mirror of
https://github.com/lancedb/lancedb.git
synced 2026-08-30 18:08:24 +00:00
a87cada90e
The bindings are built, installed and published with pnpm everywhere,
but a parallel npm dependency graph was still being maintained beside
it. This removes it, raises the supported Node floor to the versions we
actually test, and gives Dependabot the npm coverage it was missing.
## Dropping npm
`nodejs/package-lock.json` was regenerated by `ci/update_lockfiles.sh`
on every release commit and read by nothing — no workflow runs `npm ci`
or `npm install` in `nodejs/`, and npm never publishes a lockfile in a
package tarball. It could not even agree with the real install, since
npm does not see pnpm's `overrides`. Because GitHub's dependency graph
parses `package-lock.json`, it was also reporting vulnerabilities for a
tree we neither install nor ship.
`docs/package.json`, `docs/package-lock.json` and `docs/tsconfig.json`
go too. They depend on `file:../node` and
`file:../node/node_modules/apache-arrow` — the `node/` directory was
removed long ago — the tsconfig compiles `src/*.ts` where no TypeScript
files exist, and nothing installs any of it. `docs.yml` only referenced
the lockfile to configure an npm cache for an install it never ran.
Two `workflow_dispatch` workflows for regenerating those lockfiles are
removed as well. Both were already broken: they `uses:` composite
actions at `.github/workflows/update_package_lock{,_nodejs}` that do not
exist, so dispatching either failed immediately.
The remaining `npx` calls become direct `node_modules/.bin/...`
invocations. These were already running locally installed binaries
rather than resolving anything, but naming the binary removes the npm
CLI from the loop and does not depend on which Node version is active.
`dev.yml`'s commitlint check was the last place doing real npm
dependency resolution — an unpinned `npm install
@commitlint/config-conventional` that also bypassed the
`minimumReleaseAge` hold configured for `nodejs/` — and is now a pinned
`pnpm dlx`.
## Node support
Node 18 and 20 both reached end-of-life, in April 2025 and April 2026.
The matrix moves to 22, 24 and 26, and `engines` rises from `>= 18` to
`>= 22` so the declared floor is one the matrix actually covers. Node 22
is LTS until April 2027; 24 is LTS; 26 is Current and becomes LTS in
October 2026.
This also removes the reason the workflows reached for `npx` in the
first place: pnpm 11 requires Node >= 22.13, which every matrix version
now satisfies.
The prebuilt-binary smoke test in `npm-publish.yml` moves from Node 20
to Node 22 — the floor, where a napi ABI problem would surface first —
rather than fanning out across all three, to keep the publish matrix
from tripling.
## Dependabot
There were no npm-ecosystem entries at all, which is why the advisories
behind #4073 went unnoticed. Both pnpm lockfiles are now watched —
`nodejs/` and `nodejs/examples/`, which is a separate install — using
the same `lockfile-only` strategy as the existing cargo and pip entries,
so version ranges in `package.json` are left alone.
## Pre-commit biome
The hook ran `npx @biomejs/biome@1.8.3` while `nodejs/package.json`
resolved 1.9.4. The two disagree about formatting, so the hook rejected
code that `pnpm lint` accepts, and failed on unmodified `main` for
anyone touching `nodejs/`. It now uses the pnpm-managed biome, which
fixes the drift with no source changes.
## Testing
`dev.yml`'s commitlint job does not check out the repo, so it runs in an
empty workspace, and I could not verify `pnpm/action-setup` there
locally. It triggers on `pull_request_target`, so this PR exercises it
directly — worth confirming green before merge. I did verify the `pnpm
dlx` invocation itself locally: it accepts a conventional title and
rejects a non-conventional one with exit 1.
Node 26 is new enough that the examples job may surface gaps in prebuilt
native binaries (`onnxruntime-node`, `sharp`) before their maintainers
publish for it.
## Not included
`nodejs/examples/` still pins `sharp: "0.33.5"` and has its own audit
findings. Raising the Node floor unblocks that work — sharp 0.35
requires Node >= 20.9, which the matrix now satisfies — but it is a
dependency bump rather than tooling cleanup, so it is left separate.
## Breaking changes
`@lancedb/lancedb` now requires Node >= 22; previously >= 18. The
`@types/node` peer range moves from `>=18` to `>=22` to match. Users on
Node 18 or 20 must upgrade their runtime; both have been end-of-life for
some time. Existing installs are unaffected, since `engines` is only
checked on install.
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
211 lines
6.5 KiB
YAML
211 lines
6.5 KiB
YAML
name: NodeJS (NAPI)
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
paths:
|
|
- Cargo.toml
|
|
- Cargo.lock
|
|
- rust-toolchain.toml
|
|
- nodejs/**
|
|
- rust/**
|
|
- docs/src/js/**
|
|
- .github/workflows/nodejs.yml
|
|
- docker-compose.yml
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
RUST_BACKTRACE: "1"
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint
|
|
runs-on: ubuntu-22.04
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
working-directory: nodejs
|
|
env:
|
|
# Need up-to-date compilers for kernels
|
|
CC: gcc-12
|
|
CXX: g++-12
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
lfs: true
|
|
- uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 11.1.1
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
# Build on a supported LTS; the matrix job below covers every
|
|
# Node version the library claims to support.
|
|
node-version: 24
|
|
cache: 'pnpm'
|
|
cache-dependency-path: nodejs/pnpm-lock.yaml
|
|
- uses: actions-rust-lang/setup-rust-toolchain@v1
|
|
with:
|
|
components: rustfmt, clippy
|
|
- name: Install dependencies
|
|
run: |
|
|
sudo apt update
|
|
sudo apt install -y protobuf-compiler libssl-dev
|
|
- uses: Swatinem/rust-cache@v2
|
|
with:
