Merge branch 'main' into hoytak/260305-cas-xorb-change

hoytak · web-flow · commit 3222eae3e75d · 2026-03-07T15:12:04.000-08:00
diff --git a/README.md b/README.md
@@ -98,7 +98,7 @@ You can run our packages with vanilla JS, without any bundler, by using a CDN or
 
 ```html
 <script type="module">
-    import { InferenceClient } from 'https://cdn.jsdelivr.net/npm/@huggingface/inference@4.13.14/+esm';
+    import { InferenceClient } from 'https://cdn.jsdelivr.net/npm/@huggingface/inference@4.13.15/+esm';
     import { createRepo, commit, deleteRepo, listFiles } from "https://cdn.jsdelivr.net/npm/@huggingface/hub@2.10.5/+esm";
 </script>
 ```
diff --git a/packages/gguf/package.json b/packages/gguf/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@huggingface/gguf",
-	"version": "0.3.5",
+	"version": "0.3.6",
 	"description": "a GGUF parser that works on remotely hosted files",
 	"keywords": [
 		"gguf",
diff --git a/packages/gguf/src/gguf.spec.ts b/packages/gguf/src/gguf.spec.ts
@@ -28,6 +28,8 @@ const URL_V1 =
 const URL_SHARDED_GROK =
 	"https://huggingface.co/Arki05/Grok-1-GGUF/resolve/ecafa8d8eca9b8cd75d11a0d08d3a6199dc5a068/grok-1-IQ3_XS-split-00001-of-00009.gguf";
 const URL_BIG_METADATA = "https://huggingface.co/ngxson/test_gguf_models/resolve/main/gguf_test_big_metadata.gguf";
+const URL_KIMI_K25 =
+	"https://huggingface.co/unsloth/Kimi-K2.5-GGUF/resolve/5f759b07a564a5cb9fcfa9ad456cf254e539ac77/UD-Q3_K_XL/Kimi-K2.5-UD-Q3_K_XL-00001-of-00011.gguf";
 
 describe("gguf", () => {
 	beforeAll(async () => {
@@ -255,6 +257,46 @@ describe("gguf", () => {
 		});
 	});
 
+	it("should parse a large MoE model (Kimi-K2.5, 160K vocab)", async () => {
+		const { metadata, typedMetadata, tensorInfos } = await gguf(URL_KIMI_K25, { typedMetadata: true });
+
+		expect(metadata).toMatchObject({
+			version: 3,
+			"general.architecture": "deepseek2",
+			"general.name": "Kimi-K2.5",
+			"deepseek2.block_count": 61,
+			"deepseek2.embedding_length": 7168,
+			"deepseek2.expert_count": 384,
+			"deepseek2.expert_used_count": 8,
+			"deepseek2.expert_shared_count": 1,
+			"deepseek2.vocab_size": 163840,
+		});
+
+		expect(typedMetadata["general.architecture"]).toEqual({
+			value: "deepseek2",
+			type: GGUFValueType.STRING,
+		});
+		expect(typedMetadata["deepseek2.expert_count"]).toEqual({
+			value: 384,
+			type: GGUFValueType.UINT32,
+		});
+		expect(typedMetadata["tokenizer.ggml.tokens"]).toMatchObject({
+			type: GGUFValueType.ARRAY,
+			subType: GGUFValueType.STRING,
+		});
+		const tokens = typedMetadata["tokenizer.ggml.tokens"].value;
+		expect(Array.isArray(tokens)).toBe(true);
+		if (Array.isArray(tokens)) {
+			expect(tokens.length).toEqual(163_840);
+		}
+
+		expect(tensorInfos.length).toBeGreaterThan(0);
+		expect(tensorInfos[0]).toMatchObject({
+			name: "output.weight",
+			shape: [7168n, 163840n],
+		});
+	});
+
 	it("should parse a local file", async () => {
 		const parsedGguf = await gguf(".cache/model.gguf", { allowLocalFile: true });
 		const { metadata } = parsedGguf as GGUFParseOutput<{ strict: false }>; // custom metadata arch, no need for typing
diff --git a/packages/gguf/src/gguf.ts b/packages/gguf/src/gguf.ts
@@ -27,6 +27,15 @@ export {
 export const RE_GGUF_FILE = /\.gguf$/;
 export const RE_GGUF_SHARD_FILE = /^(?<prefix>.*?)-(?<shard>\d{5})-of-(?<total>\d{5})\.gguf$/;
 const GGUF_DEFAULT_ALIGNMENT = 32; // defined in ggml.h
+
+/**
+ * Safety limits to prevent OOM from crafted GGUF files (CWE-770).
+ * Values are set well above any known real-world model (e.g. Kimi-K2.5 at 1T params,
+ * 160K vocab, 384 experts) while still preventing billion-element allocations.
+ */
+const MAX_METADATA_ARRAY_LENGTH = 1_000_000;
+const MAX_KV_COUNT = 100_000;
+const MAX_TENSOR_COUNT = 10_000_000;
 const GGML_PAD = (x: number, n: number) => (x + n - 1) & ~(n - 1); // defined in ggml.h
 const PARALLEL_DOWNLOADS = 20;
 
