Dave Cox dcfbc24625 fix(deps): pin onnxruntime-node to the exact version @huggingface/transformers requires (#10543) ...

`@huggingface/transformers` 4.2.0 hard-pins `onnxruntime-node` to "1.24.3".
The production-group bump in #10403 raised the root range from "~1.24.3" to
"~1.27.0", so npm stopped deduping and nested a second copy under
`node_modules/@huggingface/transformers/node_modules/onnxruntime-node`.

Both copies ship a native `libonnxruntime.so.1` under the SAME SONAME, so
glibc binds whichever is dlopen()ed first and the other addon dies. The
Dockerfile post-build verification imports `@huggingface/transformers` and
`onnxruntime-node` in one process, so `docker build` has failed on every
commit since #10403:

  Error: .../transformers/node_modules/onnxruntime-node/bin/napi-v6/linux/x64/libonnxruntime.so.1:
  version `VERS_1.27.0' not found (required by .../onnxruntime-node/bin/napi-v6/linux/x64/onnxruntime_binding.node)

Restore the root range to "~1.24.3" so a single hoisted copy is resolved
again. Copying the nested native binaries into the standalone bundle is NOT
a workaround: it makes both `.so` files present, which is precisely what
triggers the SONAME clash above (verified against a real image build).

Regression guard: tests/unit/onnxruntime-single-copy.test.ts asserts the
lockfile resolves exactly one onnxruntime-node and that it matches the
version transformers pins. Confirmed failing on the pre-fix lockfile
(two copies, 1.27.0 vs 1.24.3) and passing after.

Validated with a full `docker build --target runner-base`: the post-build
verification step now passes (#19 DONE 156.9s) and the image boots healthy
(/api/monitoring/health 200, migrations 134-148 applied).

2026-08-17 07:59:52 -03:00

1.3 MiB

Raw Blame History

View Raw