mirror of
https://github.com/lancedb/lancedb.git
synced 2026-11-13 14:16:54 +00:00
Xuanwo
5ca8d836e7
## Problem `RUSTSEC-2026-0429` affects `zip 7.4.0`, which reaches the optional `sentence-transformers` feature through `candle-core 0.9.2`. The `deny` check on `main` fails on this advisory. ## Change Update `candle-core`, `candle-nn`, and `candle-transformers` to `0.11.1`. The focused lockfile resolution replaces `zip 7.4.0` with `zip 9.2.2`, and no other zip version remains in the all-features graph. This also pulls candle's required newer transitive `tokenizers` and `safetensors` releases; the directly declared `tokenizers 0.19.1` and the embedding implementation remain unchanged. The optional `sentence-transformers` Rust API exposes this dependency version: `SentenceTransformersEmbeddingsBuilder::device` accepts `D: Into<candle_core::Device>`, and the `Device` type is now from candle-core 0.11. The default CPU path constructs that device internally and is unchanged. `deny.toml` is unchanged. Its obsolete zip ignores now produce `advisory-not-detected` warnings, which do not fail the check. ## Validation - The `sentence-transformers` feature builds with tests and examples. - The existing CPU example loads the default model and retrieves `The human body has 206 bones.` for the matching query. - A local contract check verified 384-dimensional, finite, non-zero Float32 output and higher similarity for the matching fact than for an unrelated fact. It was not committed because it would add an 88 MB model download to all-features CI. - `cargo deny` `0.20.2`, the version used by the Rust workflow, passes `advisories`, `bans`, `licenses`, and `sources`. - The locally installed `cargo-deny 0.18.9` is not green: it treats informational unsound advisories differently from the workflow's `0.20.2`. The result above uses the exact CI version. - Targeted clippy, formatting, lockfile review, and the reverse `zip` dependency tree pass. - Hosted CI completed successfully for exact head `bffbcda6490fa1ed51838b3801e01ae2f82faed6`. CI mitigation: Reclaim completed lancedb CI-profile artifacts before the Blob v2 example after disk sampling showed a minimum of 24,764,416 available bytes. This may rebuild lancedb for the example; the exact OS cause of the SIGBUS remains unproven. BREAKING CHANGE: The optional `sentence-transformers` Rust API now takes `candle_core::Device` from candle-core 0.11. Downstream crates that explicitly construct and pass a candle-core 0.9 `Device` to `SentenceTransformersEmbeddingsBuilder::device` must use a `Device` from candle-core 0.11.x aligned with lancedb. This normally means updating a direct candle-core dependency; if the value comes through a re-export, update the dependency that supplies it. Callers that use the default CPU path without passing a `Device` do not need to migrate.
The Multimodal Lakehouse for AI
How to Install ✦ Detailed Documentation ✦ Tutorials and Recipes ✦ Contributors
The ultimate multimodal data platform for AI/ML applications.
LanceDB is designed for fast, scalable, and production-ready vector search. It is built on top of the Lance columnar format. You can store, index, and search over petabytes of multimodal data and vectors with ease. LanceDB is a central location where developers can build, train and analyze their AI workloads.
Demo: Multimodal Search by Keyword, Vector or with SQL
Star LanceDB to get updates!
⭐ Click here ⭐ to see how fast we're growing!
Key Features:
- Fast Vector Search: Search billions of vectors in milliseconds with state-of-the-art indexing.
- Comprehensive Search: Support for vector similarity search, full-text search and SQL.
- Multimodal Support: Store, query and filter vectors, metadata and multimodal data (text, images, videos, point clouds, and more).
- Advanced Features: Zero-copy, automatic versioning, manage versions of your data without needing extra infrastructure. GPU support in building vector index.
Products:
- LanceDB Embedded (open source): 100% open source, runs in your application's process; your data can live on local disk or in object storage. No vendor lock-in.
- LanceDB Enterprise: Production-scale distributed search, indexing, and maintenance. Plus, complete data sovereignty and security.
Ecosystem:
- Columnar Storage: Built on the Lance columnar format for efficient storage and analytics.
- Seamless Integration: Python, Node.js, Rust, and REST APIs for easy integration. Native Python and Javascript/Typescript support.
- Rich Ecosystem: Integrations with LangChain 🦜️🔗, LlamaIndex 🦙, Apache-Arrow, Pandas, Polars, DuckDB and more on the way.
How to Install:
Follow the Quickstart doc to set up LanceDB locally.
API & SDK: We also support Python, Typescript and Rust SDKs
| Interface | Documentation |
|---|---|
| Python SDK | https://lancedb.github.io/lancedb/python/python/ |
| Typescript SDK | https://lancedb.github.io/lancedb/js/globals/ |
| Rust SDK | https://docs.rs/lancedb/latest/lancedb/index.html |
| REST API | https://docs.lancedb.com/api-reference/rest |
Join Us and Contribute
We welcome contributions from everyone! Whether you're a developer, researcher, or just someone who wants to help out.
If you have any suggestions or feature requests, please feel free to open an issue on GitHub or discuss it on our Discord server.
Check out the GitHub Issues if you would like to work on the features that are planned for the future. If you have any suggestions or feature requests, please feel free to open an issue on GitHub.
Contributors
Stay in Touch With Us