mirror of
https://github.com/lancedb/lancedb.git
synced 2026-11-13 14:16:54 +00:00
fix(deps)!: upgrade candle to remove vulnerable zip
## Problem `RUSTSEC-2026-0429` affects `zip 7.4.0`, which reaches the optional `sentence-transformers` feature through `candle-core 0.9.2`. The `deny` check on `main` fails on this advisory. ## Change Update `candle-core`, `candle-nn`, and `candle-transformers` to `0.11.1`. The focused lockfile resolution replaces `zip 7.4.0` with `zip 9.2.2`, and no other zip version remains in the all-features graph. This also pulls candle's required newer transitive `tokenizers` and `safetensors` releases; the directly declared `tokenizers 0.19.1` and the embedding implementation remain unchanged. The optional `sentence-transformers` Rust API exposes this dependency version: `SentenceTransformersEmbeddingsBuilder::device` accepts `D: Into<candle_core::Device>`, and the `Device` type is now from candle-core 0.11. The default CPU path constructs that device internally and is unchanged. `deny.toml` is unchanged. Its obsolete zip ignores now produce `advisory-not-detected` warnings, which do not fail the check. ## Validation - The `sentence-transformers` feature builds with tests and examples. - The existing CPU example loads the default model and retrieves `The human body has 206 bones.` for the matching query. - A local contract check verified 384-dimensional, finite, non-zero Float32 output and higher similarity for the matching fact than for an unrelated fact. It was not committed because it would add an 88 MB model download to all-features CI. - `cargo deny` `0.20.2`, the version used by the Rust workflow, passes `advisories`, `bans`, `licenses`, and `sources`. - The locally installed `cargo-deny 0.18.9` is not green: it treats informational unsound advisories differently from the workflow's `0.20.2`. The result above uses the exact CI version. - Targeted clippy, formatting, lockfile review, and the reverse `zip` dependency tree pass. - Hosted CI completed successfully for exact head `bffbcda6490fa1ed51838b3801e01ae2f82faed6`. CI mitigation: Reclaim completed lancedb CI-profile artifacts before the Blob v2 example after disk sampling showed a minimum of 24,764,416 available bytes. This may rebuild lancedb for the example; the exact OS cause of the SIGBUS remains unproven. BREAKING CHANGE: The optional `sentence-transformers` Rust API now takes `candle_core::Device` from candle-core 0.11. Downstream crates that explicitly construct and pass a candle-core 0.9 `Device` to `SentenceTransformersEmbeddingsBuilder::device` must use a `Device` from candle-core 0.11.x aligned with lancedb. This normally means updating a direct candle-core dependency; if the value comes through a re-export, update the dependency that supplies it. Callers that use the default CPU path without passing a `Device` do not need to migrate.
This commit is contained in:
Xuanwo
@@ -228,7 +228,11 @@ jobs:
|
||||
# Python and TypeScript blob docs tests install preview packages.
|
||||
# Those builds are not guaranteed to remain available for more than
|
||||
# 6 months, so they stay a manual run. This example uses the workspace crate.
|
||||
run: cargo run --profile ci --all-features -p lancedb-blob-v2-docs --example multimodal --locked
