Migrate @xenova/transformers → @huggingface/transformers

[jhamon]

Root cause #2 of 3

Stacked on #17 → #16. Merge order: #16, then #17, then this. The diff here is only the transformers change on top of #17.

@xenova/transformers is frozen at 2.17.2 and pins onnxruntime-web@1.14, which drags in onnx-proto and protobufjs@6.11.x — the last critical (prototype pollution / arbitrary code execution) plus several highs. Those advisories have no fix on the 6.x line, and the vulnerable code lives in the browser ONNX backend this Node CLI never executes, so overrides were useless. transformers.js has moved to the official @huggingface/transformers package, whose current release builds on onnxruntime-web with protobufjs@^7.2.4 (fixed) and sharp@^0.34 (fixed).

Changes

• Swap the dependency to @huggingface/transformers@^4.2.0.
• embeddings.ts: use the canonical "feature-extraction" task (what v2's "embeddings" aliased to) and the v3+ dtype: "fp32" option in place of the removed quantized: false — both request full-precision weights, so behavior is unchanged.

That's the whole code change; the model ID "Xenova/all-MiniLM-L6-v2" is a Hugging Face Hub model (not the npm package) and works unchanged.

Impact

npm audit: 7 → 3, with 0 critical / 0 high / 0 moderate in production dependencies. The remaining 3 are dev/build-tool moderates (esbuild/tsup/tsx).

Verification

• npm run build, tsc --noEmit, npm test (23 pass), npm run lint, npm run format:check — all green.
• End-to-end embedding run: embedder.init("Xenova/all-MiniLM-L6-v2") + embed(...) downloads the model and returns a 384-dimensional, L2-normalized vector (norm = 1.0000) — matching the index's dimension: 384.

Where this leaves the repo

From ~69 Dependabot alerts / 46 npm audit findings down to 3 moderate, all in dev/build tooling (esbuild/tsup/tsx), with zero critical/high/moderate in shipped dependencies — achieved entirely by removing/upgrading root deps, no version overrides.

🤖 Generated with Claude Code