Haystack

As of 2026-10-12 the GitHub repo (deepset-ai/haystack) is not archived, carries an Apache-2.0 licence, and was pushed to the same day this page was checked (https://api.github.com/repos/deepset-ai/haystack). The current release is 3.3.0, published 1 October 2026, which bumped a transitive dependency (anyio) to patch CVE-2026-63374 and sped up SentenceWindowRetriever; the project has shipped a 3.x point release roughly every two to three weeks through 2026 (https://github.com/deepset-ai/haystack/releases/tag/v3.3.0). Star count stands at 26,725, confirmed via the GitHub API rather than the badge on the project's own README. The figures previously on this listing (25.3k stars, 126 integrations) were a few weeks stale and have been corrected below.

Haystack itself installs free via pip install haystack-ai — Apache-2.0, no usage cap, no paywalled components (https://pypi.org/project/haystack-ai/). deepset, the company behind it, sells two paid tiers on top: Haystack Enterprise Starter (private support, deployment templates, roughly 4 hours of consulting per the vendor) and the Haystack Enterprise Platform (managed or self-hosted orchestration with access controls and auditability). Neither publishes a number; both routes go through "Book a Demo" / "Talk to us" (https://www.deepset.ai/products-and-services/haystack-enterprise-starter). Budget a sales conversation for anything beyond the open-source framework.

The integrations catalogue lists 189 entries spanning model providers (OpenAI, Anthropic, Mistral, Bedrock, watsonx), document/vector stores (Weaviate, Pinecone, Elasticsearch, Qdrant, pgvector, and more), and monitoring tools (Langfuse, OpenTelemetry, Arize) (https://haystack.deepset.ai/integrations). Turning a pipeline into a running service is handled by a separate open-source project, Hayhooks (Apache-2.0, 153 GitHub stars), which wraps a pipeline in typed REST endpoints, an OpenAI-compatible chat-completions backend, an MCP server, and durable, Redis-checkpointed executions that survive a restart (https://github.com/deepset-ai/hayhooks). That split — orchestration in Haystack, serving in Hayhooks — is the shape to expect rather than a single built-in deploy command.

Haystack's published security policy explicitly scopes three classes of finding out of its vulnerability program: loading a pipeline YAML or resuming a PipelineSnapshot from an untrusted source (arbitrary code execution by design, since pipelines can import arbitrary components), SSRF through URL-fetching components like LinkContentFetcher (no built-in host allow/deny list), and prompt injection via retrieved documents (https://github.com/deepset-ai/haystack/security/policy). deepset's stated position is that these are the application's and the network layer's responsibility, not the framework's — a defensible and fairly common stance for a library, but it means a team feeding untrusted documents or user-supplied pipeline definitions into Haystack needs to build its own input validation, egress controls, and prompt-injection defences rather than relying on the framework to supply them. Separately, Haystack collects anonymized usage telemetry by default (component types, OS, Python version — not file paths, queries, or document content); it's disabled with HAYSTACK_TELEMETRY_ENABLED=False (https://docs.haystack.deepset.ai/docs/telemetry).

deepset's own GitHub README and site name NVIDIA, Airbus, Lufthansa Industry Solutions, Comcast, Accenture, TELUS Agriculture & Consumer Goods, Zeit Online, Apple, Meta, Databricks, Intel, the European Commission, and Germany's BMFTR research ministry as organizations using Haystack, several with published case studies (https://github.com/deepset-ai/haystack#organizations-using-haystack). These are vendor-stated and not independently corroborated here, though several (Airbus, Zeit Online, Lufthansa) link to case-study pages on deepset's own domain rather than being bare logo claims.