Pinecone Java SDK 6.3.1 stops a malformed API key leaking into logs (November 14, 2026)

What changed

November 14, 2026: Pinecone released v6.3.1 of its Java SDK, a patch on top of 6.3.0. No method signatures changed.

• Security: before 6.3.1, Pinecone.Builder.build() accepted an API key with leading or trailing whitespace or control characters, often a trailing newline from a file or a Kubernetes secret. With a newline, every later call threw an IllegalArgumentException whose message held the full key. With a tab, gRPC dropped the api-key header and logged the key. build() now trims such characters, and rejects a key that is empty or contains anything other than printable ASCII with a PineconeConfigurationException that does not echo it.
• Async writes on close: Index.close() and AsyncIndex.close() used to cancel calls still running. Calls already issued now get up to 5 seconds to finish, so closing the last index object on a connection can block that long.
• Ids and namespaces: a string with half an emoji (an unpaired surrogate, often left by substring) used to be sent as ?, so two different ids could overwrite each other. Such values now throw PineconeValidationException before the request is sent.
• Listeners: a ResponseMetadataListener that throws an Error no longer hangs the call.
• 6.3.1 is signed with the same key as 6.3.0.

Prerequisites

• A Pinecone API key in PINECONE_API_KEY
• A Java project that uses io.pinecone:pinecone-client

Steps

1. Raise the version to 6.3.1.

Maven:

<dependency>
  <groupId>io.pinecone</groupId>
  <artifactId>pinecone-client</artifactId>
  <version>6.3.1</version>
</dependency>