mirror of
https://github.com/lancedb/lancedb.git
synced 2026-09-04 20:48:50 +00:00
Will Jones
2779b75d0d
`pnpm audit` in `nodejs/` reported a number of vulnerable transitive dependencies. Most were resolved by `pnpm audit --fix`, which bumped the affected packages in the lockfile; the `minimumReleaseAgeExclude` additions in `pnpm-workspace.yaml` are its bookkeeping, exempting the specific patched versions from the repository's 24-hour hold on newly published packages. Two findings needed handling by hand, because the vulnerable package could not simply be moved to a newer release in place. `@opentelemetry/sdk-metrics` 1.30.1 pins `@opentelemetry/core` to its own exact version, and the 1.x line is end-of-life, so GHSA-8988-4f7v-96qf (unbounded memory allocation in W3C Baggage propagation) has no fix available on 1.x. This PR moves the dependency to 2.x, which brings in a patched `@opentelemetry/core`. It is a dev-only dependency with a single consumer, `__test__/otel.test.ts`, and the parts of the API that test uses are unchanged between 1.x and 2.x. `@huggingface/transformers` pins `sharp: ^0.33.5`, and no released version of transformers has moved past `^0.34.5` — every version in those ranges inherits the libvips CVEs in GHSA-f88m-g3jw-g9cj, so there is no upstream release to upgrade to. This PR adds a pnpm `overrides` entry pinning sharp to the patched `^0.35.4` line instead. `pnpm audit` now reports no known vulnerabilities. ## Not included The sharp override only applies to this repository's own dependency tree, since pnpm overrides are not published to npm. Anyone installing `@lancedb/lancedb` together with the optional `@huggingface/transformers` still resolves sharp 0.33.5, and will until transformers itself moves to sharp 0.35. Practical exposure there is low: the CVEs require decoding untrusted images, and LanceDB's transformers embedding function is text-only. `nodejs/examples/` is a separate install with its own lockfile and is untouched here. It pins `sharp: "0.33.5"` directly and `pnpm audit` reports 19 findings against it. Bumping sharp there is more involved than it looks, because sharp 0.35 requires Node >= 20.9 while the examples tests run on the Node 18/20 CI matrix, so it is left for separate work. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Xuanwo <github@xuanwo.io>
The Multimodal AI Lakehouse
How to Install ✦ Detailed Documentation ✦ Tutorials and Recipes ✦ Contributors
The ultimate multimodal data platform for AI/ML applications.
LanceDB is designed for fast, scalable, and production-ready vector search. It is built on top of the Lance columnar format. You can store, index, and search over petabytes of multimodal data and vectors with ease. LanceDB is a central location where developers can build, train and analyze their AI workloads.
Demo: Multimodal Search by Keyword, Vector or with SQL
Star LanceDB to get updates!
⭐ Click here ⭐ to see how fast we're growing!
Key Features:
- Fast Vector Search: Search billions of vectors in milliseconds with state-of-the-art indexing.
- Comprehensive Search: Support for vector similarity search, full-text search and SQL.
- Multimodal Support: Store, query and filter vectors, metadata and multimodal data (text, images, videos, point clouds, and more).
- Advanced Features: Zero-copy, automatic versioning, manage versions of your data without needing extra infrastructure. GPU support in building vector index.
Products:
- Open Source & Local: 100% open source, runs locally or in your cloud. No vendor lock-in.
- Cloud and Enterprise: Production-scale vector search with no servers to manage. Complete data sovereignty and security.
Ecosystem:
- Columnar Storage: Built on the Lance columnar format for efficient storage and analytics.
- Seamless Integration: Python, Node.js, Rust, and REST APIs for easy integration. Native Python and Javascript/Typescript support.
- Rich Ecosystem: Integrations with LangChain 🦜️🔗, LlamaIndex 🦙, Apache-Arrow, Pandas, Polars, DuckDB and more on the way.
How to Install:
Follow the Quickstart doc to set up LanceDB locally.
API & SDK: We also support Python, Typescript and Rust SDKs
| Interface | Documentation |
|---|---|
| Python SDK | https://lancedb.github.io/lancedb/python/python/ |
| Typescript SDK | https://lancedb.github.io/lancedb/js/globals/ |
| Rust SDK | https://docs.rs/lancedb/latest/lancedb/index.html |
| REST API | https://docs.lancedb.com/api-reference/rest |
Join Us and Contribute
We welcome contributions from everyone! Whether you're a developer, researcher, or just someone who wants to help out.
If you have any suggestions or feature requests, please feel free to open an issue on GitHub or discuss it on our Discord server.
Check out the GitHub Issues if you would like to work on the features that are planned for the future. If you have any suggestions or feature requests, please feel free to open an issue on GitHub.
Contributors
Stay in Touch With Us