mirror of
https://github.com/lancedb/lancedb.git
synced 2026-11-13 14:16:54 +00:00
Will JonesandClaude Opus 5.5
2f496529ca
## Summary Bumps dependencies that Aikido flags with critical advisories, where a patched version is available without code changes. | Package | Where | From → To | Ships to users | |---|---|---|---| | jackson (BOM) | `java/pom.xml` | 2.18.11 → 2.18.12 | Yes, via the published pom | | zerovec / zerovec-derive | `Cargo.lock` | 0.11.6 → 0.11.8 / 0.11.3 → 0.11.7 | Yes, linked into the wheels and Node binaries | | pillow | `python/uv.lock` | 12.3.0 → 13.0.0 | No, dev lockfile | | pyarrow | `python/uv.lock` | 24.0.0 → 26.0.1 | No, dev lockfile | | pyjwt, urllib3, anyio, cryptography | `python/uv.lock` | → 2.15.1, 2.8.0, 4.16.0, 50.0.2 | No, dev lockfile | | pillow | `docs/web-tests/blob-v2/py/requirements.txt` | 12.1.1 → 13.0.0 | No | pyarrow was held at 24.0.0 by a `pyarrow<25` pin in the `tests` extra. It came in with #3675 without a stated reason, so this PR removes it. pillow 13 and pyarrow 26 require Python 3.11+, so the lockfile keeps pillow 12.3.0 and pyarrow 25.0.1 on Python 3.10, and those remain flagged. The sharp findings in the Node examples and docs are not addressed here. They come from the `@huggingface/transformers@3.0.2` optional dependency, which needs a major upgrade to 4.3+. ## Evidence With the pyarrow pin removed and pyarrow 26.0.1 installed, the Python suite (`-m "not slow and not s3_test"`) passed locally on Python 3.12: 3319 passed, 164 skipped. That run was on main as of #4879; this branch is based on a slightly newer main. ## Merge Risk **Door:** Two-way. Patch and minor version bumps that a revert undoes. **Blast Radius:** Java consumers (jackson patch release), native binaries (zerovec patch release), Python test environments. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
366 lines
15 KiB
XML
366 lines
15 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
|
<modelVersion>4.0.0</modelVersion>
|
|
|
|
<groupId>com.lancedb</groupId>
|
|
<artifactId>lancedb-parent</artifactId>
|
|
<version>0.42.0-beta.5</version>
|
|
<packaging>pom</packaging>
|
|
<name>${project.artifactId}</name>
|
|
<description>LanceDB Java SDK Parent POM</description>
|
|
<url>http://lancedb.com/</url>
|
|
|
|
<developers>
|
|
<developer>
|
|
<name>Lance DB Dev Group</name>
|
|
<email>dev@lancedb.com</email>
|
|
</developer>
|
|
</developers>
|
|
<licenses>
|
|
<license>
|
|
<name>The Apache Software License, Version 2.0</name>
|
|
<url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
|
|
</license>
|
|
</licenses>
|
|
|
|
<properties>
|
|
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
|
|
<arrow.version>15.0.0</arrow.version>
|
|
<lance-core.version>15.0.0-beta.8</lance-core.version>
|
|
<jackson.version>2.18.12</jackson.version>
|
|
<spotless.skip>false</spotless.skip>
|
|
<spotless.version>2.30.0</spotless.version>
|
|
<spotless.java.googlejavaformat.version>1.7</spotless.java.googlejavaformat.version>
|
|
<spotless.delimiter>package</spotless.delimiter>
|
|
<spotless.license.header>
|
|
/*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
</spotless.license.header>
|
|
</properties>
|
|
|
|
<modules>
|
|
<module>lancedb-core</module>
|
|
</modules>
|
|
|
|
<scm>
|
|
<connection>scm:git:https://github.com/lancedb/lancedb.git</connection>
|
|
<developerConnection>scm:git:ssh://git@github.com/lancedb/lancedb.git</developerConnection>
|
|
<url>https://github.com/lancedb/lancedb</url>
|
|
</scm>
|
|
|
|
<dependencyManagement>
|
|
<dependencies>
|
|
<!-- Pin every Jackson artifact, including ones pulled in transitively
|
|
(e.g. jackson-core), to a single patched version. -->
|
|
<dependency>
|
|
<groupId>com.fasterxml.jackson</groupId>
|
|
<artifactId>jackson-bom</artifactId>
|
|