@@ -223,6 +232,11 @@ function readMetadataValue(
 		case GGUFValueType.ARRAY: {
 			const arrayType = view.getUint32(offset, littleEndian);
 			const arrayLength = readVersionedSize(view, offset + 4, version, littleEndian);
+			if (arrayLength.value > MAX_METADATA_ARRAY_LENGTH) {
+				throw new Error(
+					`Metadata array length ${arrayLength.value} exceeds maximum allowed (${MAX_METADATA_ARRAY_LENGTH})`,
+				);
+			}
 			let length = 4 + arrayLength.length;
 			const arrayValues: MetadataValue[] = [];
 			for (let i = 0; i < arrayLength.value; i++) {
@@ -340,8 +354,14 @@ export async function gguf(
 	// initial offset after header
 	let offset = 8;
 	const tensorCount = readVersionedSize(r.view, offset, version, littleEndian);
+	if (tensorCount.value > MAX_TENSOR_COUNT) {
+		throw new Error(`Tensor count ${tensorCount.value} exceeds maximum allowed (${MAX_TENSOR_COUNT})`);
+	}
 	offset += tensorCount.length;
 	const numKv = readVersionedSize(r.view, offset, version, littleEndian);
+	if (numKv.value > MAX_KV_COUNT) {
+		throw new Error(`KV metadata count ${numKv.value} exceeds maximum allowed (${MAX_KV_COUNT})`);
+	}
 	offset += numKv.length;
 	const metadata: GGUFMetadata<{ strict: false }> = {
 		version,
diff --git a/packages/inference/package.json b/packages/inference/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@huggingface/inference",
-	"version": "4.13.14",
+	"version": "4.13.15",
 	"description": "Typescript client for the Hugging Face Inference Providers and Inference Endpoints",
 	"keywords": [
 		"ai",
diff --git a/packages/inference/src/lib/getProviderHelper.ts b/packages/inference/src/lib/getProviderHelper.ts
@@ -198,6 +198,7 @@ export const PROVIDERS: Record<InferenceProvider, Partial<Record<InferenceTask,
 	"zai-org": {
 		conversational: new Zai.ZaiConversationalTask(),
 		"text-to-image": new Zai.ZaiTextToImageTask(),
+		"image-to-text": new Zai.ZaiImageToTextTask(),
 	},
 };
 
diff --git a/packages/inference/src/package.ts b/packages/inference/src/package.ts
@@ -1,3 +1,3 @@
 // Generated file from package.json. Issues importing JSON directly when publishing on commonjs/ESM - see https://github.com/microsoft/TypeScript/issues/51783
-export const PACKAGE_VERSION = "4.13.14";
+export const PACKAGE_VERSION = "4.13.15";
 export const PACKAGE_NAME = "@huggingface/inference";
diff --git a/packages/inference/src/providers/hf-inference.ts b/packages/inference/src/providers/hf-inference.ts
@@ -78,6 +78,7 @@ import type { ImageToImageArgs } from "../tasks/cv/imageToImage.js";
 import type { AutomaticSpeechRecognitionArgs } from "../tasks/audio/automaticSpeechRecognition.js";
 import { omit } from "../utils/omit.js";
 import type { ImageSegmentationArgs } from "../tasks/cv/imageSegmentation.js";
+import type { ImageToTextArgs } from "../tasks/cv/imageToText.js";
 interface Base64ImageGeneration {
 	data: Array<{
 		b64_json: string;
@@ -378,6 +379,10 @@ export class HFInferenceImageToTextTask extends HFInferenceTask implements Image
 		}
 		return response;
 	}
+
+	async preparePayloadAsync(args: ImageToTextArgs): Promise<RequestArgs> {
+		return "data" in args ? args : { ...omit(args, "inputs"), data: args.inputs };
+	}
 }
 
 export class HFInferenceImageToImageTask extends HFInferenceTask implements ImageToImageTaskHelper {
diff --git a/packages/inference/src/providers/providerHelper.ts b/packages/inference/src/providers/providerHelper.ts
@@ -67,6 +67,7 @@ import type { ImageToVideoArgs } from "../tasks/cv/imageToVideo.js";
 import type { ImageTextToImageArgs } from "../tasks/cv/imageTextToImage.js";
 import type { ImageTextToVideoArgs } from "../tasks/cv/imageTextToVideo.js";
 import type { ImageSegmentationArgs } from "../tasks/cv/imageSegmentation.js";
+import type { ImageToTextArgs } from "../tasks/cv/imageToText.js";
 
