[dependabot]

Bumps the npm-minor-and-patch group with 2 updates in the / directory: openapi-fetch and vectra.

Updates openapi-fetch from 0.15.2 to 0.17.0

Release notes

Sourced from openapi-fetch's releases.

openapi-fetch@0.17.0

Minor Changes

• #2549 a690e52 Thanks @​abumalick! - Add readOnly/writeOnly support via --read-write-markers flag. When enabled, readOnly properties are wrapped with $Read<T> and writeOnly properties with $Write<T>. openapi-fetch uses Readable<T> and Writable<T> helpers to exclude these properties from responses and request bodies respectively.

Patch Changes

• #2572 9350ddf Thanks @​luis-guideti! - Do not treat Content-Length=0 as empty when Transfer-Encoding is chunked

• Updated dependencies [a690e52]:

  • openapi-typescript-helpers@0.1.0

openapi-fetch@0.16.0

Minor Changes

• #2362 9002418 Thanks @​luxass! - Added support for setting a custom path serializers either globally or per request. This allows you to customize how path parameters are serialized in the URL. E.g. you can use a custom serializer to prevent encoding of a path parameter, if you need to pass a value that should not be encoded.

Changelog

Sourced from openapi-fetch's changelog.

0.17.0

Minor Changes

• #2549 a690e52 Thanks @​abumalick! - Add readOnly/writeOnly support via --read-write-markers flag. When enabled, readOnly properties are wrapped with $Read<T> and writeOnly properties with $Write<T>. openapi-fetch uses Readable<T> and Writable<T> helpers to exclude these properties from responses and request bodies respectively.

Patch Changes

• #2572 9350ddf Thanks @​luis-guideti! - Do not treat Content-Length=0 as empty when Transfer-Encoding is chunked

• Updated dependencies [a690e52]:

  • openapi-typescript-helpers@0.1.0

0.16.0

Minor Changes

• #2362 9002418 Thanks @​luxass! - Added support for setting a custom path serializers either globally or per request. This allows you to customize how path parameters are serialized in the URL. E.g. you can use a custom serializer to prevent encoding of a path parameter, if you need to pass a value that should not be encoded.

Commits

• 5709d33 [ci] release (#2611)
• 9350ddf Do not treat Content-Length=0 as empty when Transfer-Encoding is chunked (#2572)
• a690e52 feat(openapi-typescript): add readOnly/writeOnly support via markers (#2549)
• a06e6c3 chore(deps): update dependency superagent to v10.3.0 (#2595)
• 7318f82 [ci] release (#2604)
• 33b83c4 chore(deps): update dependency express to v5.2.1 (#2591)
• 66556d0 chore(deps): update dependency axios to v1.13.5 (#2590)
• 9002418 feat(openapi-fetch): add support for pathSerializer option (#2362)
• ed0c26c feat(openapi-fetch): enable middleware request param module augmentation (#2527)
• See full diff in compare view

Updates vectra from 0.9.0 to 0.15.0

Release notes

Sourced from vectra's releases.

v0.15.0 — Performance & reliability

Non-breaking performance and bug-fix release on top of a dependency-update wave. Vectra's own API is fully backward-compatible; only direct callers of bumped SDKs (most notably openai 4 → 6) need to review their code.

Install Vectra from NPM

Highlights

• Re-upserting unchanged documents is a no-op instead of O(chunks) embedding calls.
• Faster transactions, faster top-K queries, faster bulk delete.
• Fixed a long-standing bug where upsertItem left a stale precomputed norm, silently degrading cosine rankings.
• Fixed a Windows-only FolderWatcher crash for paths under os.tmpdir() (and anywhere else 8.3 short names resolve).
• Test coverage is up to 97.7% statements / 91.5% branches (from ~94.6% / 87.1%).

Performance

Skip-if-unchanged document upsert. LocalDocumentIndex.upsertDocument now hashes text + docType + metadata (canonicalized, SHA-256) and stores the hash on the catalog. If you re-upsert a URI with byte-identical content, the call returns the existing document handle without re-chunking or re-embedding. Measured: a 100-file no-op sync that previously took ~505s of pure re-embed overhead now finishes in under a second.

Old catalogs bootstrap on first upsert per URI, then short-circuit. No catalog version bump. Opt out with { force: true } as the 5th argument (e.g., after rotating embeddings models).

Engine improvements:

• beginUpdate no longer deep-clones vectors — shallow array copy saves O(N·D) memory per upsert.
• queryItems uses a bounded min-heap for top-K — O(N log K) instead of O(N log N).
• queryItems loads external metadata in parallel.
• deleteDocument removes all chunks in one pass via the new public LocalIndex.deleteItems(ids) helper — O(N) instead of O(N·M).

Bug fixes

Stale precomputed norm after upsertItem. Upsert previously kept the old norm when the vector changed, skewing every subsequent cosine ranking against that item. Indexes built with prior versions self-heal on the next upsert per item.

FolderWatcher Windows crash with 8.3 short-name paths. The watcher now resolves paths through fs.realpath before calling fs.watch, avoiding a libuv assertion (!_wcsnicmp in fs-event.c) on paths under os.tmpdir(). It also no longer uses fs.watch(..., { recursive: true }) — it walks the tree and watches each directory individually, adding/removing watchers as subdirs appear or disappear.

Behavior note: URIs stored in an index for paths that previously contained 8.3 short names will now be in their canonical long-name form. If you store Vectra URIs externally, paths under os.tmpdir() (or similar) may differ.

Testing & internals

• New src/internals/transformersLoader.ts test seam — @huggingface/transformers 4.x marks its ESM exports as non-configurable, which broke the prior sinon.stub(module, 'pipeline') approach in tests. Production behavior unchanged.
• Linux CI now correctly runs all spec files (test scripts quote the glob).