<version>${jackson.version}</version>
|
|
<type>pom</type>
|
|
<scope>import</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.lance</groupId>
|
|
<artifactId>lance-core</artifactId>
|
|
<version>${lance-core.version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.arrow</groupId>
|
|
<artifactId>arrow-vector</artifactId>
|
|
<version>${arrow.version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.arrow</groupId>
|
|
<artifactId>arrow-memory-netty</artifactId>
|
|
<version>${arrow.version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.arrow</groupId>
|
|
<artifactId>arrow-c-data</artifactId>
|
|
<version>${arrow.version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.arrow</groupId>
|
|
<artifactId>arrow-dataset</artifactId>
|
|
<version>${arrow.version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.junit.jupiter</groupId>
|
|
<artifactId>junit-jupiter</artifactId>
|
|
<version>5.10.1</version>
|
|
</dependency>
|
|
</dependencies>
|
|
</dependencyManagement>
|
|
|
|
<repositories>
|
|
<repository>
|
|
<id>lance</id>
|
|
<url>https://maven.lance.org</url>
|
|
<snapshots>
|
|
<enabled>false</enabled>
|
|
</snapshots>
|
|
</repository>
|
|
</repositories>
|
|
|
|
<distributionManagement>
|
|
<snapshotRepository>
|
|
<id>ossrh</id>
|
|
<url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>
|
|
</snapshotRepository>
|
|
<repository>
|
|
<id>ossrh</id>
|
|
<url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
|
|
</repository>
|
|
</distributionManagement>
|
|
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-source-plugin</artifactId>
|
|
<version>3.3.1</version>
|
|
<executions>
|
|
<execution>
|
|
<id>attach-sources</id>
|
|
<goals>
|
|
<goal>jar-no-fork</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-javadoc-plugin</artifactId>
|
|
<version>3.11.2</version>
|
|
<executions>
|
|
<execution>
|
|
<id>attach-javadocs</id>
|
|
<goals>
|
|
<goal>jar</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-checkstyle-plugin</artifactId>
|
|
<version>3.3.1</version>
|
|
<configuration>
|
|
<configLocation>google_checks.xml</configLocation>
|
|
<consoleOutput>true</consoleOutput>
|
|
<failsOnError>false</failsOnError>
|
|
<failOnViolation>false</failOnViolation>
|
|
<violationSeverity>warning</violationSeverity>
|
|
<linkXRef>false</linkXRef>
|
|
</configuration>
|
|
<executions>
|
|
<execution>
|
|
<id>validate</id>
|
|
<phase>validate</phase>
|
|
<goals>
|
|
<goal>check</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>com.diffplug.spotless</groupId>
|
|
<artifactId>spotless-maven-plugin</artifactId>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.codehaus.mojo</groupId>
|
|
<artifactId>license-maven-plugin</artifactId>
|
|
<version>2.4.0</version>
|
|
<configuration>
|
|
<outputDirectory>${project.basedir}</outputDirectory>
|
|
<thirdPartyFilename>JAVA_THIRD_PARTY_LICENSES.md</thirdPartyFilename>
|
|
<fileTemplate>/org/codehaus/mojo/license/third-party-file-groupByLicense.ftl</fileTemplate>
|
|
<includedScopes>compile,runtime</includedScopes>
|
|
<excludedScopes>test,provided</excludedScopes>
|
|
<sortArtifactByName>true</sortArtifactByName>
|
|
</configuration>
|
|
</plugin>
|
|
</plugins>
|
|
<pluginManagement>
|
|
<plugins>
|
|
<plugin>
|
|
<artifactId>maven-clean-plugin</artifactId>
|
|
<version>3.4.1</version>
|
|
</plugin>
|
|
<plugin>
|
|
<artifactId>maven-resources-plugin</artifactId>
|
|
<version>3.3.1</version>
|
|
</plugin>
|
|
<plugin>
|
|
<artifactId>maven-compiler-plugin</artifactId>
|
|
<version>3.14.0</version>
|
|
<configuration>
|
|
<compilerArgs>
|
|
<arg>-h</arg>
|
|
<arg>target/headers</arg>
|
|
</compilerArgs>
|
|
</configuration>
|
|
</plugin>
|
|
<plugin>
|
|
<artifactId>maven-surefire-plugin</artifactId>
|
|
<version>3.2.5</version>
|
|
<configuration>
|
|
<forkNode
|
|