|
||||
run: |
|
||||
# The completed all-features checks leave large lancedb artifacts in target.
|
||||
# Reclaim that package before building the example with a different feature set.
|
||||
cargo clean --profile ci -p lancedb
|
||||
cargo run --profile ci --all-features -p lancedb-blob-v2-docs --example multimodal --locked
|
||||
|
||||
remote:
|
||||
timeout-minutes: 30
|
||||
|
||||
Generated
+124
-19
@@ -38,6 +38,7 @@ dependencies = [
|
||||
"const-random",
|
||||
"getrandom 0.3.4",
|
||||
"once_cell",
|
||||
"serde",
|
||||
"version_check",
|
||||
"zerocopy",
|
||||
]
|
||||
@@ -1577,32 +1578,36 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "candle-core"
|
||||
version = "0.9.2"
|
||||
version = "0.11.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c15b675b80d994b2eadb20a4bbe434eabeb454eac3ee5e2b4cf6f147ee9be091"
|
||||
checksum = "d11c8be87cfbaef9ebb62fb3f850d1fc8e00cc1d11d393fdbe55a4d5c2cdb325"
|
||||
dependencies = [
|
||||
"byteorder",
|
||||
"float8",
|
||||
"gemm",
|
||||
"half",
|
||||
"libc",
|
||||
"libm",
|
||||
"memmap2 0.9.10",
|
||||
"num-traits",
|
||||
"num_cpus",
|
||||
"parking_lot",
|
||||
"rand 0.9.5",
|
||||
"rand_distr 0.5.1",
|
||||
"rayon",
|
||||
"safetensors",
|
||||
"thiserror 2.0.18",
|
||||
"tokenizers 0.23.2",
|
||||
"yoke",
|
||||
"zerocopy",
|
||||
"zip",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "candle-nn"
|
||||
version = "0.9.2"
|
||||
version = "0.11.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3045fa9e7aef8567d209a27d56b692f60b96f4d0569f4c3011f8ca6715c65e03"
|
||||
checksum = "437fabe77547c2447c7bdf3cc946e19db29a2832440176b419f77c80b0a9a05e"
|
||||
dependencies = [
|
||||
"candle-core",
|
||||
"half",
|
||||
@@ -1616,14 +1621,14 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "candle-transformers"
|
||||
version = "0.9.2"
|
||||
version = "0.11.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b538ec4aa807c416a2ddd3621044888f188827862e2a6fcacba4738e89795d01"
|
||||
checksum = "2b1e1abeac23d7df4f94e8a3852b3dbb661d332e37c3bef479507bac867187b2"
|
||||
dependencies = [
|
||||
"byteorder",
|
||||
"candle-core",
|
||||
"candle-nn",
|
||||
"fancy-regex",
|
||||
"fancy-regex 0.19.2",
|
||||
"num-traits",
|
||||
"rand 0.9.5",
|
||||
"rayon",
|
||||
@@ -1639,6 +1644,15 @@ version = "0.3.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
|
||||
|
||||
[[package]]
|
||||
name = "castaway"
|
||||
version = "0.2.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
|
||||
dependencies = [
|
||||
"rustversion",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "cbc"
|
||||
version = "0.1.2"
|
||||
@@ -1887,6 +1901,21 @@ dependencies = [
|
||||
"unicode-width 0.2.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "compact_str"
|
||||
version = "0.9.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9dfdd1c2274d9aa354115b09dc9a901d6c5576818cdf70d14cae2bdb47df00ab"
|
||||
dependencies = [
|
||||
"castaway",
|
||||
"cfg-if 1.0.4",
|
||||
"itoa",
|
||||
"rustversion",
|
||||
"ryu",
|
||||
"serde",
|
||||
"static_assertions",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "compression-codecs"
|
||||
version = "0.4.38"
|
||||
@@ -2291,6 +2320,12 @@ version = "2.1.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "db756b5eb7d81d31f31f660f4132f8cf5698de52fca144c143d0ae0cbb5f2e06"
|
||||
|
||||
[[package]]
|
||||
name = "daachorse"
|
||||
version = "3.0.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5614204febbc33cc07a2806aa6440b904ac012b68eecc37f4493ea4a76455a3d"
|
||||
|
||||
[[package]]
|
||||
name = "darling"
|
||||
version = "0.20.11"
|
||||
@@ -2360,6 +2395,15 @@ dependencies = [
|
||||
"syn 3.0.3",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "dary_heap"
|
||||
version = "0.3.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8b1e3a325bc115f096c8b77bbf027a7c2592230e70be2d985be950d3d5e60ebe"
|
||||
dependencies = [
|
||||
"serde",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "dashmap"
|
||||
version = "6.2.1"
|
||||
@@ -3465,6 +3509,17 @@ dependencies = [
|
||||
"regex-syntax",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "fancy-regex"
|
||||
version = "0.19.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d301f5bf187b3c295fce6468d3875037a0bccc5f6b151c63cac2f85babf21912"
|
||||
dependencies = [
|
||||
"bit-set",
|
||||
"regex-automata",
|
||||
"regex-syntax",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "fast-float"
|
||||
version = "0.2.0"
|
||||
@@ -3550,9 +3605,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "float8"
|
||||
version = "0.6.1"
|
||||
version = "0.7.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "719a903cc23e4a89e87962c2a80fdb45cdaad0983a89bd150bb57b4c8571a7d5"
|
||||
checksum = "c2d1f04709a8ac06e8e8042875a3c466cc4832d3c1a18dbcb9dba3c6e83046bc"
|
||||
dependencies = [
|
||||
"half",
|
||||
"num-traits",
|
||||
@@ -5956,7 +6011,7 @@ dependencies = [
|
||||
"strum_macros 0.28.0",
|
||||
"tempfile",
|
||||
"test-log",
|
||||
"tokenizers",
|
||||
"tokenizers 0.19.1",
|
||||
"tokio",
|
||||
"tonic",
|
||||
"tracing",
|
||||
@@ -6199,7 +6254,7 @@ dependencies = [
|
||||
"anyhow",
|
||||
"byteorder",
|
||||
"csv",
|
||||
"daachorse",
|
||||
"daachorse 2.1.1",
|
||||
"kanaria",
|
||||
"lindera-dictionary",
|
||||
"log",
|
||||
@@ -6226,7 +6281,7 @@ dependencies = [
|
||||
"anyhow",
|
||||
"byteorder",
|
||||
"csv",
|
||||
"daachorse",
|
||||
"daachorse 2.1.1",
|
||||
"derive_builder",
|
||||
"encoding_rs",
|
||||
"encoding_rs_io",
|
||||
@@ -8932,6 +8987,17 @@ dependencies = [
|
||||
"rayon",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rayon-cond"
|
||||
version = "0.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2964d0cf57a3e7a06e8183d14a8b527195c706b7983549cd5462d5aa3747438f"
|
||||
dependencies = [
|
||||
"either",
|
||||
"itertools 0.14.0",
|
||||
"rayon",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rayon-core"
|
||||
version = "1.13.0"
|
||||
@@ -9684,13 +9750,15 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "safetensors"
|
||||
version = "0.7.0"
|
||||
version = "0.8.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "675656c1eabb620b921efea4f9199f97fc86e36dd6ffd1fbbe48d0f59a4987f5"
|
||||
checksum = "79b079b829cb27a1c3c374341345ed2e8b2c0c839034522cee576c140bd7f846"
|
||||
dependencies = [
|
||||
"hashbrown 0.16.1",
|
||||
"libc",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"tempfile",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -10845,7 +10913,7 @@ dependencies = [
|
||||
"paste",
|
||||
"rand 0.8.6",
|
||||
"rayon",
|
||||
"rayon-cond",
|
||||
"rayon-cond 0.3.0",
|
||||
"regex",
|
||||
"regex-syntax",
|
||||
"serde",
|
||||
@@ -10857,6 +10925,39 @@ dependencies = [
|
||||
"unicode_categories",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tokenizers"
|
||||
version = "0.23.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7afbf6e88718afcc138bad01d6ccc3051dbbc3b2ce9793d8b8a3aeb610969cfc"
|
||||
dependencies = [
|
||||
"ahash",
|
||||
"compact_str",
|
||||
"daachorse 3.0.3",
|
||||
"dary_heap",
|
||||
"derive_builder",
|
||||
"esaxx-rs",
|
||||
"fancy-regex 0.17.0",
|
||||
"getrandom 0.3.4",
|
||||
"itertools 0.14.0",
|
||||
"log",
|
||||
"macro_rules_attribute",
|
||||
"monostate",
|
||||
"paste",
|
||||
"rand 0.9.5",
|
||||
"rayon",
|
||||
"rayon-cond 0.4.0",
|
||||
"regex",
|
||||
"regex-syntax",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"spm_precompiled",
|
||||
"thiserror 2.0.18",
|
||||
"unicode-normalization-alignments",
|
||||
"unicode-segmentation",
|
||||
"unicode_categories",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tokio"
|
||||
version = "1.54.1"
|
||||
@@ -11254,9 +11355,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "typed-path"
|
||||
version = "0.12.3"
|
||||
version = "0.13.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
|
||||
checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
|
||||
|
||||
[[package]]
|
||||
name = "typenum"
|
||||
@@ -12559,14 +12660,18 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "zip"
|
||||
version = "7.4.0"
|
||||
version = "9.2.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "cc12baa6db2b15a140161ce53d72209dacea594230798c24774139b54ecaa980"
|
||||
checksum = "e408c6cc4699dd017d53dc080cd51c2cea2b5354af57a1479bd265ed42911487"
|
||||
dependencies = [
|
||||
"crc32fast",
|
||||
"getrandom 0.4.2",
|
||||
"indexmap 2.14.0",
|
||||
"libc",
|
||||
"memchr",
|
||||
"nix 0.31.3",
|
||||
"typed-path",
|
||||
"windows-sys 0.61.2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
||||
@@ -101,9 +101,9 @@ hf-hub = { workspace = true, optional = true, features = [
|
||||
"tokio",
|
||||
"ureq",
|
||||
] }
|
||||
candle-core = { version = "0.9.1", optional = true }
|
||||
candle-transformers = { version = "0.9.1", optional = true }
|
||||
candle-nn = { version = "0.9.1", optional = true }
|
||||
candle-core = { version = "0.11.1", optional = true }
|
||||
candle-transformers = { version = "0.11.1", optional = true }
|
||||
candle-nn = { version = "0.11.1", optional = true }
|
||||
tokenizers = { version = "0.19.1", optional = true }
|
||||
semver = { workspace = true }
|
||||
roaring = "0.11.4"
|
||||
|
||||
Reference in New Issue
Block a user