개선(deps): Bump adm-zip and @huggingface/transformers

[dependabot]

Bumps adm-zip to 0.6.1 and updates ancestor dependency @huggingface/transformers. These dependencies need to be updated together.

Updates adm-zip from 0.6.0 to 0.6.1

Release notes

Sourced from adm-zip's releases.

v0.6.1

Full Changelog: cthackers/adm-zip@v0.6.0...v0.6.1

• Updated dev dependencies
• Fixed uncaught crash in async decompression on malformed DEFLATE data
• Fixed addLocalFolder following symlinks out of the archived folder
• Stripped setuid/setgid/sticky bits from extracted file permissions
• Enforced the decompression size cap on the async path and for size 0
• Rejected archives with duplicate entry names
• Blocked extraction from writing through symlinks inside the target
• Routed malformed-header parse errors through the async callback
• Rejected zip entries whose declared data extent runs past the buffer
• Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
• Fixed addLocalFolderAsync2 mangling local paths on Windows

Commits

• cb2cf9b Fixed addLocalFolderAsync2 mangling local paths on Windows
• 54902b6 Fixed addLocalFolderPromise hanging on empty folders and swallowing errors
• 73131bd Fixed CI
• 758898d Rejected zip entries whose declared data extent runs past the buffer
• 74b6e9f Routed malformed-header parse errors through the async callback
• eaa35fa Blocked extraction from writing through symlinks inside the target
• 1e015e3 Increment version
• 05101d4 Rejected archives with duplicate entry names
• 4916006 Enforced the decompression size cap on the async path and for size 0
• 6a63c33 Stripped setuid/setgid/sticky bits from extracted file permissions
• Additional commits viewable in compare view

Updates @huggingface/transformers from 4.2.0 to 4.3.0

Release notes

Sourced from @​huggingface/transformers's releases.

4.3.0

🚀 Transformers.js v4.3 — Structured Output, New Models, WebGPU upgrade, Documentation Overhaul

This release adds structured output, three new model architectures, WebGPU support for Safari 26+, and a documentation overhaul. We also upgraded ONNX Runtime to the latest version.

What's new?

Structured output

Constrain generation to a JSON schema, JSON object, or regular expression with the experimental, dependency-free @huggingface/transformers-structured-output package in huggingface/transformers.js#1758.

For example, classify customer feedback into a fixed set of sentiments and topics:

import { pipeline, TextStreamer } from "@huggingface/transformers";
import { StructuredOutputProcessor } from "@huggingface/transformers-structured-output";
// Create the pipeline first so its tokenizer is available.
const generator = await pipeline(
"text-generation",
"onnx-community/LFM2.5-350M-ONNX",
{ dtype: "q4f16", device: "webgpu" },
);
const processor = new StructuredOutputProcessor(generator.tokenizer, {
type: "json_schema",
json_schema: {
type: "object",
properties: {
sentiment: { enum: ["positive", "negative", "neutral"] },
topic: { enum: ["price", "quality", "delivery", "other"] },
},
required: ["sentiment", "topic"],
additionalProperties: false,
},
});
const messages = [
{
role: "user",
content: "Classify this feedback: The product is way too expensive.",
},
];
const output = await generator(messages, {
max_new_tokens: 512,
do_sample: false,
streamer: new TextStreamer(generator.tokenizer, {
skip_prompt: true,
skip_special_tokens: true,
</tr></table>

... (truncated)

Commits

• a1728dd [version] Update to 4.3.0
• f9dec42 Bump dependencies (#1766)
• dce094e Massive documentation overhaul (#1665)
• 37fddf9 Fix RawAudio.toBlob() ignoring TypedArray byteOffset/length (#1712)
• eb5d05e Skip browser cache writes for non-http(s) resources (#1723)
• 3991b6a Create @huggingface/transformers-structured-output package (#1758)
• 6fe1ccc Pin WebGPU KV cache for ImageAudioTextToText models (Gemma3n, Gemma4) (#1757)
• f09d000 Correctly dispose Chatterbox KV cache after generation (#1737)
• 3152877 Remove unused code and exports (#1763)
• 274446c Fix Moonshine ASR token decoding (#1738)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Labels

The following labels could not be found: landing. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.