mirror of
https://github.com/lancedb/lancedb.git
synced 2026-11-13 22:26:53 +00:00
Will JonesandClaude Opus 5.5
96328f6e08
## Summary
`@lancedb/lancedb` pins the optional dependency
`@huggingface/transformers` at 3.0.2, which requires `sharp ^0.33.5`.
Every npm install of LanceDB therefore pulled in a sharp version with
critical advisories (GHSA-wq5f-xc86-pv6w, GHSA-rgj7-g3m4-5g8c). No 3.x
release of transformers allows a patched sharp, so this upgrades to
4.3.2, which requires `sharp ^0.35.4`. A fresh install resolves that
range to 0.35.5, the first release that fixes both advisories.
- `nodejs/package.json`: `@huggingface/transformers` 3.0.2 → 4.3.2.
- `nodejs/pnpm-workspace.yaml`: remove the `sharp: ^0.35.4` override. It
only covered our own install, not consumers, and transformers now
requires that range itself.
- `nodejs/examples`: transformers 3.0.2 → 4.3.2, sharp 0.33.5 → 0.35.5.
- Both lockfiles resolve sharp to 0.35.5; `pnpm audit` reports no sharp
advisories in either.
`TransformersEmbeddingFunction` needed no code changes. The transformers
types are only used in private fields, so the published typings don't
change.
`docs/web-tests/ts` and `docs/web-tests/blob-v2/ts` are left alone: they
resolve transformers through a published `@lancedb/lancedb`, so they
pick this up after a release.
## Evidence
Embeddings from the built-in `huggingface` embedding function (default
`Xenova/all-MiniLM-L6-v2`) on 4.3.2, compared with the same mean pooling
on 3.0.2, for three sentences:
```
transformers 4.3.2: 3 x 384
text 0: max|diff|=6.62e-07 cosine=1.00000000
text 1: max|diff|=6.26e-07 cosine=1.00000000
text 2: max|diff|=7.33e-07 cosine=1.00000000
```
End to end through a table, `search("a feline sat down")` returns `["The
cat sat on the mat.", "A dog barked at the mailman."]`.
## Merge Risk
**Door:** Two-way. A revert restores the 3.0.2 pin.
**Blast Radius:** Node `huggingface` embedding function, and install
footprint of the optional dependency (onnxruntime-node 1.19.2 → 1.30.0,
which still downloads the CUDA provider on Linux x64 by default, as
1.19.2 did).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
50 lines
1.2 KiB
YAML
50 lines
1.2 KiB
YAML
# Flat node_modules layout. The @napi-rs/cli build step fails to locate
|
|
# the cdylib artifact under pnpm's isolated layout; the hoisted linker
|
|
# mirrors npm's structure and unblocks the native build.
|
|
nodeLinker: hoisted
|
|
|
|
# Block resolution of versions less than 24h old (Shai-Hulud window).
|
|
# This is the pnpm 11 default but pinned here so it's visible to
|
|
# reviewers and survives a future pnpm major flipping the default.
|
|
minimumReleaseAge: 1440
|
|
|
|
# Fail install if a transitive dep tries to run an unapproved script.
|
|
strictDepBuilds: true
|
|
|
|
allowBuilds:
|
|
'@biomejs/biome': true
|
|
onnxruntime-node: true
|
|
protobufjs: true
|
|
sharp: true
|
|
|
|
minimumReleaseAgeExclude:
|
|
- protobufjs@7.5.8
|
|
- tmp@0.2.6
|
|
- form-data@4.0.6
|
|
- tar@7.5.16
|
|
- markdown-it@14.1.2
|
|
- linkify-it@5.0.1
|
|
- js-yaml@3.15.0
|
|
- js-yaml@4.1.2
|
|
- protobufjs@7.6.1
|
|
- protobufjs@7.6.3
|
|
- '@babel/core@7.29.1'
|
|
- axios@1.18.0
|
|
- brace-expansion@2.1.2
|
|
- brace-expansion@1.1.16
|
|
- js-yaml@4.3.0
|
|
- tar@7.5.18
|
|
- tar@7.5.19
|
|
- tar@7.5.17
|
|
- protobufjs@7.6.5
|
|
- linkify-it@5.0.2
|
|
- sharp@0.35.0
|
|
- brace-expansion@1.1.17
|
|
- brace-expansion@2.1.3
|
|
- brace-expansion@2.1.4
|
|
- brace-expansion@1.1.18
|
|
- js-yaml@3.15.1
|
|
- js-yaml@4.3.1
|
|
- tar@7.5.21
|
|
- '@opentelemetry/core@2.8.0'
|