v1.2.0

Removed

• Removed the in-tree Go bindings (bindings/go/) and the build-ncruces-go CI job. The CGO bindings were never published by this fork, and the ncruces/go-sqlite3 WASM build broke when upstream migrated to wasm2go, which no longer supports injecting a custom C extension at build time. Go users should use upstream asg017/sqlite-vec or ncruces/go-sqlite3's built-in ext/vec1 extension.

Fixed

• Hardened the optimize command (INSERT INTO t(t) VALUES('optimize')) against a native crash on tables with metadata columns. optimize now validates each metadata chunk's blob size and slot offset before copying and fails as a catchable SQLITE_ERROR on malformed internal state, instead of risking heap corruption or a host-process abort (EXC_BREAKPOINT/SIGTRAP).
• Fixed a per-row memory leak of vector buffers during optimize (tens of MB on large compactions).
• Fixed error-masking in the metadata-copy path that could report a failed copy as success, and a related blob-handle leak; guarded a latent double-free of the chunk-validity buffers.
• DELETE now propagates metadata-clear failures instead of silently returning success.

Commits

Full Changelog: v1.1.1...v1.2.0

v1.1.1

Full Changelog: v1.1.0...v1.1.1

v1.1.0

Full Changelog: v1.0.1...v1.1.0

v1.0.1

Infrastructure

• Fixed Windows CI builds in npm-release.yaml: corrected MSVC flags (removed invalid GCC flags), fixed DLL output path, added security hardening for both x64 and ARM64
• Removed unused upstream release.yaml (would have erroneously published to PyPI/RubyGems/crates.io)
• Cleaned up Makefile: removed dead variables and phantom targets, added loadable-msvc-x64/loadable-msvc-arm64 targets

Full Changelog: v1.0.0...v1.0.1

v1.0.0

Changed

• npm package renamed from @mceachen/sqlite-vec to @photostructure/sqlite-vec

About this fork

This package is a community fork of Alex Garcia's excellent sqlite-vec, building on Vlad Lasky's community fork which merged 15+ upstream PRs. We're grateful to both for their foundational work.

PhotoStructure depends on sqlite-vec for production vector search and is committed to maintaining this fork for as long as we need it. Our current focus is:

• Stability: Memory leak fixes, sanitizer-verified error paths, comprehensive test coverage
• Node.js packaging: Prebuilt binaries for all major platforms (including Alpine/musl and Windows ARM64), Electron support, no post-install scripts

The version was bumped to 1.0.0 to signal the package rename and avoid confusion with the 0.x releases under the previous name. The underlying C extension is unchanged from 0.4.1.

All code remains open source under the original MIT/Apache-2.0 dual license.

Full Changelog: v0.4.1...v1.0.0

v0.4.1

Full Changelog: v0.4.0...v0.4.1

v0.4.0

Full Changelog: v0.3.3...v0.4.0

v0.3.3

Full Changelog: v0.3.2...v0.3.3

v0.3.2

Added

• Memory testing framework (c8654d0)
  • Valgrind and AddressSanitizer support via make test-memory
  • Catches memory leaks, use-after-free, and buffer overflows

Fixed

• Memory leaks in KNN queries (e4d3340, df2c2fc, f05a360)

  • Fixed leaks in vec0Filter_knn metadata IN clause processing
  • Fixed leaks and potential crashes in vec_static_blob_entries filter
  • Ensured knn_data is freed on error paths

• Memory leaks in vtab lifecycle (5f667d8, 49dcce7)

  • Fixed leaks in vec0_init and vec0Destroy error paths
  • Added NULL check before blob read to prevent crashes
  • vec0_free now properly frees partition, auxiliary, and metadata column names

• Cosine distance with zero vectors (5d1279b)

  • Returns 1.0 (max distance) instead of NaN for zero-magnitude vectors

Commits

Full Changelog: v0.3.1...v0.3.2

v0.3.1

Added

• Lua binding with IEEE 754 compliant float serialization (1d3c258)

  • New bindings/lua/sqlite_vec.lua module for Lua 5.1+
  • serialize_f32() for IEEE 754 binary format
  • serialize_json() for JSON format
  • Example script in examples/simple-lua/
  • Incorporates upstream PR #237 with extensive bugfixes for float encoding

• Safer automated release workflow (6d06b7d)

  • prepare-release job creates a release branch before building
  • All builds use the release branch with correct version baked in
  • Main branch only updated after successful npm publish
  • If any step fails, main is untouched

Fixed

• Numpy header parsing: fixed &&→|| logic bug (90e0099)

• Go bindings patch updated for new SQLite source (ceb488c)

  • Updated bindings/go/ncruces/go-sqlite3.patch for compatibility with latest SQLite

• npm-release workflow improvements

  • Synchronized VERSION file with package.json during version bump (c345dab, baffb9b )
  • Enhanced npm publish to handle prerelease tags (alpha, beta, etc.) (0b691fb)

Commits

Full Changelog: v0.3.0...v0.3.1