2956 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Jack Ye	b52df9d008	docs: give SQL one section with a page per construct ... SELECT and Enterprise SQL sat apart in Query while documenting the same engine. They are now one SQL group: overview, Select, Aggregation, Join, Window, Sampling, Functions -- one page per construct, with the Enterprise client-setup and FTS pages merged in rather than parallel to them. Sampling is new. TABLESAMPLE is implemented and was undocumented: BERNOULLI picks rows, SYSTEM picks Lance fragments, REPEATABLE fixes the draw so a sample works as a stable evaluation set. Its refusals are documented too -- a percentage over 100, a fractional row count, BUCKET, the SAMPLE spelling and the OFFSET modifier are all errors, because a sampling clause that were read and not applied would be a wrong answer rather than a missing feature. Schema & Data Types is one page again, with the multimodal content merged into its blob section rather than sitting beside it. Agentic Skills stops being a tab. Both its pages are tutorials, so they join the Tutorials tab; the Basics page that introduces them stays.	2026-09-09 23:48:38 -07:00
Jack Ye	83595ac839	docs: add data types to Basics, split the demo gallery, regroup tabs ... Basics gains a Schema & Data Types section -- the Arrow types a table can hold, the extension types Lance adds on top (lance.json, lance.blob.v2, lance.bfloat16), and where geospatial actually stands. The multimodal page moves in beside it. Consistency joins Basics too, after Query & Job. Query & Job now leads with the thing the _async convention actually gives you: a handle. execute_query_async returns a query, everything else returns a job, and both answer the same four questions -- which one, how is it going, give me the result, stop. Only the third differs, because a query produces rows to stream and a job produces an outcome to wait for. Management gains a Materialized View page. Creating one was documented only on the refresh page, and the stable-row-ids requirement is a creation-time decision that cannot be undone. Embeddings move to Integrations as the Embedding Registry, which is what they are -- a client-side feature that wraps provider models, sitting above the providers it registers. The demo gallery was three apps on one page; it is now three pages. Use Cases folds into Tutorials as Tutorials and Use Cases.	2026-09-09 23:38:50 -07:00
Jack Ye	139138c22e	docs: move versioning and branching under Table, split schema from data evolution ... Versioning and branching are properties of a table, not steps in getting data in, so they join the Table group. Consistency stays with Ingestion, where the question it answers -- when do other writers' rows become visible -- is asked. The Ingesting Data page was in the Table group while an Ingestion overview existed separately, so the two are merged. The large-dataset section was duplicated between it and the insert page; the insert page keeps it. Schema and Data Evolution covered two different things under one title. Changing a table's shape stays in Table management; deriving values from data already there becomes a Feature engineering page, next to computed columns and functions, which are the same job at larger scale.	2026-09-09 23:23:14 -07:00
Jack Ye	8f37234a86	docs: split feature engineering, move functions to Management ... Feature engineering is now the overview plus one page per operation: add a computed column, refresh a column, refresh a materialized view. Computed columns covered declaring and filling on one page, which are separate decisions with separate failure modes. Functions move to Management, where the other catalog objects are, and absorb the environment-mismatch guidance from the Enterprise page -- a symptom table worth having beside the parameters that cause it. The Enterprise feature-engineering page is merged into the overview. Two of its claims were stale: create_materialized_view is implemented for db:// connections in remote/db.py, so views are not local-only, and the tier is Enterprise rather than 'Cloud and Enterprise'. The REST reference leaves the sidebar. Mintlify only generates per-endpoint pages from a navigation group -- hidden, dropdowns, global anchors and a top-level openapi key were all tried -- so removing the group removes those pages. The overview survives as an unlisted page, linked from SDKs & SQL, and the spec still ships for anything that wants to read it directly.	2026-09-09 23:19:06 -07:00
Jack Ye	c3f428acae	docs: reorder Basics and give Management a database page ... Basics now reads outward from the format: Lance Format, Lakehouse & Catalog, Query & Job, SDKs & SQL, Agentic Skills. Jobs becomes Query & Job. Async means two unrelated things here -- whether your thread blocks, and whether the work outlives the call -- and nothing said so. The API Reference tab is gone. Its SDK index is folded into SDKs & SQL, where the surfaces are already compared; the generated REST pages move into Basics beside it. Connecting was described in passing on the catalog page. It is now a Management page covering the URI forms and what each changes, deployment options, storage options, and read consistency, since which one you pass decides what exists. Quickstart ran out at multimodal storage. It now continues through a computed column and its refresh into a PyTorch loader, which is the arc the rest of the docs assume.	2026-09-09 23:01:02 -07:00
Jack Ye	4015560b83	docs: restructure around the three API surfaces ... The Documentation tab now reads as a manual over Python, TypeScript and SQL rather than a Python guide with SQL bolted on. Basics replaces the Catalog section: what the catalog holds, what each API surface can do, jobs, agentic skills, and what Lance is. Management is new and is the CRUD and listing reference for every catalog object, with a column per language so the gaps are visible -- TypeScript has no function or SQL methods, SQL needs a deployment. Search becomes Query and gains a SELECT reference, since an analytical query is a query whether it came from a builder or a statement. Jobs is new. Every long-running operation already returned the same handle from an _async method; nothing documented it. The SQL function reference gains what Lance registers on top of DataFusion: contains_tokens, backed by the FTS index, and the JSON accessors, backed by a JSON scalar index. Geospatial st_* functions are behind a build feature LanceDB does not ship, which is now stated rather than left to a confusing error. Removes the Geneva pages' orphaned snippets, merges FTS Examples into Full-Text Search, and splits Query Optimization into Explain and Explain Analyze.	2026-09-09 22:20:19 -07:00
Jack Ye	44f4b959ca	docs: restructure the Documentation tab around catalog objects ... The tab opened on Quickstart, buried "What is LanceDB?" inside it, and put everything else under a single Guides group that had to be expanded before any section was reachable. Model training sat outside it for no reason. Reorganize around what a user does, in order: Introduction, Catalog, Ingestion, Search, Feature engineering, Training, Maintenance, SQL. Guides is gone as a level, so each section is one click. New pages: catalog overview and database, and a compaction page under Maintenance. tables/update covered four separate operations, so it becomes the Ingestion section — insert, merge insert, update, delete — with insert drawing on the large-dataset material from tables/create. Its old URL redirects. Agentic skills move to their own tab after API Reference.	2026-09-09 21:33:24 -07:00
Jack Ye	96bfdcd937	docs: drop the DataFrame API from the SQL manual ... DataFrame support is not going ahead, so the pages documenting it come out: the relational operations and the expression system, both of which described only that API. The manual was framed around having two query surfaces and choosing between them. With one, that framing is gone — the overview now leads with SQL over Arrow Flight SQL and what the dialect is, rather than with a comparison to something that will not exist. The function reference keeps everything that was about SQL: the DataFusion version, how Lance columns map onto its type system, the pseudo-columns, blob handling, and `fts()`. Only the section on reaching functions through the Python wrapper is replaced, since the wrapper is going too. Mentions of pandas and polars DataFrames elsewhere in the documentation are unrelated and untouched.	2026-09-09 20:49:50 -07:00
Jack Ye	f7ed6c6b93	docs: reference the DataFusion dialect and Lance's type mapping ... The manual said the SQL dialect's function and type reference was out of scope. It is not: the engine is DataFusion 54 with its default function set registered, so the dialect is documented already and the useful thing is to say which version and point at it. The types are worth being concrete about rather than deferring. Lance's DataFusion table provider returns the dataset's Arrow schema directly — there is no SQL type layer over storage — so DataFusion's type reference describes Lance columns exactly, and a vector column is a FixedSizeList that behaves like one. Two consequences of that mapping are documented because they surprise people. The pseudo-columns the provider can append are real and typed — `_rowid`, `_rowaddr` and `_rowoffset` are nullable UInt64, and the nullability is a reused selection bitmap rather than a missing value, so a null there means nothing. And a blob column's Arrow type depends on how it is read: descriptions by default, binary on request, which changes the schema a query sees. `fts()` is recorded as what it is, a DataFusion TableProvider over the dataset. That explains the parts that otherwise look arbitrary: why it is a table function rather than a predicate, why every column of the table is available in its result, and why projections push into the scan.	2026-09-04 00:49:37 -07:00
