@wrongstack/vector-memory 1.0.3 → 1.0.5

package/README.md

@@ -77,16 +77,16 @@ the second line of defense).
 
 ## Installation
 
-`@huggingface/transformers` is listed as an **optional** dependency so
-the package installs and typechecks even without it. In this monorepo
-it's installed by default; in downstream packages, ensure it's present:
+`@huggingface/transformers` is an **opt-in** backend. It is not installed
+automatically because its Node runtime currently pulls in an unpatched ZIP
+extraction advisory. The hashing provider remains available without it. To
+explicitly enable local ONNX embeddings while skipping ONNX's CUDA installer:
 
 ```sh
-pnpm add @huggingface/transformers
+$env:ONNXRUNTIME_NODE_INSTALL='skip'; pnpm add @huggingface/transformers
 ```
 
-The package itself is a workspace member; no extra install step is
-needed inside the monorepo.
+On POSIX shells, prefix the command with `ONNXRUNTIME_NODE_INSTALL=skip`.
 
 ## Quick start
 

package/dist/index.js

@@ -1624,7 +1624,8 @@ var TransformersEmbeddingProvider = class {
   }
   async loadModule() {
     try {
-      return await import("@huggingface/transformers");
+      const packageName = "@huggingface/transformers";
+      return await import(packageName);
     } catch (err) {
       throw new VectorMemoryProviderUnavailableError(
         "@huggingface/transformers is not installed. Install it (pnpm add @huggingface/transformers) or wire a fallback EmbeddingProvider.",

package/dist/transformers-provider.d.ts

@@ -3,8 +3,8 @@
  * feature-extraction pipeline as a sage `EmbeddingProvider`.
  *
  * The provider is lazy: nothing is imported until `embed()` is first called.
- * If `@huggingface/transformers` is not installed (it's listed as an
- * optionalDependency), `isAvailable()` returns false and `embed()` throws
+ * If the opt-in `@huggingface/transformers` package is not installed,
+ * `isAvailable()` returns false and `embed()` throws
  * a descriptive `VectorMemoryProviderUnavailableError` so callers can
  * fall back to `HashingEmbeddingProvider`.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/vector-memory",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "license": "MIT",
   "description": "WrongStack Vector Memory — an additional vector-search memory store powered by @huggingface/transformers (local ONNX embeddings), alongside the SAGE lexical memory system.",
   "repository": {
@@ -27,12 +27,9 @@
     "README.md"
   ],
   "dependencies": {
-    "@wrongstack/core": "1.0.3",
-    "@wrongstack/persistence": "1.0.3",
-    "@wrongstack/sage": "1.0.3"
-  },
-  "optionalDependencies": {
-    "@huggingface/transformers": "^4.2.0"
+    "@wrongstack/core": "1.0.5",
+    "@wrongstack/persistence": "1.0.5",
+    "@wrongstack/sage": "1.0.5"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",