implementation="org.apache.maven.plugin.surefire.extensions.SurefireForkNodeFactory" />
|
|
<useSystemClassLoader>false</useSystemClassLoader>
|
|
</configuration>
|
|
</plugin>
|
|
<plugin>
|
|
<artifactId>maven-jar-plugin</artifactId>
|
|
<version>3.4.2</version>
|
|
</plugin>
|
|
<plugin>
|
|
<artifactId>maven-install-plugin</artifactId>
|
|
<version>3.1.3</version>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>com.diffplug.spotless</groupId>
|
|
<artifactId>spotless-maven-plugin</artifactId>
|
|
<version>${spotless.version}</version>
|
|
<configuration>
|
|
<skip>${spotless.skip}</skip>
|
|
<upToDateChecking>
|
|
<enabled>true</enabled>
|
|
</upToDateChecking>
|
|
<java>
|
|
<includes>
|
|
<include>src/main/java/**/*.java</include>
|
|
<include>src/test/java/**/*.java</include>
|
|
</includes>
|
|
<googleJavaFormat>
|
|
<version>${spotless.java.googlejavaformat.version}</version>
|
|
<style>GOOGLE</style>
|
|
</googleJavaFormat>
|
|
|
|
<importOrder>
|
|
<order>com.lancedb.lance,,javax,java,\#</order>
|
|
</importOrder>
|
|
|
|
<removeUnusedImports />
|
|
</java>
|
|
<scala>
|
|
<includes>
|
|
<include>src/main/scala/**/*.scala</include>
|
|
<include>src/main/scala-*/**/*.scala</include>
|
|
<include>src/test/scala/**/*.scala</include>
|
|
<include>src/test/scala-*/**/*.scala</include>
|
|
</includes>
|
|
</scala>
|
|
<licenseHeader>
|
|
<content>${spotless.license.header}</content>
|
|
<delimiter>${spotless.delimiter}</delimiter>
|
|
</licenseHeader>
|
|
</configuration>
|
|
<executions>
|
|
<execution>
|
|
<id>spotless-check</id>
|
|
<phase>validate</phase>
|
|
<goals>
|
|
<goal>apply</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
</plugins>
|
|
</pluginManagement>
|
|
</build>
|
|
|
|
<profiles>
|
|
<profile>
|
|
<id>jdk8</id>
|
|
<activation>
|
|
<jdk>[1.8,1.8.999]</jdk>
|
|
</activation>
|
|
<properties>
|
|
<maven.compiler.source>1.8</maven.compiler.source>
|
|
<maven.compiler.target>1.8</maven.compiler.target>
|
|
</properties>
|
|
</profile>
|
|
<profile>
|
|
<id>jdk11+</id>
|
|
<activation>
|
|
<jdk>[11,)</jdk>
|
|
</activation>
|
|
<properties>
|
|
<maven.compiler.source>11</maven.compiler.source>
|
|
<maven.compiler.target>11</maven.compiler.target>
|
|
</properties>
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<artifactId>maven-surefire-plugin</artifactId>
|
|
<version>3.2.5</version>
|
|
<configuration>
|
|
<argLine>--add-opens=java.base/java.nio=ALL-UNNAMED</argLine>
|
|
<forkNode
|
|
implementation="org.apache.maven.plugin.surefire.extensions.SurefireForkNodeFactory" />
|
|
<useSystemClassLoader>false</useSystemClassLoader>
|
|
</configuration>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
</profile>
|
|
<profile>
|
|
<id>deploy-to-ossrh</id>
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.sonatype.central</groupId>
|
|
<artifactId>central-publishing-maven-plugin</artifactId>
|
|
<version>0.8.0</version>
|
|
<extensions>true</extensions>
|
|
<configuration>
|
|
<publishingServerId>ossrh</publishingServerId>
|
|
<tokenAuth>true</tokenAuth>
|
|
<autoPublish>true</autoPublish>
|
|
</configuration>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.sonatype.plugins</groupId>
|
|
<artifactId>nexus-staging-maven-plugin</artifactId>
|
|
<version>1.6.13</version>
|
|
<extensions>true</extensions>
|
|
<configuration>
|
|
<serverId>ossrh</serverId>
|
|
<nexusUrl>https://s01.oss.sonatype.org/</nexusUrl>
|
|
<autoReleaseAfterClose>true</autoReleaseAfterClose>
|
|
</configuration>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-gpg-plugin</artifactId>
|
|
<version>3.2.7</version>
|
|
<executions>
|
|
<execution>
|
|
<id>sign-artifacts</id>
|
|
<phase>verify</phase>
|
|
<goals>
|
|
<goal>sign</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
</profile>
|
|
</profiles>
|
|
</project>
|