Bump dependencies

[xenova]

• sharp -> 0.35.4
• @huggingface/jinja -> 0.5.10
• @huggingface/tokenizers -> 0.2.0
• onnxruntime-web -> 1.31.0-dev.20260914-8d85527a0
• onnxruntime-node -> 1.30.0

commit log looks a bit messy, but it's because it's including everything from #1665 (won't be shown when we squash)

increases required node.js version to >= 20 due to sharp dependency.

Closes #1687
Closes #1707
Closes #1718
Closes #1727
Closes #1729
Closes #1730
Closes #1731
Closes #1761

[Copilot]

🔵 Needs a closer look

Remainder mishandles zero divisors for integer tensors and RFFT silently normalizes invalid axes.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

packages/transformers/src/utils/tensor.js:361

• A zero divisor silently produces incorrect results for Number-backed integer tensors: % yields NaN, which integer typed arrays coerce to 0 (while bigint tensors throw). Since this API advertises Python-style modulo semantics, reject zero before entering the loop so all numeric dtypes behave consistently.
  packages/transformers/src/utils/tensor.js:1183
• Using modulo to normalize the axis also accepts invalid dimensions: for a rank-2 input, axis 2 becomes 0 and axis -3 becomes 1, whereas the documented torch.fft.rfft behavior must reject axes outside [-2, 1]. Validate the original scalar axis with the existing safeIndex helper before applying remainder.

• Files reviewed: 18/19 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[nico-martin]

two nit-picks, otherwise lftm :)

[Copilot]

🟡 Changes recommended

The remainder calculation is numerically incorrect for large divisors, and the advertised Node.js floor does not match Sharp’s requirement.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

packages/transformers/package.json:62

• sharp@0.35.4 requires Node >=20.9.0 (pnpm-lock.yaml:1611-1613), but this published package still has no engines declaration and the updated compatibility docs promise Node 20+. Consequently Node 20.0–20.8 are advertised as supported even though a direct dependency rejects them. Declare the package minimum as >=20.9.0 and align the changed compatibility text (or use a compatible Sharp release).

    "sharp": "^0.35.4"

• Files reviewed: 19/20 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🟡 Changes recommended

The new remainder implementation silently produces incorrect values for unsupported or unrepresentable tensor operations.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

packages/transformers/src/utils/tensor.js:369

• Assigning the corrected value back to the original fixed-width array can silently destroy the documented Python-style result. For example, new Tensor('uint8', [3], [1]).remainder(-2) computes -1 but stores 255 (uint64 stores 18446744073709551615n); int8([-1]).remainder(200) similarly computes 199 and stores -57. Please reject divisors/results that the in-place dtype cannot represent before mutation, or promote the out-of-place result while making remainder_ reject it.

            const needs_shift = (remainder < 0 && divisor > 0) || (remainder > 0 && divisor < 0);
            this_data[i] = needs_shift ? remainder + divisor : remainder;

• Files reviewed: 22/23 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

Negative divisors produce wrapped, incorrect remainder values for unsigned and boolean tensors.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

packages/transformers/src/utils/tensor.js:369

• For unsigned and bool tensors, a negative divisor produces a negative Python-style remainder that is then assigned back into an unsigned typed array and wraps (for example, uint8([1]).remainder(-2) yields 255, and uint64 yields 2^64 - 1, rather than -1). This contradicts the documented sign semantics. Please either reject negative divisors for these dtypes or define a promoted output dtype, and cover that behavior in the tests.

• Files reviewed: 22/23 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

Major native-runtime and ONNX changes span multiple platforms and include altered model outputs plus reduced MusicGen coverage.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 22/23 changed files
• Comments generated: 0 new
• Review effort level: Balanced