Jack Ye	6e1473278d	docs: frame feature engineering as a lakehouse capability ... Functions and materialized views are objects in the Lance Multimodal Lakehouse, alongside tables and indexes — created, versioned and refreshed like anything else in it. The pages introduced them as client methods, which undersold what they are and left the capability sounding like a helper rather than part of the storage layer. The materialized view page also framed Enterprise availability around which client you are holding. A reader does not care about that; they care whether views exist where their data lives. They do, refreshed across the cluster, and the page now says so and points at the Enterprise documentation rather than implying the feature is missing.	2026-09-04 00:09:04 -07:00
Jack Ye	65ed41333b	docs: distinguish this materialized view from the Enterprise one ... Both the lancedb client and the geneva client expose `create_materialized_view`, and they are not the same feature. The page said materialized views are local only, which is true of this client and misleading for anyone on Enterprise, where views are created through geneva and refreshed on the cluster. Found by assembling the combined site and reading the Geneva pages against the new ones: they described the same call as distributed and Enterprise while this one described it as raising. Both were accurate about their own client and neither said which client it meant.	2026-09-04 00:06:54 -07:00
Jack Ye	c0fe2eacda	docs: document feature engineering against the LanceDB API ... The feature engineering documentation describes the geneva package, a separate SDK. The capability it covers now lives in this client — materialized views, computed columns, and registered functions are all shipped API with no pages describing them. Four pages cover the three mechanisms and, more usefully, when each applies. The overview leads with that choice rather than with concepts, because the mechanisms overlap and picking the wrong one is the expensive mistake. Two things they say plainly that the API reference cannot: Declaring and filling are separate everywhere, and filling never revisits a row it has already done. That makes refreshes idempotent and appends cheap, and it means a filled value does not track its inputs — surprising if you expect a spreadsheet, so it is stated rather than left to be discovered. The availability split runs the opposite way to expectation. Materialized views are local only and raise on a remote connection; functions are Cloud and Enterprise only and raise on a local one. Someone reading about both in one sitting will otherwise assume the usual direction and be wrong in one of them. Examples are the tested ones from the docstrings, so they cannot drift from the behaviour they describe. The training and tutorial pages that pointed into the geneva documentation now point here.	2026-09-03 23:39:51 -07:00
Jack Ye	e687c64f94	docs: describe the documentation workflow in CONTRIBUTING ... The README that carried this sat inside docs/web, which is the published site root, so it would have shipped as a page. Contributor guidance belongs in the contributing guide, which is also where someone changing behaviour will look for whether the page describing it is theirs to update.	2026-09-02 21:10:35 -07:00
Jack Ye	b21fb2a4dc	docs: bring the open-source documentation into this repository ... The pages describing this code lived in lancedb/docs, a repository with ten stars that neither contributing guide mentioned. A user who hit a wrong page while reading the source had to find a separate, near-invisible repository to fix it. These 102 pages now sit beside the code, and a documentation fix is a pull request in the repository the reader already had open. `docs/web` is a complete Mintlify site: `cd docs/web && mint dev` serves it with no other checkout. Enterprise pages stay private and are merged in when the published site is assembled, so links into them do not resolve here — every open-source page does. `docs/web-tests` holds the tests the code examples are extracted from. They ran against a published wheel before; here they can run against this repository's own SDK, so an example that stops compiling fails the pull request that broke it rather than being noticed later. Both directories sit beside `docs/src` and are invisible to it: mkdocs reads `docs_dir: src`, so the SDK reference builds and deploys exactly as before.	2026-09-02 21:09:30 -07:00
3 people	2779b75d0d	fix(node): resolve remaining pnpm audit findings (#4073) ... `pnpm audit` in `nodejs/` reported a number of vulnerable transitive dependencies. Most were resolved by `pnpm audit --fix`, which bumped the affected packages in the lockfile; the `minimumReleaseAgeExclude` additions in `pnpm-workspace.yaml` are its bookkeeping, exempting the specific patched versions from the repository's 24-hour hold on newly published packages. Two findings needed handling by hand, because the vulnerable package could not simply be moved to a newer release in place. `@opentelemetry/sdk-metrics` 1.30.1 pins `@opentelemetry/core` to its own exact version, and the 1.x line is end-of-life, so GHSA-8988-4f7v-96qf (unbounded memory allocation in W3C Baggage propagation) has no fix available on 1.x. This PR moves the dependency to 2.x, which brings in a patched `@opentelemetry/core`. It is a dev-only dependency with a single consumer, `__test__/otel.test.ts`, and the parts of the API that test uses are unchanged between 1.x and 2.x. `@huggingface/transformers` pins `sharp: ^0.33.5`, and no released version of transformers has moved past `^0.34.5` — every version in those ranges inherits the libvips CVEs in GHSA-f88m-g3jw-g9cj, so there is no upstream release to upgrade to. This PR adds a pnpm `overrides` entry pinning sharp to the patched `^0.35.4` line instead. `pnpm audit` now reports no known vulnerabilities. ## Not included The sharp override only applies to this repository's own dependency tree, since pnpm overrides are not published to npm. Anyone installing `@lancedb/lancedb` together with the optional `@huggingface/transformers` still resolves sharp 0.33.5, and will until transformers itself moves to sharp 0.35. Practical exposure there is low: the CVEs require decoding untrusted images, and LanceDB's transformers embedding function is text-only. `nodejs/examples/` is a separate install with its own lockfile and is untouched here. It pins `sharp: "0.33.5"` directly and `pnpm audit` reports 19 findings against it. Bumping sharp there is more involved than it looks, because sharp 0.35 requires Node >= 20.9 while the examples tests run on the Node 18/20 CI matrix, so it is left for separate work. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Xuanwo <github@xuanwo.io>	2026-09-03 07:31:03 +08:00
lancedb-gatefixer[bot]	0d19a6c546	fix: support nested-list FTS indexing (#4059) ... ## Summary - validate native FTS fields against the recursively resolved terminal text leaf - preserve canonical public paths and list depth for Lance document-boundary handling - cover async nested-list index creation and deepest-list `_doc_index` search coordinates ## Root cause The FTS resolver recursively found the terminal text field but returned the outer list field. Native validation therefore rejected `List(List(Utf8))` before Lance could create a list-element index. ## Validation - `cargo test --quiet --features remote -p lancedb test_nested_list_fts_uses_deepest_document_coordinates -- --nocapture` - `cargo test --quiet --features remote -p lancedb test_execute_async_validates_fts_input_before_starting_job` - `cargo test --quiet --features remote -p lancedb test_public_fts_field_path_prefers_exact_case` - `cargo check --quiet --features remote --tests --examples` - `cargo clippy --quiet --features remote --tests --examples` - `cargo fmt --all -- --check` Fixes #4058 <!-- lance-gatekeeper-fix:v1 agent=a4e48f49d12b2b6de7f10adb1c5bf5f5 generation=1 --> Co-authored-by: Gatefixer <313497061+lancedb-gatefixer[bot]@users.noreply.github.com>	2026-09-02 17:51:21 +08:00
Lance Release	c0f33f8627	Bump version: 0.39.0-beta.0 → 0.39.0-beta.1	2026-09-02 05:28:44 +00:00
LanceDB Robot	904bd975e5	chore: update lance dependency to v12.0.0-beta.11 (#4118) ... Updates the Rust workspace Lance dependencies and Java lance-core dependency to v12.0.0-beta.11. No compatibility fixes were required. Trigger: https://github.com/lance-format/lance/releases/tag/v12.0.0-beta.11	2026-09-01 22:27:12 -07:00
Will JonesandClaude Opus 5	d2ca0ce0ab	feat: accept multiple on columns for merge insert on remote tables (#4102) ... Merge insert has always taken a list of columns to match on, and local tables have always joined on all of them. Remote tables did not: any list longer than one was rejected with `MergeInsertBuilder only supports a single 'on' column`, so a composite-key upsert was impossible against LanceDB Cloud and Enterprise from Rust, Python or TypeScript. The remote request now carries `on` as a list and sends it as one repeated query parameter per column — `?on=shard_key&on=id`. That is how the lance-namespace spec encodes an array-valued `on`, so the server receives a composite key in the shape it expects. A single column still serializes to `?on=id`, exactly what clients sent before, so existing callers are unaffected. A column repeated within `on` is now rejected client-side rather than sent for the server to reject with a 400. No binding changes were needed: `Table.merge_insert` in Python and `Table.mergeInsert` in TypeScript already accepted a list, it just could not reach a remote table. Both gain a test for composite keys, and the doc comments now say what passing several columns means. Part of [ENT-2084](https://linear.app/lancedb/issue/ENT-2084/mergeinsertintotablerequest-support-multiple-columns-for-the). ## Example ```python table.merge_insert(["shard_key", "id"]) \ .when_matched_update_all() \ .when_not_matched_insert_all() \ .execute(new_data) ``` A row whose `id` matches an existing row but whose `shard_key` differs is an insert, not an update. ## Not included Java. Java callers reach merge insert through `org.lance.namespace.LanceNamespace`, whose `MergeInsertIntoTableRequest.on` is a single string until lance-namespace 0.12 ([lance-namespace#363](https://github.com/lance-format/lance-namespace/pull/363), [lance#8915](https://github.com/lance-format/lance/pull/8915)). There is nothing in this repo's Java SDK to change until the `lance-core` pin can move. Sending more than one column requires a server that accepts the repeated parameter ([sophon#7571](https://github.com/lancedb/sophon/pull/7571)); an older server returns a 400 rather than silently merging on one column. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-01 16:32:04 -07:00
