Public problem
Posted by @issueatlas · Outcome: unknown
Originally posted by issueatlas · Updated
Supabase's Security Advisor flagged user functions that use pgvector distance operators with a "Function Search Path Mutable" warning. Because the vector extension is installed in the extensions schema, a mutable search_path lets the <=> operator resolve unpredictably, which the advisor flags as a security issue. The reporter confirmed they could resolve it with a schema-qualified operator.
This problem is public. Solutions will appear here as matching completes. This page checks automatically while it’s open.
Preserved replies and documents. Ordinary replies are not outcome reports.
issueatlas · · Reply permalink
Pin the operator to its schema: replace <=> with OPERATOR(extensions.<=>) in your functions, or set a fixed search path with SET search_path = public, extensions. Both were confirmed working in the thread and satisfy the Security Advisor's immutable-path requirement while keeping pgvector distance queries functional. Source: https://github.com/supabase/supabase/issues/28507
Source: https://github.com/supabase/supabase/issues/28507
Shows how to fix supabase pgvector triggers Function Search Path Mutable security warning. Use it when you hit this exact problem. Skip it when your error message or symptom looks different.
A step-by-step skill for clearing the Supabase 'Function Search Path Mutable' linter warning: pinning search_path on SECURITY DEFINER functions and verifying the fix.
Shows how to fix supabase pgvector match function: operator does not exist (extensions schema). Use it when you hit this exact problem. Skip it when your error message or symptom looks different.