[codex] fix(memory-lancedb): align apache arrow peer dependency by allenhurff · Pull Request #99118 · openclaw/openclaw

allenhurff · 2026-07-02T14:33:45Z

What Problem This Solves

Fixes #90295.
Refreshes the same minimal dependency fix path as #90407 against the current main branch.

@openclaw/memory-lancedb currently pairs @lancedb/[email protected] with [email protected], but LanceDB 0.30.0 declares an Arrow peer range of >=15.0.0 <=18.1.0. Under normal npm peer resolution, that makes the memory-lancedb package fail with ERESOLVE.

Why This Change Was Made

This pins apache-arrow to 18.1.0, the highest version accepted by @lancedb/[email protected], and regenerates the package lock/shrinkwrap artifacts from the repo tooling.

Changed files:

extensions/memory-lancedb/package.json
extensions/memory-lancedb/npm-shrinkwrap.json
pnpm-lock.yaml

User Impact

Users should be able to install/update @openclaw/memory-lancedb with standard npm peer dependency resolution again, without pinning back to [email protected] to keep LanceDB-backed memory working.

Evidence

Base checked against upstream main@4614449d.

npm view @lancedb/[email protected] peerDependencies --json returns { "apache-arrow": ">=15.0.0 <=18.1.0" }
npm view [email protected] version dist.integrity --json
corepack pnpm install --lockfile-only
node scripts/generate-npm-shrinkwrap.mjs --check --package-dir extensions/memory-lancedb
npm install --prefix /tmp/openclaw-memory-lancedb-install-test --ignore-scripts ./extensions/memory-lancedb --package-lock-only
node scripts/run-vitest.mjs src/plugins/contracts/package-manifest.contract.test.ts src/plugins/contracts/extension-runtime-dependencies.contract.test.ts test/package-manager-config.test.ts test/plugin-npm-package-manifest.test.ts --reporter=dot

The targeted vitest run passed 463 tests across the tooling and plugin contract shards.

github-actions · 2026-07-02T14:36:43Z

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

extensions/memory-lancedb/npm-shrinkwrap.json
extensions/memory-lancedb/package.json
extensions/msteams/npm-shrinkwrap.json
extensions/slack/npm-shrinkwrap.json
pnpm-lock.yaml

Maintainer follow-up:

Review whether the dependency changes are intentional.
Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

github-actions · 2026-07-02T14:36:55Z

Dependency graph change authorized

This PR includes dependency graph changes. A repository admin or member of @openclaw/openclaw-secops authorized this exact head SHA with /allow-dependencies-change.

Approved SHA: d2fc17cdba7384d8ec635161c6728cc0d66da402
Approved by: @joshavant

A later push changes the PR head SHA and requires a fresh security approval.

allenhurff · 2026-07-02T14:38:13Z

This dependency-guard failure is expected for this PR: the dependency graph change is intentional and limited to memory-lancedb.

The package currently pairs @lancedb/[email protected] with [email protected], but LanceDB 0.30.0 declares apache-arrow >=15.0.0 <=18.1.0. This PR pins Arrow to 18.1.0, regenerates the lock/shrinkwrap artifacts, and includes local npm install proof plus targeted contract test results in the PR body.

Could a repo admin or @openclaw/openclaw-secops review and, if acceptable, comment /allow-dependencies-change for head 99229956bf339a16bc0981a004dfcf0bb64a5a4a?

allenhurff · 2026-07-02T14:41:53Z

@openclaw/openclaw-secops Could you please review this minimal targeted fix for the memory-lancedb peer dependency conflict and, if acceptable, approve the dependency graph change with:

/allow-dependencies-change

Head commit: 99229956bf339a16bc0981a004dfcf0bb64a5a4a

This fixes #90295 by aligning apache-arrow with the peer range declared by @lancedb/[email protected] (>=15.0.0 <=18.1.0). Local npm install proof and the targeted contract suite are included in the PR body; the local vitest run passed 463 tests. The dependency-guard failure is expected and appears to be the only real blocker for this intentional dependency graph change.

clawsweeper · 2026-07-02T14:46:55Z

Codex review: found issues before merge. Reviewed July 2, 2026, 4:53 PM ET / 20:53 UTC.

