agentic-flow 2.1.0 still ships vulnerable protobufjs chain via abandoned @xenova/transformers — migrate to @huggingface/transformers #178

Summary

Installing agentic-flow@2.1.0 (latest, verified 2026-07-17) introduces 30 npm audit vulnerabilities — 1 critical, 5 high, 24 moderate — into an otherwise-clean tree, and npm audit fix can resolve none of them (all transitive, no compatible patched versions).

protobufjs  <=7.6.2   CRITICAL  (GHSA-xq3m-2v4x-88gg arbitrary code execution, + 10 more advisories)
  └─ onnx-proto → onnxruntime-web <=1.16.0 → @xenova/transformers → agentic-flow

Root cause

agentic-flow depends on @xenova/transformers ^2.17.2. That package is abandoned at 2.17.2 — it was renamed/superseded by @huggingface/transformers — and permanently pins onnxruntime-web 1.14.0, which drags in the vulnerable onnx-proto/protobufjs chain. No release of @xenova/transformers will ever fix this.

Proposed fix

Migrate the embedding stack to the official successor:

- "@xenova/transformers": "^2.17.2"
+ "@huggingface/transformers": "^4.2.0"

@huggingface/transformers 4.x uses onnxruntime-web 1.26.x — entirely off the vulnerable path. The API is a near-drop-in rename (import { pipeline } from '@huggingface/transformers'), with the main v3+ changes being device/dtype options.

Verification

$ npm view @xenova/transformers@latest version dependencies.onnxruntime-web
2.17.2 / 1.14.0        # abandoned, vulnerable
$ npm view @huggingface/transformers@latest version dependencies.onnxruntime-web
4.2.0 / 1.26.0-dev.…   # patched

Related

• agentic-flow 2.x dependency chain pulls vulnerable protobufjs <7.5.5 (CVE GHSA-xq3m-2v4x-88gg) #145 was closed as completed, but the chain is still present in 2.1.0 as published on npm.
• Security: 10 unfixable npm vulnerabilities in transitive dependencies #125 tracks the transitive vulnerabilities generally; this issue proposes the specific dependency swap that eliminates the critical/high cluster.

The only mitigation currently available to consumers is uninstalling agentic-flow (audit returns to 0), which loses local embeddings entirely.