Vanna AI Archived on GitHub: What It Means for Teams Using It in Production

·1 views

The vanna-ai/vanna repository, a popular text-to-SQL open-source tool with 23,800 GitHub stars, was archived by its owner on 29 March 2026, making it permanently read-only. While existing deployments continue to function for now, archiving halts all dependency updates, security patches, and community-driven bug fixes, meaning a breaking change in an underlying library such as SQLAlchemy or an LLM SDK could render it unusable within months. Vanna bundled five distinct capabilities — a training store, schema retrieval, prompt assembly, LLM calls, and UI helpers — and no single maintained library currently replicates all five together. A key risk when replacing its retrieval layer is a silent authorization failure: if the replacement is not identity-aware, a language model may generate valid SQL against restricted tables, receive empty results due to row-level security, and confidently report that no data exists rather than flagging an access denial. Teams are advised to pin their current Vanna version, export training data, and explicitly test how their system responds when a restricted user queries data they are not permitted to see.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Uses Personal Portfolio as a Live SEO Experiment to Unify Online Presence

Web developer Rishikumar Yadav has been rebuilding his personal portfolio as a Laravel application with the goal of making it a central hub linking his LinkedIn, GitHub, DEV.to, and other profiles. After searching his own name on Google, he found his portfolio and several associated online profiles appearing on the first page, which he describes as a milestone in an ongoing personal SEO experiment. Rather than chasing keyword rankings, his approach focuses on technical SEO fundamentals including meaningful metadata, canonical URLs, Open Graph tags, and JSON-LD structured data. The JSON-LD schema uses 'sameAs' relationships to signal to search engines that his various platform profiles belong to the same individual. His broader goal is not to duplicate content across platforms, but to let each one represent a distinct aspect of his work while pointing back to a single authoritative source.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build Audit-Ready Node.js PDF Endpoints for HR Onboarding Compliance

Building HR onboarding PDF endpoints for US/EU SaaS platforms requires more than file generation — each render must produce a signed receipt, a stable output hash, and a deletion record that can withstand privacy audits. The endpoint should function as an evidence-producing job, with the receipt capturing the template revision, source and output SHA-256 hashes, renderer image digest, and retention policy decision. Personal identifiers such as employee names and government IDs must be kept out of job IDs to limit data exposure. A fixture-based benchmark corpus — covering edge cases like right-to-left text, embedded scans, and missing optional fields — helps detect layout drift caused by font or renderer changes before they reach production. Separating failed render reason codes from employee data further allows engineers to replay layout tests without accessing real personnel files, supporting both debugging and privacy review.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Standardized Protocols Needed to Make AI Agent Benchmarks Reliable

AI coding-agent benchmark scores are often misleading because they omit critical context such as prompt text, tool allowlists, sandbox configurations, and grader settings that can influence results more than the model itself. Researchers argue that a registered protocol — documenting corpus identifiers, holdout sampling rules, decoding settings, and network policies — must accompany any published pass rate to make scores comparable. Negative-control canaries, tasks with known expected outcomes, are proposed as a built-in harness check to detect grader leaks or environment drift that could silently corrupt results. Published benchmark runs should also include attempt counts, wall-clock time, token costs, and variance across seeds, since two agents passing the same tests at vastly different costs are not equivalent. Without these standardized requirements, leaderboard percentages function more as marketing screenshots than as reproducible scientific measurements.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Write Reliable Realtime Moderation Tests in Node.js Without Sleep Hacks

A developer tutorial on DEV Community outlines a structured approach to testing realtime participant moderation in Node.js, specifically in collaborative environments like shared stock watchlists. The core advice is to model the client and moderation states explicitly as a state machine rather than relying on arbitrary timing delays. Key states such as connecting, expired, kicked, or denied are treated as distinct, assertable conditions separate from business events like cursor updates. The guide emphasizes using stable room and participant identifiers to handle reconnections, duplicate events, and offline kick scenarios reliably. A sample TypeScript harness is provided that calls list and moderation endpoints directly, verifying outcomes through server responses rather than inferring results from local UI interactions.

0 comments Read more at DEV Community