GitHub
GitHub Copilot tightens enterprise governance while AI security scanning drops its CodeQL prerequisite
A side-by-side editorial comparison of Elasticsearch and Manticore Search — release velocity, themes, recent moves, and the top alternatives to consider.
Elastic patches seven Kibana CVEs in a single wave, two rated High severity
Elasticsearch/Kibana is working through a broad security audit of its Fleet and agent management layer. The September 2026 patch wave disclosed seven CVEs across Kibana, Filebeat, and Fleet Server — all centered on incorrect or missing authorization checks. Two carry a CVSS 8.1 High rating: one allowing unauthorized configuration modification via Fleet, another enabling privilege escalation through under-validated integration package credentials.
Manticore 29.9 ships chunked multi-vector embeddings and mmap column access, closing gaps with dedicated vector DBs.
Manticoresearch is releasing at high cadence, shipping major capabilities alongside a stream of correctness fixes. The 29.9.0 release consolidates chunked auto-embeddings with multiple strategies (mean, fixed, recursive, sentence), float_vector_array for multi-vector document storage, mmap-based columnar attribute access, and AWS credential-chain backup authentication — all in a single open-source artifact. The 29.8.x series concurrently fixed hybrid search correctness, Elasticsearch-compatible bulk error handling, and RT table embedding metadata.
Elasticsearch/Kibana is working through a broad security audit of its Fleet and agent management layer. The September 2026 patch wave disclosed seven CVEs across Kibana, Filebeat, and Fleet Server — all centered on incorrect or missing authorization checks. Two carry a CVSS 8.1 High rating: one allowing unauthorized configuration modification via Fleet, another enabling privilege escalation through under-validated integration package credentials.
Fleet's growing role as the agent management backbone is exposing authorization boundary issues at scale. The pattern across these advisories — privilege checks missing or bypassed in Fleet-adjacent features — suggests a systematic review is underway rather than isolated bug hunting. Expect further patch batches as the audit reaches Fleet integrations, plugins, and cross-space access paths introduced in the 9.x line.
The Cribl integration code-injection fix (ESA-2026-151) signals that third-party integration templates are under scrutiny; more integration-specific CVEs in the 9.x series are likely before the current audit cycle closes.
Manticoresearch is releasing at high cadence, shipping major capabilities alongside a stream of correctness fixes. The 29.9.0 release consolidates chunked auto-embeddings with multiple strategies (mean, fixed, recursive, sentence), float_vector_array for multi-vector document storage, mmap-based columnar attribute access, and AWS credential-chain backup authentication — all in a single open-source artifact. The 29.8.x series concurrently fixed hybrid search correctness, Elasticsearch-compatible bulk error handling, and RT table embedding metadata.
The engine is systematically replacing external dependencies for AI workloads. Native chunking means no upstream text-splitting service, auto-embeddings with configurable input limits means no external embedding pipeline, and float_vector_array means no separate vector database for chunk-level retrieval. Manticore is positioning as the single system that ingests, chunks, embeds, and searches — a self-hosted alternative to a Qdrant or Weaviate stack that requires orchestrating multiple services. The cloud-aware backup additions suggest it's also targeting managed deployments.
The hybrid search correctness fixes in 29.8.x reveal active work on BM25+KNN fusion. The next likely move is a configurable retrieval reranker or a scoring blend API that lets applications tune the balance between lexical and vector relevance without writing fusion code themselves.
Other DevOps products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Elasticsearch or Manticore Search.
GitHub Copilot tightens enterprise governance while AI security scanning drops its CodeQL prerequisite
CodeRabbit adds TypeScript config and an attack surface mapper, stretching well past code review.
Gravity Forms ships an MCP server, putting AI assistants on a direct line to WordPress form data.
Sanity's MCP server hits v2.33 with safer publishing guards as Studio bug-fix cadence accelerates
Speakeasy becomes the enterprise control plane for MCP server access and AI tool governance.
Kubernetes v1.37 matures its memory management and scheduling stack for AI/ML workloads.
See all Elasticsearch alternatives → · See all Manticore Search alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
They serve adjacent needs but don't currently overlap on shipped themes. Manticore Search is currently shipping more aggressively (velocity 7.5 vs 5.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Manticore Search is currently shipping more aggressively (velocity 7.5 vs 5.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other DevOps products to evaluate alongside.
Top Elasticsearch alternatives in DevOps are ranked by recent ship velocity. Browse the "Elasticsearch alternatives" section above for the current picks, or visit /alternatives/elastic for the full list with editorial commentary on each.
Top Manticore Search alternatives in DevOps are ranked by recent ship velocity. Browse the "Manticore Search alternatives" section above for the current picks, or visit /alternatives/manticoresearch for the full list with editorial commentary on each.