lancedb

vpython-v0.32.0 scope: python Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 21d Vector Databases

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

approximate-nearest-neighbor-search image-search nearest-neighbor-search recommender-system search-engine semantic-search

+2 more

similarity-search vector-db

Affected surfaces

deps

ReleasePort's take

Light signal

editorial:auto 13d

LanceDB v0.32.0 removes legacy tantivy FTS support and refactors namespace management with breaking changes. Security improvements include default hostname verification and RUSTSEC-2026-0104 dependency patch.

Why it matters: Applications using legacy FTS must migrate to model-backed tokenizers before upgrading. Hostname verification now enabled by default; validate connections in dev environments. Namespace refactoring requires code review for affected operations.

Summary

AI summary

Legacy tantivy FTS support removed, requiring migration.

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	RUSTSEC-2026-0104 cargo-deny advisory addressed in dependencies RUSTSEC-2026-0104 cargo-deny advisory addressed in dependencies Source: llm_adapter@2026-05-21 Confidence: high	—
Security	Medium	Hostname verification enabled by default for connection security Hostname verification enabled by default for connection security Source: llm_adapter@2026-05-21 Confidence: high	—
Breaking	Medium	Namespace naming and enterprise integration refactored with breaking changes Namespace naming and enterprise integration refactored with breaking changes Source: llm_adapter@2026-05-21 Confidence: low	—
Feature
Feature	Medium	Permutation made fork-safe for PyTorch DataLoader workers Permutation made fork-safe for PyTorch DataLoader workers Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	Child namespace operations and JSON serialization supported Child namespace operations and JSON serialization supported Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	IVF_HNSW_FLAT vector index type now supported IVF_HNSW_FLAT vector index type now supported Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	Manifest-enabled directory namespace mode added Manifest-enabled directory namespace mode added Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	Enum types in Pydantic to Arrow schema conversion supported Enum types in Pydantic to Arrow schema conversion supported Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	Model-backed native FTS tokenizers now supported Model-backed native FTS tokenizers now supported Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	user_id field added to ClientConfig for user identification user_id field added to ClientConfig for user identification Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	prewarmData method added to Table on Node.js prewarmData method added to Table on Node.js Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix
Bugfix	Medium	Bad vectors sanitized before Arrow cast to prevent corruption Bad vectors sanitized before Arrow cast to prevent corruption Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Reranker prevented from keeping Node.js process alive Reranker prevented from keeping Node.js process alive Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	None guard added before .decode() on split_names metadata None guard added before .decode() on split_names metadata Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Permutation made picklable for PyTorch multiprocessing Permutation made picklable for PyTorch multiprocessing Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Namespace client passed on schema-only table creation Namespace client passed on schema-only table creation Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix	Medium	Namespace-backed Rust connection used for namespace tables Namespace-backed Rust connection used for namespace tables Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix	Medium	Gemini-text provider migrated to google-genai SDK Gemini-text provider migrated to google-genai SDK Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix	Medium	Build failure fixed by removing redundant postbuild script Build failure fixed by removing redundant postbuild script Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix	Medium	Spurious trailing ? dropped from listing-database URIs Spurious trailing ? dropped from listing-database URIs Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix	Medium	Missing space added to hybrid query error message Missing space added to hybrid query error message Source: llm_adapter@2026-05-21 Confidence: low	—
Refactor	Medium	Legacy tantivy FTS support removed Legacy tantivy FTS support removed Source: llm_adapter@2026-05-21 Confidence: high	—

Full changelog

🛠 Breaking Changes

refactor!: consolidate namespace related naming and enterprise integration by @jackye1995 in https://github.com/lancedb/lancedb/pull/3205

🎉 New Features

feat(python): support Enum types in Pydantic to Arrow schema conversion by @Zelys-DFKH in https://github.com/lancedb/lancedb/pull/3232
feat: add user_id field to ClientConfig for user identification by @jackye1995 in https://github.com/lancedb/lancedb/pull/3240
feat(python): support child namepsace operations and json serialization for LanceDBConnection by @jackye1995 in https://github.com/lancedb/lancedb/pull/3265
feat(rust): support nested namespace ops in listing db by @jackye1995 in https://github.com/lancedb/lancedb/pull/3279
feat: add manifest-enabled directory namespace mode by @jackye1995 in https://github.com/lancedb/lancedb/pull/3332
feat(python): make Permutation fork-safe for PyTorch DataLoader workers by @westonpace in https://github.com/lancedb/lancedb/pull/3339
feat(python): support model-backed native FTS tokenizers by @Xuanwo in https://github.com/lancedb/lancedb/pull/3289
feat(python): add IVF_HNSW_FLAT vector index support by @shenganzhang in https://github.com/lancedb/lancedb/pull/3366
feat(nodejs): add prewarmData method on Table by @brendanclement in https://github.com/lancedb/lancedb/pull/3374

🐛 Bug Fixes

fix(python): sanitize bad vectors before Arrow cast by @myandpr in https://github.com/lancedb/lancedb/pull/3158
fix(python): guard against None before .decode() on split_names metadata key by @lennylxx in https://github.com/lancedb/lancedb/pull/3229
fix(python): migrate gemini-text provider to google-genai sdk by @DhruvGarg111 in https://github.com/lancedb/lancedb/pull/3250
fix(python): pass namespace client on schema-only table create by @jackye1995 in https://github.com/lancedb/lancedb/pull/3283
fix(python): use namespace-backed rust connection for namespace tables by @jackye1995 in https://github.com/lancedb/lancedb/pull/3286
fix(node): prevent reranker from keeping process alive by @snigenigmatic in https://github.com/lancedb/lancedb/pull/3270
fix(rust): materialize declared namespace tables on create by @jackye1995 in https://github.com/lancedb/lancedb/pull/3288
fix: enable hostname verification by default by @jackye1995 in https://github.com/lancedb/lancedb/pull/3304
fix: address RUSTSEC-2026-0104 cargo-deny advisory by @westonpace in https://github.com/lancedb/lancedb/pull/3326
fix(python): add missing space in hybrid query error message by @n1teshy in https://github.com/lancedb/lancedb/pull/3340
fix(node): remove redundant postbuild:release script to fix build failure by @qingfeng-occ in https://github.com/lancedb/lancedb/pull/3285
fix(python): make Permutation picklable for PyTorch multiprocessing by @westonpace in https://github.com/lancedb/lancedb/pull/3335
fix(database): drop spurious trailing ? from listing-database URIs by @touch-of-grey in https://github.com/lancedb/lancedb/pull/3357

📚 Documentation

docs: fix broken documentation links by @Gezi-lzq in https://github.com/lancedb/lancedb/pull/3278

Other Changes

refactor(python): remove legacy tantivy FTS support by @Xuanwo in https://github.com/lancedb/lancedb/pull/3282

🔧 Build and CI

ci: add top-level permissions to GHA workflows by @wjones127 in https://github.com/lancedb/lancedb/pull/3255
ci: add Dependabot config for shipped Rust binaries by @wjones127 in https://github.com/lancedb/lancedb/pull/3300
ci: switch PyPI publish to OIDC trusted publishing by @wjones127 in https://github.com/lancedb/lancedb/pull/3302
ci: add cargo-deny configuration and CI check by @wjones127 in https://github.com/lancedb/lancedb/pull/3307
ci: avoid passing GPG passphrase on command line in Java publish workflow by @octo-patch in https://github.com/lancedb/lancedb/pull/3313

Breaking Changes

Removed legacy tantivy FTS support from python API.

Security Fixes

Address RUSTSEC-2026-0104 cargo-deny advisory
Enable hostname verification by default

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track lancedb

Get notified when new releases ship.

About lancedb

Developer-friendly OSS embedded retrieval library for multimodal AI. Search More; Manage Less.