Will JonesandClaude Opus 5.5
2f496529ca
## Summary Bumps dependencies that Aikido flags with critical advisories, where a patched version is available without code changes. | Package | Where | From → To | Ships to users | |---|---|---|---| | jackson (BOM) | `java/pom.xml` | 2.18.11 → 2.18.12 | Yes, via the published pom | | zerovec / zerovec-derive | `Cargo.lock` | 0.11.6 → 0.11.8 / 0.11.3 → 0.11.7 | Yes, linked into the wheels and Node binaries | | pillow | `python/uv.lock` | 12.3.0 → 13.0.0 | No, dev lockfile | | pyarrow | `python/uv.lock` | 24.0.0 → 26.0.1 | No, dev lockfile | | pyjwt, urllib3, anyio, cryptography | `python/uv.lock` | → 2.15.1, 2.8.0, 4.16.0, 50.0.2 | No, dev lockfile | | pillow | `docs/web-tests/blob-v2/py/requirements.txt` | 12.1.1 → 13.0.0 | No | pyarrow was held at 24.0.0 by a `pyarrow<25` pin in the `tests` extra. It came in with #3675 without a stated reason, so this PR removes it. pillow 13 and pyarrow 26 require Python 3.11+, so the lockfile keeps pillow 12.3.0 and pyarrow 25.0.1 on Python 3.10, and those remain flagged. The sharp findings in the Node examples and docs are not addressed here. They come from the `@huggingface/transformers@3.0.2` optional dependency, which needs a major upgrade to 4.3+. ## Evidence With the pyarrow pin removed and pyarrow 26.0.1 installed, the Python suite (`-m "not slow and not s3_test"`) passed locally on Python 3.12: 3319 passed, 164 skipped. That run was on main as of #4879; this branch is based on a slightly newer main. ## Merge Risk **Door:** Two-way. Patch and minor version bumps that a revert undoes. **Blast Radius:** Java consumers (jackson patch release), native binaries (zerovec patch release), Python test environments. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Blob v2 documentation tests
docs/web-tests/ts pins @lancedb/lancedb 0.31.0 and docs/web-tests/rs pins lancedb 0.31.0. Those releases do not include blob(). Run the Blob v2 examples here.
Python
lancedb==0.41.0b10 from the LanceDB package index, without pylance. PyPI lancedb 0.40.0 does not provide lancedb.blob().
python3.13 -m venv .venv
.venv/bin/pip install -r docs/web-tests/blob-v2/py/requirements.txt
.venv/bin/python -m pytest docs/web-tests/blob-v2/py/test_multimodal.py
test_blob_pylance.py checks custom thresholds and to_pandas() in lazy and bytes mode. Those calls import pylance. Use a second virtualenv. test_multimodal.py fails if lance can be imported. Snippets from this file are written to docs/web/snippets/blob_pylance.mdx.
This install is for the optional tests only. The public guide does not tell users to bypass the dependency resolver. PyPI pylance 13.0.0 requires lance-namespace<0.12, and lancedb==0.41.0b10 requires lance-namespace>=0.13, so lancedb[pylance] does not resolve. The three tests passed with pylance installed after the base requirements, without its own dependency pin.
python3.13 -m venv .venv-pylance
.venv-pylance/bin/pip install -r docs/web-tests/blob-v2/py/requirements.txt
.venv-pylance/bin/pip install --no-deps pylance==13.0.0
.venv-pylance/bin/python -m pytest docs/web-tests/blob-v2/py/test_blob_pylance.py
TypeScript
@lancedb/lancedb@0.41.0-beta.8. Node.js 22.6 or newer. npm test passes --experimental-strip-types, which Node added in 22.6.0.
cd docs/web-tests/blob-v2/ts
npm ci
npm test
Rust
crates.io lancedb 0.40.0 does not include blob(). This example builds the workspace crate, lancedb 0.41.0-beta.10. Pass --features remote so this checkout compiles. The example uses a local database. The Rust workflow runs this example. It is not a default feature, so a workspace build without remote does not turn that feature on for the rest of the workspace.
cargo run -p lancedb-blob-v2-docs --features remote --example multimodal
CI
Python and TypeScript above install preview packages. Pre-release builds are not guaranteed to stay available for more than 6 months, so those runs are not required PR checks. Run them when the guide's pins change. The Rust example is the in-repo check.
Regenerate snippets from the repository root:
python3 docs/web-tests/mdx_snippets_gen.py \
-s docs/web-tests/py -s docs/web-tests/ts -s docs/web-tests/rs \
-s docs/web-tests/blob-v2/py -s docs/web-tests/blob-v2/ts -s docs/web-tests/blob-v2/rs \
-o docs/web/snippets