Summary
The PR changes the memory-lancedb package dependency from apache-arrow 21.1.0 to 18.1.0 and refreshes the plugin/root generated dependency graph files.

PR surface: Source +23, Config 0, Other +8. Total +31 across 5 files.

Reproducibility: yes. Current main and v2026.6.11 declare Arrow 21.1.0 beside LanceDB 0.30.0, while the live npm registry contract for LanceDB 0.30.0 accepts Arrow only through 18.1.0; I did not run an npm install in this read-only review.

Review metrics: 1 noteworthy metric.

Dependency graph surface: 1 manifest dependency changed; 4 lock/shrinkwrap files changed. This is the merge-relevant surface that requires exact graph review, not just ordinary code validation.

Stored data model
Persistent data-model change detected: migration/backfill/repair: pnpm-lock.yaml, unknown-data-model-change: extensions/memory-lancedb/npm-shrinkwrap.json, vector/embedding metadata: extensions/memory-lancedb/npm-shrinkwrap.json. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #90295
Summary: This PR is the current fix candidate for the memory-lancedb Arrow/LanceDB peer mismatch tracked by the canonical issue.

Members:

canonical: memory-lancedb 2026.6.1 fails to install: apache-arrow 21.1.0 conflicts with @lancedb/lancedb 0.30.0 peer range #90295 - The issue reports the same npm ERESOLVE failure and expected dependency alignment for memory-lancedb.
fixed_by_candidate: fix(memory-lancedb): align apache arrow peer dependency #90407 - The older open PR proposes the same Arrow 18.1.0 alignment but is currently conflicting, while this PR refreshes the path against a newer base.
duplicate: Issue on memory-lancedb #90877 - The closed issue reports the same memory-lancedb dependency incompatibility.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster
Patch quality: 🦐 gold shrimp
Result: needs maintainer review before merge.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Get accepted exact-head dependency-guard authorization for d2fc17cdba7384d8ec635161c6728cc0d66da402.
Wait for the dependency/shrinkwrap/package-boundary checks that cover the refreshed graph to complete successfully.

Risk before merge

[P1] The PR intentionally changes a package manifest plus four lock/shrinkwrap files, and the latest dependency-guard run still failed because the current dependency graph authorization was not accepted for the head.
[P1] Downgrading Arrow and its transitive graph is the right shape for the LanceDB peer contract, but it remains a supply-chain and upgrade review surface until secops/admin owns the exact resolved graph.

Maintainer options:

Authorize the exact dependency graph (recommended)
Have a recognized admin or secops approver authorize head d2fc17cdba7384d8ec635161c6728cc0d66da402 after the current blocked guard comment, then rerun the dependency guard and shrinkwrap checks.
Move the graph refresh to a trusted branch
A maintainer can apply the same manifest and generated graph repair from a trusted branch if the external PR authorization path remains awkward.
Pause the external branch
If maintainers do not want to accept dependency graph changes from this branch, close or pause this PR and keep memory-lancedb 2026.6.1 fails to install: apache-arrow 21.1.0 conflicts with @lancedb/lancedb 0.30.0 peer range #90295 as the canonical issue for an internal repair.

Next step before merge

[P2] The remaining action is human secops/admin authorization and graph review, not an autonomous code repair.

Security
Needs attention: The diff is a targeted dependency repair, but it changes the resolved package graph and still needs accepted dependency-guard/secops authorization before merge.

Review findings

[P1] Resolve the current-head dependency approval — extensions/memory-lancedb/package.json:12

Review details

Best possible solution:

Land this PR or an equivalent maintainer branch after accepted exact-head dependency-graph authorization and shrinkwrap/package checks pass, without adding runtime fallback or config changes.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main and v2026.6.11 declare Arrow 21.1.0 beside LanceDB 0.30.0, while the live npm registry contract for LanceDB 0.30.0 accepts Arrow only through 18.1.0; I did not run an npm install in this read-only review.

