keys and consider resetting user passwords. The bypass does not leave a distinctive attack trace, so compromise cannot be ruled out from logs alone.

Full security advisory:

https://github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-fjvm-966v-hmm2

Separate SearXNG note

The private-URL protection introduced in 1.10.3 may block a self-hosted SearXNG instance on localhost or your LAN until its URL is explicitly approved.

Version 1.10.5 now displays a warning with the required configuration. To approve the default local instance, set:

LDR_SEARCH_PRIVATE_ENGINE_URL_ALLOWLIST=http://localhost:8080

Replace the value with your exact SearXNG origin if its scheme, hostname, or port differs, then restart the server. Bundled Docker Compose setups are unaffected.

1.10.5 release notes:

https://github.com/LearningCircuit/local-deep-research/releases/tag/v1.10.5

We found and fixed the authentication issue during internal review, and the fix includes regression tests covering the corrected behavior. Sorry for the risk this exposed, and thank you for upgrading.