lancedb

v0.29.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 21d Vector Databases

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

approximate-nearest-neighbor-search image-search nearest-neighbor-search recommender-system search-engine semantic-search

+2 more

similarity-search vector-db

Affected surfaces

deps

ReleasePort's take

Moderate signal

editorial:auto 13d

LanceDB v0.29.0 removes legacy tantivy full‑text search support, a breaking change that requires migration of any FTS workloads.

Why it matters: Migrate existing tantivy FTS implementations before upgrading to avoid query failures; plan the migration now.

Summary

AI summary

Removed legacy tantivy FTS support, a breaking change requiring migration.

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	Enable hostname verification by default for TLS connections Enable hostname verification by default for TLS connections Source: llm_adapter@2026-05-21 Confidence: high	—
Security	Medium	Address RUSTSEC-2026-0104 cargo-deny advisory in dependencies Address RUSTSEC-2026-0104 cargo-deny advisory in dependencies Source: llm_adapter@2026-05-21 Confidence: low	—
Breaking	Medium	Consolidate namespace related naming and enterprise integration Consolidate namespace related naming and enterprise integration Source: llm_adapter@2026-05-21 Confidence: low	—
Feature
Feature	Medium	Add manifest-enabled directory namespace mode Add manifest-enabled directory namespace mode Source: llm_adapter@2026-05-21 Confidence: high	—
Feature	Medium	Support Enum types in Pydantic to Arrow schema conversion Support Enum types in Pydantic to Arrow schema conversion Source: llm_adapter@2026-05-21 Confidence: high	—
Feature	Medium	Support nested namespace operations in database listing Support nested namespace operations in database listing Source: llm_adapter@2026-05-21 Confidence: high	—
Feature	Medium	Add user_id field to ClientConfig for user identification Add user_id field to ClientConfig for user identification Source: llm_adapter@2026-05-21 Confidence: high	—
Feature	Medium	Add IVF_HNSW_FLAT vector index support in Python Add IVF_HNSW_FLAT vector index support in Python Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	Support model-backed native FTS tokenizers in Python Support model-backed native FTS tokenizers in Python Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	Support child namespace operations and JSON serialization Support child namespace operations and JSON serialization Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	Make Permutation fork-safe for PyTorch DataLoader workers Make Permutation fork-safe for PyTorch DataLoader workers Source: llm_adapter@2026-05-21 Confidence: low	—
Feature	Medium	Add prewarmData method on Table in Node.js Add prewarmData method on Table in Node.js Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix
Bugfix	Medium	Sanitize bad vectors before Arrow type cast Sanitize bad vectors before Arrow type cast Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Make Permutation picklable for PyTorch multiprocessing Make Permutation picklable for PyTorch multiprocessing Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Materialize declared namespace tables on creation Materialize declared namespace tables on creation Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Guard against None before decode on split_names metadata Guard against None before decode on split_names metadata Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Migrate gemini-text provider to google-genai SDK Migrate gemini-text provider to google-genai SDK Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Remove redundant postbuild:release script to fix build failure Remove redundant postbuild:release script to fix build failure Source: llm_adapter@2026-05-21 Confidence: high	—
Bugfix	Medium	Prevent reranker from keeping Node process alive Prevent reranker from keeping Node process alive Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix	Medium	Pass namespace client on schema-only table creation Pass namespace client on schema-only table creation Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix	Medium	Use namespace-backed Rust connection for namespace tables Use namespace-backed Rust connection for namespace tables Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix	Medium	Drop spurious trailing question mark from listing-database URIs Drop spurious trailing question mark from listing-database URIs Source: llm_adapter@2026-05-21 Confidence: low	—
Bugfix	Medium	Fix broken documentation links Fix broken documentation links Source: llm_adapter@2026-05-21 Confidence: low	—
Refactor	Medium	Remove legacy tantivy full-text search support Remove legacy tantivy full-text search support Source: llm_adapter@2026-05-21 Confidence: high	—

Full changelog

🛠 Breaking Changes

refactor!: consolidate namespace related naming and enterprise integration by @jackye1995 in https://github.com/lancedb/lancedb/pull/3205

🎉 New Features

feat(python): support Enum types in Pydantic to Arrow schema conversion by @Zelys-DFKH in https://github.com/lancedb/lancedb/pull/3232
feat: add user_id field to ClientConfig for user identification by @jackye1995 in https://github.com/lancedb/lancedb/pull/3240
feat(python): support child namepsace operations and json serialization for LanceDBConnection by @jackye1995 in https://github.com/lancedb/lancedb/pull/3265
feat(rust): support nested namespace ops in listing db by @jackye1995 in https://github.com/lancedb/lancedb/pull/3279
feat: add manifest-enabled directory namespace mode by @jackye1995 in https://github.com/lancedb/lancedb/pull/3332
feat(python): make Permutation fork-safe for PyTorch DataLoader workers by @westonpace in https://github.com/lancedb/lancedb/pull/3339
feat(python): support model-backed native FTS tokenizers by @Xuanwo in https://github.com/lancedb/lancedb/pull/3289
feat(python): add IVF_HNSW_FLAT vector index support by @shenganzhang in https://github.com/lancedb/lancedb/pull/3366
feat(nodejs): add prewarmData method on Table by @brendanclement in https://github.com/lancedb/lancedb/pull/3374

🐛 Bug Fixes

fix(python): sanitize bad vectors before Arrow cast by @myandpr in https://github.com/lancedb/lancedb/pull/3158
fix(python): guard against None before .decode() on split_names metadata key by @lennylxx in https://github.com/lancedb/lancedb/pull/3229
fix(python): migrate gemini-text provider to google-genai sdk by @DhruvGarg111 in https://github.com/lancedb/lancedb/pull/3250
fix(python): pass namespace client on schema-only table create by @jackye1995 in https://github.com/lancedb/lancedb/pull/3283
fix(python): use namespace-backed rust connection for namespace tables by @jackye1995 in https://github.com/lancedb/lancedb/pull/3286
fix(node): prevent reranker from keeping process alive by @snigenigmatic in https://github.com/lancedb/lancedb/pull/3270
fix(rust): materialize declared namespace tables on create by @jackye1995 in https://github.com/lancedb/lancedb/pull/3288
fix: enable hostname verification by default by @jackye1995 in https://github.com/lancedb/lancedb/pull/3304
fix: address RUSTSEC-2026-0104 cargo-deny advisory by @westonpace in https://github.com/lancedb/lancedb/pull/3326
fix(python): add missing space in hybrid query error message by @n1teshy in https://github.com/lancedb/lancedb/pull/3340
fix(node): remove redundant postbuild:release script to fix build failure by @qingfeng-occ in https://github.com/lancedb/lancedb/pull/3285
fix(python): make Permutation picklable for PyTorch multiprocessing by @westonpace in https://github.com/lancedb/lancedb/pull/3335
fix(database): drop spurious trailing ? from listing-database URIs by @touch-of-grey in https://github.com/lancedb/lancedb/pull/3357

📚 Documentation

docs: fix broken documentation links by @Gezi-lzq in https://github.com/lancedb/lancedb/pull/3278

Other Changes

refactor(python): remove legacy tantivy FTS support by @Xuanwo in https://github.com/lancedb/lancedb/pull/3282

🔧 Build and CI

ci: add top-level permissions to GHA workflows by @wjones127 in https://github.com/lancedb/lancedb/pull/3255
ci: add Dependabot config for shipped Rust binaries by @wjones127 in https://github.com/lancedb/lancedb/pull/3300
ci: switch PyPI publish to OIDC trusted publishing by @wjones127 in https://github.com/lancedb/lancedb/pull/3302
ci: add cargo-deny configuration and CI check by @wjones127 in https://github.com/lancedb/lancedb/pull/3307
ci: avoid passing GPG passphrase on command line in Java publish workflow by @octo-patch in https://github.com/lancedb/lancedb/pull/3313

Breaking Changes

Removed legacy tantivy FTS support from python integration

Security Fixes

Address RUSTSEC-2026-0104 cargo-deny advisory

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track lancedb

Get notified when new releases ship.

About lancedb

Developer-friendly OSS embedded retrieval library for multimodal AI. Search More; Manage Less.

All releases →

Related context

Related tools

Earlier breaking changes

v0.30.0-beta.0 Fixes nested field paths support in native index creation
vpython-v0.32.0 Namespace naming and enterprise integration refactored with breaking changes