mirror of
https://github.com/lancedb/lancedb.git
synced 2026-11-13 14:16:54 +00:00
Xuanwo
5ca8d836e7
## Problem `RUSTSEC-2026-0429` affects `zip 7.4.0`, which reaches the optional `sentence-transformers` feature through `candle-core 0.9.2`. The `deny` check on `main` fails on this advisory. ## Change Update `candle-core`, `candle-nn`, and `candle-transformers` to `0.11.1`. The focused lockfile resolution replaces `zip 7.4.0` with `zip 9.2.2`, and no other zip version remains in the all-features graph. This also pulls candle's required newer transitive `tokenizers` and `safetensors` releases; the directly declared `tokenizers 0.19.1` and the embedding implementation remain unchanged. The optional `sentence-transformers` Rust API exposes this dependency version: `SentenceTransformersEmbeddingsBuilder::device` accepts `D: Into<candle_core::Device>`, and the `Device` type is now from candle-core 0.11. The default CPU path constructs that device internally and is unchanged. `deny.toml` is unchanged. Its obsolete zip ignores now produce `advisory-not-detected` warnings, which do not fail the check. ## Validation - The `sentence-transformers` feature builds with tests and examples. - The existing CPU example loads the default model and retrieves `The human body has 206 bones.` for the matching query. - A local contract check verified 384-dimensional, finite, non-zero Float32 output and higher similarity for the matching fact than for an unrelated fact. It was not committed because it would add an 88 MB model download to all-features CI. - `cargo deny` `0.20.2`, the version used by the Rust workflow, passes `advisories`, `bans`, `licenses`, and `sources`. - The locally installed `cargo-deny 0.18.9` is not green: it treats informational unsound advisories differently from the workflow's `0.20.2`. The result above uses the exact CI version. - Targeted clippy, formatting, lockfile review, and the reverse `zip` dependency tree pass. - Hosted CI completed successfully for exact head `bffbcda6490fa1ed51838b3801e01ae2f82faed6`. CI mitigation: Reclaim completed lancedb CI-profile artifacts before the Blob v2 example after disk sampling showed a minimum of 24,764,416 available bytes. This may rebuild lancedb for the example; the exact OS cause of the SIGBUS remains unproven. BREAKING CHANGE: The optional `sentence-transformers` Rust API now takes `candle_core::Device` from candle-core 0.11. Downstream crates that explicitly construct and pass a candle-core 0.9 `Device` to `SentenceTransformersEmbeddingsBuilder::device` must use a `Device` from candle-core 0.11.x aligned with lancedb. This normally means updating a direct candle-core dependency; if the value comes through a re-export, update the dependency that supplies it. Callers that use the default CPU path without passing a `Device` do not need to migrate.