|
|
# Restore everywhere, but only save from main. Per-PR saves are
|
|
# unreadable outside their own branch anyway, since GitHub scopes
|
|
# caches to the creating ref.
|
|
save-if: ${{ github.ref == 'refs/heads/main' }}
|
|
- name: Format Rust
|
|
run: cargo fmt --all -- --check
|
|
- name: Lint Rust
|
|
run: cargo clippy --profile ci --all --all-features -- -D warnings
|
|
- name: Lint Typescript
|
|
run: |
|
|
pnpm install --frozen-lockfile
|
|
pnpm lint-ci
|
|
- name: Lint examples
|
|
working-directory: nodejs/examples
|
|
# The `@lancedb/lancedb` dep points at file:../dist; pnpm errors if
|
|
# that dir is missing, so create an empty one for lint-only runs.
|
|
run: mkdir -p ../dist && pnpm install --frozen-lockfile && pnpm lint-ci
|
|
linux:
|
|
name: Linux (NodeJS ${{ matrix.node-version }})
|
|
timeout-minutes: 30
|
|
strategy:
|
|
matrix:
|
|
node-version: [ "22", "24", "26" ]
|
|
runs-on: "ubuntu-22.04"
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
working-directory: nodejs
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
lfs: true
|
|
- uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 11.1.1
|
|
- uses: actions/setup-node@v6
|
|
name: Setup Node.js 24 for build
|
|
with:
|
|
# Build and install once on a fixed version so the generated docs
|
|
# are identical across matrix legs; the tests below then run on each
|
|
# supported Node version.
|
|
node-version: 24
|
|
cache: 'pnpm'
|
|
cache-dependency-path: nodejs/pnpm-lock.yaml
|
|
- uses: Swatinem/rust-cache@v2
|
|
with:
|
|
# Restore everywhere, but only save from main. Per-PR saves are
|
|
# unreadable outside their own branch anyway, since GitHub scopes
|
|
# caches to the creating ref.
|
|
save-if: ${{ github.ref == 'refs/heads/main' }}
|
|
- name: Install dependencies
|
|
run: |
|
|
sudo apt update
|
|
sudo apt install -y protobuf-compiler libssl-dev
|
|
- name: Build
|
|
run: |
|
|
pnpm install --frozen-lockfile
|
|
# No `--` separator: pnpm forwards it literally, which would
|
|
# make napi-rs treat `--profile ci` as a cargo passthrough arg.
|
|
pnpm build:debug --profile ci
|
|
pnpm tsc
|
|
- name: Setup examples
|
|
working-directory: nodejs/examples
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Check docs
|
|
run: |
|
|
# We run this as part of the job because the binary needs to be built
|
|
# first to export the types of the native code.
|
|
set -e
|
|
# `pnpm docs` would invoke pnpm's built-in `docs` command, not
|
|
# the script — use `pnpm run docs`.
|
|
pnpm run docs
|
|
if ! git diff --exit-code -- ../ ':(exclude)Cargo.lock'; then
|
|
echo "Docs need to be updated"
|
|
echo "Run 'pnpm run docs', fix any warnings, and commit the changes."
|
|
exit 1
|
|
fi
|
|
- uses: actions/setup-node@v6
|
|
name: Setup Node.js ${{ matrix.node-version }} for test
|
|
with:
|
|
node-version: ${{ matrix.node-version }}
|
|
- name: Setup localstack
|
|
working-directory: .
|
|
run: docker compose up --detach --wait
|
|
- name: Test
|
|
env:
|
|
S3_TEST: "1"
|
|
# Newer @smithy/core uses dynamic ESM imports.
|
|
NODE_OPTIONS: "--experimental-vm-modules"
|
|
# Invoke the installed jest binary directly; the pnpm shim is set up
|
|
# against the build-phase Node, not the version selected above.
|
|
run: node_modules/.bin/jest --verbose
|
|
- name: Test examples
|
|
working-directory: ./
|
|
env:
|
|
OPENAI_API_KEY: test
|
|
OPENAI_BASE_URL: http://0.0.0.0:8000
|
|
NODE_OPTIONS: "--experimental-vm-modules"
|
|
run: |
|
|
python ci/mock_openai.py &
|
|
cd nodejs/examples
|
|
node_modules/.bin/jest --testEnvironment jest-environment-node-single-context --verbose
|
|
macos:
|
|
timeout-minutes: 30
|
|
# macos-15 ships a newer linker; the older macos-14 linker fails to insert
|
|
# branch islands when the debug cdylib's __text section exceeds the 128 MB
|
|
# AArch64 B/BL branch range.
|
|
runs-on: "macos-15"
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
working-directory: nodejs
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
lfs: true
|
|
- uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 11.1.1
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
# pnpm 11 requires Node >= 22.13.
|
|
node-version: 24
|
|
cache: 'pnpm'
|
|
cache-dependency-path: nodejs/pnpm-lock.yaml
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
with:
|
|
# Restore everywhere, but only save from main. Per-PR saves are
|
|
# unreadable outside their own branch anyway, since GitHub scopes
|
|
# caches to the creating ref.
|
|
save-if: ${{ github.ref == 'refs/heads/main' }}
|
|
- name: Install dependencies
|
|
run: |
|
|
brew install protobuf
|
|
- name: Build
|
|
run: |
|
|
pnpm install --frozen-lockfile
|
|
# No `--` separator: pnpm forwards it literally, which would
|
|
# make napi-rs treat `--profile ci` as a cargo passthrough arg.
|
|
pnpm build:debug --profile ci
|
|
pnpm tsc
|
|
- name: Test
|
|
run: |
|
|
pnpm test
|