mirror of
https://github.com/lancedb/lancedb.git
synced 2026-09-21 20:45:57 +00:00
Jack Ye
37771fd4fc
Two upstream dependency releases broke CI on `main`. Both fixes are dependency constraints, so they ride together. ## `deny` — RUSTSEC-2026-0285 rustls 0.23.40 accepts TLS 1.3 handshake messages sent at the wrong encryption level ([advisory](https://rustsec.org/advisories/RUSTSEC-2026-0285)), patched in 0.23.45. rustls 0.23.45 requires `aws-lc-rs >= 1.18`, which the nodejs crate pinned to `=1.16.3`, so this also bumps that pin and its `aws-lc-sys` companion to `=1.18.1` / `=0.45.0`. The pin comment already calls for periodic updates on security patches. The workspace's other rustls (0.21.12) is below the advisory's affected range (`unaffected = ["< 0.23.13"]`). ## `build-no-lock` — aws-smithy-types 1.7.0 `aws-smithy-types` 1.7.0 and `aws-smithy-json` 0.64.0 both released 2026-09-14. 1.7.0 made `Document` `non_exhaustive`, which `aws-smithy-json` 0.63 does not compile against: ``` error[E0004]: non-exhaustive patterns: `&_` not covered --> aws-smithy-json-0.63.0/src/serialize.rs:36:15 note: `aws_smithy_types::Document` defined here --> aws-smithy-types-1.7.0/src/document/mod.rs:91:1 ``` Every `aws-sdk-*` crate moved to `aws-smithy-json ^0.64`, but `aws-config` 1.12.0 still requires `^0.63`, so a lockfile-free resolve pairs json 0.63.0 with types 1.7.0 and fails. This caps `aws-smithy-types` below 1.7 as a constraint-only dev-dependency, matching the existing `aws-smithy-runtime` entry. Revert once `aws-config` moves to `aws-smithy-json` 0.64. Note this break is not specific to this PR — `build-no-lock` fails the same way on unrelated branches (e.g. `jon/secrets-client-api` run 34903587364), which passed it hours earlier. ## Verification Resolution only, no local build: - Locked resolve unchanged: `aws-smithy-types` stays 1.4.8; the only `Cargo.lock` delta from the cap is the new dev-dep edge. - Fresh resolve (`rm Cargo.lock`): `aws-smithy-json` 0.63.0 with `aws-smithy-types` 1.6.3, `aws-sdk-*` one release back, `rustls` 0.23.45 retained.
51 lines
1.4 KiB
TOML
51 lines
1.4 KiB
TOML
[package]
|
|
name = "lancedb-nodejs"
|
|
edition.workspace = true
|
|
version = "0.39.0-beta.8"
|
|
publish = false
|
|
license.workspace = true
|
|
description.workspace = true
|
|
repository.workspace = true
|
|
keywords.workspace = true
|
|
categories.workspace = true
|
|
|
|
[lib]
|
|
crate-type = ["cdylib"]
|
|
|
|
[dependencies]
|
|
async-trait.workspace = true
|
|
arrow-ipc.workspace = true
|
|
arrow-array.workspace = true
|
|
arrow-buffer.workspace = true
|
|
half.workspace = true
|
|
arrow-schema.workspace = true
|
|
env_logger.workspace = true
|
|
futures.workspace = true
|
|
lancedb.workspace = true
|
|
lance-namespace.workspace = true
|
|
napi = { version = "3.8.3", default-features = false, features = [
|
|
"napi9",
|
|
"async",
|
|
"chrono_date",
|
|
"serde-json",
|
|
] }
|
|
chrono.workspace = true
|
|
serde_json.workspace = true
|
|
napi-derive = "3.5.2"
|
|
# Prevent dynamic linking of lzma, which comes from datafusion
|
|
lzma-sys = { version = "0.1", features = ["static"] }
|
|
log.workspace = true
|
|
|
|
# Pin to resolve build failures; update periodically for security patches.
|
|
# rustls >= 0.23.45 (RUSTSEC-2026-0285) needs aws-lc-rs >= 1.18.
|
|
aws-lc-sys = "=0.45.0"
|
|
aws-lc-rs = "=1.18.1"
|
|
|
|
[build-dependencies]
|
|
napi-build = "2.3.1"
|
|
|
|
[features]
|
|
default = ["remote", "lancedb/aws", "lancedb/gcs", "lancedb/azure", "lancedb/dynamodb", "lancedb/oss", "lancedb/huggingface", "lancedb/goosefs", "lancedb/metrics-otel"]
|
|
fp16kernels = ["lancedb/fp16kernels"]
|
|
remote = ["lancedb/remote"]
|