Release version inconsistency: 0.3.8 in-tree vs 0.3.7 on PyPI (last shipped 2026-03-08)

[elJayAdvisor]

Release version inconsistency: 0.3.8 in-tree vs 0.3.7 on PyPI (last shipped 2026-03-08)

Summary
There's a significant version skew between the in-tree version and what's published on PyPI. Users installing from PyPI get a 6-month-old release that predates recent security hardening.

Current State

• PyPI last shipped: v0.3.7 (2026-03-08) — 6 months stale
• In-tree versions: 0.3.8 (hnsw, diskann, leann-core, leann packages)
• Backend variants: ivf and flashlib stuck at 0.3.6
• Dockerfiles: Pin 0.3.6
• Self-classified: Beta (Development Status :: 4)

Why This Matters
Users installing via pip install leann get v0.3.7, which predates:

• September 5 hardening: ZMQ embedding servers bound to loopback by default (fix: bind ZMQ embedding servers to loopback by default #404)
• September 5 security documentation: SECURITY.md with private advisory channel (docs: add SECURITY.md with a private reporting path #413)
• Other recent stability and security fixes

This means new users adopt the package without the latest security posture improvements.

Suggested Approach
When the team is ready to cut a release:

1. Align all in-tree package versions (0.3.8 → shared tag)
2. Include the September 5 security hardening commits
3. Update Dockerfiles to match
4. Ship to PyPI with clear release notes (security improvements, storage claims validation, etc.)

This is not blocking for local/development use, but it's worth resolving before recommending LEANN for downstream integration or production workloads.

Note: The MLSys 2026 Best Paper recognition has driven strong adoption (12.9K stars, 1.1K forks). A fresh PyPI release with the latest hardening would reinforce confidence in the project's maturity.

[yichuan-w]

cc @andylizf