Is this the best way to solve the issue?

Yes. A plugin-owned manifest, shrinkwrap, and root lockfile alignment to Arrow 18.1.0 is the narrow maintainable fix; the remaining blocker is dependency-graph authorization, not a better runtime implementation.

Full review comments:

[P1] Resolve the current-head dependency approval — extensions/memory-lancedb/package.json:12
This line intentionally changes the plugin dependency graph, and the PR also updates shrinkwrap/lock files. The latest dependency-guard run for the current head still failed because no accepted admin/secops override was found, so this cannot merge until the exact head is authorized or the graph change is moved to a trusted maintainer branch.
Confidence: 0.87

Overall correctness: patch is incorrect
Overall confidence: 0.87

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against c20171ddfc13.

Label changes

Label justifications:

P2: The PR fixes a real install/update break for one official memory plugin while core OpenClaw remains usable with fallback memory behavior.
merge-risk: 🚨 compatibility: Changing the published plugin dependency graph can affect existing memory-lancedb installs and upgrades.
merge-risk: 🚨 other: The external branch changes security-reviewed dependency graph files and is still blocked by dependency-guard authorization.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (terminal): The PR body and follow-up comments provide registry peer-contract output plus after-fix npm install and targeted contract test output for the dependency install claim.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body and follow-up comments provide registry peer-contract output plus after-fix npm install and targeted contract test output for the dependency install claim.

Evidence reviewed

PR surface:

Source +23, Config 0, Other +8. Total +31 across 5 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	3	78	55	+23
Tests	0	0	0	0
Docs	0	0	0	0
Config	1	1	1	0
Generated	0	0	0	0
Other	1	46	38	+8
Total	5	125	94	+31

Security concerns:

[medium] Unaccepted dependency graph change — extensions/memory-lancedb/package.json:12
The PR changes a package manifest plus generated lock/shrinkwrap files, and the latest dependency-guard run for the current head failed without a current accepted override.
Confidence: 0.9

Acceptance criteria:

[P1] pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json.
[P1] pnpm deps:shrinkwrap:check.
[P1] node scripts/generate-npm-shrinkwrap.mjs --package-dir extensions/memory-lancedb --check.
[P1] node scripts/run-vitest.mjs src/plugins/contracts/package-manifest.contract.test.ts src/plugins/contracts/extension-runtime-dependencies.contract.test.ts test/package-manager-config.test.ts test/plugin-npm-package-manifest.test.ts --reporter=dot.
[P1] pnpm test extensions/memory-lancedb --reporter=dot.

What I checked:

Current main still has the mismatch: The checked-out main package manifest declares @lancedb/lancedb 0.30.0 with apache-arrow 21.1.0, so the central bug is not implemented on main. (extensions/memory-lancedb/package.json:12, c20171ddfc13)
Current shrinkwrap records LanceDB's peer ceiling: The memory-lancedb shrinkwrap records LanceDB's apache-arrow peer range as >=15.0.0 <=18.1.0, while the plugin root still depends on 21.1.0. (extensions/memory-lancedb/npm-shrinkwrap.json:47, c20171ddfc13)
Upstream dependency contract checked directly: The npm registry metadata for @lancedb/[email protected] reports peerDependencies.apache-arrow as >=15.0.0 <=18.1.0, which supports the PR's target version.
PR diff applies the narrow dependency alignment: The live PR diff changes extensions/memory-lancedb/package.json from Arrow 21.1.0 to 18.1.0 and refreshes extensions/memory-lancedb/npm-shrinkwrap.json, extensions/msteams/npm-shrinkwrap.json, extensions/slack/npm-shrinkwrap.json, and pnpm-lock.yaml. (extensions/memory-lancedb/package.json:12, d2fc17cdba73)
Dependency guard is still blocking the head: The latest dependency-guard job for head d2fc17cdba7384d8ec635161c6728cc0d66da402 detected five dependency-related changes and failed with the message that dependency graph changes require removal or a current admin/secops override. (d2fc17cdba73)
Repository policy treats dependency graph changes as guarded: The dependency guard renders dependency graph changes as blocked unless a repository admin or @openclaw/openclaw-secops explicitly authorizes the current head SHA. (scripts/github/dependency-guard.mjs:388, c20171ddfc13)

Likely related people:

steipete: GitHub commit history shows 48ccc50282ebf41175aefe821903380a98b596bb changed memory-lancedb from LanceDB 0.29.0/Arrow 18.1.0 to LanceDB 0.30.0/Arrow 21.1.0 in the manifest, shrinkwrap, and root lockfile. (role: introduced affected dependency pair; confidence: high; commits: 48ccc50282eb; files: extensions/memory-lancedb/package.json, extensions/memory-lancedb/npm-shrinkwrap.json, pnpm-lock.yaml)
vincentkoc: Recent commit history for extensions/memory-lancedb/package.json shows multiple release/package-graph touches that carried the affected dependency pair into the current release train. (role: recent package graph and release contributor; confidence: medium; commits: 66e676d29b92, 0671c0890073, b039e949b66a; files: extensions/memory-lancedb/package.json, extensions/memory-lancedb/npm-shrinkwrap.json, pnpm-lock.yaml)
joshavant: The dependency-guard workflow lists joshavant in OPENCLAW_SECURITY_APPROVERS, and the live PR includes their dependency graph refresh commit plus an attempted /allow-dependencies-change comment. (role: dependency graph approval contact; confidence: medium; commits: d2fc17cdba73; files: .github/workflows/dependency-guard.yml, scripts/github/dependency-guard.mjs, extensions/msteams/npm-shrinkwrap.json)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

allenhurff · 2026-07-02T15:22:25Z

Updating the dependency approval request after the branch was synced with current main.

Current head commit is now: 5b669d0984703a6cc566e590e56424fdf7d0f50e

@openclaw/openclaw-secops Could you please review the resolved graph for this current head and, if acceptable, approve with:

/allow-dependencies-change

The patch remains the same targeted memory-lancedb fix: align apache-arrow to 18.1.0 for @lancedb/[email protected], with lock + shrinkwrap regenerated.

allenhurff · 2026-07-02T15:55:58Z

@clawsweeper re-review\n\nCurrent-head dependency approval request has been updated for 5b669d0984703a6cc566e590e56424fdf7d0f50e; please refresh the author-action status.

allenhurff · 2026-07-02T19:10:04Z

Branch repaired after the transient broad diff.

Current head is now clean again: 01844f6d3e657cc6275c63a75c73bcc562f6ff96

Current PR surface is back to the intended three files only:

extensions/memory-lancedb/package.json
extensions/memory-lancedb/npm-shrinkwrap.json
pnpm-lock.yaml

The fix remains the same targeted dependency alignment: apache-arrow 21.1.0 -> 18.1.0 for @lancedb/[email protected].

Local validation on this repaired head:

pnpm install --frozen-lockfile --ignore-scripts passed
node scripts/generate-npm-shrinkwrap.mjs --package-dir extensions/memory-lancedb --check passed
temp npm install --ignore-scripts ./extensions/memory-lancedb --package-lock-only passed
node scripts/run-vitest.mjs src/plugins/contracts/package-manifest.contract.test.ts src/plugins/contracts/extension-runtime-dependencies.contract.test.ts --reporter=dot passed: 442 tests
pnpm test extensions/memory-lancedb --reporter=dot passed: 135 tests

@clawsweeper re-review

@openclaw/openclaw-secops If the current resolved graph looks acceptable, please authorize this current clean head with:

/allow-dependencies-change

clawsweeper · 2026-07-02T19:10:06Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

socket-security · 2026-07-02T19:10:25Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/apache-arrow@21.1.0 ⏵ 18.1.0

View full report

allenhurff · 2026-07-02T19:22:45Z

Addressing the current ClawSweeper check-shrinkwrap finding.

