mirror of
https://github.com/lancedb/lancedb.git
synced 2026-05-14 18:40:39 +00:00
d135c18db6
Adds a `deny.toml` at the workspace root and a `deny` CI job that runs `cargo deny check` on every PR. Catches yanked crates, license drift, banned or wildcard dependencies, unapproved sources, and new RUSTSEC advisories. As part of wiring this up: - Updated `aws-lc-rs` 1.13.0 → 1.16.3 / `aws-lc-sys` 0.28.0 → 0.40.0 to clear four 2026 AWS-LC advisories (timing side-channel, PKCS7 bypass, CRL scope). Removed the `=0.28.0` workaround pin; the original build failure no longer reproduces. - Updated `bytes`, `zlib-rs`, `rand`, `rustls-webpki`, `lz4_flex` to clear their current advisories. - Marked `lancedb-nodejs` and `lancedb-python` as `publish = false` and pinned `lzma-sys` from `*` to `0.1` so `bans.wildcards = "deny"` can be enforced. 10 remaining advisories have no safe upgrade available (transitive via opendal, lance, datafusion, async-openai, aws-sdk on the legacy rustls 0.21 chain). Each is ignored in `deny.toml` with a per-entry rationale and a link to the RUSTSEC advisory. New advisories still fail CI. Fixes #3297 --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
45 lines
1.2 KiB
TOML
45 lines
1.2 KiB
TOML
[package]
|
|
name = "lancedb-nodejs"
|
|
edition.workspace = true
|
|
version = "0.28.0-beta.9"
|
|
publish = false
|
|
license.workspace = true
|
|
description.workspace = true
|
|
repository.workspace = true
|
|
keywords.workspace = true
|
|
categories.workspace = true
|
|
|
|
[lib]
|
|
crate-type = ["cdylib"]
|
|
|
|
[dependencies]
|
|
async-trait.workspace = true
|
|
arrow-ipc.workspace = true
|
|
arrow-array.workspace = true
|
|
arrow-buffer = "57.2"
|
|
half.workspace = true
|
|
arrow-schema.workspace = true
|
|
env_logger.workspace = true
|
|
futures.workspace = true
|
|
lancedb = { path = "../rust/lancedb", default-features = false }
|
|
napi = { version = "3.8.3", default-features = false, features = [
|
|
"napi9",
|
|
"async"
|
|
] }
|
|
napi-derive = "3.5.2"
|
|
# Prevent dynamic linking of lzma, which comes from datafusion
|
|
lzma-sys = { version = "0.1", features = ["static"] }
|
|
log.workspace = true
|
|
|
|
# Pin to resolve build failures; update periodically for security patches.
|
|
aws-lc-sys = "=0.40.0"
|
|
aws-lc-rs = "=1.16.3"
|
|
|
|
[build-dependencies]
|
|
napi-build = "2.3.1"
|
|
|
|
[features]
|
|
default = ["remote", "lancedb/aws", "lancedb/gcs", "lancedb/azure", "lancedb/dynamodb", "lancedb/oss", "lancedb/huggingface"]
|
|
fp16kernels = ["lancedb/fp16kernels"]
|
|
remote = ["lancedb/remote"]
|