Skip to content

fix: copy SearchConfig before mutating .limit to prevent shared-state clobber#1594

Open
totto wants to merge 1 commit into
getzep:mainfrom
totto:fix/searchconfig-module-level-mutation
Open

fix: copy SearchConfig before mutating .limit to prevent shared-state clobber#1594
totto wants to merge 1 commit into
getzep:mainfrom
totto:fix/searchconfig-module-level-mutation

Conversation

@totto

@totto totto commented Jun 17, 2026

Copy link
Copy Markdown

What

search_recall() assigned one of the module-level SearchConfig constants directly to a local variable and then mutated .limit on it:

search_config = EDGE_HYBRID_SEARCH_RRF  # reference, not copy
search_config.limit = num_results        # mutates the global constant

Why it matters

This is a concurrency hazard. Every concurrent call to search_recall() races to set limit on the same shared object. One request can silently cap another request's result count to whatever was set most recently.

Even in a single-threaded context, the module-level constant is permanently modified after the first call — subsequent calls that rely on the default limit will get the last caller's value instead.

Fix

Call .model_copy(deep=True) before mutation so each invocation works on its own independent copy:

search_config = (
    EDGE_HYBRID_SEARCH_RRF if center_node_uuid is None else EDGE_HYBRID_SEARCH_NODE_DISTANCE
).model_copy(deep=True)
search_config.limit = num_results

…clobber

search_recall() assigned the module-level constant EDGE_HYBRID_SEARCH_RRF
(or _NODE_DISTANCE) directly to search_config, then mutated .limit on it.
Every concurrent call therefore races to set the same object's limit field,
meaning one request can silently cap another request's result count.

Fix: call .model_copy(deep=True) before mutation so each invocation works
on its own copy, leaving the module-level default untouched.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@zep-cla-assistant

Copy link
Copy Markdown
Contributor


Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. For privacy information, see our Privacy Notice. You can sign the CLA by just posting a Pull Request Comment same as the below format.


I have read the CLA Document and I hereby sign the CLA behalf on myself, e-mail: example@example.com

or

I have read the CLA Document and I hereby sign the CLA behalf of my company, e-mail: example@example.com

Signature is valid for 6 months.


This bot will be retriggered when the Contributor License Agreement comment has been provided. Posted by the CLA Assistant Lite bot.

@totto

totto commented Jun 19, 2026

Copy link
Copy Markdown
Author

I have read the CLA Document and I hereby sign the CLA behalf on myself, e-mail: totto@exoreaction.com

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant