0.65.13 — langroid[lancedb] installs on Python 3.13 again, LanceDB FTS fixed

This release unpins lancedb and pyarrow. Two pins had drifted into an outright conflict that made the lancedb extra uninstallable on Python 3.13, and lifting them surfaced a LanceDB API rename that had quietly broken full-text search in LanceDocChatAgent.

:::bash
pip install -U langroid

The pin conflict (#1073)

lancedb<0.9.0 pulled in pylance==0.12.1, which requires pyarrow<12 — directly contradicting the pyarrow>=15.0.0 that langroid[vecdbs] declares. The two extras were only ever co-installable by resolution luck.

The practical consequence: pyarrow 15 has no cp313 wheel, so on Python 3.13 the resolver fell back to building it from source, which fails. Installing langroid[lancedb] (or anything pulling it in, including langroid[all]) was broken on 3.13.

Both floors are raised with no upper cap:

which resolves to lancedb 0.34.0 and pyarrow 25.0.0, and drops pylance entirely. It also clears a high-severity pyarrow advisory (use-after-free when reading an IPC file with pre-buffering, patched in 23.0.1).

LanceDB renamed the FTS score column

Somewhere between 0.8.2 and 0.34.0, LanceDB renamed the full-text-search relevance column from score to _score. LanceDocChatAgent's BM25 path read it by name, so on current LanceDB it raised KeyError: 'score'. Confirmed against a live table:

FTS result columns:    ['vector', 'text', 'id', '_score']
vector result columns: ['vector', 'text', 'id', '_distance']

LanceDocChatAgent.get_similar_chunks_bm25 now accepts either name, so it works across the supported range rather than pinning us to one LanceDB generation. Two previously-failing tests in test_lance_doc_chat_agent.py pass again.

Upgrade notes

• If you pin lancedb yourself, note the floor is now 0.9.0.
• This is a large LanceDB jump (0.8.2 → 0.34.0). If you have existing local .lancedb collections and hit schema errors, re-creating the collection is the quickest path.
• No Langroid API changes.

Verification

13 LanceDB vector-store tests and the LanceDocChatAgent suite pass; black, ruff, and mypy -p langroid are clean.

Also since 0.65.11

Four security advisories were published against 0.65.11 and are fixed in that release and later — see Security Advisories and the rewritten SECURITY.md (github.com), which now states the threat model for agents that execute LLM-generated SQL/Cypher/AQL/pandas, and what is in and out of scope for vulnerability reports.

Upgrade

:::bash
pip install -U langroid

Full changelog: 0.65.12...0.65.13