Skip to content

Turbovec: add vector index C API foundation - #211

Merged
gianni-cor merged 75 commits into
tetherto:temp-10297from
dev-nid:turbovec-cpu-pr1-core
Aug 24, 2026
Merged

gianni-cor merged 75 commits into
tetherto:temp-10297from
dev-nid:turbovec-cpu-pr1-core

Conversation

@dev-nid

@dev-nid dev-nid commented Aug 21, 2026

Copy link
Copy Markdown

Summary

Rebasing this again for branch temp-10297
Adds the initial standalone ggml-vector-index C API foundation.

  • Introduces ggml_vec_index_* public API surface.
  • Adds basic in-memory vector index lifecycle, add, search, remove, contains, write/load coverage from the initial implementation slice.
  • Wires the initial vector-index source into the build.
  • Adds the first test-vector-index coverage for API behavior.

Test plan

  • cmake -S . -B build -DGGML_VECTOR_INDEX=ON -DLLAMA_BUILD_TESTS=ON
  • cmake --build build --target test-vector-index
  • ctest --test-dir build -R '^test-vector-index$' --output-on-failure

Related PR

embed: tetherto/qvac#3292

Original reference

https://github.com/RyanCodrai/turbovec

dev-nid added 30 commits August 21, 2026 17:57
Fix malformed snapshot handling, reserved padding IDs, finite input validation, score clamping, and PR1 test isolation. Make the vector-index foundation default-off behind a standalone  target.
Export vector-index symbols correctly in shared builds by propagating GGML_SHARED, and enable GGML_VECTOR_INDEX in Linux and Windows shared CI so the library and test target are exercised.
Reject non-zero reserved v1 header bytes, expand malformed snapshot and invalid API coverage, and fix ggml package configuration paths.
Make snapshot writes atomic, tighten API edge-case handling, and add CI coverage for package exports and static consumers.
Fix vector-index API semantics, snapshot I/O safety, search ranking, and package smoke checks.
Avoid GCC attribute warnings from the FILE deleter and keep POSIX snapshot writes restrictive until publish. Preserve existing file modes, apply default creation permissions for new files, and cover the permission behavior in tests.
Avoid exact reserve calls during add by growing storage capacity with slack and only reserving the id map when insertion would rehash.
Sync the temporary snapshot again after chmod, fsync the parent directory after rename, and report post-rename sync failures as GGML_VEC_INDEX_E_NOT_DURABLE.
Fix vector-index snapshot durability on Windows and macOS, tighten byte-span overflow validation, and cover static package consumers in CI.
Fix vector-index snapshot durability on Windows and macOS, tighten byte-span overflow validation, and cover static package consumers in CI.
Add regression coverage that a failed atomic write targeting an existing valid snapshot leaves the snapshot bytes unchanged.
… both pip installs and the jinja2 import check."

This reverts commit 7be3d08.

Assisted-by: GPT-5.5
Run converter installs and imports through the CI virtualenv interpreter so macOS self-hosted jobs do not fall back to a Python without jinja2 or torch.

Assisted-by: GPT-5.5
Restore the CI script after confirming the Apple GPU failure comes from the self-hosted runner Python version rather than converter interpreter selection.

Assisted-by: GPT-5.5
Use an AVX2-compatible sign-extension sequence for q4/q8 search and add focused quantized reference and IVF recall coverage.
Harden quantized scoring, IVF probing, remove semantics, and vector-index packaging while moving the private build wiring into the vector-index subdirectory.
Align the vector-index persistence API/docs with the implemented f32 snapshot support, make snapshot writes atomic and safer, and add regression coverage for malformed loads, unsupported modes, filter validation, and quantized IVF edge cases.
Keep file-local capacity helpers internal so fatal-warning builds do not reject them for missing prototypes.
dev-nid added 17 commits August 21, 2026 17:58
Clarify the Rust turbovec v0.9.0 Ziggurat and statrs-derived constants, and add focused coverage for the full normal table and TQ+ beta quantiles.
Use the PR3 temp-path test style and avoid non-finite q8 IVF scoring in the rebased stack.

Assisted-by: GPT-5.5
Resolve PR3 rebase fallout in delta replay locking and vector-index tests so the rebased stack builds and runs cleanly.

Assisted-by: GPT-5.5
Adapt the rebased tail-recovery regression to PR3 test helpers and align zero-row logged-add coverage with the PR2d delta-start policy.

Assisted-by: GPT-5.5
Fix TurboVec calibration persistence edge cases, make failed delta replay rollback safer, and add regression coverage for zero-scale rows, legacy calibration snapshots, and partial replay failures.
Fix delta-log replay, legacy recovery, TurboVec dimension compatibility, and static pkg-config coverage for vector-index builds.
Keep the PR2d replay and durability checks after rebasing PR3 onto the delta-log branch.

