[jonlwheat2-gif]

Summary

Implements #10536: upgrade @atjsh/llmlingua-2 from 2.0.3 → 2.0.5 and remove @tensorflow/tfjs from the LLMLingua SLM optional stack.

• @atjsh/llmlingua-2@2.0.5 adds official Transformers.js v4 support (peer: "@huggingface/transformers": "^3.5.2 || ^4.0.0"), restoring compatibility with OmniRoute's current @huggingface/transformers@^4.2.0.
• 2.0.4+ no longer requires @tensorflow/tfjs — dropping it removes the largest single contributor to the optional runtime footprint (previously dominated the ~800 MB TensorFlow.js + transformers closure).

Changes

• package.json / package-lock.json: @atjsh/llmlingua-2 2.0.3 → 2.0.5, remove @tensorflow/tfjs@4.22.0 and its transitive closure.
• Dockerfile: drop @tensorflow/tfjs from the standalone package validation loop.
• .github/dependabot.yml: refresh the stale "HARD-PINNED at 3.5.2" comment (the repo is on ^4.2.0 since fix(build): bump @huggingface/transformers to 4.2.0 + onnxruntime-node 1.24.3 #9962; llmlingua-2@2.0.5 peers ^3.5.2 || ^4.0.0).
• config/quality/dependency-allowlist.json: remove @tensorflow/tfjs (the stale-allowlist gate requires it once the dep is gone).
• scripts/build/colocateOptionals.mjs (SEED_PACKAGES), scripts/build/colocate-standalone.mjs, scripts/build/prepublish.ts, scripts/packs/optionalPackManifest.mjs (ml-runtime pack): remove tfjs from the SLM closure/seeds.
• open-sse/services/compression/engines/llmlingua/worker.ts: remove tfjs from the fail-open gate comments.
• Tests: tests/unit/colocate-optionals.test.ts, tests/unit/docker-llmlingua-optionals-9166.test.ts, tests/unit/compression/llmlingua-worker.test.ts — no longer require tfjs; fixtures updated to the 2.0.5 / Transformers.js v4 stack.
• Docs: docs/compression/COMPRESSION_ENGINES.md, docs/ops/RELEASE_CHECKLIST.md plus zh-CN / zh-TW / pl translations; new changelog fragment changelog.d/fixes/10536-llmlingua-2-2.0.5-drop-tfjs.md.

Verification

• 48/48 focused llmlingua / colocate / docker unit tests pass. Full compression suite: 1413 pass, 5 fail — all 5 are pre-existing RTK MCP test failures (confirmed identical on the pristine tree, unrelated to this change).
• npm run typecheck:core — clean.
• check:deps (dependency allowlist) and check:changelog-integrity — clean.
• Optional-pack verification: the ml-runtime pack stages from the real installed tree with exactly 4 members (@huggingface/transformers@4.2.0, onnxruntime-node@1.24.3, @atjsh/llmlingua-2@2.0.5, js-tiktoken@1.0.21) — the index entry builds and verifies, and no @tensorflow directory remains anywhere under node_modules.

Closes #10536

[diegosouzapw]

This is a clean, well-documented dependency drop — every reference to @tensorflow/tfjs across package.json, the lockfile, the Dockerfile validation step, the dependency allowlist, dependabot's comment, the build/pack scripts, and all 4 language mirrors of the compression docs was updated consistently, and the reasoning in colocateOptionals.mjs about the 'instance-split bug' is spot on.

I went further than the focused test suite and actually exercised the real compression path locally: installed @atjsh/llmlingua-2@2.0.5 with @tensorflow/tfjs removed entirely, and confirmed the tinybert ONNX pipeline still loads and compresses correctly through @huggingface/transformers 4.2.0 alone — so the tfjs removal does not affect compression quality.

One unrelated thing I noticed while doing that (NOT something to fix in this PR — it's identical on the current release/v3.8.50 tip, so it predates this change): new Worker(pathToFileURL(file).href, ...) in worker.ts passes a string where Node's worker_threads API wants the URL object itself, which throws ERR_WORKER_PATH on Node 24 and gets silently swallowed by the fail-open catch — meaning the LLMLingua 'ultra' compression tier may be silently no-op'ing in production right now regardless of this PR. Worth its own issue; flagging here since I found it during validation.