Bruno Ramirez	9a1ffb9e02	fix(remote): forward create index replace flag (#4115) ... Remote create-index requests already expose `replace` on the builder, but the remote client did not consistently forward an explicit `replace=false` over REST. That meant create-only intent could be lost before it reached a remote server, even though local builders and Python APIs can express it. This PR forwards `replace=false` on the existing `create_index` endpoint and keeps the current default behavior unchanged for compatibility. This was accomplished with the following changes: - Serialize `replace: false` into the existing remote create-index request body when the builder is configured with `.replace(false)`. - Forward `replace` through the synchronous Python remote `create_index` wrapper so `RemoteTable.create_index(..., replace=False)` reaches the repaired path. - Continue omitting `replace` for the default path so existing remote create-index requests keep their current semantics. - Document `name` and `replace` on the existing OpenAPI create-index request schema. - Add coverage that verifies the remote client uses the existing `/create_index/` route and forwards `replace=false`, including the synchronous Python unified API. ### Testing - `cargo fmt --all --check` - `cargo test -p lancedb --features remote test_create_index_forwards_replace_false_on_existing_route --locked` - `uv tool run maturin develop --extras tests,dev,embeddings` - `uv run --frozen pytest python/tests/test_remote_db.py::test_remote_create_index_new_api` - `uv run ruff format --check python/lancedb/remote/table.py python/tests/test_remote_db.py` - `cargo build -p lancedb --features remote --locked` - `cargo clippy -p lancedb --features remote --all-targets --locked -- -D warnings`	2026-09-01 11:54:53 -07:00
LanceDB Robot	f2eb4a245d	chore: update lance dependency to v12.0.0-beta.9 (#4116) ... Updates Lance dependencies from v12.0.0-beta.5 to v12.0.0-beta.9 across Rust and Java. No compatibility fixes were required; full workspace Clippy passes with all features. Lance tag: https://github.com/lance-format/lance/releases/tag/v12.0.0-beta.9	2026-09-02 00:25:27 +08:00
Xuanwo	e6867f7d04	feat: support nested blob function signatures (#4109) ... Function signatures currently reject Blob v2 fields nested inside structs, preventing UDFs from accepting or returning structured values that contain blobs. Accept canonical Blob v2 fields as direct or recursive struct children while preserving exact field metadata and nullability. Blob fields under list, large-list, fixed-size-list, or map ancestors remain rejected because collection runtime adaptation is outside the supported Function ABI. A whole named struct result can bind directly to one destination column without introducing an extra wrapper level.	2026-09-01 23:51:08 +08:00
Xuanwo	193c5e3458	feat: add list_functions client APIs (#4108) ... Function registration and exact lookup are exposed through the SDK, but clients cannot discover published versions even though the server provides `POST /v1/functions/list`. Add Rust and Python sync/async `list_functions()` APIs that return typed `FunctionVersion` values. The remote client requests canonical definitions and follows opaque page tokens until the listing is complete, including empty intermediate pages, while preserving the server's name/version ordering. Local databases retain the existing Function-catalog unsupported error. The SDK consumes protocol pagination internally so callers receive the complete catalog rather than handling server-specific page tokens.	2026-09-01 23:50:57 +08:00
Lance Release	7ebd3c222d	Bump version: 0.38.0 → 0.39.0-beta.0	2026-09-01 13:16:03 +00:00
Wyatt Alt	d118ef168b	feat: record the source namespace in a materialized view definition (#4098) ... A view definition recorded its source by bare name and refresh resolved that name at the root, so declaring a view over a namespaced source was refused outright -- materialized views were root-only for every caller. The definition now carries `source_namespace`, and refresh opens the source at that coordinate. `plan` takes the namespace too: refresh re-plans the stored definition and persists the result when it migrates, so defaulting it there would strand the view on its next rebuild. The stored kind is the version boundary. Root definitions keep the `select` form byte-for-byte, so everything written before this change reads exactly as it always did. A namespaced source is stored as `namespaced_select`: released readers drop unknown fields and resolve a `select` source at the root, so keeping the old kind would let a rolled-back worker refresh a view from a same-name root table -- the new kind routes them to their existing unrecognized-kind refusal instead. The Python and Node definition parsers learn the new kind alongside the Rust core.	2026-09-01 06:05:02 -07:00
lancedb-gatefixer[bot]andXuanwo	19232f9c50	fix: preserve duplicate take offsets (#4024) ... ## Summary - preserve repeated table offsets without adding a public ordering guarantee - retain exact requested ordering in identity and persisted permutations - cover local, projected, multi-batch, and mocked-remote query paths ## Root cause Take queries lowered offsets to a set-like IN predicate and discarded repeated occurrences. Persisted permutation loading also compared the distinct base-table result count with the requested occurrence count, rejecting repeated row IDs before its existing reordering step could expand them. ## Fix The shared take-query path now deduplicates the predicate for efficient lookup, requests row-offset metadata internally, and expands each matching row to the requested multiplicity in backend result order. An internal opt-in keeps exact requested order for identity PermutationReader reads, while persisted permutations continue using their existing ordering map. ## Validation - cargo test --quiet --features remote --tests - cargo check --quiet --features remote --tests --examples - cargo clippy --quiet --features remote --tests --examples - targeted Python local and mocked-remote regression tests - exact issue reproduction Fixes #2820 <!-- lance-gatekeeper-fix:v1 agent=75acf840afa6f4be4bff98b567b504bd generation=1 --> --------- Co-authored-by: Gatefixer <313497061+lancedb-gatefixer[bot]@users.noreply.github.com> Co-authored-by: Xuanwo <github@xuanwo.io>	2026-09-01 20:08:47 +08:00
Xuanwo	5cbd979455	fix: preserve namespace drop errors (#4099) ... ## Summary - preserve typed namespace errors returned by `drop_table` - return `TableNotFound` when dropping an absent namespace table - cover repeated drop behavior in the namespace database test ## Validation - `cargo test --quiet --features remote -p lancedb database::namespace::tests::test_namespace_drop_table --lib` - `cargo clippy --quiet --features remote -p lancedb --lib --tests -- -D warnings` ## Context Sophon SQL implements `DROP TABLE IF EXISTS` by matching `lancedb::Error::TableNotFound`. The namespace database previously wrapped this error as `Runtime`, causing cleanup to fail and mask an earlier statement error.	2026-08-31 14:02:40 -07:00
3 people	e773d1e093	build(deps): bump the rust-minor-patch group across 1 directory with 9 updates (#4084) ... Bumps the rust-minor-patch group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [async-trait](https://github.com/dtolnay/async-trait) | `0.1.91` | `0.1.92` | | [log](https://github.com/rust-lang/log) | `0.4.33` | `0.4.34` | | [moka](https://github.com/moka-rs/moka) | `0.12.15` | `0.12.16` | | [uuid](https://github.com/uuid-rs/uuid) | `1.24.0` | `1.26.0` | | [serde_with](https://github.com/jonasbb/serde_with) | `3.21.0` | `3.22.0` | | [roaring](https://github.com/RoaringBitmap/roaring-rs) | `0.11.4` | `0.11.5` | | [napi](https://github.com/napi-rs/napi-rs) | `3.11.0` | `3.12.0` | | [napi-derive](https://github.com/napi-rs/napi-rs) | `3.6.1` | `3.6.3` | | [napi-build](https://github.com/napi-rs/napi-rs) | `2.4.0` | `2.4.1` | Updates `async-trait` from 0.1.91 to 0.1.92 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dtolnay/async-trait/releases">async-trait's releases</a>.</em></p> <blockquote> <h2>0.1.92</h2> <ul> <li>Resolve double_must_use clippy lint in generated code (<a href="https://redirect.github.com/dtolnay/async-trait/issues/303">#303</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dtolnay/async-trait/commit/82e7e9edd60f622294373a23c0ce9c0077ad0263"><code>82e7e9e</code></a> Release 0.1.92</li> <li><a href="https://github.com/dtolnay/async-trait/commit/9a35cb87f9366cd992bbc00d430e1b5fe1aa0cdd"><code>9a35cb8</code></a> Merge pull request <a href="https://redirect.github.com/dtolnay/async-trait/issues/303">#303</a> from dtolnay/mustuse</li> <li><a href="https://github.com/dtolnay/async-trait/commit/875ceecb100bab2cf369178633b4791336d92b75"><code>875ceec</code></a> Resolve double_must_use clippy lint</li> <li><a href="https://github.com/dtolnay/async-trait/commit/62993a57bc6a8d5bd3de23fbae48cede333cb925"><code>62993a5</code></a> Raise minimum tested compiler to rust 1.88</li> <li>See full diff in <a href="https://github.com/dtolnay/async-trait/compare/0.1.91...0.1.92">compare view</a></li> </ul> </details> <br /> Updates `log` from 0.4.33 to 0.4.34 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rust-lang/log/releases">log's releases</a>.</em></p> <blockquote> <h2>0.4.34</h2> <h2>What's Changed</h2> <ul> <li>doc: Add context-logger utility to README by <a href="https://github.com/alekseysidorov"><code>@​alekseysidorov</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/735">rust-lang/log#735</a></li> <li>Add alloc support for boxed loggers by <a href="https://github.com/malezjaa"><code>@​malezjaa</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/737">rust-lang/log#737</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/alekseysidorov"><code>@​alekseysidorov</code></a> made their first contribution in <a href="https://redirect.github.com/rust-lang/log/pull/735">rust-lang/log#735</a></li> <li><a href="https://github.com/malezjaa"><code>@​malezjaa</code></a> made their first contribution in <a href="https://redirect.github.com/rust-lang/log/pull/737">rust-lang/log#737</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rust-lang/log/compare/0.4.33...0.4.34">https://github.com/rust-lang/log/compare/0.4.33...0.4.34</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rust-lang/log/blob/master/CHANGELOG.md">log's changelog</a>.</em></p> <blockquote> <h2>[0.4.34] - 2026-08-22</h2> <h2>What's Changed</h2> <ul> <li>doc: Add context-logger utility to README by <a href="https://github.com/alekseysidorov"><code>@​alekseysidorov</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/735">rust-lang/log#735</a></li> <li>Add alloc support for boxed loggers by <a href="https://github.com/malezjaa"><code>@​malezjaa</code></a> in <a href="https://redirect.github.com/rust-lang/log/pull/737">rust-lang/log#737</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/alekseysidorov"><code>@​alekseysidorov</code></a> made their first contribution in <a href="https://redirect.github.com/rust-lang/log/pull/735">rust-lang/log#735</a></li> <li><a href="https://github.com/malezjaa"><code>@​malezjaa</code></a> made their first contribution in <a href="https://redirect.github.com/rust-lang/log/pull/737">rust-lang/log#737</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rust-lang/log/compare/0.4.33...0.4.34">https://github.com/rust-lang/log/compare/0.4.33...0.4.34</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rust-lang/log/commit/8034743dd9d7f7583bd9a670271483d176130911"><code>8034743</code></a> Merge pull request <a href="https://redirect.github.com/rust-lang/log/issues/738">#738</a> from rust-lang/cargo/0.4.34</li> <li><a href="https://github.com/rust-lang/log/commit/7d1e24e3506d4ffa1badf6c9ea357779877adaf0"><code>7d1e24e</code></a> prepare for 0.4.34 release</li> <li><a href="https://github.com/rust-lang/log/commit/3b939b6714616dc32193c12019861c7c518c5edb"><code>3b939b6</code></a> Merge pull request <a href="https://redirect.github.com/rust-lang/log/issues/737">#737</a> from malezjaa/master</li> <li><a href="https://github.com/rust-lang/log/commit/b88266cfed8b287f8c35b2015808b09b056f61af"><code>b88266c</code></a> Add alloc support for boxed loggers</li> <li><a href="https://github.com/rust-lang/log/commit/037d7a58f6ad184abb3afc4db81d37c43a5696ec"><code>037d7a5</code></a> doc: Add context-logger utility to README</li> <li>See full diff in <a href="https://github.com/rust-lang/log/compare/0.4.33...0.4.34">compare view</a></li> </ul> </details> <br /> Updates `moka` from 0.12.15 to 0.12.16 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/moka-rs/moka/releases">moka's releases</a>.</em></p> <blockquote> <h2>v0.12.16</h2> <h2>Version 0.12.16</h2> <h3>Fixed</h3> <ul> <li>Fixed a bug where cache eviction could stall permanently when the cache was configured with the <strong>non-default</strong> LRU eviction policy (<code>EvictionPolicy::lru()</code>) by a race between insert and remove operations on the same key (<a href="https://redirect.github.com/moka-rs/moka/issues/592">#592</a><a href="https://redirect.github.com/moka-rs/moka/pull/592/">gh-pull-0592</a> by <a href="https://github.com/kim-jhyeon"><code>@​kim-jhyeon</code></a>, reported in <a href="https://redirect.github.com/moka-rs/moka/issues/590">#590</a><a href="https://redirect.github.com/moka-rs/moka/issues/590/">gh-issue-0590</a>): <ul> <li>This bug was introduced in v0.12.0 and affected <code>sync::Cache</code>, <code>sync::SegmentedCache</code> and <code>future::Cache</code>.</li> <li>A race between applying a write recording for an entry and concurrently removing that entry from the internal concurrent hash table could leave an orphaned node at the front of the LRU queue. Once present, no entry was ever evicted again and the cache grew unboundedly past <code>max_capacity</code>.</li> <li>The same race also affected the default TinyLFU eviction policy, but with a milder symptom: each occurrence permanently leaked one phantom entry slot, causing <code>entry_count</code> and <code>weighted_size</code> to over-report and the usable capacity to shrink by one entry per occurrence. Fixed by the same change.</li> </ul> </li> </ul> <h3>Changed</h3> <ul> <li>Worked around a ThreadSanitizer false positive (<a href="https://redirect.github.com/moka-rs/moka/issues/602">#602</a><a href="https://redirect.github.com/moka-rs/moka/pull/602/">gh-pull-0602</a>): <ul> <li>Replaced the standalone <code>fence(Acquire)</code> in the internal <code>MiniArc</code>'s drop path with an <code>Acquire</code> load of the reference count, so that downstream projects can now run ThreadSanitizer on code using Moka without hitting this false positive.</li> <li><code>std::sync::Arc</code> has a similar workaround.</li> </ul> </li> <li>Raised the minimum version of the <code>crossbeam-epoch</code> crate from <code>v0.9.18</code> to <code>v0.9.20</code> to avoid the following advisory (<a href="https://redirect.github.com/moka-rs/moka/issues/603">#603</a><a href="https://redirect.github.com/moka-rs/moka/pull/603/">gh-pull-0603</a>): <ul> <li>[RUSTSEC-2026-0204] crossbeam-epoch: invalid pointer dereference in <code>fmt::Pointer</code> for <code>Atomic</code> and <code>Shared</code></li> <li>Moka is <em>not</em> affected by this advisory because it never formats these pointer types. However, raising the minimum version prevents downstream lockfiles from resolving to an affected <code>crossbeam-epoch</code> version via Moka.</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/moka-rs/moka/blob/main/CHANGELOG.md">moka's changelog</a>.</em></p> <blockquote> <h2>Version 0.12.16</h2> <h3>Fixed</h3> <ul> <li>Fixed a bug where cache eviction could stall permanently when the cache was configured with the <strong>non-default</strong> LRU eviction policy (<code>EvictionPolicy::lru()</code>) by a race between insert and remove operations on the same key (<a href="https://redirect.github.com/moka-rs/moka/issues/592">#592</a>[gh-pull-0592] by [<a href="https://github.com/kim-jhyeon"><code>@​kim-jhyeon</code></a>][gh-kim-jhyeon], reported in <a href="https://redirect.github.com/moka-rs/moka/issues/590">#590</a>[gh-issue-0590]): <ul> <li>This bug was introduced in v0.12.0 and affected <code>sync::Cache</code>, <code>sync::SegmentedCache</code> and <code>future::Cache</code>.</li> <li>A race between applying a write recording for an entry and concurrently removing that entry from the internal concurrent hash table could leave an orphaned node at the front of the LRU queue. Once present, no entry was ever evicted again and the cache grew unboundedly past <code>max_capacity</code>.</li> <li>The same race also affected the default TinyLFU eviction policy, but with a milder symptom: each occurrence permanently leaked one phantom entry slot, causing <code>entry_count</code> and <code>weighted_size</code> to over-report and the usable capacity to shrink by one entry per occurrence. Fixed by the same change.</li> </ul> </li> </ul> <h3>Changed</h3> <ul> <li>Worked around a ThreadSanitizer false positive (<a href="https://redirect.github.com/moka-rs/moka/issues/602">#602</a>[gh-pull-0602]): <ul> <li>Replaced the standalone <code>fence(Acquire)</code> in the internal <code>MiniArc</code>'s drop path with an <code>Acquire</code> load of the reference count, so that downstream projects can now run ThreadSanitizer on code using Moka without hitting this false positive.</li> <li><code>std::sync::Arc</code> has a similar workaround.</li> </ul> </li> <li>Raised the minimum version of the <code>crossbeam-epoch</code> crate from <code>v0.9.18</code> to <code>v0.9.20</code> to avoid the following advisory (<a href="https://redirect.github.com/moka-rs/moka/issues/603">#603</a>[gh-pull-0603]): <ul> <li>[RUSTSEC-2026-0204] crossbeam-epoch: invalid pointer dereference in <code>fmt::Pointer</code> for <code>Atomic</code> and <code>Shared</code></li> <li>Moka is <em>not</em> affected by this advisory because it never formats these pointer types. However, raising the minimum version prevents downstream lockfiles from resolving to an affected <code>crossbeam-epoch</code> version via Moka.</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/moka-rs/moka/commit/a616ec19e8d4ed938caf8b2c88090331d778d5da"><code>a616ec1</code></a> Merge pull request <a href="https://redirect.github.com/moka-rs/moka/issues/604">#604</a> from moka-rs/chore/bump-v0.12.16</li> <li><a href="https://github.com/moka-rs/moka/commit/3b140a627e9faa4ec6a8e682224c7f81efc2b6e4"><code>3b140a6</code></a> Bump the version to v0.12.16</li> <li><a href="https://github.com/moka-rs/moka/commit/51b802dc5cfc9e0da21de04177d79028bfbe5d47"><code>51b802d</code></a> Merge pull request <a href="https://redirect.github.com/moka-rs/moka/issues/603">#603</a> from moka-rs/bump-crossbeam-epoch-floor</li> <li><a href="https://github.com/moka-rs/moka/commit/4f9071684161d59212c32a0e89762c3a5d6385a4"><code>4f90716</code></a> Raise the minimum crossbeam-epoch version to 0.9.20</li> <li><a href="https://github.com/moka-rs/moka/commit/08d0e0458bd95af7f9435ff3ffbba6d1e91647c1"><code>08d0e04</code></a> Merge pull request <a href="https://redirect.github.com/moka-rs/moka/issues/602">#602</a> from moka-rs/gh600-tsan-workaround</li> <li><a href="https://github.com/moka-rs/moka/commit/14447a7cbe441639e2aa3570e411fe493c71c9ac"><code>14447a7</code></a> Restructure the v0.12.16 TSan workaround CHANGELOG entry</li> <li><a href="https://github.com/moka-rs/moka/commit/7b14c37b009a25c9a2ec27e2669dc5f8db7ce254"><code>7b14c37</code></a> Avoid a TSan false positive by replacing the fence in MiniArc::drop</li> <li><a href="https://github.com/moka-rs/moka/commit/05b37c63098473034e7e961c1010284163ad8634"><code>05b37c6</code></a> Merge pull request <a href="https://redirect.github.com/moka-rs/moka/issues/599">#599</a> from moka-rs/gh590-deterministic-tests</li> <li><a href="https://github.com/moka-rs/moka/commit/fc318584d25c0ea01109872da37d395754647e04"><code>fc31858</code></a> Replace private doc references in gh590 test comments</li> <li><a href="https://github.com/moka-rs/moka/commit/57435922036ff4ab9f1b5bd0c3bffe6c8acd9921"><code>5743592</code></a> Improve the v0.12.16 CHANGELOG entry</li> <li>Additional commits viewable in <a href="https://github.com/moka-rs/moka/compare/v0.12.15...v0.12.16">compare view</a></li> </ul> </details> <br /> Updates `uuid` from 1.24.0 to 1.26.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/uuid-rs/uuid/releases">uuid's releases</a>.</em></p> <blockquote> <h2>v1.26.0</h2> <h2>What's Changed</h2> <ul> <li>Add ContextV7::with_additional_precision_bits by <a href="https://github.com/ChrisJr404"><code>@​ChrisJr404</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/904">uuid-rs/uuid#904</a></li> <li>Prepare for 1.26.0 release by <a href="https://github.com/KodrAus"><code>@​KodrAus</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/905">uuid-rs/uuid#905</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/uuid-rs/uuid/compare/1.25.0...v1.26.0">https://github.com/uuid-rs/uuid/compare/1.25.0...v1.26.0</a></p> <h2>1.25.0</h2> <h2>What's Changed</h2> <ul> <li>Add a serde::bytes module that encodes a Uuid as a byte string by <a href="https://github.com/ChrisJr404"><code>@​ChrisJr404</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/902">uuid-rs/uuid#902</a></li> <li>Prepare for 1.25.0 release by <a href="https://github.com/KodrAus"><code>@​KodrAus</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/903">uuid-rs/uuid#903</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ChrisJr404"><code>@​ChrisJr404</code></a> made their first contribution in <a href="https://redirect.github.com/uuid-rs/uuid/pull/902">uuid-rs/uuid#902</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/uuid-rs/uuid/compare/v1.24.1...1.25.0">https://github.com/uuid-rs/uuid/compare/v1.24.1...1.25.0</a></p> <h2>v1.24.1</h2> <h2>What's Changed</h2> <ul> <li>Fix non-ASCII character handling in parse diagnostics by <a href="https://github.com/questfever"><code>@​questfever</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/899">uuid-rs/uuid#899</a></li> <li>Prepare for 1.24.1 release by <a href="https://github.com/KodrAus"><code>@​KodrAus</code></a> in <a href="https://redirect.github.com/uuid-rs/uuid/pull/900">uuid-rs/uuid#900</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/questfever"><code>@​questfever</code></a> made their first contribution in <a href="https://redirect.github.com/uuid-rs/uuid/pull/899">uuid-rs/uuid#899</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/uuid-rs/uuid/compare/v1.24.0...v1.24.1">https://github.com/uuid-rs/uuid/compare/v1.24.0...v1.24.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/uuid-rs/uuid/commit/cdc96a87bddc38d0eb8f894c764e151d2299b4b3"><code>cdc96a8</code></a> Merge pull request <a href="https://redirect.github.com/uuid-rs/uuid/issues/905">#905</a> from uuid-rs/cargo/v1.26.0</li> <li><a href="https://github.com/uuid-rs/uuid/commit/34e4f49c0d50c12f1b3021baf98b8fb91f6407bb"><code>34e4f49</code></a> don't test macros under miri</li> <li><a href="https://github.com/uuid-rs/uuid/commit/d9e7242b37755d844d19fa74559a88e1c46c5206"><code>d9e7242</code></a> update nightly used for miri</li> <li><a href="https://github.com/uuid-rs/uuid/commit/ec16819865b89aa3c52456c8afd0ce9a90f0fcdb"><code>ec16819</code></a> prepare for 1.26.0 release</li> <li><a href="https://github.com/uuid-rs/uuid/commit/162cd208a4521138f1d8ce05b63342ba7ba5c4e6"><code>162cd20</code></a> Merge pull request <a href="https://redirect.github.com/uuid-rs/uuid/issues/904">#904</a> from ChrisJr404/v7-additional-precision-bits</li> <li><a href="https://github.com/uuid-rs/uuid/commit/97eceffa708f87969792af604291d3e4984dfc90"><code>97eceff</code></a> Add ContextV7::with_additional_precision_bits for microsecond clocks</li> <li><a href="https://github.com/uuid-rs/uuid/commit/302e0bf6dc5abf949c06973a37f1f3a093cc2699"><code>302e0bf</code></a> Merge pull request <a href="https://redirect.github.com/uuid-rs/uuid/issues/903">#903</a> from uuid-rs/cargo/1.25.0</li> <li><a href="https://github.com/uuid-rs/uuid/commit/b7ccde885d770d013f413a2685ebe7f38932e1d0"><code>b7ccde8</code></a> prepare for 1.25.0 release</li> <li><a href="https://github.com/uuid-rs/uuid/commit/c62dffbc038034ff045f3009f2536362e313bf34"><code>c62dffb</code></a> Merge pull request <a href="https://redirect.github.com/uuid-rs/uuid/issues/902">#902</a> from ChrisJr404/serde-bytes-module</li> <li><a href="https://github.com/uuid-rs/uuid/commit/8c198b24b1aa55948c0fa4b3433c1954be19c8c8"><code>8c198b2</code></a> Add a serde::bytes module that encodes as a byte string</li> <li>Additional commits viewable in <a href="https://github.com/uuid-rs/uuid/compare/v1.24.0...v1.26.0">compare view</a></li> </ul> </details> <br /> Updates `serde_with` from 3.21.0 to 3.22.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jonasbb/serde_with/releases">serde_with's releases</a>.</em></p> <blockquote> <h2>serde_with v3.22.0</h2> <h3>Added</h3> <ul> <li>Add support for <code>jiff</code> v0.2 behind the new <code>jiff_0_2</code> feature flag (<a href="https://redirect.github.com/jonasbb/serde_with/issues/936">#936</a>) <code>jiff::SignedDuration</code> works with <code>DurationSeconds</code> and its variants. <code>jiff::Timestamp</code>, <code>jiff::Zoned</code>, and <code>jiff::civil::DateTime</code> work with <code>TimestampSeconds</code> and its variants. Deserializing a <code>jiff::Zoned</code> uses the system time zone, like <code>chrono::DateTime&lt;Local&gt;</code>.</li> </ul> <h3>Fixed</h3> <ul> <li>Extend the <a href="https://github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj">GHSA-7gcf-g7xr-8hxj</a> fix to the duplicate-key-prevention collections. The <code>rust::sets_duplicate_value_is_error</code>, <code>rust::maps_duplicate_key_is_error</code>, <code>rust::sets_last_value_wins</code>, and <code>rust::maps_first_key_wins</code> adapters created their backing sets/maps with <code>with_capacity_and_hasher</code> using the raw deserializer <code>size_hint</code>, bypassing the <code>size_hint_cautious</code> cap added in <a href="https://redirect.github.com/jonasbb/serde_with/issues/966">#966</a> (the <code>clippy.toml</code> <code>disallowed_methods</code> lint only covers <code>Vec::with_capacity</code>, not <code>with_capacity_and_hasher</code>, so these sites were not flagged). Attacker-controlled input claiming a huge length could panic with <code>Hash table capacity overflow</code> before a single element was read. All such constructions now route through <code>size_hint_cautious</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jonasbb/serde_with/commit/88f576a17c5cd45cea6a30252ef10653dde69fa8"><code>88f576a</code></a> Bump version to 3.22.0 (<a href="https://redirect.github.com/jonasbb/serde_with/issues/991">#991</a>)</li> <li><a href="https://github.com/jonasbb/serde_with/commit/931e664445c2139446b84e76b339924f136a1565"><code>931e664</code></a> Bump version to 3.22.0</li> <li><a href="https://github.com/jonasbb/serde_with/commit/e26930e0b7a6c1e6463086a2447e7cc8fc6f0a24"><code>e26930e</code></a> Bump github/codeql-action from 4.37.3 to 4.37.4 in the github-actions group (...</li> <li><a href="https://github.com/jonasbb/serde_with/commit/92cd5a0bd5c7a80fc7eae90bb99b873c40429aa3"><code>92cd5a0</code></a> Bump github/codeql-action in the github-actions group</li> <li><a href="https://github.com/jonasbb/serde_with/commit/32be66fecc5c1fe4c90ac0230c0af04d1977df53"><code>32be66f</code></a> Guard with_capacity_and_hasher against untrusted size_hint (DoS) (<a href="https://redirect.github.com/jonasbb/serde_with/issues/971">#971</a>)</li> <li><a href="https://github.com/jonasbb/serde_with/commit/33871cd4dd1ecef2c3af0ead9528c8b407c16f04"><code>33871cd</code></a> Merge branch 'master' into fix/duplicate-key-impls-capacity-overflow</li> <li><a href="https://github.com/jonasbb/serde_with/commit/bb1e06484261595c8cec7fd7f4ed33ecdfb951c0"><code>bb1e064</code></a> Change function position within impl (<a href="https://redirect.github.com/jonasbb/serde_with/issues/968">#968</a>)</li> <li><a href="https://github.com/jonasbb/serde_with/commit/202d3dd617d7b5a9db5f490fa752d6ccb48454e8"><code>202d3dd</code></a> Improve the time unit macros to remove unnecessary repetition and make the co...</li> <li><a href="https://github.com/jonasbb/serde_with/commit/b347efb536caf83c850d4808f90503835fd78755"><code>b347efb</code></a> Move the <code>use_duration_signed_ser</code>/<code>*_de</code> macros utils</li> <li><a href="https://github.com/jonasbb/serde_with/commit/65905455527c0abf51f2f906bc08724426b2b922"><code>6590545</code></a> chrono_0_4: Implement the same time unit macro cleanup as jiff_0_2</li> <li>Additional commits viewable in <a href="https://github.com/jonasbb/serde_with/compare/v3.21.0...v3.22.0">compare view</a></li> </ul> </details> <br /> Updates `roaring` from 0.11.4 to 0.11.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/RoaringBitmap/roaring-rs/releases">roaring's releases</a>.</em></p> <blockquote> <h2>v0.11.5</h2> <h2>What's Changed</h2> <ul> <li>Implement std Error for IntegerTooSmall by <a href="https://github.com/Kerollmops"><code>@​Kerollmops</code></a> in <a href="https://redirect.github.com/RoaringBitmap/roaring-rs/pull/362">RoaringBitmap/roaring-rs#362</a></li> <li>fix: invalid treemap iter advance by <a href="https://github.com/silver-ymz"><code>@​silver-ymz</code></a> in <a href="https://redirect.github.com/RoaringBitmap/roaring-rs/pull/360">RoaringBitmap/roaring-rs#360</a></li> <li>Fix off-by-one that corrupts a bitmap in remove_smallest/remove_biggest (<a href="https://redirect.github.com/RoaringBitmap/roaring-rs/issues/359">#359</a>) by <a href="https://github.com/youdie006"><code>@​youdie006</code></a> in <a href="https://redirect.github.com/RoaringBitmap/roaring-rs/pull/363">RoaringBitmap/roaring-rs#363</a></li> <li>Upgrade dependencies bump version by <a href="https://github.com/Kerollmops"><code>@​Kerollmops</code></a> in <a href="https://redirect.github.com/RoaringBitmap/roaring-rs/pull/364">RoaringBitmap/roaring-rs#364</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/silver-ymz"><code>@​silver-ymz</code></a> made their first contribution in <a href="https://redirect.github.com/RoaringBitmap/roaring-rs/pull/360">RoaringBitmap/roaring-rs#360</a></li> <li><a href="https://github.com/youdie006"><code>@​youdie006</code></a> made their first contribution in <a href="https://redirect.github.com/RoaringBitmap/roaring-rs/pull/363">RoaringBitmap/roaring-rs#363</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/RoaringBitmap/roaring-rs/compare/v0.11.4...v0.11.5">https://github.com/RoaringBitmap/roaring-rs/compare/v0.11.4...v0.11.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/RoaringBitmap/roaring-rs/commit/0ce3fc8b55b193ce220253bfbc0c3e09bd171375"><code>0ce3fc8</code></a> Merge pull request <a href="https://redirect.github.com/RoaringBitmap/roaring-rs/issues/364">#364</a> from RoaringBitmap/upgrade-dependencies-bump-version</li> <li><a href="https://github.com/RoaringBitmap/roaring-rs/commit/a961a042db8d325515e6b5273a2e9369fe5c931d"><code>a961a04</code></a> Remove the once_cell dependency</li> <li><a href="https://github.com/RoaringBitmap/roaring-rs/commit/5e8445b2d6914e8e56d85de340f9156825f4e91b"><code>5e8445b</code></a> Merge pull request <a href="https://redirect.github.com/RoaringBitmap/roaring-rs/issues/363">#363</a> from youdie006/fix/359-interval-remove-boundary</li> <li><a href="https://github.com/RoaringBitmap/roaring-rs/commit/bf2961d99fb4da2c540a55eb699228a7bb00a732"><code>bf2961d</code></a> Bump version to v0.11.5</li> <li><a href="https://github.com/RoaringBitmap/roaring-rs/commit/048a8b05fcae08636354607f0c00d6e95f262107"><code>048a8b0</code></a> Fix off-by-one that corrupts a bitmap in remove_smallest/remove_biggest</li> <li><a href="https://github.com/RoaringBitmap/roaring-rs/commit/27d84f567dd85243194d2b87683262ef43a5dd97"><code>27d84f5</code></a> Merge pull request <a href="https://redirect.github.com/RoaringBitmap/roaring-rs/issues/360">#360</a> from silver-ymz/fix/treemap-iter-advance-across-bitmaps</li> <li><a href="https://github.com/RoaringBitmap/roaring-rs/commit/aac2de82a7f9e44fd73d8364de840169447d580b"><code>aac2de8</code></a> Make clippy happy</li> <li><a href="https://github.com/RoaringBitmap/roaring-rs/commit/a3d1d54be985fe22c01e882f85c3ee7055ad9c8b"><code>a3d1d54</code></a> Merge pull request <a href="https://redirect.github.com/RoaringBitmap/roaring-rs/issues/362">#362</a> from RoaringBitmap/std-error-for-integer-too-small</li> <li><a href="https://github.com/RoaringBitmap/roaring-rs/commit/9a3c33e42c0b14bdd3f296313ee367526092aa81"><code>9a3c33e</code></a> Implement std Error for IntegerTooSmall</li> <li><a href="https://github.com/RoaringBitmap/roaring-rs/commit/f46c0ffe90b6d5d52a93106253bb6fa51a08c137"><code>f46c0ff</code></a> fix: invalid treemap iter advance</li> <li>See full diff in <a href="https://github.com/RoaringBitmap/roaring-rs/compare/v0.11.4...v0.11.5">compare view</a></li> </ul> </details> <br /> Updates `napi` from 3.11.0 to 3.12.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/napi-rs/napi-rs/releases">napi's releases</a>.</em></p> <blockquote> <h2>napi-v3.12.0</h2> <h3>Added</h3> <ul> <li><em>(cli)</em> support non-threaded WASI targets (<a href="https://redirect.github.com/napi-rs/napi-rs/pull/3353">#3353</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/napi-rs/napi-rs/commit/58bd87fa524a837a7c962ab4103e5588557ccd81"><code>58bd87f</code></a> chore: release (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3414">#3414</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/9da87236dbc4fef99f066b7a130f4d0377308d44"><code>9da8723</code></a> chore(release): publish</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/8d22196aa98a1e6e70584561f5446d117d9c802c"><code>8d22196</code></a> chore(deps): update dependency oxc-parser to ^0.142.0 (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3422">#3422</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/abc30fbafc2e3967d499cef970c68b3edfefd850"><code>abc30fb</code></a> build(deps): bump postcss from 8.5.17 to 8.5.23 (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3421">#3421</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/55421392cbaa24d4df69419e4c6d4958fbcb6a12"><code>5542139</code></a> build(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3418">#3418</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/dc4ee8c89cc27ce30e239482199b3b3d786bf8b6"><code>dc4ee8c</code></a> build(deps): bump fast-uri from 3.1.3 to 3.1.4 (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3419">#3419</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/050d985196174b4be830cdb813d09e2705258455"><code>050d985</code></a> feat(async-runtime): drain-linger surface + lock-free scheduler internals (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3">#3</a>...</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/e0b87086eefe0e7efeea6d269e9403c4be4ba9aa"><code>e0b8708</code></a> chore(deps): update dependency oxc-parser to ^0.141.0 (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3417">#3417</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/fc8494010697d078a93a528c3180271f6f187504"><code>fc84940</code></a> chore(deps): update actions/setup-node action to v7 (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3413">#3413</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/ee598db45985ef11e18c7340801c28bb2452b688"><code>ee598db</code></a> build(deps): bump protobufjs from 7.6.4 to 7.6.5 (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3410">#3410</a>)</li> <li>Additional commits viewable in <a href="https://github.com/napi-rs/napi-rs/compare/napi-v3.11.0...napi-v3.12.0">compare view</a></li> </ul> </details> <br /> Updates `napi-derive` from 3.6.1 to 3.6.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/napi-rs/napi-rs/releases">napi-derive's releases</a>.</em></p> <blockquote> <h2>napi-derive-v3.6.3</h2> <h3>Other</h3> <ul> <li>updated the following local packages: napi-derive-backend</li> </ul> <h2>napi-derive-v3.6.2</h2> <h3>Other</h3> <ul> <li>updated the following local packages: napi-derive-backend</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/napi-rs/napi-rs/commit/956e4525fea6a676ea3680b711382f167b899af9"><code>956e452</code></a> chore: release (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3448">#3448</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/73048f5a7fdbd42cdc2f46f2d5ac60ef27417bfa"><code>73048f5</code></a> chore(release): publish</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/61fae8a1440ad8b7249f3cd7838fc2bafe00a906"><code>61fae8a</code></a> fix(napi): stop unloading addons with live native code, preserve non-Error re...</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/93e86ce167095e84f2be2ae1c66a6c0bb96fec49"><code>93e86ce</code></a> chore(release): publish</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/2c905991899b9f12a0df4072c4bff6d62ef70d26"><code>2c90599</code></a> fix(cli): support npm 12 pack output (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3449">#3449</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/360b1ec99ab0d001147d29e11c416c8338d3d1c9"><code>360b1ec</code></a> fix(wasi): avoid randomness during module registration (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3447">#3447</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/b648c4090e7518ced18c9eca6059d27af3ab511b"><code>b648c40</code></a> build(deps): bump nanoid from 3.3.16 to 3.3.18 (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3446">#3446</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/ffda4efff4bc4ebb6bef1f629dd0a6f09dc8f210"><code>ffda4ef</code></a> chore(deps): update dependency js-yaml to v4.3.1 [security] (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3445">#3445</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/387b0dc7986018e44a4a0b466b030dc414170411"><code>387b0dc</code></a> feat(cli): size WASI browser worker pools from navigator.hardwareConcurrency ...</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/61e4346ce3d9a9c13e5c5dd6fb3b7d5e1b1d6e0d"><code>61e4346</code></a> build(deps): bump fast-uri from 3.1.4 to 3.1.5 (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3440">#3440</a>)</li> <li>Additional commits viewable in <a href="https://github.com/napi-rs/napi-rs/compare/napi-derive-v3.6.1...napi-derive-v3.6.3">compare view</a></li> </ul> </details> <br /> Updates `napi-build` from 2.4.0 to 2.4.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/napi-rs/napi-rs/releases">napi-build's releases</a>.</em></p> <blockquote> <h2>napi-build-v2.4.1</h2> <h3>Fixed</h3> <ul> <li><em>(napi)</em> stop unloading addons with live native code, preserve non-Error rejections, and add the wasm teardown barrier (<a href="https://redirect.github.com/napi-rs/napi-rs/pull/3423">#3423</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/napi-rs/napi-rs/commit/956e4525fea6a676ea3680b711382f167b899af9"><code>956e452</code></a> chore: release (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3448">#3448</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/73048f5a7fdbd42cdc2f46f2d5ac60ef27417bfa"><code>73048f5</code></a> chore(release): publish</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/61fae8a1440ad8b7249f3cd7838fc2bafe00a906"><code>61fae8a</code></a> fix(napi): stop unloading addons with live native code, preserve non-Error re...</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/93e86ce167095e84f2be2ae1c66a6c0bb96fec49"><code>93e86ce</code></a> chore(release): publish</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/2c905991899b9f12a0df4072c4bff6d62ef70d26"><code>2c90599</code></a> fix(cli): support npm 12 pack output (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3449">#3449</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/360b1ec99ab0d001147d29e11c416c8338d3d1c9"><code>360b1ec</code></a> fix(wasi): avoid randomness during module registration (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3447">#3447</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/b648c4090e7518ced18c9eca6059d27af3ab511b"><code>b648c40</code></a> build(deps): bump nanoid from 3.3.16 to 3.3.18 (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3446">#3446</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/ffda4efff4bc4ebb6bef1f629dd0a6f09dc8f210"><code>ffda4ef</code></a> chore(deps): update dependency js-yaml to v4.3.1 [security] (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3445">#3445</a>)</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/387b0dc7986018e44a4a0b466b030dc414170411"><code>387b0dc</code></a> feat(cli): size WASI browser worker pools from navigator.hardwareConcurrency ...</li> <li><a href="https://github.com/napi-rs/napi-rs/commit/61e4346ce3d9a9c13e5c5dd6fb3b7d5e1b1d6e0d"><code>61e4346</code></a> build(deps): bump fast-uri from 3.1.4 to 3.1.5 (<a href="https://redirect.github.com/napi-rs/napi-rs/issues/3440">#3440</a>)</li> <li>Additional commits viewable in <a href="https://github.com/napi-rs/napi-rs/compare/napi-build-v2.4.0...napi-build-v2.4.1">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Will Jones <willjones127@gmail.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-31 10:40:11 -07:00