Assisted-by: GPT-5.5
Keep direct q8 and q4 row quantization under nearest rounding so added vectors do not depend on the caller's active rounding mode.
Add batched Accelerate query rotation and fused 4-query TurboVec LUT scoring, with platform guards and regression coverage to keep search results stable across scalar, NEON, and Apple targets. Also fix related CI/package checks.
Keep TurboVec persisted derivations under nearest rounding and make the TQ+ LUT parity hook independent of backend query rotation. Align remove_logged API docs with its error-code return convention.
Avoid including private vector-index internals in the production smoke test while preserving hook-only coverage for snapshot temp-file cleanup.

Assisted-by: GPT-5.5
Bound the reader loop before exercising add/remove mutations so static ARM64 runs do not depend on shared_mutex writer fairness.
Restore delta-bound mutation, mmap version, and symlink coverage after rebasing the TurboVec test suite.

Assisted-by: GPT-5.6 Sol
Declare the test-only addressability hook before its definition so fatal-warning builds do not fail on missing declarations.
Accept hardlink aliases during delta compaction using the existing inode-aware path check, and tighten vector-index tests so concurrent and mmap searches validate returned ids and scores.
@dev-nid
dev-nid requested review from a team as code owners August 21, 2026 12:50
@github-actions github-actions Bot added documentation Improvements or additions to documentation examples ggml testing build devops labels Aug 21, 2026
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedcargo/​faer@​0.20.21001009310070
Addedcargo/​turbovec@​0.9.08210093100100

View full report

@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: cargo zerocopy is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/zerocopy@0.8.55

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy@0.8.55. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo autocfg

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/autocfg@1.5.1

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/autocfg@1.5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
System shell access: cargo autocfg

Location: Package overview

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/autocfg@1.5.1

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/autocfg@1.5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo crossbeam-deque

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/crossbeam-deque@0.8.7

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/crossbeam-deque@0.8.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo crossbeam-epoch

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/crossbeam-epoch@0.9.20

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/crossbeam-epoch@0.9.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo crossbeam-utils

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/crossbeam-utils@0.8.22

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/crossbeam-utils@0.8.22. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo crunchy

Install script: Package overview

Source: undefined

From: ?cargo/faer@0.20.2cargo/crunchy@0.2.4

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/crunchy@0.2.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
System shell access: cargo equator

Location: Package overview

From: ?cargo/faer@0.20.2cargo/equator@0.4.2

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/equator@0.4.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo gemm-common

Install script: Package overview

Source: undefined

From: ?cargo/faer@0.20.2cargo/gemm-common@0.18.2

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/gemm-common@0.18.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo libc

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/libc@0.2.189

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libc@0.2.189. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
System shell access: cargo libc

Location: Package overview

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/libc@0.2.189

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libc@0.2.189. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo libm

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/libm@0.2.16

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libm@0.2.16. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo matrixmultiply

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/matrixmultiply@0.3.11

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/matrixmultiply@0.3.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo nano-gemm-c32

Install script: Package overview

Source: undefined

From: ?cargo/faer@0.20.2cargo/nano-gemm-c32@0.1.0

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/nano-gemm-c32@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo nano-gemm-c64

Install script: Package overview

Source: undefined

From: ?cargo/faer@0.20.2cargo/nano-gemm-c64@0.1.0

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/nano-gemm-c64@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo nano-gemm-f32

Install script: Package overview

Source: undefined

From: ?cargo/faer@0.20.2cargo/nano-gemm-f32@0.1.0

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/nano-gemm-f32@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo nano-gemm-f64

Install script: Package overview

Source: undefined

From: ?cargo/faer@0.20.2cargo/nano-gemm-f64@0.1.0

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/nano-gemm-f64@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo num-traits

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/num-traits@0.2.19

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/num-traits@0.2.19. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo paste

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/paste@1.0.15

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/paste@1.0.15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo portable-atomic-util

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/portable-atomic-util@0.2.7

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/portable-atomic-util@0.2.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo portable-atomic

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/portable-atomic@1.14.0

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/portable-atomic@1.14.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo proc-macro2

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/proc-macro2@1.0.107

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/proc-macro2@1.0.107. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo pulp

Install script: Package overview

Source: undefined

From: ?cargo/faer@0.20.2cargo/pulp@0.21.5

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/pulp@0.21.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo quote

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/quote@1.0.47

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/quote@1.0.47. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo rayon-core

Install script: Package overview

Source: undefined

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/rayon-core@1.13.0

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/rayon-core@1.13.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
System shell access: cargo rayon

Location: Package overview

From: ?cargo/turbovec@0.9.0cargo/faer@0.20.2cargo/rayon@1.12.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/rayon@1.12.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo serde_core

Install script: Package overview

Source: undefined

From: ?cargo/faer@0.20.2cargo/serde_core@1.0.229

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/serde_core@1.0.229. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Install-time scripts: cargo serde

Install script: Package overview

Source: undefined

From: ?cargo/faer@0.20.2cargo/serde@1.0.229

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/serde@1.0.229. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 8 more rows in the dashboard

View full report

@github-actions

Copy link
Copy Markdown

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.

@gianni-cor
gianni-cor merged commit 2b6f222 into tetherto:temp-10297 Aug 24, 2026
29 of 46 checks passed
@gagallo7 gagallo7 mentioned this pull request Aug 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

build devops documentation Improvements or additions to documentation examples ggml testing

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants