[dependabot]

Bumps @huggingface/transformers from 3.8.1 to 4.3.1.

Release notes

Sourced from @​huggingface/transformers's releases.

4.3.1

What's new?

This release adds support for EmbeddingGemma 2. EmbeddingGemma 2 is an open multimodal embedding model built by Google DeepMind which maps text (incl. code), images, video, and audio inputs—and combinations thereof—into a single, unified 768-dimensional vector space. The model has 740M total parameters, combining a 270M parameter text model with modular vision (170M) and audio (300M) encoders.

Text search

The feature-extraction pipeline returns normalized embeddings, so the dot product of two embeddings is their cosine similarity:

import { pipeline, matmul } from "@huggingface/transformers";
const extractor = await pipeline("feature-extraction", "onnx-community/embeddinggemma-2-ONNX", {
device: "webgpu", // or "wasm" (browser) / "cpu" (Node.js)
dtype: "q4", // see "Choosing a dtype" below
});
const query = "task: search result | query: Which planet is known as the Red Planet?";
const documents = [
"title: none | text: Venus is often called Earth's twin because of its similar size and proximity.",
"title: none | text: Mars, known for its reddish appearance, is often referred to as the Red Planet.",
"title: none | text: Jupiter, the largest planet in our solar system, has a prominent red spot.",
"title: none | text: Saturn, famous for its rings, is sometimes mistaken for the Red Planet.",
];
const embeddings = await extractor([query, ...documents], { pooling: "mean", normalize: true });
const query_embedding = embeddings.slice([0, 1]);
const document_embeddings = embeddings.slice([1, null]);
const scores = (await matmul(query_embedding, document_embeddings.transpose(1, 0))).tolist()[0];
const ranking = scores.map((score, i) => ({ score, document: documents[i] })).sort((a, b) => b.score - a.score);
console.log(ranking);
// [
//   { score: 0.854, document: "title: none | text: Mars, known for its reddish appearance, ..." },
//   { score: 0.783, document: "title: none | text: Saturn, famous for its rings, ..." },
//   { score: 0.752, document: "title: none | text: Jupiter, the largest planet in our solar system, ..." },
//   { score: 0.684, document: "title: none | text: Venus is often called Earth's twin, ..." },
// ]

Images, audio and video

For other modalities, use the processor and the model directly. Every input maps into the same embedding space, so any embedding can be compared with any other: here, text queries against an image, an audio clip and a video.

import { AutoModel, AutoProcessor, load_image, load_audio, load_video, cat, matmul } from "@huggingface/transformers";
const model_id = "onnx-community/embeddinggemma-2-ONNX";
const processor = await AutoProcessor.from_pretrained(model_id);
</tr></table>

... (truncated)

Commits

• 511bb61 [version] Update to 4.3.1
• e822439 new model (#1788)
• 40d3304 Bump doc-builder workflow pin (#1787)
• 836b9cb Scope GITHUB_TOKEN permissions per job (#1777)
• c5f2b97 Bump the actions group across 1 directory with 6 updates (#1703)
• a1728dd [version] Update to 4.3.0
• f9dec42 Bump dependencies (#1766)
• dce094e Massive documentation overhaul (#1665)
• 37fddf9 Fix RawAudio.toBlob() ignoring TypedArray byteOffset/length (#1712)
• eb5d05e Skip browser cache writes for non-http(s) resources (#1723)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Summary by cubic

Bumps the @huggingface/transformers devDependency from 3.8.1 to 4.3.1 and adds a packageExtensions entry so the new version's Node bundle can resolve onnxruntime-common, which it imports but doesn't declare.

• Brings onnxruntime-node up to 1.30.0 and adds new transitive dependencies (@huggingface/tokenizers, adm-zip).
• Upgrades sharp to 0.35.5, which raises the minimum Node version to >=20.9.0.

^{Written for commit b3ffd21. Summary will update on new commits.}

[glebedel]

s2d2 verdict: SAFE (local verification required before merge). transformers 4.3.1 devDep, ONNX tests run with LFS models and pass.

• CI on b3ffd21: green
• Breaking changes reaching our code: transformers 4: new deps (@huggingface/tokenizers, adm-zip), sharp 0.35 needs Node >=20.9, imports onnxruntime-common undeclared (handled by a packageExtensions entry added in this branch); AutoTokenizer.from_pretrained unchanged
• Call sites: 1 file: src/classifiers/onnx-classifier.ts:331 (dynamic import, AutoTokenizer.from_pretrained); optional peer

All checks green on head b3ffd21 (build, lint, tests typecheck, test, examples typecheck and smoke, osv-scanner, gitleaks, zizmor, Aikido). node-ci checks out with lfs: true, so the ONNX classifier specs ran against transformers 4.3.1 + onnxruntime-node 1.30.0. The branch carries 2 commits by glebedel aligning onnxruntime to 1.30.0 and adding packageExtensions. Caveat for the owner: peerDependencies still say @huggingface/transformers ^3.0.0, so CI now tests 4.x while consumers are told 3.x; decide whether to widen the peer range. Conflicts in intent with #128 (onnxruntime-node 1.31.1).

Requested by guillaume@stackone.com, Security Autopilot run sa-2026-11-05-ae4daeb6. s2d2 never approves PRs.