mirror of
https://github.com/lancedb/lancedb.git
synced 2026-09-03 12:08:52 +00:00
Will Jones
2779b75d0d
`pnpm audit` in `nodejs/` reported a number of vulnerable transitive dependencies. Most were resolved by `pnpm audit --fix`, which bumped the affected packages in the lockfile; the `minimumReleaseAgeExclude` additions in `pnpm-workspace.yaml` are its bookkeeping, exempting the specific patched versions from the repository's 24-hour hold on newly published packages. Two findings needed handling by hand, because the vulnerable package could not simply be moved to a newer release in place. `@opentelemetry/sdk-metrics` 1.30.1 pins `@opentelemetry/core` to its own exact version, and the 1.x line is end-of-life, so GHSA-8988-4f7v-96qf (unbounded memory allocation in W3C Baggage propagation) has no fix available on 1.x. This PR moves the dependency to 2.x, which brings in a patched `@opentelemetry/core`. It is a dev-only dependency with a single consumer, `__test__/otel.test.ts`, and the parts of the API that test uses are unchanged between 1.x and 2.x. `@huggingface/transformers` pins `sharp: ^0.33.5`, and no released version of transformers has moved past `^0.34.5` — every version in those ranges inherits the libvips CVEs in GHSA-f88m-g3jw-g9cj, so there is no upstream release to upgrade to. This PR adds a pnpm `overrides` entry pinning sharp to the patched `^0.35.4` line instead. `pnpm audit` now reports no known vulnerabilities. ## Not included The sharp override only applies to this repository's own dependency tree, since pnpm overrides are not published to npm. Anyone installing `@lancedb/lancedb` together with the optional `@huggingface/transformers` still resolves sharp 0.33.5, and will until transformers itself moves to sharp 0.35. Practical exposure there is low: the CVEs require decoding untrusted images, and LanceDB's transformers embedding function is text-only. `nodejs/examples/` is a separate install with its own lockfile and is untouched here. It pins `sharp: "0.33.5"` directly and `pnpm audit` reports 19 findings against it. Bumping sharp there is more involved than it looks, because sharp 0.35 requires Node >= 20.9 while the examples tests run on the Node 18/20 CI matrix, so it is left for separate work. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Xuanwo <github@xuanwo.io>
113 lines
3.5 KiB
JSON
113 lines
3.5 KiB
JSON
{
|
|
"name": "@lancedb/lancedb",
|
|
"description": "LanceDB: A serverless, low-latency vector database for AI applications",
|
|
"keywords": [
|
|
"database",
|
|
"lance",
|
|
"lancedb",
|
|
"search",
|
|
"vector",
|
|
"vector database",
|
|
"ann"
|
|
],
|
|
"private": false,
|
|
"version": "0.39.0-beta.1",
|
|
"main": "dist/index.js",
|
|
"exports": {
|
|
".": "./dist/index.js",
|
|
"./embedding": "./dist/embedding/index.js",
|
|
"./embedding/openai": "./dist/embedding/openai.js",
|
|
"./embedding/transformers": "./dist/embedding/transformers.js"
|
|
},
|
|
"types": "dist/index.d.ts",
|
|
"napi": {
|
|
"binaryName": "lancedb",
|
|
"targets": [
|
|
"aarch64-apple-darwin",
|
|
"x86_64-unknown-linux-gnu",
|
|
"aarch64-unknown-linux-gnu",
|
|
"x86_64-unknown-linux-musl",
|
|
"aarch64-unknown-linux-musl",
|
|
"x86_64-pc-windows-msvc",
|
|
"aarch64-pc-windows-msvc"
|
|
]
|
|
},
|
|
"license": "Apache-2.0",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/lancedb/lancedb"
|
|
},
|
|
"devDependencies": {
|
|
"@aws-sdk/client-dynamodb": "3.1003.0",
|
|
"@aws-sdk/client-kms": "3.1003.0",
|
|
"@aws-sdk/client-s3": "3.1003.0",
|
|
"@biomejs/biome": "^1.7.3",
|
|
"@jest/globals": "^29.7.0",
|
|
"@napi-rs/cli": "3.7.0",
|
|
"@opentelemetry/sdk-metrics": "^2.10.0",
|
|
"@types/axios": "^0.14.0",
|
|
"@types/jest": "^29.1.2",
|
|
"@types/node": "22.7.4",
|
|
"@types/tmp": "^0.2.6",
|
|
"apache-arrow-15": "npm:apache-arrow@15.0.0",
|
|
"apache-arrow-16": "npm:apache-arrow@16.0.0",
|
|
"apache-arrow-17": "npm:apache-arrow@17.0.0",
|
|
"apache-arrow-18": "npm:apache-arrow@18.0.0",
|
|
"eslint": "^8.57.0",
|
|
"jest": "^29.7.0",
|
|
"shx": "^0.3.4",
|
|
"tmp": "^0.2.7",
|
|
"ts-jest": "^29.1.2",
|
|
"typedoc": "0.26.4",
|
|
"typedoc-plugin-markdown": "4.2.1",
|
|
"typescript": "5.5.4",
|
|
"typescript-eslint": "^7.1.0"
|
|
},
|
|
"ava": {
|
|
"timeout": "3m"
|
|
},
|
|
"engines": {
|
|
"node": ">= 22"
|
|
},
|
|
"packageManager": "pnpm@11.1.1",
|
|
"cpu": ["x64", "arm64"],
|
|
"os": ["darwin", "linux", "win32"],
|
|
"scripts": {
|
|
"artifacts": "napi artifacts",
|
|
"build:debug": "napi build --platform --dts ../lancedb/native.d.ts --js ../lancedb/native.js --output-dir lancedb",
|
|
"postbuild:debug": "shx mkdir -p dist && shx cp lancedb/*.node dist/ && node -e \"require('fs').writeFileSync('dist/package.json', JSON.stringify({name:'@lancedb/lancedb',type:'commonjs'}))\"",
|
|
"build:release": "napi build --platform --release --dts ../lancedb/native.d.ts --js ../lancedb/native.js --output-dir dist",
|
|
"build": "pnpm build:debug && pnpm tsc",
|
|
"build-release": "pnpm build:release && pnpm tsc",
|
|
"tsc": "tsc -b",
|
|
"posttsc": "shx cp lancedb/native.d.ts dist/native.d.ts",
|
|
"lint-ci": "biome ci .",
|
|
"docs": "typedoc --plugin typedoc-plugin-markdown --treatWarningsAsErrors --out ../docs/src/js lancedb/index.ts",
|
|
"postdocs": "node typedoc_post_process.js",
|
|
"lint": "biome check . && biome format .",
|
|
"lint-fix": "biome check --write . && biome format --write .",
|
|
"prepublishOnly": "napi prepublish -t npm",
|
|
"test": "jest --verbose",
|
|
"integration": "S3_TEST=1 pnpm test",
|
|
"universal": "napi universalize",
|
|
"version": "napi version"
|
|
},
|
|
"dependencies": {
|
|
"@opentelemetry/api": "^1.9.0",
|
|
"reflect-metadata": "^0.2.2"
|
|
},
|
|
"optionalDependencies": {
|
|
"@huggingface/transformers": "3.0.2",
|
|
"openai": "4.29.2"
|
|
},
|
|
"peerDependencies": {
|
|
"@types/node": ">=22",
|
|
"apache-arrow": ">=15.0.0 <=18.1.0"
|
|
},
|
|
"peerDependenciesMeta": {
|
|
"@types/node": {
|
|
"optional": true
|
|
}
|
|
}
|
|
}
|