Repository navigation
ci: ignore RUSTSEC-2026-0385 until ctutils fix ages past 48h - #10269
Merged
Merged
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
github-actions
Bot
added
A-python
![lance-gatekeeper[bot]](https://avatars.githubusercontent.com/in/4433141?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
lance-gatekeeper
Bot
added
the
K-changes
Xuanwo
changed the title
lance-gatekeeper
Bot
removed
the
K-changes
Contributor
There was a problem hiding this comment.
Restoring the lockfiles addresses the dependency-age finding. The temporary ignore follows the repository's dated-exception policy, but leaves ctutils 0.4.2 affected by RUSTSEC-2026-0385 until the planned update after October 25. Remove the ignore with that update, before its October 30 expiry.
lance-gatekeeper
Bot
added
K-approved
BubbleCal
approved these changes
Oct 23, 2026
Xuanwo
pushed a commit
that referenced
this pull request
Oct 23, 2026
## Summary Fix two independent recall failures seen on main: - In streaming coreset training, a singleton can retain a large compression loss and reach the top of the split heap while other clusters are still splittable. Finalize that singleton and continue; stop only when the heap's remaining clusters are finalized. This prevents premature termination followed by duplicate-centroid padding. Extend the existing regression test with lossy summaries and exhausted splits. - Give `test_legacy_ivf_pq_cosine_multivec_smoke` eight PQ sub-vectors instead of four, reducing quantization error with its small training sample. Keep its data, query, training sample rate, iteration count, and `recall >= 0.5` assertion unchanged. Failing CI: [Float64 streaming coreset recall](https://github.com/lance-format/lance/actions/runs/39917533988/job/120294401363), [legacy multivector PQ recall](https://github.com/lance-format/lance/actions/runs/39919434480/job/120301400723). Related: #9346 proposes fallback bisection and rejecting unattainable partition counts. This PR fixes singleton termination in the existing split loop and preserves the current exhausted-split behavior. ## Validation - The added lossy/exhausted regression cases fail before the fix: 16 distinct centroids instead of 32. All three cases pass afterward. - 15 weighted tests, 28 streaming tests, and the final legacy multivector smoke test pass. - `cargo fmt --all --check` - `cargo clippy --locked --all --tests --benches -- -D warnings` - `git diff --check`; commit hooks pass. Local recall checks were measured on fix commit `271c19a82f6b8a7c2cd9574aca3a9bb8198f664c` against `77b7fd4250e248cce207c54389b7f7065f5252d9`, before syncing main, on Apple M3 Max (arm64), Rust 1.98.1, default features and test profile. Each version uses the same seeded fixture; training runs use normal OS randomness and are independent. | Scenario / metric | Baseline | Fix commit `271c19a82` | | --- | ---: | ---: | | Streaming L2: recall@5 below 0.5 | 2 / 500 runs | 0 / 500 runs | | Streaming cosine: recall@5 below 0.5 | 2 / 500 runs | 0 / 500 runs | | Streaming L2: distinct centroids | 107–176 | 257 | | Streaming cosine: distinct centroids | 80–140 | 257 | | Legacy multivector PQ: mean recall@100 | 0.57940 | 0.76845 | | Legacy multivector PQ: minimum recall@100 | 0.50 | 0.67 | Streaming: 600 Float64 vectors, four dimensions, two fragments, 257 partitions, sample rates 2/1, one training iteration, minimum 16 probes, query row 321. All-partition recall is 1.0 in every run before and after. Multivector PQ: 200 runs per version, 512 rows with three 32-dimensional vectors each, one fully probed partition, query row 0, 8-bit codebooks, sample rate 1, two iterations. The Linux CI failure was 0.49; the local baseline did not fall below 0.5. These are fixture-specific correctness observations. CI on `271c19a82` passed Rust tests on all platforms, Clippy, Python and JNI checks. Its only failed check was the main-branch dependency advisory RUSTSEC-2026-0385. Syncing main incorporates the already-merged handling in #10269. The merged tree was rechecked with formatting, full workspace Clippy, and all 44 focused tests above; new CI results are pending.
Xuanwo
added a commit
that referenced
this pull request
Oct 27, 2026
The cargo-deny job on `main` fails on RUSTSEC-2026-0385: `ctutils` 0.4.2 has non-constant-time mask generation, fixed in `ctutils` 0.4.4. The fixed versions (0.4.4, 0.4.5) were both published 2026-10-23, so `ci/check_dependency_age.py` rejects them for another ~48 hours. Following the pattern in `ci/check_advisory_ignores.py`, this adds a dated ignore for RUSTSEC-2026-0385 that expires 2026-10-30. Follow-up: run `cargo update -p ctutils` in the root, `python/`, and `java/lance-jni/` lockfiles once the versions are 48h old (from 2026-10-25), then remove this ignore. Verification: `cargo deny check` (cargo-deny 0.19.0, same version CI pins) reports `advisories ok, bans ok, licenses ok, sources ok`; `ci/check_dependency_age.py` and `ci/check_advisory_ignores.py` both pass locally.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The cargo-deny job on
mainfails on RUSTSEC-2026-0385:ctutils0.4.2 has non-constant-time mask generation, fixed inctutils0.4.4.The fixed versions (0.4.4, 0.4.5) were both published 2026-10-23, so
ci/check_dependency_age.pyrejects them for another ~48 hours. Following the pattern inci/check_advisory_ignores.py, this adds a dated ignore for RUSTSEC-2026-0385 that expires 2026-10-30.Follow-up: run
cargo update -p ctutilsin the root,python/, andjava/lance-jni/lockfiles once the versions are 48h old (from 2026-10-25), then remove this ignore.Verification:
cargo deny check(cargo-deny 0.19.0, same version CI pins) reportsadvisories ok, bans ok, licenses ok, sources ok;ci/check_dependency_age.pyandci/check_advisory_ignores.pyboth pass locally.