Files
Will JonesandClaude Opus 5.5 c2c8269fc8 fix(java): upgrade Jackson to 2.18.11 to address CVEs (#4500)
## Summary

The Java SDK pinned `jackson-databind` 2.17.1, and `jackson-core` and
the other Jackson modules came in transitively via `arrow-vector` and
`lance-namespace-apache-client` at 2.16.x–2.17.x, all affected by known
CVEs.

This imports `jackson-bom` 2.18.11 in the parent POM, and declares
`jackson-core`, `jackson-annotations`, `jackson-datatype-jsr310`, and
`jackson-jaxrs-json-provider` as direct (BOM-managed) dependencies of
`lancedb-core`. The direct declarations are needed because the parent's
dependency management doesn't apply to a consumer's transitive
resolution; without them, Maven's nearest-wins mediation still hands
downstream apps the older versions from `arrow-vector`.

## Evidence

`mvn dependency:list` in a separate consumer project depending only on
`lancedb-core`:

| Artifact | Before | After |
|---|---|---|
| jackson-core | 2.16.0 | 2.18.11 |
| jackson-annotations | 2.16.0 | 2.18.11 |
| jackson-databind | 2.17.1 | 2.18.11 |
| jackson-datatype-jsr310 | 2.16.0 | 2.18.11 |
| jackson-jaxrs-base / json-provider | 2.17.1 | 2.18.11 |
| jackson-module-jaxb-annotations | 2.17.1 | 2.18.11 |

## Merge Risk

**Door:** Two-way. Dependency versions only, and they stay within
Jackson 2.x.
**Blast Radius:** `java` dependencies. Downstream users of
`lancedb-core` now get Jackson 2.18.11 transitively.

Fixes OSS-2360, OSS-2337

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-09 19:55:19 -07:00
..

LanceDB Java Enterprise Client

Configuration and Initialization

LanceDB Cloud

For LanceDB Cloud, use the simplified builder API:

import com.lancedb.LanceDbNamespaceClientBuilder;
import org.lance.namespace.LanceNamespace;

// If your DB url is db://example-db, then your database here is example-db
LanceNamespace namespaceClient = LanceDbNamespaceClientBuilder.newBuilder()
    .apiKey("your_lancedb_cloud_api_key")
    .database("your_database_name")
    .build();

LanceDB Enterprise

For Enterprise deployments, use your custom endpoint:

LanceNamespace namespaceClient = LanceDbNamespaceClientBuilder.newBuilder()
    .apiKey("your_lancedb_enterprise_api_key")
    .database("your_database_name")
    .endpoint("<your_enterprise_endpoint>")
    .build();

MemWAL LSM write path

Most table operations reach LanceDB through the LanceNamespace above, which is generated from the Lance Namespace specification. The MemWAL LSM routes are not part of that specification, so they are issued through a separate client:

import com.lancedb.LanceDbRestClient;
import com.lancedb.LanceDbTableLsm;
import com.lancedb.LsmWriteSpec;

LanceDbRestClient client = LanceDbNamespaceClientBuilder.newBuilder()
    .apiKey("your_lancedb_cloud_api_key")
    .database("your_database_name")
    .buildRestClient();

LanceDbTableLsm lsm = new LanceDbTableLsm(client, "my_table");

// Route future merge_insert upserts through the MemWAL, hash-bucketed by `id`.
lsm.setLsmWriteSpec(LsmWriteSpec.bucket("id", 16));

// ... merge_insert traffic ...

// Converge the fresh tier into the base table.
lsm.checkpointLsm();

// Inspect live per-bucket state.
lsm.getLsmStats().ifPresent(stats -> stats.buckets().forEach(bucket ->
    System.out.println(bucket.shardId() + ": " + bucket.generations().size() + " L0 generations")));

client.close();

maintainedIndexes is tri-state, and the null default is the opposite of what a Java reader usually expects:

Value Meaning
unset (null) Maintain every index the table has, including ones created later
Collections.emptyList() Maintain none
Arrays.asList("id_idx") Maintain exactly those

Development

The parent POM includes https://maven.lance.org to resolve Lance beta and RC dependencies. Use an explicit lance-core.version; numbered beta and RC versions are Maven releases, not snapshots. Maven Central remains available for stable and historical versions, as well as other dependencies.

Build:

./mvnw install -pl lancedb-core -am

Run tests:

./mvnw test -pl lancedb-core