mirror of
https://github.com/lancedb/lancedb.git
synced 2026-09-03 03:58:27 +00:00
Will Jones
2779b75d0d
`pnpm audit` in `nodejs/` reported a number of vulnerable transitive dependencies. Most were resolved by `pnpm audit --fix`, which bumped the affected packages in the lockfile; the `minimumReleaseAgeExclude` additions in `pnpm-workspace.yaml` are its bookkeeping, exempting the specific patched versions from the repository's 24-hour hold on newly published packages. Two findings needed handling by hand, because the vulnerable package could not simply be moved to a newer release in place. `@opentelemetry/sdk-metrics` 1.30.1 pins `@opentelemetry/core` to its own exact version, and the 1.x line is end-of-life, so GHSA-8988-4f7v-96qf (unbounded memory allocation in W3C Baggage propagation) has no fix available on 1.x. This PR moves the dependency to 2.x, which brings in a patched `@opentelemetry/core`. It is a dev-only dependency with a single consumer, `__test__/otel.test.ts`, and the parts of the API that test uses are unchanged between 1.x and 2.x. `@huggingface/transformers` pins `sharp: ^0.33.5`, and no released version of transformers has moved past `^0.34.5` — every version in those ranges inherits the libvips CVEs in GHSA-f88m-g3jw-g9cj, so there is no upstream release to upgrade to. This PR adds a pnpm `overrides` entry pinning sharp to the patched `^0.35.4` line instead. `pnpm audit` now reports no known vulnerabilities. ## Not included The sharp override only applies to this repository's own dependency tree, since pnpm overrides are not published to npm. Anyone installing `@lancedb/lancedb` together with the optional `@huggingface/transformers` still resolves sharp 0.33.5, and will until transformers itself moves to sharp 0.35. Practical exposure there is low: the CVEs require decoding untrusted images, and LanceDB's transformers embedding function is text-only. `nodejs/examples/` is a separate install with its own lockfile and is untouched here. It pins `sharp: "0.33.5"` directly and `pnpm audit` reports 19 findings against it. Bumping sharp there is more involved than it looks, because sharp 0.35 requires Node >= 20.9 while the examples tests run on the Node 18/20 CI matrix, so it is left for separate work. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Xuanwo <github@xuanwo.io>
LanceDB JavaScript SDK
A JavaScript library for LanceDB.
Installation
npm install @lancedb/lancedb
This will download the appropriate native library for your platform. We currently support:
- Linux (x86_64 and aarch64 on glibc and musl)
- MacOS (Intel and ARM/M1/M2)
- Windows (x86_64 and aarch64)
Usage
Basic Example
import * as lancedb from "@lancedb/lancedb";
const db = await lancedb.connect("data/sample-lancedb");
const table = await db.createTable("my_table", [
{ id: 1, vector: [0.1, 1.0], item: "foo", price: 10.0 },
{ id: 2, vector: [3.9, 0.5], item: "bar", price: 20.0 },
]);
const results = await table.vectorSearch([0.1, 0.3]).limit(20).toArray();
console.log(results);
The quickstart contains more complete examples.
Development
See CONTRIBUTING.md for information on how to contribute to LanceDB.