From deda136ae881f45b5d76067eb80474845eba7a11 Mon Sep 17 00:00:00 2001 From: mrsibe Date: Wed, 30 Sep 2026 12:26:24 +0800 Subject: [PATCH] deps(sqlite-vec): move the pin from 0.1.7-alpha.2 to the stable 0.1.9 `docs/dependency-audit.md` recorded this as a follow-up: the manifest pinned an alpha while a stable release existed upstream. The pin stays exact, because upstream is pre-v1 and `^0.1.9` would resolve `0.1.10-alpha.*`, which is an ANN change we have no reason to take implicitly. Verified on Linux x64: - `npm run typecheck` - clean - `npm test` - 469/469 pass (includes the real-`vec0` scope-filter tests) - `npm run build:unpack && npm run smoke:packaged` - 29 checks pass; the packaged app loads `sqlite-vec-linux-x64/vec0.so` from `app.asar.unpacked` and reports `vec_version()` -> `v0.1.9`; the `vec0` upsert/KNN/delete round trip still works The audit document is updated to the new version, marks the follow-up done, and corrects the recorded smoke-pass count to the current 29. --- docs/dependency-audit.md | 46 ++++++++++++++++++++------------------ package-lock.json | 48 ++++++++++++++++++++-------------------- package.json | 2 +- 3 files changed, 50 insertions(+), 46 deletions(-) diff --git a/docs/dependency-audit.md b/docs/dependency-audit.md index c9dad17..c2215d9 100644 --- a/docs/dependency-audit.md +++ b/docs/dependency-audit.md @@ -15,12 +15,12 @@ added here only when a committed feature is blocked by it, with that feature as Verdicts up front: -| Dependency | Verdict | -| ------------------------------------------------ | ---------------------------------------------------------------------- | -| `sqlite-vec` | **KEEP** — with a recorded, low-risk option to leave the alpha channel | -| `pdfjs-dist` | **REPLACE (upgrade)** → tracked as #121, a v1.4 blocker | -| `@huggingface/transformers` + `onnxruntime-node` | **KEEP** — already on the latest published versions | -| FTS5 (for #77's BM25/hybrid) | **available** — proven in the packaged app, see below | +| Dependency | Verdict | +| ------------------------------------------------ | ------------------------------------------------------- | +| `sqlite-vec` | **KEEP** — now on the stable `0.1.9`, exact-pinned | +| `pdfjs-dist` | **REPLACE (upgrade)** → tracked as #121, a v1.4 blocker | +| `@huggingface/transformers` + `onnxruntime-node` | **KEEP** — already on the latest published versions | +| FTS5 (for #77's BM25/hybrid) | **available** — proven in the packaged app, see below | ## Read `dependencies` vs `devDependencies` the way this repo means it @@ -56,13 +56,13 @@ Consequences that matter: ## 1. `sqlite-vec` — KEEP -| | | -| -------------------- | ---------------------------------------------------------------------------------------- | -| Declared / installed | `0.1.7-alpha.2` (exact pin, no range) | -| Ships as | confirmed at runtime by the packaged app: `vec_version()` → `v0.1.7-alpha.2` | -| Upstream | `latest` dist-tag is **`0.1.9`**; `alpha` is `0.1.10-alpha.4`; last published 2026-05-18 | -| Licence | MIT OR Apache-2.0 | -| Native | yes — loadable SQLite extension, unpacked (`sqlite-vec-linux-x64`, ~156 KB shipped) | +| | | +| -------------------- | ----------------------------------------------------------------------------------- | +| Declared / installed | `0.1.9` (exact pin, no range) | +| Ships as | confirmed at runtime by the packaged app: `vec_version()` → `v0.1.9` | +| Upstream | `latest` dist-tag is **`0.1.9`** (this pin); `alpha` is `0.1.10-alpha.4` | +| Licence | MIT OR Apache-2.0 | +| Native | yes — loadable SQLite extension, unpacked (`sqlite-vec-linux-x64`, ~156 KB shipped) | **What it constrains.** `vec0` is the substrate every retrieval strategy sits on. Its capability set (distance metrics, metadata filtering, table lifecycle) bounds what `DenseRetriever` and @@ -71,9 +71,11 @@ just its search: `SQLiteVectorStore` treats vector width as a per-notebook decis width change without an explicit rebuild, and drops a notebook's vector table when the notebook is deleted — all of that is `vec0` semantics, and the packaged smoke test asserts it. -**The alpha question.** We pin an alpha while a stable `0.1.9` exists upstream. That is a real -inconsistency, but it is not currently causing a problem, and the pin is exact so the resolved -version cannot drift on its own. +**The alpha question.** This pin used to be an alpha (`0.1.7-alpha.2`) while a stable `0.1.9` +existed upstream. That is no longer true: the pin is the stable `0.1.9` itself, so the manifest no +longer sits on a pre-release. The pin stays exact, so the resolved version still cannot drift on +its own — upstream is pre-v1 and a range (`^0.1.9`) would pull `0.1.10-alpha.*`, which is not a +change to take implicitly. **Replacement cost.** There is no cheaper option. Replacing the vector store means either a pure-JS index (losing the SQLite-side filtering and the shared transaction boundary with @@ -84,9 +86,11 @@ persistence format, and a re-index migration for existing users). asserted end to end by the packaged smoke test, and replacing it would be a rewrite of the retrieval storage layer for no capability we currently lack. -**Recorded follow-up (not in #62):** moving from `0.1.7-alpha.2` to the stable `0.1.9`. Because the -pin is exact, that is a one-line manifest change plus a smoke run and the existing retrieval tests — -worth doing as its own small change, so a `vec0` behaviour change cannot hide inside a bigger PR. +**Recorded follow-up (not in #62), now done:** moving from `0.1.7-alpha.2` to the stable `0.1.9`. +Because the pin is exact, that was a one-line manifest change plus a smoke run and the existing +retrieval tests — done as its own small change, so a `vec0` behaviour change cannot hide inside a +bigger PR. Verified end to end: the packaged app reports `vec_version()` → `v0.1.9`, the `vec0` +upsert/KNN/delete round trip passes, and the scope-filtered query tests still pass. **Blast radius:** native addon, `asarUnpack` (`node_modules/sqlite-vec/**`, `node_modules/sqlite-vec-*/**`), and an entry in `dependencies`. @@ -198,10 +202,10 @@ work in the build users actually run. Result from `npm run build:unpack && npm run smoke:packaged`: ```text -[SmokeTest] ok sqlite-vec reports version v0.1.7-alpha.2 +[SmokeTest] ok sqlite-vec reports version v0.1.9 [SmokeTest] ok FTS5 is available and ranks: sqlite 3.53.2, ENABLE_FTS5 flag present, bm25() = -9.447852760736198e-7 -[SmokeTest] PASS - 20 checks passed +[SmokeTest] PASS - 29 checks passed ``` **FTS5 is available: `ENABLE_FTS5` is compiled in, `MATCH` returned the expected row, and `bm25()` diff --git a/package-lock.json b/package-lock.json index 1237b31..74ffcbe 100644 --- a/package-lock.json +++ b/package-lock.json @@ -19,7 +19,7 @@ "onnxruntime-node": "^1.30.0", "pdfjs-dist": "^6.3.289", "sharp": "^0.35.4", - "sqlite-vec": "0.1.7-alpha.2" + "sqlite-vec": "0.1.9" }, "devDependencies": { "@ai-sdk/anthropic": "^2.0.105", @@ -16916,22 +16916,22 @@ "optional": true }, "node_modules/sqlite-vec": { - "version": "0.1.7-alpha.2", - "resolved": "https://registry.npmmirror.com/sqlite-vec/-/sqlite-vec-0.1.7-alpha.2.tgz", - "integrity": "sha512-rNgRCv+4V4Ed3yc33Qr+nNmjhtrMnnHzXfLVPeGb28Dx5mmDL3Ngw/Wk8vhCGjj76+oC6gnkmMG8y73BZWGBwQ==", + "version": "0.1.9", + "resolved": "https://registry.npmmirror.com/sqlite-vec/-/sqlite-vec-0.1.9.tgz", + "integrity": "sha512-L7XJWRIBNvR9O5+vh1FQ+IGkh/3D2AzVksW5gdtk28m78Hy8skFD0pqReKH1Yp0/BUKRGcffgKvyO/EON5JXpA==", "license": "MIT OR Apache", "optionalDependencies": { - "sqlite-vec-darwin-arm64": "0.1.7-alpha.2", - "sqlite-vec-darwin-x64": "0.1.7-alpha.2", - "sqlite-vec-linux-arm64": "0.1.7-alpha.2", - "sqlite-vec-linux-x64": "0.1.7-alpha.2", - "sqlite-vec-windows-x64": "0.1.7-alpha.2" + "sqlite-vec-darwin-arm64": "0.1.9", + "sqlite-vec-darwin-x64": "0.1.9", + "sqlite-vec-linux-arm64": "0.1.9", + "sqlite-vec-linux-x64": "0.1.9", + "sqlite-vec-windows-x64": "0.1.9" } }, "node_modules/sqlite-vec-darwin-arm64": { - "version": "0.1.7-alpha.2", - "resolved": "https://registry.npmmirror.com/sqlite-vec-darwin-arm64/-/sqlite-vec-darwin-arm64-0.1.7-alpha.2.tgz", - "integrity": "sha512-raIATOqFYkeCHhb/t3r7W7Cf2lVYdf4J3ogJ6GFc8PQEgHCPEsi+bYnm2JT84MzLfTlSTIdxr4/NKv+zF7oLPw==", + "version": "0.1.9", + "resolved": "https://registry.npmmirror.com/sqlite-vec-darwin-arm64/-/sqlite-vec-darwin-arm64-0.1.9.tgz", + "integrity": "sha512-jSsZpE42OfBkGL/ItyJTVCUwl6o6Ka3U5rc4j+UBDIQzC1ulSSKMEhQLthsOnF/MdAf1MuAkYhkdKmmcjaIZQg==", "cpu": [ "arm64" ], @@ -16942,9 +16942,9 @@ ] }, "node_modules/sqlite-vec-darwin-x64": { - "version": "0.1.7-alpha.2", - "resolved": "https://registry.npmmirror.com/sqlite-vec-darwin-x64/-/sqlite-vec-darwin-x64-0.1.7-alpha.2.tgz", - "integrity": "sha512-jeZEELsQjjRsVojsvU5iKxOvkaVuE+JYC8Y4Ma8U45aAERrDYmqZoHvgSG7cg1PXL3bMlumFTAmHynf1y4pOzA==", + "version": "0.1.9", + "resolved": "https://registry.npmmirror.com/sqlite-vec-darwin-x64/-/sqlite-vec-darwin-x64-0.1.9.tgz", + "integrity": "sha512-KDlVyqQT7pnOhU1ymB9gs7dMbSoVmKHitT+k1/xkjarcX8bBqPxWrGlK/R+C5WmWkfvWwyq5FfXfiBYCBs6PlA==", "cpu": [ "x64" ], @@ -16955,9 +16955,9 @@ ] }, "node_modules/sqlite-vec-linux-arm64": { - "version": "0.1.7-alpha.2", - "resolved": "https://registry.npmmirror.com/sqlite-vec-linux-arm64/-/sqlite-vec-linux-arm64-0.1.7-alpha.2.tgz", - "integrity": "sha512-6Spj4Nfi7tG13jsUG+W7jnT0bCTWbyPImu2M8nWp20fNrd1SZ4g3CSlDAK8GBdavX7wRlbBHCZ+BDa++rbDewA==", + "version": "0.1.9", + "resolved": "https://registry.npmmirror.com/sqlite-vec-linux-arm64/-/sqlite-vec-linux-arm64-0.1.9.tgz", + "integrity": "sha512-5wXVJ9c9kR4CHm/wVqXb/R+XUHTdpZ4nWbPHlS+gc9qQFVHs92Km4bPnCKX4rtcPMzvNis+SIzMJR1SCEwpuUw==", "cpu": [ "arm64" ], @@ -16968,9 +16968,9 @@ ] }, "node_modules/sqlite-vec-linux-x64": { - "version": "0.1.7-alpha.2", - "resolved": "https://registry.npmmirror.com/sqlite-vec-linux-x64/-/sqlite-vec-linux-x64-0.1.7-alpha.2.tgz", - "integrity": "sha512-IcgrbHaDccTVhXDf8Orwdc2+hgDLAFORl6OBUhcvlmwswwBP1hqBTSEhovClG4NItwTOBNgpwOoQ7Qp3VDPWLg==", + "version": "0.1.9", + "resolved": "https://registry.npmmirror.com/sqlite-vec-linux-x64/-/sqlite-vec-linux-x64-0.1.9.tgz", + "integrity": "sha512-w3tCH8xK2finW8fQJ/m8uqKodXUZ9KAuAar2UIhz4BHILfpE0WM/MTGCRfa7RjYbrYim5Luk3guvMOGI7T7JQA==", "cpu": [ "x64" ], @@ -16981,9 +16981,9 @@ ] }, "node_modules/sqlite-vec-windows-x64": { - "version": "0.1.7-alpha.2", - "resolved": "https://registry.npmmirror.com/sqlite-vec-windows-x64/-/sqlite-vec-windows-x64-0.1.7-alpha.2.tgz", - "integrity": "sha512-TRP6hTjAcwvQ6xpCZvjP00pdlda8J38ArFy1lMYhtQWXiIBmWnhMaMbq4kaeCYwvTTddfidatRS+TJrwIKB/oQ==", + "version": "0.1.9", + "resolved": "https://registry.npmmirror.com/sqlite-vec-windows-x64/-/sqlite-vec-windows-x64-0.1.9.tgz", + "integrity": "sha512-y3gEIyy/17bq2QFPQOWLE68TYWcRZkBQVA2XLrTPHNTOp55xJi/BBBmOm40tVMDMjtP+Elpk6UBUXdaq+46b0Q==", "cpu": [ "x64" ], diff --git a/package.json b/package.json index 7573bbd..cff4171 100644 --- a/package.json +++ b/package.json @@ -107,7 +107,7 @@ "onnxruntime-node": "^1.30.0", "pdfjs-dist": "^6.3.289", "sharp": "^0.35.4", - "sqlite-vec": "0.1.7-alpha.2" + "sqlite-vec": "0.1.9" }, "//devDependencies": [ "Everything else, including packages the main process uses. electron-vite",