mirror of
https://github.com/proffesor-for-testing/agentic-qe.git
synced 2026-09-19 08:45:47 +08:00
Dragan Spiridonov
122f223c9a
@xenova/transformers v2.17.2 (last publish 2024-05-29) pins onnxruntime-web@1.14.0, which pulls onnx-proto → protobufjs <=7.5.5. That chain has 8 GHSA advisories including a critical arbitrary-code- execution one (GHSA-xq3m-2v4x-88gg). Our top-level `overrides` block forced protobufjs@^7.5.6 in our own tree, hiding the vulns from `npm audit` in this repo — but `overrides` are root-only by design and do not propagate to downstream consumers. End users running `npm install agentic-qe` were getting 5 vulns (4 high, 1 critical). @huggingface/transformers@4.2.0 is the official maintained successor (same project, renamed). It pulls onnxruntime-web@1.26 which depends on protobufjs@^7.2.4 directly (no onnx-proto), so the version range resolves cleanly to the patched line. API changes handled: - pipeline()/Tensor: drop-in compatible, just the import path changes - `quantized: bool` → `dtype: DataType` (mapped from our QuantizationType enum: 'none'→'fp32', 'fp16'→'fp16', 'int8'→'int8', 'binary'→'q8'; binary stays a post-process step downstream) - progress_callback signature: ProgressInfo is now a discriminated union; `progress` only exists on the "progress" variant — narrowed accordingly Also added onnxruntime-node and onnxruntime-web to the CLI and MCP bundle externals lists. @huggingface/transformers ships both runtimes (node for Node.js, web as fallback); esbuild can't bundle the native .node binary so it must remain external. End-user verification (npm pack + clean install in /tmp/aqe-canary): - 183 packages (was 180 pre-migration; same order of magnitude) - 0 vulnerabilities (was 5: 4 high, 1 critical) - aqe init --auto runs in 93 ms; all 13 phases pass; optional-peers hint renders correctly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>