mirror of
https://github.com/lancedb/lancedb.git
synced 2026-09-04 12:38:38 +00:00
Will Jones
2779b75d0d
`pnpm audit` in `nodejs/` reported a number of vulnerable transitive dependencies. Most were resolved by `pnpm audit --fix`, which bumped the affected packages in the lockfile; the `minimumReleaseAgeExclude` additions in `pnpm-workspace.yaml` are its bookkeeping, exempting the specific patched versions from the repository's 24-hour hold on newly published packages. Two findings needed handling by hand, because the vulnerable package could not simply be moved to a newer release in place. `@opentelemetry/sdk-metrics` 1.30.1 pins `@opentelemetry/core` to its own exact version, and the 1.x line is end-of-life, so GHSA-8988-4f7v-96qf (unbounded memory allocation in W3C Baggage propagation) has no fix available on 1.x. This PR moves the dependency to 2.x, which brings in a patched `@opentelemetry/core`. It is a dev-only dependency with a single consumer, `__test__/otel.test.ts`, and the parts of the API that test uses are unchanged between 1.x and 2.x. `@huggingface/transformers` pins `sharp: ^0.33.5`, and no released version of transformers has moved past `^0.34.5` — every version in those ranges inherits the libvips CVEs in GHSA-f88m-g3jw-g9cj, so there is no upstream release to upgrade to. This PR adds a pnpm `overrides` entry pinning sharp to the patched `^0.35.4` line instead. `pnpm audit` now reports no known vulnerabilities. ## Not included The sharp override only applies to this repository's own dependency tree, since pnpm overrides are not published to npm. Anyone installing `@lancedb/lancedb` together with the optional `@huggingface/transformers` still resolves sharp 0.33.5, and will until transformers itself moves to sharp 0.35. Practical exposure there is low: the CVEs require decoding untrusted images, and LanceDB's transformers embedding function is text-only. `nodejs/examples/` is a separate install with its own lockfile and is untouched here. It pins `sharp: "0.33.5"` directly and `pnpm audit` reports 19 findings against it. Bumping sharp there is more involved than it looks, because sharp 0.35 requires Node >= 20.9 while the examples tests run on the Node 18/20 CI matrix, so it is left for separate work. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Xuanwo <github@xuanwo.io>
57 lines
1.5 KiB
YAML
57 lines
1.5 KiB
YAML
# Flat node_modules layout. The @napi-rs/cli build step fails to locate
|
|
# the cdylib artifact under pnpm's isolated layout; the hoisted linker
|
|
# mirrors npm's structure and unblocks the native build.
|
|
nodeLinker: hoisted
|
|
|
|
# Block resolution of versions less than 24h old (Shai-Hulud window).
|
|
# This is the pnpm 11 default but pinned here so it's visible to
|
|
# reviewers and survives a future pnpm major flipping the default.
|
|
minimumReleaseAge: 1440
|
|
|
|
# Fail install if a transitive dep tries to run an unapproved script.
|
|
strictDepBuilds: true
|
|
|
|
allowBuilds:
|
|
'@biomejs/biome': true
|
|
onnxruntime-node: true
|
|
protobufjs: true
|
|
sharp: true
|
|
|
|
minimumReleaseAgeExclude:
|
|
- protobufjs@7.5.8
|
|
- tmp@0.2.6
|
|
- form-data@4.0.6
|
|
- tar@7.5.16
|
|
- markdown-it@14.1.2
|
|
- linkify-it@5.0.1
|
|
- js-yaml@3.15.0
|
|
- js-yaml@4.1.2
|
|
- protobufjs@7.6.1
|
|
- protobufjs@7.6.3
|
|
- '@babel/core@7.29.1'
|
|
- axios@1.18.0
|
|
- brace-expansion@2.1.2
|
|
- brace-expansion@1.1.16
|
|
- js-yaml@4.3.0
|
|
- tar@7.5.18
|
|
- tar@7.5.19
|
|
- tar@7.5.17
|
|
- protobufjs@7.6.5
|
|
- linkify-it@5.0.2
|
|
- sharp@0.35.0
|
|
- brace-expansion@1.1.17
|
|
- brace-expansion@2.1.3
|
|
- brace-expansion@2.1.4
|
|
- brace-expansion@1.1.18
|
|
- js-yaml@3.15.1
|
|
- js-yaml@4.3.1
|
|
- tar@7.5.21
|
|
- '@opentelemetry/core@2.8.0'
|
|
|
|
# @huggingface/transformers pins sharp ^0.33.5 and no released version has moved
|
|
# past ^0.34.5, all of which inherit the libvips CVEs in GHSA-f88m-g3jw-g9cj.
|
|
# Force the patched line. sharp is only reached by transformers' image pipeline,
|
|
# which LanceDB's text embedding function never uses.
|
|
overrides:
|
|
sharp: ^0.35.4
|