Yang Cen	c8fd3e97d1	test(python): cover stable main udf registration identity (#4094) ... ## Other changes ### What changed? - Add a subprocess regression harness for an ordinary `@udf` function defined in `__main__`. - Verify the full registration request, artifact digest, and Function signature stay identical across independent Python processes and renamed/moved script paths. - Verify body, referenced-global, and annotation changes still produce distinct artifact identities, with annotation changes also producing a distinct Function signature. ### Why is the change needed? [ENT-2441](https://linear.app/lancedb/issue/ENT-2441/make-sure-function-defined-in-main-gets-stable-signature) tracks the stability guarantee. Investigation on the exact `840e1d73` main base found that LanceDB already packages canonical source instead of cloudpickle bytes, so the unchanged `__main__` function is stable and no production-code fix is needed. This change closes the missing regression-test coverage. [GEN-950](https://linear.app/lancedb/issue/GEN-950/class-based-udfs-defined-in-main-get-a-new-auto-version-on-every-run) remains a separate Geneva checkpoint-version issue for class-based callables. LanceDB's Function API continues to accept synchronous Python functions only. ## Validation - `cd python && uv run --extra tests pytest python/tests/test_first_class_function_slice2.py -q` (`40 passed`) - `uv run --project python --extra dev ruff format .` - `uv run --project python --extra dev ruff check .` (`All checks passed!`)	2026-08-31 22:34:34 +08:00
Xuanwo	c196d033e9	feat: add drop_function client APIs (#4097)	2026-08-31 22:17:11 +08:00
Yang CenandClaude	16753b805a	revert: restore the lance v12.0.0-beta.5 pin on main (#4095) ... Reverts #4093 (`c4ee8ae`), restoring main's lance dependency to v12.0.0-beta.5 and the v12 integration surface it carried — the `read_dir_page` paginated-listing pushdown from #3979, the v12 object-store wrapper APIs, and the shard-manifest call sites. Pinning lance v11.0.0 stable belonged on a dedicated release branch for cutting v0.38.0, not on main: main was already on the v12 beta train, so #4093 was a downgrade of the development line. The released **v0.38.0 stands as published** — this only moves main forward again. Verified on this branch: `cargo check --features remote --tests --examples` clean, all 48 `database::listing` tests pass (the restored store-pushdown pagination versions), `cargo fmt --check` and `cargo clippy --features remote --tests --examples` clean. The root `Cargo.lock` is restored by the revert and resolves as-is. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01BX7w9fUMQbPAXuxe9YgQKc --- _Generated by [Claude Code](https://claude.ai/code/session_01BX7w9fUMQbPAXuxe9YgQKc)_ Co-authored-by: Claude <noreply@anthropic.com>	2026-08-31 20:40:46 +08:00
Lance Release	840e1d7313	Bump version: 0.38.0-beta.16 → 0.38.0	2026-08-31 07:38:51 +00:00
Lance Release	1a9414c47c	Bump version: 0.38.0-beta.15 → 0.38.0-beta.16	2026-08-31 07:38:25 +00:00
LanceDB Robot	c4ee8ae670	feat: update lance dependency to v11.0.0 (#4093) ... Updates the Rust workspace and Java lance-core dependency to Lance v11.0.0. Includes compatibility adjustments for the Lance 11 object-store, table-listing, and shard-manifest APIs.	2026-08-31 15:35:09 +08:00
Lance Release	57b8d3bf05	Bump version: 0.38.0-beta.14 → 0.38.0-beta.15	2026-08-31 07:33:34 +00:00
Jack Ye	c6dfe830d9	feat(python): support large_utf8 function signatures (#4092) ... Teach the Python Function signature emitter to serialize PyArrow large strings as the canonical Arrow type name `large_utf8`. Extend the shared Function Arrow type fixture and explicit-schema coverage for scalar, nested, list, and large-list compositions.	2026-08-31 00:32:04 -07:00
Jack Ye	d5dac65a21	feat: support Blob v2 UDF signatures (#4091) ... Make Function authoring and declaration planning treat Blob v2 as a scalar semantic type while preserving exact Blob metadata in binding schemas. Covers scalar Blob outputs, expanded named-struct outputs, and whole-result structs with Blob children.	2026-08-30 23:33:30 -07:00
Lance Release	1b0fc2c465	Bump version: 0.38.0-beta.13 → 0.38.0-beta.14	2026-08-30 15:16:33 +00:00
Xuanwo	a417e46bfa	feat(functions): support GPU resource requirements (#4085) ... Functions can describe their Python environment today, but cannot declare accelerator requirements. That prevents Sophon from scheduling computed-column UDF refreshes onto GPU workers from the immutable Function definition. Add `num_gpus` to Python `@udf` through a typed `FunctionResourceRequirements` value and represent resource-aware definitions with the `python_v2` runtime discriminator. CPU Functions retain their existing `python` encoding and canonical identity. The new discriminator is intentional for mixed-version safety: deployments that do not understand execution resources reject the runtime instead of accepting a new field and silently running the Function on CPU. Required resources are part of Function version identity; priority, concurrency, and retry policy remain Job concerns. The actual resource scheduling remains owned by Sophon.	2026-08-30 08:10:08 -07:00
Jack Ye	fcdc3f949e	fix: allow multiple function bindings per table (#4090) ... Allow a remote Function declaration when the table already contains valid, supported Function binding metadata. Existing bindings remain fully validated, including fail-closed handling for newer or inconsistent contracts, while other schema mutations retain their existing no-binding guard. Add planner and remote request-path regression coverage for a second binding and reject dependent Function inputs, including nested paths.	2026-08-30 01:16:57 -07:00
Lance Release	0c4e0667bc	Bump version: 0.38.0-beta.12 → 0.38.0-beta.13	2026-08-30 06:09:21 +00:00
Jack Ye	101f524e47	feat(python): support nested Function Arrow types (#4088) ... Teach Python Function authoring to retain the compact V1 grammar for existing types and emit canonical exact JSON for nested struct signatures. Adds coverage for recursive struct/list schemas and exact field properties.	2026-08-29 23:07:59 -07:00
LanceDB RobotandJack Ye	36c142fa2e	chore: update lance dependency to v12.0.0-beta.5 (#4089) ... Updates the Rust workspace and Java lance-core dependency to Lance v12.0.0-beta.5. Includes minimal Rust 1.97 Clippy compatibility fixes required by validation. Lance tag: https://github.com/lance-format/lance/releases/tag/v12.0.0-beta.5 --------- Co-authored-by: Jack Ye <yezhaoqin@gmail.com>	2026-08-29 14:51:41 -07:00
Will JonesandClaude Opus 5	a87cada90e	feat(node)!: require Node >= 22 and drop npm lockfiles (#4074) ... The bindings are built, installed and published with pnpm everywhere, but a parallel npm dependency graph was still being maintained beside it. This removes it, raises the supported Node floor to the versions we actually test, and gives Dependabot the npm coverage it was missing. ## Dropping npm `nodejs/package-lock.json` was regenerated by `ci/update_lockfiles.sh` on every release commit and read by nothing — no workflow runs `npm ci` or `npm install` in `nodejs/`, and npm never publishes a lockfile in a package tarball. It could not even agree with the real install, since npm does not see pnpm's `overrides`. Because GitHub's dependency graph parses `package-lock.json`, it was also reporting vulnerabilities for a tree we neither install nor ship. `docs/package.json`, `docs/package-lock.json` and `docs/tsconfig.json` go too. They depend on `file:../node` and `file:../node/node_modules/apache-arrow` — the `node/` directory was removed long ago — the tsconfig compiles `src/*.ts` where no TypeScript files exist, and nothing installs any of it. `docs.yml` only referenced the lockfile to configure an npm cache for an install it never ran. Two `workflow_dispatch` workflows for regenerating those lockfiles are removed as well. Both were already broken: they `uses:` composite actions at `.github/workflows/update_package_lock{,_nodejs}` that do not exist, so dispatching either failed immediately. The remaining `npx` calls become direct `node_modules/.bin/...` invocations. These were already running locally installed binaries rather than resolving anything, but naming the binary removes the npm CLI from the loop and does not depend on which Node version is active. `dev.yml`'s commitlint check was the last place doing real npm dependency resolution — an unpinned `npm install @commitlint/config-conventional` that also bypassed the `minimumReleaseAge` hold configured for `nodejs/` — and is now a pinned `pnpm dlx`. ## Node support Node 18 and 20 both reached end-of-life, in April 2025 and April 2026. The matrix moves to 22, 24 and 26, and `engines` rises from `>= 18` to `>= 22` so the declared floor is one the matrix actually covers. Node 22 is LTS until April 2027; 24 is LTS; 26 is Current and becomes LTS in October 2026. This also removes the reason the workflows reached for `npx` in the first place: pnpm 11 requires Node >= 22.13, which every matrix version now satisfies. The prebuilt-binary smoke test in `npm-publish.yml` moves from Node 20 to Node 22 — the floor, where a napi ABI problem would surface first — rather than fanning out across all three, to keep the publish matrix from tripling. ## Dependabot There were no npm-ecosystem entries at all, which is why the advisories behind #4073 went unnoticed. Both pnpm lockfiles are now watched — `nodejs/` and `nodejs/examples/`, which is a separate install — using the same `lockfile-only` strategy as the existing cargo and pip entries, so version ranges in `package.json` are left alone. ## Pre-commit biome The hook ran `npx @biomejs/biome@1.8.3` while `nodejs/package.json` resolved 1.9.4. The two disagree about formatting, so the hook rejected code that `pnpm lint` accepts, and failed on unmodified `main` for anyone touching `nodejs/`. It now uses the pnpm-managed biome, which fixes the drift with no source changes. ## Testing `dev.yml`'s commitlint job does not check out the repo, so it runs in an empty workspace, and I could not verify `pnpm/action-setup` there locally. It triggers on `pull_request_target`, so this PR exercises it directly — worth confirming green before merge. I did verify the `pnpm dlx` invocation itself locally: it accepts a conventional title and rejects a non-conventional one with exit 1. Node 26 is new enough that the examples job may surface gaps in prebuilt native binaries (`onnxruntime-node`, `sharp`) before their maintainers publish for it. ## Not included `nodejs/examples/` still pins `sharp: "0.33.5"` and has its own audit findings. Raising the Node floor unblocks that work — sharp 0.35 requires Node >= 20.9, which the matrix now satisfies — but it is a dependency bump rather than tooling cleanup, so it is left separate. ## Breaking changes `@lancedb/lancedb` now requires Node >= 22; previously >= 18. The `@types/node` peer range moves from `>=18` to `>=22` to match. Users on Node 18 or 20 must upgrade their runtime; both have been end-of-life for some time. Existing installs are unaffected, since `engines` is only checked on install. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-28 09:47:47 -07:00
Xuanwo	0559108fa9	feat: support blob computed column refresh (#4081) ... Computed-column planning currently sees Blob v2 storage descriptors, so expressions cannot consume payload bytes or preserve Blob semantics in their outputs. A computed declaration now derives its output field from its expression. A direct projection of a Blob v2 field inherits the source field's Blob metadata; other expressions retain their ordinary Arrow-inferred type. Declarations remain ordered, so the same rule applies across chained projections. Refresh materializes referenced Blob inputs as `LargeBinary` payload bytes and publishes inherited Blob outputs through Lance's Blob conversion path. Remote requests remain within the shared namespace contract as `{name, computed}`; the server planner is being updated in tandem to implement the same Blob-aware planning semantics, and remote enablement must be aligned with that server rollout. The existing null-as-unfilled contract remains unchanged. Row-level freshness and cell flags remain follow-up work.	2026-08-28 17:23:49 +08:00
Will Jones	6ab3b9eb30	ci: upgrade chacha20 to 0.10.2 (#4078) ... The pinned version was yanked due to UB in some SIMD kernels. Upgrading.	2026-08-27 19:06:07 -07:00
Lance Release	c94d9a2a16	Bump version: 0.38.0-beta.11 → 0.38.0-beta.12	2026-08-28 00:52:01 +00:00
Wyatt Alt	6c8aa22704	feat: let a computed-column batch read its own earlier declarations (#4072) ... `add_columns().computed()` accepted several columns in one call but bound each against the table's schema as it stood before the call, so `a` and `b = a + 1` had to be two commits. A server staging declarations behind other schema work has no atomic way to do that, and a caller reading the builder's plural signature reasonably expects the batch to be one. Each accepted column now joins the schema the next one resolves against, so the batch is planned and committed as one. Order is the dependency order; reading ahead is still an unknown column. `validate_declarations` exposes the schema-level checks -- the Function-binding guard and the planning -- without a commit, for callers that must reject before earlier work in the same request lands; LSM state is table state and stays a commit-time check. Refresh order matters for a dependent column: `b = coalesce(a, 0)` refreshed before `a` would bake zeros from `a`'s placeholder null, and the fill-once contract keeps them. Refresh now refuses, naming the input, while a computed input still has rows a refresh of it would fill -- the same probe refresh already uses to detect a no-op. Otherwise it is one snapshot and one commit, as before; a concurrent append is not in the commit and waits for the next refresh. Refreshing dependencies on the caller's behalf was considered and rejected: it is not how materialized views or our own backfill scheduler behave, and it needs multi-commit fencing that an explicit per-row fill marker would make unnecessary.	2026-08-27 17:47:27 -07:00
Will JonesandClaude Opus 5	84f46df876	ci(nodejs): fix nightly OOM on the aarch64 publish legs (#4077) ... The nightly `NPM Publish` run has failed every night since at least Aug 23, always on the same two legs: `aarch64-unknown-linux-gnu` and `aarch64-unknown-linux-musl`. The other five targets pass. rustc is OOM-killed during the fat-LTO codegen of the cdylib — `signal: 9` with no diagnostic, about 27 minutes in — and on the musl leg that takes the whole runner down with `The runner has received a shutdown signal`. Both legs now pass: | leg | before | peak memory | wall time | | --- | --- | --- | --- | | `aarch64-unknown-linux-gnu` | OOM-killed at ~27 min | 31391 → 22851 MiB | 38m43s → 22m04s | | `aarch64-unknown-linux-musl` | runner killed at ~28 min | >32 GiB → 16516 MiB | ~40 min → 20m50s | **ThinLTO** is most of that. Fat LTO is single-threaded, and its peak is consumed inside rustc's LLVM before any linker process is spawned — which is why it is the whole fix on musl, and why lld alone left the gnu leg still peaking at 31391 MiB against the runner's 32 GiB. Both legs now use the `lto: thin` / `codegen_units: 16` settings that darwin and both Windows legs already use, at a cost of a few percent runtime performance. **lld** covers the rest, on the gnu leg. arm64 Linux otherwise links through GNU `ld` where x86_64 already defaults to `rust-lld`, which is why only the arm64 legs hit this at all; on a comparable arm64 build (`lancedb/sophon#7313`) it cut the largest single linker process from 7.0 to 4.0 GiB and wall time by 35%. The flags live in a small wrapper script used as the linker rather than in `-C link-arg`, because the per-target rustflags variable does not reach every unit that links: dependency crates linking a dylib (`crc-fast`, `lance-arrow`) were invoked as bare `clang`, which targets the x86_64 host and fails with `Relocations in generic ELF (EM: 183)`. Separately, and affecting five legs rather than two: the three ThinLTO targets exported `CARGO_PROFILE_RELEASE_LTO` and `CARGO_PROFILE_RELEASE_CODEGEN_UNITS` from `pre_build`, which runs inside the build step — after the cache step. `Swatinem/rust-cache` computes its key when the action runs, before any step, so step-local values are invisible to it. The result is a loop that never converges: the key never changes, so restores are exact hits, an exact hit makes the post-run save a no-op, and cargo invalidates the restored artifacts anyway because the flags differ. Those legs have been rebuilding cold on every run. Both values move to job-level `env:` ahead of the cache step, driven by new `lto:`/`codegen_units:` matrix fields, and are forwarded into the containers with `-e` since `docker run` inherits nothing. Every leg's cache key shifts once as a result, so expect one cold rebuild. A `Report peak memory` step is added so whether these legs fit is a number rather than an inference from whether the runner survived. It produced the figures above. ## Not included Moving these legs to native arm64 runners. It would retire the zig cross path, the `AT_HWCAP2` workaround and the `TARGET_CC` override, and arm64 runners are billed roughly 37% below x64 at equal core count — but the `lts-debian-aarch64` image exists to link against the manylinux2014 sysroot's glibc 2.17, and building natively on ubuntu-24.04 would raise the minimum glibc for every published aarch64 binary. That is a user-facing decision, not a CI cleanup. Dropping these legs to smaller runners, which is where the real cost saving is — larger runners are billed even on public repos. On these numbers it is not available yet: musl at 16516 MiB is about 130 MiB over what a 16 GB standard runner has. Worth revisiting as a follow-up. ## Testing Cargo's rustflags precedence was checked locally rather than taken from the docs, since getting it wrong would silently change the published binaries. With a throwaway crate carrying both a `target.'cfg(all())'` and a per-target rustflags table: setting `RUSTFLAGS` discards both, and setting it to the empty string discards them too. That rules out routing the linker flag through a job-level `RUSTFLAGS`, because `env:` keys cannot be conditionally omitted and every other leg would then silently lose the `target-cpu`/`target-feature` settings in `.cargo/config.toml` — `+avx2` on x86_64 and `-crt-static` on aarch64-musl. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-27 17:35:06 -07:00
Drew	83cff3ab93	fix(python): use one blobv2 type and coerce blob writes by metadata (#4065)	2026-08-27 17:07:29 -07:00