Bump @xenova/transformers from 2.0.1 to 2.17.2

[dependabot]

Bumps @xenova/transformers from 2.0.1 to 2.17.2.

Release notes

Sourced from @​xenova/transformers's releases.

2.17.2

🚀 What's new?

• Add support for MobileViTv2 in xenova/transformers.js#721

  import { pipeline } from '@xenova/transformers';
  // Create an image classification pipeline
  const classifier = await pipeline('image-classification', 'Xenova/mobilevitv2-1.0-imagenet1k-256', {
  quantized: false,
  });
  // Classify an image
  const url = 'https://huggingface.co/datasets/Xenova/transformers.js-docs/resolve/main/tiger.jpg';
  const output = await classifier(url);
  // [{ label: 'tiger, Panthera tigris', score: 0.6491137742996216 }]

  See here for the full list of supported models.

• Add support for FastViT in xenova/transformers.js#749

  import { pipeline } from '@xenova/transformers';
  // Create an image classification pipeline
  const classifier = await pipeline('image-classification', 'Xenova/fastvit_t12.apple_in1k', {
  quantized: false
  });
  // Classify an image
  const url = 'https://huggingface.co/datasets/Xenova/transformers.js-docs/resolve/main/tiger.jpg';
  const output = await classifier(url, { topk: 5 });
  // [
  //   { label: 'tiger, Panthera tigris', score: 0.6649345755577087 },
  //   { label: 'tiger cat', score: 0.12454754114151001 },
  //   { label: 'lynx, catamount', score: 0.0010689536575227976 },
  //   { label: 'dhole, Cuon alpinus', score: 0.0010422508930787444 },
  //   { label: 'silky terrier, Sydney silky', score: 0.0009548701345920563 }
  // ]

  See here for the full list of supported models.

• Optimize FFT in xenova/transformers.js#766

• Auto rotate image by @​KTibow in xenova/transformers.js#737

• Support reading data from blob URI by @​hans00 in xenova/transformers.js#645

• Add sequence post processor in xenova/transformers.js#771

• Add model file name by @​NawarA in xenova/transformers.js#594

• Update pipelines.js to allow for token_embeddings as well by @​NikhilVerma in xenova/transformers.js#770

• Remove old import from stream/web for ReadableStream in xenova/transformers.js#752

• Update tokenizer playground by @​xenova in xenova/transformers.js#717

• Use ungated version of mistral tokenizer by @​xenova in xenova/transformers.js#718

... (truncated)

Commits

• da26886 [version] Update to 2.17.2
• f542c52 Update Next.js demos to 14.2.3 (#772)
• 64b3da6 Update pipelines.js to allow for token_embeddings as well (#770)
• 250fcd7 Add model file name (#594)
• db9250b Add sequence post processor (#771)
• e50f568 Add support for FastViT (#749)
• da0e920 Auto rotate image (#737)
• 8d166ca Optimize FFT (#766)
• 8963720 Fix CI - update tests.yml (#768)
• 0af1e2f Remove old import from stream/web for ReadableStream (#752)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Medium Risk
Large dependency jump on the embedding/inference path with nested ONNX runtime version pinning; behavior or vector outputs could change until integration tests pass.

Overview
Bumps @xenova/transformers from 2.0.1 to 2.17.2 in package.json and refreshes package-lock.json. There are no application source changes; embedding still goes through the same pipeline('embeddings', 'Xenova/all-MiniLM-L6-v2') usage.

The lockfile shifts how Transformers.js pulls in ONNX: it adds @huggingface/jinja, pins onnxruntime-web / optional onnxruntime-node to 1.14.0 under @xenova/transformers, and adjusts related transitive packages (flatbuffers, long, protobufjs, onnx-proto). Top-level onnxruntime-node remains ^1.14.0 in package.json, so you may have both 1.27.x (direct) and 1.14.0 (nested) in the tree—worth watching for inference/runtime quirks.

^{Reviewed by Cursor Bugbot for commit 28bd36a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 28bd36a. Configure here.}

[cursor]

Embeddings lose default pooling

High Severity

Upgrading @xenova/transformers from 2.0.1 to 2.17.2 changes the default embeddings/feature-extraction output from a pooled 384-d vector to per-token hidden states. embed() still calls the pipeline with no pooling or normalize options and flattens result.data, so upserts and queries send vectors whose length is sequence_length * 384 instead of 384, which will fail against the 384-dimension Pinecone index.

 

^{Reviewed by Cursor Bugbot for commit 28bd36a. Configure here.}