QVAC-24253 chore[mod]: bump @qvac/fabric to ^0.10.0 for the npm-runtime addons

[iancris]

🎯 Problem

classification-ggml and vla-ggml consume the shared ggml runtime through the published npm package
@qvac/fabric, not the qvac-fabric vcpkg port. The qvac-fabric 10297.1.1 rollout
(#4121) therefore never reached them —
.github/fabric-consumers.json lists both under npm_runtime precisely because they sit outside it.

They cannot pick the new runtime up on their own. A caret on a 0.x version locks the minor, so
^0.8.0 and ^0.9.0 will never resolve 0.10.0 no matter how long they wait. Left alone, both keep
installing a superseded fabric indefinitely, and nothing fails loudly to say so.

📝 How

package	version	@qvac/fabric
classification-ggml	0.22.0 → 0.23.0	^0.8.0 → ^0.10.0
vla-ggml	0.23.0 → 0.24.0	^0.9.0 → ^0.10.0

Both move qvac-fabric 10297.0.0 → 10297.1.1. classification-ggml crosses two fabric minors, so
it additionally picks up @qvac/fabric 0.9.0's ROCm/HIP GGML_BACKEND_DL module; vla-ggml already had
it.

Neither addon exposes a GPU or vector-index surface of its own, so no API changes — the bump keeps
them on the current shared runtime rather than a stale one.

vla-ggml also releases work already on main

#3998 migrated vla-ggml off the vcpkg port onto the npm
runtime and deliberately deferred its version bump and changelog entry:

"Park the fabric-migration changelog and version bump for a follow-up PR after this cycle."

This is that follow-up. Its 0.24.0 entry therefore documents the migration, the ASAN C++ test-runner
change and the mobile test-group validation alongside the caret bump, rather than publishing them
silently under a version whose changelog mentions none of them.

classification-ggml's only other unreleased change is a check:generated script tweak, noted in its
entry for completeness.

🧪 Tested

• @qvac/fabric@0.10.0 is published and resolvable — npm latest is 0.10.0, git tag
  fabric-v0.10.0 exists. This was the blocking precondition: opening this PR before fabric published
  would leave its own CI unable to resolve ^0.10.0 and go red for an unrelated reason.
• Diff is exactly 4 files — 2 × package.json, 2 × CHANGELOG.md. No source, no workflows.
• Both package.json files parse, and both changelog headings use the bracketed
  ## [<version>] - <date> form the release-merge-guard requires.
• Both addons' pre-bump versions matched npm latest (0.22.0 / 0.23.0), so neither had an unreleased
  version already pending.

⚠️ Breaking

None. Both bumps are minor on 0.x, no API surface changes, and the ROCm/HIP module is fail-safe at
runtime — the DL loader skips it on non-AMD hosts and falls back to Vulkan/CPU.

Squash-merging publishes 2 packages: @qvac/classification-ggml 0.23.0 and @qvac/vla-ggml 0.24.0.

🤖 Generated with Claude Code

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.

[github-actions]

License compliance — clean

No new dependency license findings in this PR.

Warn-only (shadow) mode — this check does not block merges yet.

Updated automatically by the canonical license compliance workflow.

NOTICE presence (advisory)

Missing NOTICE (advisory, does not block):

• ./.github/actions/release-merge-guard
• ./docs/website
• ./packages/ggml-coload-smoke
• ./packages/fabric/test/integration
• ./packages/inference-addon-cpp/mobile
• ./packages/sdk/e2e
• ./packages/llm-llamacpp/benchmarks/performance
• ./packages/llm-llamacpp/benchmarks/server
• ./packages/vla-ggml/sim/server
• ./packages/embed-llamacpp/benchmarks/performance
• ./packages/embed-llamacpp/benchmarks/server
• ./packages/asr-ggml/benchmarks/server

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​qvac/​fabric@​0.9.0 ⏵ 0.10.0				+1

View full report