security: remediate dependency and infrastructure gaps (Phase 3)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/dev.yml

@@ -15,7 +15,7 @@ jobs:
     name: Label PR
     runs-on: ubuntu-latest
     steps:
-      - uses: srvaroa/labeler@master
+      - uses: srvaroa/labeler@v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   commitlint:
@@ -24,7 +24,7 @@ jobs:
     name: Verify PR title / description conforms to semantic-release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: "18"
       # These rules are disabled because Github will always ensure there
@@ -47,7 +47,7 @@ jobs:
 
             ${{ github.event.pull_request.body }}
       - if: failure()
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         with:
           script: |
             const message = `**ACTION NEEDED**

.github/workflows/docs.yml

@@ -53,7 +53,7 @@ jobs:
           python -m pip install --extra-index-url https://pypi.fury.io/lance-format/ --extra-index-url https://pypi.fury.io/lancedb/ -e .
           python -m pip install --extra-index-url https://pypi.fury.io/lance-format/ --extra-index-url https://pypi.fury.io/lancedb/ -r ../docs/requirements.txt
       - name: Set up node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20
           cache: 'npm'
@@ -68,7 +68,7 @@ jobs:
         run: |
           PYTHONPATH=. mkdocs build
       - name: Setup Pages
-        uses: actions/configure-pages@v2
+        uses: actions/configure-pages@v5
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v3
         with:

.github/workflows/nodejs.yml

@@ -37,7 +37,7 @@ jobs:
       with:
         fetch-depth: 0
         lfs: true
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
       with:
         node-version: 20
         cache: 'npm'
@@ -77,7 +77,7 @@ jobs:
       with:
         fetch-depth: 0
         lfs: true
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
       name: Setup Node.js 20 for build
       with:
         # @napi-rs/cli v3 requires Node >= 20.12 (via @inquirer/prompts@8).
@@ -94,7 +94,7 @@ jobs:
       run: |
         npm ci --include=optional
         npm run build:debug -- --profile ci
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
       name: Setup Node.js ${{ matrix.node-version }} for test
       with:
         node-version: ${{ matrix.node-version }}
@@ -143,7 +143,7 @@ jobs:
       with:
         fetch-depth: 0
         lfs: true
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
       with:
         node-version: 20
         cache: 'npm'

dockerfiles/Dockerfile

@@ -1,27 +1,27 @@
-#Simple base dockerfile that supports basic dependencies required to run lance with FTS and Hybrid Search
-#Usage docker build -t lancedb:latest -f Dockerfile .
-FROM python:3.10-slim-buster
+# Simple base dockerfile that supports basic dependencies required to run lance with FTS and Hybrid Search
+# Usage: docker build -t lancedb:latest -f Dockerfile .
+FROM python:3.12-slim-bookworm
 
-# Install Rust
-RUN apt-get update && apt-get install -y curl build-essential && \
-  curl https://sh.rustup.rs -sSf | sh -s -- -y
-
-# Set the environment variable for Rust
-ENV PATH="/root/.cargo/bin:${PATH}"
-
-# Install protobuf compiler
-RUN apt-get install -y protobuf-compiler && \
+# Install build dependencies in a single layer
+RUN apt-get update && \
+  apt-get install -y --no-install-recommends \
+    curl \
+    build-essential \
+    protobuf-compiler \
+    git \
+    ca-certificates && \
   apt-get clean && \
   rm -rf /var/lib/apt/lists/*
 
-RUN apt-get -y update &&\
-  apt-get -y upgrade && \
-  apt-get -y install git
+# Install Rust (pinned installer, non-interactive)
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
 
+# Set the environment variable for Rust
+ENV PATH="/root/.cargo/bin:${PATH}"
 
 # Verify installations
 RUN python --version && \
   rustc --version && \
   protoc --version
 
-RUN pip install tantivy lancedb
+RUN pip install --no-cache-dir tantivy lancedb

docs/requirements.txt

@@ -1,9 +1,9 @@
 mkdocs==1.5.3
 mkdocs-jupyter==0.24.1
 mkdocs-material==9.5.3
-mkdocs-autorefs<=1.0
+mkdocs-autorefs>=0.5,<=1.0
 mkdocstrings[python]==0.25.2
-griffe
-mkdocs-render-swagger-plugin
-pydantic
-mkdocs-redirects
+griffe>=0.40,<1.0
+mkdocs-render-swagger-plugin>=0.1.0
+pydantic>=2.0,<3.0
+mkdocs-redirects>=1.2.0

java/pom.xml

@@ -111,7 +111,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-source-plugin</artifactId>
-                <version>2.2.1</version>
+                <version>3.3.1</version>
                 <executions>
                     <execution>
                         <id>attach-sources</id>
@@ -124,7 +124,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-javadoc-plugin</artifactId>
-                <version>2.9.1</version>
+                <version>3.11.2</version>
                 <executions>
                     <execution>
                         <id>attach-javadocs</id>
@@ -178,15 +178,15 @@
             <plugins>
                 <plugin>
                     <artifactId>maven-clean-plugin</artifactId>
-                    <version>3.1.0</version>
+                    <version>3.4.1</version>
                 </plugin>
                 <plugin>
                     <artifactId>maven-resources-plugin</artifactId>
-                    <version>3.0.2</version>
+                    <version>3.3.1</version>
                 </plugin>
                 <plugin>
                     <artifactId>maven-compiler-plugin</artifactId>
-                    <version>3.8.1</version>
+                    <version>3.14.0</version>
                     <configuration>
                         <compilerArgs>
                             <arg>-h</arg>
@@ -205,11 +205,11 @@
                 </plugin>
                 <plugin>
                     <artifactId>maven-jar-plugin</artifactId>
-                    <version>3.0.2</version>
+                    <version>3.4.2</version>
                 </plugin>
                 <plugin>
                     <artifactId>maven-install-plugin</artifactId>
-                    <version>2.5.2</version>
+                    <version>3.1.3</version>
                 </plugin>
                 <plugin>
                     <groupId>com.diffplug.spotless</groupId>
@@ -327,7 +327,7 @@
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-gpg-plugin</artifactId>
-                        <version>1.5</version>
+                        <version>3.2.7</version>
                         <executions>
                             <execution>
                                 <id>sign-artifacts</id>

nodejs/Cargo.toml

@@ -25,7 +25,7 @@ napi = { version = "3.8.3", default-features = false, features = [
 ] }
 napi-derive = "3.5.2"
 # Prevent dynamic linking of lzma, which comes from datafusion
-lzma-sys = { version = "*", features = ["static"] }
+lzma-sys = { version = "0.1", features = ["static"] }
 log.workspace = true
 
 # Pin to resolve build failures; update periodically for security patches.

python/pyproject.toml

@@ -3,10 +3,10 @@ name = "lancedb"
 # version in Cargo.toml
 dynamic = ["version"]
 dependencies = [
-    "deprecation",
-    "numpy",
+    "deprecation>=2.1.0",
+    "numpy>=1.24.0",
     "overrides>=0.7; python_version<'3.12'",
-    "packaging",
+    "packaging>=23.0",
     "pyarrow>=16",
     "pydantic>=1.10",
     "tqdm>=4.27.0",
@@ -48,25 +48,25 @@ pylance = [
     "pylance>=4.0.0b7",
 ]
 tests = [
-    "aiohttp",
-    "boto3",
+    "aiohttp>=3.9.0",
+    "boto3>=1.28.57",
     "pandas>=1.4",
-    "pytest",
-    "pytest-mock",
-    "pytest-asyncio",
-    "duckdb",
-    "pytz",
+    "pytest>=7.0",
+    "pytest-mock>=3.10",
+    "pytest-asyncio>=0.21",
+    "duckdb>=0.9.0",
+    "pytz>=2023.3",
     "polars>=0.19, <=1.3.0",
-    "tantivy",
-    "pyarrow-stubs",
+    "tantivy>=0.20.0",
+    "pyarrow-stubs>=16.0",
     "pylance>=4.0.0b7",
-    "requests",
+    "requests>=2.31.0",
     "datafusion>=52,<53",
 ]
 dev = [
-    "ruff",
-    "pre-commit",
-    "pyright",
+    "ruff>=0.3.0",
+    "pre-commit>=3.5.0",
+    "pyright>=1.1.350",
     'typing-extensions>=4.0.0; python_version < "3.11"',
 ]
 docs = ["mkdocs", "mkdocs-jupyter", "mkdocs-material", "mkdocstrings-python"]
@@ -75,21 +75,21 @@ siglip = ["torch", "pillow>=12.1.1", "transformers>=4.41.0","sentencepiece"]
 embeddings = [
     "requests>=2.31.0",
     "openai>=1.6.1",
-    "sentence-transformers",
-    "torch",
+    "sentence-transformers>=2.2.0",
+    "torch>=2.0.0",
     "pillow>=12.1.1",
-    "open-clip-torch",
-    "cohere",
+    "open-clip-torch>=2.20.0",
+    "cohere>=4.0",
     "colpali-engine>=0.3.10",
-    "huggingface_hub",
-    "InstructorEmbedding",
-    "google.generativeai",
+    "huggingface_hub>=0.19.0",
+    "InstructorEmbedding>=1.0.1",
+    "google.generativeai>=0.3.0",
     "boto3>=1.28.57",
     "awscli>=1.44.38",
     "botocore>=1.31.57",
     'ibm-watsonx-ai>=1.1.2; python_version >= "3.10"',
     "ollama>=0.3.0",
-    "sentencepiece"
+    "sentencepiece>=0.1.99"
 ]
 azure = ["adlfs>=2024.2.0"]