From 511e63bf887035231dd9dd5801aebb762eddc02e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 23 Oct 2026 08:24:55 +0000 Subject: [PATCH 1/2] chore(release): version packages --- .changeset/classify-network-failures.md | 5 ----- .changeset/pgvector-rls-on-supabase.md | 5 ----- .changeset/postgres-query-correctness.md | 5 ----- .changeset/ultracite-8-formatting.md | 4 ---- .changeset/upstash-namespace-integrity.md | 5 ----- packages/vecstore-sdk/CHANGELOG.md | 9 +++++++++ packages/vecstore-sdk/package.json | 2 +- 7 files changed, 10 insertions(+), 25 deletions(-) delete mode 100644 .changeset/classify-network-failures.md delete mode 100644 .changeset/pgvector-rls-on-supabase.md delete mode 100644 .changeset/postgres-query-correctness.md delete mode 100644 .changeset/ultracite-8-formatting.md delete mode 100644 .changeset/upstash-namespace-integrity.md diff --git a/.changeset/classify-network-failures.md b/.changeset/classify-network-failures.md deleted file mode 100644 index 45ee476..0000000 --- a/.changeset/classify-network-failures.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"vecstore-sdk": patch ---- - -Report network failures as `{ kind: "connection" }` on Bun as well as Node. Bun's `fetch` puts the error code on the error itself instead of on `cause`, so an unreachable host came back as `provider` from the Qdrant, Upstash, and Supabase adapters under Bun. The adapters now recognise both shapes, and the Supabase adapter treats a response with status 0 (no HTTP response) as a connection failure, including a timed-out request. The pgvector adapter also maps node-postgres's code-less timeouts and dropped connections to `connection`, and both Postgres adapters map the SQLSTATEs 57P02, 57P03, and 53300 to it. `SupabaseRpcResponse` gains an optional `status` field. diff --git a/.changeset/pgvector-rls-on-supabase.md b/.changeset/pgvector-rls-on-supabase.md deleted file mode 100644 index 4c2836d..0000000 --- a/.changeset/pgvector-rls-on-supabase.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"vecstore-sdk": patch ---- - -Turn on row level security for a table that the pgvector adapter's `createIndex` makes when the database has an `anon` role, as every Supabase project does. Before this, a table created through `createPgvectorStore` on a Supabase database sat in `public` with row level security off, so anyone holding the project's anon key could read, change, and delete its records through the REST API. The role that runs `createIndex` owns the table and keeps full access. Plain Postgres without an `anon` role is unchanged. Tables created by earlier versions are not altered; turn it on with `alter table "" enable row level security;`. diff --git a/.changeset/postgres-query-correctness.md b/.changeset/postgres-query-correctness.md deleted file mode 100644 index 0a06948..0000000 --- a/.changeset/postgres-query-correctness.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"vecstore-sdk": patch ---- - -Fix three pgvector and Supabase query defects. `not` around a range filter, such as `not(gt("year", 2000))`, now matches records that have no `year`, as the docs describe; the range comparison evaluated to SQL `NULL` for a missing field, so those records were skipped by queries and by `delete({ filter })`. A record with a zero vector, whose cosine score is NaN, now ranks last instead of first when Postgres reads an HNSW-indexed table without the index. The metric is now read from the `embedding` column's operator class only, so a table whose name contains an operator class name, such as `x_vector_cosine_ops`, keeps its own metric. Re-run `sql/supabase.sql` to get the new `vecstore_filter_sql`, `vecstore_metric`, and `vecstore_query`. diff --git a/.changeset/ultracite-8-formatting.md b/.changeset/ultracite-8-formatting.md deleted file mode 100644 index 2ce4c2d..0000000 --- a/.changeset/ultracite-8-formatting.md +++ /dev/null @@ -1,4 +0,0 @@ ---- ---- - -Formatting only: apply the blank-line spacing that ultracite 8 enforces and write the Redis field pattern with `\w`. No change in behaviour, so no release. diff --git a/.changeset/upstash-namespace-integrity.md b/.changeset/upstash-namespace-integrity.md deleted file mode 100644 index 796f9da..0000000 --- a/.changeset/upstash-namespace-integrity.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"vecstore-sdk": patch ---- - -Keep Upstash namespaces apart on `fetch` in metadata mode. A default-namespace handle that fetched an id shaped `{namespace}/{length}/{id}` received that namespace's record, relabelled with the plain id, in place of its own. `fetch` now returns only records of the handle's namespace. Every verb also returns `invalid_argument` up front for a metadata-mode namespace holding a backslash or both quote characters, which `upsert` used to accept although no query or filtered delete could reach it afterwards, and for an index name of `.` or `..`, which the request URL would have collapsed. diff --git a/packages/vecstore-sdk/CHANGELOG.md b/packages/vecstore-sdk/CHANGELOG.md index 2a8ca1c..267be95 100644 --- a/packages/vecstore-sdk/CHANGELOG.md +++ b/packages/vecstore-sdk/CHANGELOG.md @@ -1,5 +1,14 @@ # vecstore-sdk +## 0.1.5 + +### Patch Changes + +- 5bc2bed: Report network failures as `{ kind: "connection" }` on Bun as well as Node. Bun's `fetch` puts the error code on the error itself instead of on `cause`, so an unreachable host came back as `provider` from the Qdrant, Upstash, and Supabase adapters under Bun. The adapters now recognise both shapes, and the Supabase adapter treats a response with status 0 (no HTTP response) as a connection failure, including a timed-out request. The pgvector adapter also maps node-postgres's code-less timeouts and dropped connections to `connection`, and both Postgres adapters map the SQLSTATEs 57P02, 57P03, and 53300 to it. `SupabaseRpcResponse` gains an optional `status` field. +- 83c8002: Turn on row level security for a table that the pgvector adapter's `createIndex` makes when the database has an `anon` role, as every Supabase project does. Before this, a table created through `createPgvectorStore` on a Supabase database sat in `public` with row level security off, so anyone holding the project's anon key could read, change, and delete its records through the REST API. The role that runs `createIndex` owns the table and keeps full access. Plain Postgres without an `anon` role is unchanged. Tables created by earlier versions are not altered; turn it on with `alter table "" enable row level security;`. +- a4daf39: Fix three pgvector and Supabase query defects. `not` around a range filter, such as `not(gt("year", 2000))`, now matches records that have no `year`, as the docs describe; the range comparison evaluated to SQL `NULL` for a missing field, so those records were skipped by queries and by `delete({ filter })`. A record with a zero vector, whose cosine score is NaN, now ranks last instead of first when Postgres reads an HNSW-indexed table without the index. The metric is now read from the `embedding` column's operator class only, so a table whose name contains an operator class name, such as `x_vector_cosine_ops`, keeps its own metric. Re-run `sql/supabase.sql` to get the new `vecstore_filter_sql`, `vecstore_metric`, and `vecstore_query`. +- da20248: Keep Upstash namespaces apart on `fetch` in metadata mode. A default-namespace handle that fetched an id shaped `{namespace}/{length}/{id}` received that namespace's record, relabelled with the plain id, in place of its own. `fetch` now returns only records of the handle's namespace. Every verb also returns `invalid_argument` up front for a metadata-mode namespace holding a backslash or both quote characters, which `upsert` used to accept although no query or filtered delete could reach it afterwards, and for an index name of `.` or `..`, which the request URL would have collapsed. + ## 0.1.4 ### Patch Changes diff --git a/packages/vecstore-sdk/package.json b/packages/vecstore-sdk/package.json index 480f5b3..cc8e7b0 100644 --- a/packages/vecstore-sdk/package.json +++ b/packages/vecstore-sdk/package.json @@ -1,6 +1,6 @@ { "name": "vecstore-sdk", - "version": "0.1.4", + "version": "0.1.5", "description": "A unified vector store SDK for TypeScript. One filter language across Qdrant, pgvector, Pinecone, Supabase, Upstash Vector, Cloudflare Vectorize, and Redis, so you can switch providers without rewriting queries.", "keywords": [ "cloudflare", From 8cfccb949af040ea5708e1e40cd5e9a5ea0ae268 Mon Sep 17 00:00:00 2001 From: PunGrumpy <108584943+PunGrumpy@users.noreply.github.com> Date: Mon, 26 Oct 2026 09:05:19 +0700 Subject: [PATCH 2/2] ci(release): run the required checks on the release pull request The changesets bot opens this pull request with GITHUB_TOKEN, so CI never ran and the four required checks stayed missing.