I reproduced the full shrinkwrap check locally on clean head 01844f6d3e657cc6275c63a75c73bcc562f6ff96:

pnpm deps:shrinkwrap:check
...
extensions/memory-lancedb: npm-shrinkwrap.json is current.
extensions/moonshot: npm-shrinkwrap.json is current.
extensions/msteams: npm-shrinkwrap.json is stale. Run `pnpm deps:shrinkwrap:generate`.

The memory-lancedb shrinkwrap check itself passes:

node scripts/generate-npm-shrinkwrap.mjs --package-dir extensions/memory-lancedb --check
extensions/memory-lancedb: npm-shrinkwrap.json is current.

Generating the stale msteams shrinkwrap locally changes only extensions/msteams/npm-shrinkwrap.json, specifically @types/node 25.9.2 -> 25.9.1. That file is unchanged by this PR and unchanged relative to the current base in this branch, so the failing full check-shrinkwrap appears to be unrelated base drift rather than a memory-lancedb artifact issue.

I am intentionally not expanding this PR to include the unrelated msteams shrinkwrap cleanup unless maintainers want that included here.

@clawsweeper re-review

joshavant · 2026-07-02T20:53:40Z

/allow-dependencies-change

…claw#99118) * fix(memory-lancedb): align apache arrow peer dependency * fix(memory-lancedb): refresh arrow dependency graph --------- Co-authored-by: joshavant <[email protected]>

openclaw-barnacle Bot added extensions: memory-lancedb Extension: memory-lancedb size: XS labels Jul 2, 2026

allenhurff marked this pull request as ready for review July 2, 2026 14:36

allenhurff requested a review from a team as a code owner July 2, 2026 14:36

github-actions Bot added the dependencies-changed PR changes dependency-related files label Jul 2, 2026

joshavant self-assigned this Jul 2, 2026

clawsweeper Bot removed proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. labels Jul 2, 2026

fix(memory-lancedb): align apache arrow peer dependency

01844f6

allenhurff force-pushed the codex/fix-memory-lancedb-arrow-peer branch from f6f07f4 to 01844f6 Compare July 2, 2026 19:09

clawsweeper Bot removed the merge-risk: 🚨 message-delivery 🚨 May drop, duplicate, misroute, suppress, or wrongly target messages. label Jul 2, 2026

fix(memory-lancedb): refresh arrow dependency graph

d2fc17c

openclaw-barnacle Bot added channel: msteams Channel integration: msteams channel: slack Channel integration: slack labels Jul 2, 2026

joshavant merged commit 968aa51 into openclaw:main Jul 2, 2026
89 of 92 checks passed

github-actions Bot mentioned this pull request Jul 2, 2026

📡 Upstream Digest — 2026-07-02 22:57 UTC curtismercier/openclaw-mods#1193

Open

steipete mentioned this pull request Jul 12, 2026

fix(memory-lancedb): align apache arrow peer dependency #90407

Closed

Uh oh!

Uh oh!

Conversation

allenhurff commented Jul 2, 2026

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Guard

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency graph change authorized

Uh oh!

allenhurff commented Jul 2, 2026

Uh oh!

allenhurff commented Jul 2, 2026

Uh oh!

clawsweeper Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

allenhurff commented Jul 2, 2026

Uh oh!

allenhurff commented Jul 2, 2026

Uh oh!

allenhurff commented Jul 2, 2026

Uh oh!

clawsweeper Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 2, 2026

Uh oh!

allenhurff commented Jul 2, 2026

Uh oh!

joshavant commented Jul 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jul 2, 2026 •

edited

Loading

github-actions Bot commented Jul 2, 2026 •

edited

Loading

clawsweeper Bot commented Jul 2, 2026 •

edited

Loading

clawsweeper Bot commented Jul 2, 2026 •

edited

Loading