Dependency updates

Runtime — major bumps (review direct usage): openai 4.104.0 → 6.33.0, @huggingface/transformers 3.8.1 → 4.0.1, dotenv 16.5.0 → 17.4.1, protobufjs 7.5.4 → 8.0.0, uuid 11.1.0 → 13.0.0, yargs 17.7.2 → 18.0.0.

Runtime — minor/patch: wink-nlp 2.4.0, cheerio 1.2.0, turndown 7.2.4.

Dev/tooling: typescript 5.9.3, eslint 10.2.0, mocha 11.7.5, nyc 18.0.0, webpack-cli 7.0.2, @types/node 25.5.2, @types/uuid 11.0.0, @types/yargs 17.0.35.

GitHub Actions: checkout v6, setup-node v6, deploy-pages v5, upload-pages-artifact v5, configure-pages v6.

Upgrading from v0.14.x

No required code changes. Three things to watch for:

1. Direct openai SDK usage alongside OpenAIEmbeddings — Vectra's wrapper is unchanged, but the underlying SDK jumped 4 → 6.

... (truncated)

Changelog

Sourced from vectra's changelog.

v0.15.0

Performance, a bug fix, and a wave of dependency updates. All Vectra API surface changes are additive and non-breaking; one direct runtime dependency (openai) had a major version bump that callers using the SDK directly should review.

Skip-if-unchanged document upsert

LocalDocumentIndex.upsertDocument now hashes text + docType + metadata (canonicalized, SHA-256) and stores the hash on the catalog. When a caller re-upserts a URI whose content + metadata are byte-identical to what's already stored, the call returns a LocalDocument handle without re-chunking or re-embedding.

Who is affected: Callers that drive Vectra in a "scan every file, upsert each one" sync pattern. No-op syncs against unchanged corpora drop from O(chunks) embedding calls per pass to zero. Measured: a 100-file periodic sync that previously grew to ~505s of pure re-embed overhead now finishes in well under a second when nothing has changed.

Backward compatibility: Public API is unchanged. An old catalog (no hash field) bootstraps on first upsert per URI, then short-circuits on subsequent identical upserts. The on-disk catalog gains an optional uriToHash map (JSON) / uri_to_hash field (protobuf, tag 5) — old readers ignore unknown fields. No catalog version bump.

Opt-out: Pass { force: true } as the fifth argument to bypass the check (e.g., after rotating embeddings models):

await docs.upsertDocument(uri, text, docType, metadata, { force: true });

Internal performance improvements

A set of non-breaking optimizations to hot paths. No API changes beyond the new deleteItems helper; all existing tests pass without modification.

• beginUpdate no longer deep-clones vectors. The transactional snapshot is now a shallow copy of the items array. For an index with N chunks × D-dimensional vectors, this saves O(N·D) memory copy per upsertItem / upsertDocument. Internally, upsert now replaces items rather than mutating them so the previously-committed snapshot stays intact on cancelUpdate.
• queryItems uses a bounded min-heap for top-K. Distance ranking is now O(N log K) instead of O(N log N), and avoids allocating an N-sized intermediate distance array.
• queryItems loads external metadata files in parallel. Top-K metadata reads now use Promise.all instead of awaiting each file sequentially.
• deleteDocument removes all chunks in a single pass. New public method LocalIndex.deleteItems(ids: Iterable<string>) does a single filter over the items array. LocalDocumentIndex.deleteDocument now uses this, dropping chunk-removal cost from O(N·M) to O(N) for a document with M chunks in an index of N total chunks.

Bug fix: FolderWatcher crash on Windows with 8.3 short-name paths

FolderWatcher.start() now resolves each watched path through fs.realpath before handing it to fs.watch. Previously, watching a path containing a Windows 8.3 short name (e.g., anything under os.tmpdir() when the user's home dir maps to a STEVEN~1-style alias) would crash the process with a libuv assertion (!_wcsnicmp in fs-event.c) the first time ReadDirectoryChangesW returned an event filename in long-name form. The watcher also no longer uses fs.watch(..., { recursive: true }); it walks the tree on start and installs one non-recursive watcher per directory, dynamically adding/removing watchers as subdirectories appear or disappear. Both fixes are internal — no API changes — but URIs stored in the index for paths that contained short names will now be in their canonical long-name form.

Bug fix: stale norm after upsertItem

LocalIndex.upsertItem previously updated the item's vector, metadata, and metadataFile but kept the old precomputed norm. Any upsert that changed the vector would leave behind a norm that no longer matched, skewing every subsequent cosine-similarity ranking against that item until it was deleted and re-inserted.

The fix is a one-line addition in the upsert replacement path that also recomputes norm from the new vector. Indexes built with affected versions will self-heal on the next upsert per item; if you suspect query results are off and you've been upserting items in place, force a refresh via upsertItem (or, for documents, upsertDocument(..., { force: true })).

Dependency updates

Major-version runtime dependencies — review your direct usage if any:

• openai 4.104.0 → 6.33.0
• @huggingface/transformers 3.8.1 → 4.0.1
• dotenv 16.5.0 → 17.4.1
• protobufjs 7.5.4 → 8.0.0
• uuid 11.1.0 → 13.0.0
• yargs 17.7.2 → 18.0.0

Minor / patch runtime updates:

... (truncated)

Commits

• See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[micsparre]

Closing. The grepr-server sync overwrites package.json and bun.lock in this repo, so npm dependency changes go in grepr-server cli/ (ENGT-6417). #37 removed the npm entry from dependabot.yml.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml