fix(local): honor ssl_verify=False for data-plane host scheme; allow dimension for sparse indexes

[tsushanth]

Problem

Two bugs make Pinecone Local unusable with the v9 Python SDK.

Issue #678 — data-plane host forced to https:// even with ssl_verify=False

IndexModel.__post_init__ calls normalize_host, which prepends https:// to any bare hostname returned by the control plane (Pinecone Local returns no scheme). The ssl_verify=False flag set on Pinecone(...) is correctly forwarded to the Index kwargs, but the host already carries https:// by the time the data-plane client is constructed — so an outbound TLS handshake is attempted against a server that serves plain HTTP only. The result is SSL_WRONG_VERSION_NUMBER even though the user explicitly opted out of TLS.

Issue #679 — cannot create a sparse index against Pinecone Local

validate_create_inputs raises PineconeValueError: dimension must not be provided for sparse indexes before any request is sent. Omitting dimension causes Pinecone Local to return 422 missing field 'dimension' because its /indexes endpoint requires the field regardless of vector_type. The SDK and the server are in a deadlock with no path to success.

Fix

For #678: _resolve_index_host (sync in _client.py, async in async_client/pinecone.py, and both sync/async paths in preview/__init__.py) now rewrites https:// to http:// on the resolved host whenever ssl_verify=False. An explicit host= argument passed directly by the caller is returned unchanged. Production hosts — which always have a scheme already explicit in the host string — are unaffected because only the name-resolved path (bare hostname → IndexModel.__post_init__ → normalize_host) produces an unwanted https:// for local targets.

For #679: The client-side prohibition on dimension for sparse indexes is removed from validate_create_inputs. The field remains optional and is forwarded to the server only when supplied, exactly as it is for dense indexes. Cloud Pinecone silently accepts and ignores an extra dimension on sparse indexes; Pinecone Local requires it. The server is the appropriate authority for per-environment validation.

Tests

• TestResolveIndexHostSslVerify in test_client.py: three cases — ssl_verify=False rewrites https:// on the name-resolved host, ssl_verify=True preserves https://, and an explicit host= argument is never rewritten
• test_create_sparse_with_dimension_allowed in test_indexes_create.py: replaces the old test_create_sparse_with_dimension_raises test; verifies the request body contains both vector_type=sparse and dimension=1

Fixes #678
Fixes #679

---

Note

Low Risk
Targeted local-dev fixes with narrow conditions (ssl_verify off + describe-resolved https host; relaxed sparse dimension validation). Production paths with default ssl_verify and typical sparse creates are unchanged.

Overview
Fixes Pinecone Local compatibility in two areas.

When an index host is resolved by name (describe), ssl_verify=False now rewrites https:// → http:// before caching and connecting, so plain-HTTP local data planes are not forced into TLS. The same logic applies on sync/async Pinecone, AsyncPinecone, and preview index host resolution. An explicit host= argument is never rewritten.

Sparse index creation no longer rejects a client-supplied dimension in validate_create_inputs; optional dimension is still forwarded in the create body when provided, leaving environment-specific rules to the API (needed for Local, harmless for cloud).

^{Reviewed by Cursor Bugbot for commit 811ea2a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 811ea2a. Configure here.}

[cursor]

Cached host skips ssl rewrite

Medium Severity

With ssl_verify=False, the https://→http:// rewrite runs only when _resolve_index_host misses the shared _host_cache and calls describe. On a cache hit it returns the stored host unchanged, so entries written by indexes.describe (always normalized to https://) still trigger TLS against plain-HTTP Pinecone Local.

Additional Locations (1)

• pinecone/async_client/pinecone.py#L809-L812

 

^{Reviewed by Cursor Bugbot for commit 811ea2a. Configure here.}