Looks merge-ready to me once CI actually runs (I only see semgrep/Mergify checks so far — might be waiting on workflow approval for an external contributor).

[jonlwheat2-gif]

Note on the 5 failing tests in the full compression suite — they are Windows-environment failures, pre-existing, and unrelated to this PR.

I reran the full tests/unit/compression/ suite on this branch (Windows) and got 1434 tests, 1429 pass, 5 fail. All 5 also fail on the pristine release/v3.8.50 base, so they're not introduced by this change. For the record, they're actually two distinct issues:

1. tests/unit/compression/rtk-mcp-tools.test.ts — 4 failures (3 tests + file-level), one EPERM in teardown

Error: EPERM, Permission denied: ...\Temp\omni-rtk-mcp-pS0s3o
    at Object.rmSync (tests/unit/compression/rtk-mcp-tools.test.ts:45:6)

• omniroute_rtk_learn returns a filter draft for a specific command
• returns an empty/baseline result with no samples (no throw)
• both tools are audited in mcp_tool_audit
• the file-level failure (same teardown error)

The test sets process.env.DATA_DIR to a fresh temp dir and opens a SQLite DB there; the file's after() hook then calls fs.rmSync(TEST_DATA_DIR, { recursive: true }). On Windows, SQLite's file handles (storage.sqlite + WAL) are still open at that point, and Windows refuses to delete a directory containing open files — so teardown throws EPERM. On Linux/macOS this passes because POSIX allows unlinking open files. The beforeEach assertions themselves pass; the count of 4 is one teardown error attributed to the tests + file by the runner.

2. tests/unit/compression/rtk-toml-compatibility.test.ts — 1 failure, POSIX mode assertion

AssertionError: Expected values to be strictly equal: 438 !== 384
    at ... (rtk-toml-compatibility.test.ts:243)

installs atomically, protects the file and refuses an implicit overwrite asserts fs.statSync(target).mode & 0o777 === 0o600 (384). On Windows, Node emulates POSIX permission bits as 0o666 (438) for writeable files, because Windows has no owner/group/other distinction — so the permission assertion can't hold there. It passes on Linux.

Bottom line: neither file imports anything this PR touches (deps, Dockerfile, build scripts, worker, docs, manifest), and both failures reproduce on the untouched base. They are platform artifacts of running the suite on a Windows machine — CI runs on Linux, where these 5 pass. No action needed for this PR.

[jonlwheat2-gif]

More work was needed — stale base fixed (merged current release/v3.8.50)

Assessment of this PR found one real problem and one blocker, both fixed/actioned below.

Problem: the branch was cut from a pre-fix release. The head was based on df9059141, which predates the #10692 production-build fix (22b89a273). The earlier "Build App" failure (29 × Module not found for localDb.js/child_process/fs/dns via db/migrationRunner, logRotation, tlsClient…) was that old leak — the branch never had the fix. The previous merge attempt (c1073032) merged a stale local origin/release/v3.8.50 ref (df9059141), so it did not help.

Fix applied: merged the current release/v3.8.50 tip (b754e44e2, includes #10695/#10697/#10698/#10700) into fix/10536-llmlingua-2-2.0.5-drop-tfjs → head is now 54ee3e498. Verified: no conflicts; 22b89a273 and b754e44e2 are ancestors; @atjsh/llmlingua-2@2.0.5 preserved with @tensorflow/tfjs gone; 15/15 focused tests pass (colocate-optionals, docker-llmlingua-optionals-9166, compression/llmlingua-worker).

Blocker: the PR CI never actually ran. All pull_request workflow runs are action_required (first-time external contributor) — semgrep, DAST smoke, Quality Gates, unit tests, vitest were never approved/executed. A maintainer needs to approve the runs on the new head.

Expected after CI runs: the gates will likely show the inherited base-red failures tracked in #9985 (error-helper geminiWeb.ts, mutation-test-coverage stryker drift, dead-code ratchet 419>415, open-sse-typecheck, chat-messages-validation-6402, ESLint warnings) — none caused by this PR; per repo policy they are fixed in the base-red track, not in this branch.

PR content itself validated: tfjs references remain only in docs/changelog (describing the removal), deps/scripts/manifests/tests consistent, focused suite green.

[jonlwheat2-gif]

@diegosouzapw code is clean let me know if more work is needed.