Skip to content

build(deps): bump @huggingface/transformers from 3.8.1 to 4.2.0#100

Merged
qnbs merged 1 commit into
mainfrom
dependabot/npm_and_yarn/huggingface/transformers-4.2.0
Jun 9, 2026
Merged

build(deps): bump @huggingface/transformers from 3.8.1 to 4.2.0#100
qnbs merged 1 commit into
mainfrom
dependabot/npm_and_yarn/huggingface/transformers-4.2.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps @huggingface/transformers from 3.8.1 to 4.2.0.

Release notes

Sourced from @​huggingface/transformers's releases.

4.2.0

🚀 Transformers.js v4.2 — Tool calling, simpler internals, and privacy filtering

  • Added tools to TextGenerationPipeline in #1655
  • Use inputMetadata API for simplified internals in #1657
  • Add support for OpenAI privacy filter model in #1658

Full Changelog: 4.1.0...4.2.0

4.1.0

🚀 Transformers.js v4.1 — Gemma 4, KV cache improvements, and new quantization dtypes

  • Add support for Gemma 4 in #1627
  • Cached generation improvements (+ past_key_values via pipeline function) in #1638
  • Improve tokenizer types based on input function parameters in #1641
  • Add support for q1, q1f16, q2, and q2f16 data types in #1647
  • Re-enable SmolVLM in #1648
  • Update default generation parameters in #1649
  • Pin GitHub Actions to commit SHAs in #1626

Full Changelog: 4.0.0...4.1.0

4.0.1

What's new?

Full Changelog: 4.0.0...4.0.1

4.0.0

🚀 Transformers.js v4

We're excited to announce that Transformers.js v4 is now available on NPM! After a year of development (we started in March 2025 🤯), we're finally ready for you to use it.

npm i @huggingface/transformers

Links: YouTube Video, Blog Post, Demo Collection

New WebGPU backend

The biggest change is undoubtedly the adoption of a new WebGPU Runtime, completely rewritten in C++. We've worked closely with the ONNX Runtime team to thoroughly test this runtime across our ~200 supported model architectures, as well as many new v4-exclusive architectures.

In addition to better operator support (for performance, accuracy, and coverage), this new WebGPU runtime allows the same transformers.js code to be used across a wide variety of JavaScript environments, including browsers, server-side runtimes, and desktop applications. That's right, you can now run WebGPU-accelerated models directly in Node, Bun, and Deno!

We've proven that it's possible to run state-of-the-art AI models 100% locally in the browser, and now we're focused on performance: making these models run as fast as possible, even in resource-constrained environments. This required completely rethinking our export strategy, especially for large language models. We achieve this by re-implementing new models operation by operation, leveraging specialized ONNX Runtime Contrib Operators like com.microsoft.GroupQueryAttention, com.microsoft.MatMulNBits, or com.microsoft.QMoE to maximize performance.

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 8, 2026
@dependabot
dependabot Bot requested a review from qnbs as a code owner June 8, 2026 23:55
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 8, 2026
@vercel

vercel Bot commented Jun 8, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
storycraft-studio Ready Ready Preview, Comment Jun 9, 2026 5:31am

@codeant-ai

codeant-ai Bot commented Jun 8, 2026

Copy link
Copy Markdown

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

@socket-security

socket-security Bot commented Jun 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedlz-string@​1.5.01001008680100
Addedzod@​4.4.310010010093100

View full report

@socket-security

socket-security Bot commented Jun 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm json-schema is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@ai-sdk/google@3.0.79 → npm/ai@6.0.191 → npm/@ai-sdk/react@3.0.193 → npm/@ai-sdk/openai@3.0.68 → npm/json-schema@0.4.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/json-schema@0.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@qnbs
qnbs enabled auto-merge June 9, 2026 05:27
@qnbs

qnbs commented Jun 9, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
build(deps): bump @huggingface/transformers from 3.8.1 to 4.2.0
ac2551c 
Bumps [@huggingface/transformers](https://github.com/huggingface/transformers.js) from 3.8.1 to 4.2.0.
- [Release notes](https://github.com/huggingface/transformers.js/releases)
- [Commits](huggingface/transformers.js@3.8.1...4.2.0)

---
updated-dependencies:
- dependency-name: "@huggingface/transformers"
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/huggingface/transformers-4.2.0 branch from 7bbc65f to ac2551c Compare June 9, 2026 05:31
@qnbs
qnbs merged commit 0509950 into main Jun 9, 2026
16 checks passed
@qnbs
qnbs deleted the dependabot/npm_and_yarn/huggingface/transformers-4.2.0 branch June 9, 2026 06:20
qnbs added a commit that referenced this pull request Jun 10, 2026
@qnbs @claude
chore(ai-core): verify transformers v4 migration — compatible, no sou…
6ce236f 
…rce changes

WS-3 of the v1.21.0 Integrity & Hardening Cycle (audit finding F-6).

The Dependabot major bump @huggingface/transformers 3.8.1 -> 4.2.0 (PR #100,
ac2551c) landed unverified. Verified against ai-core/voice integration points:

- API surface unchanged in v4.2.0: `pipeline<T>(task, model?, { device, dtype,
  session_options, ... })` (exact `{ dtype: 'q8', device }` usage),
  `env` + `env.backends.onnx.wasm.proxy`, and `RawAudio`/`read_audio` exports
  all present in the shipped type defs.
- `pnpm typecheck` clean under v4.2.0 (TS strict).
- 63 tests green: ai-core.test, aiCoreFallbackPaths, inferenceWorker,
  voice/wasmSttEngine, voice/kokoroTtsEngine, services/voice/voiceDownloadAndIntent.

No source changes required. Production bundling (rolldown / vendor-ai-onnx
chunk) is exercised by the CI build + smoke:prod jobs. Recorded in CHANGELOG
[Unreleased].

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@qnbs qnbs Awaiting requested review from qnbs qnbs is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@qnbs