 /**
  * Base class for task-specific provider helpers
@@ -205,6 +206,7 @@ export interface ObjectDetectionTaskHelper {
 export interface ImageToTextTaskHelper {
 	getResponse(response: unknown, url?: string, headers?: HeadersInit): Promise<ImageToTextOutput>;
 	preparePayload(params: BodyParams<ImageToTextInput & BaseArgs>): Record<string, unknown> | BodyInit;
+	preparePayloadAsync(args: ImageToTextArgs): Promise<RequestArgs>;
 }
 
 export interface ZeroShotImageClassificationTaskHelper {
diff --git a/packages/inference/src/providers/zai-org.ts b/packages/inference/src/providers/zai-org.ts
@@ -14,20 +14,41 @@
  *
  * Thanks!
  */
+import type { ImageToTextOutput } from "@huggingface/tasks";
 import {
 	InferenceClientInputError,
 	InferenceClientProviderApiError,
 	InferenceClientProviderOutputError,
 } from "../errors.js";
 import { isUrl } from "../lib/isUrl.js";
-import type { BodyParams, HeaderParams, OutputType } from "../types.js";
+import type { BodyParams, HeaderParams, OutputType, RequestArgs } from "../types.js";
+import { base64FromBytes } from "../utils/base64FromBytes.js";
 import { dataUrlFromBlob } from "../utils/dataUrlFromBlob.js";
 import { delay } from "../utils/delay.js";
 import { omit } from "../utils/omit.js";
-import { BaseConversationalTask, TaskProviderHelper, type TextToImageTaskHelper } from "./providerHelper.js";
+import type { ImageToTextArgs } from "../tasks/cv/imageToText.js";
+import {
+	BaseConversationalTask,
+	TaskProviderHelper,
+	type ImageToTextTaskHelper,
+	type TextToImageTaskHelper,
+} from "./providerHelper.js";
 
 const ZAI_API_BASE_URL = "https://api.z.ai";
 
+abstract class ZaiTask extends TaskProviderHelper {
+	constructor() {
+		super("zai-org", ZAI_API_BASE_URL);
+	}
+
+	override prepareHeaders(params: HeaderParams, binary: boolean): Record<string, string> {
+		const headers = super.prepareHeaders(params, binary);
+		headers["x-source-channel"] = "hugging_face";
+		headers["accept-language"] = "en-US,en";
+		return headers;
+	}
+}
+
 export class ZaiConversationalTask extends BaseConversationalTask {
 	constructor() {
 		super("zai-org", ZAI_API_BASE_URL);
@@ -63,28 +84,12 @@ interface ZaiAsyncResultResponse {
 const MAX_POLL_ATTEMPTS = 60;
 const POLL_INTERVAL_MS = 5000;
 
-export class ZaiTextToImageTask extends TaskProviderHelper implements TextToImageTaskHelper {
-	constructor() {
-		super("zai-org", ZAI_API_BASE_URL);
-	}
-
-	override prepareHeaders(params: HeaderParams, binary: boolean): Record<string, string> {
-		const headers: Record<string, string> = {
-			Authorization: `Bearer ${params.accessToken}`,
-			"x-source-channel": "hugging_face",
-			"accept-language": "en-US,en",
-		};
-		if (!binary) {
-			headers["Content-Type"] = "application/json";
-		}
-		return headers;
-	}
-
-	makeRoute(): string {
+export class ZaiTextToImageTask extends ZaiTask implements TextToImageTaskHelper {
+	override makeRoute(): string {
 		return "/api/paas/v4/async/images/generations";
 	}
 
-	preparePayload(params: BodyParams): Record<string, unknown> {
+	override preparePayload(params: BodyParams): Record<string, unknown> {
 		return {
 			...omit(params.args, ["inputs", "parameters"]),
 			...(params.args.parameters as Record<string, unknown>),
@@ -93,7 +98,7 @@ export class ZaiTextToImageTask extends TaskProviderHelper implements TextToImag
 		};
 	}
 
-	async getResponse(
+	override async getResponse(
 		response: ZaiTextToImageResponse,
 		url?: string,
 		headers?: Record<string, string>,
@@ -190,3 +195,56 @@ export class ZaiTextToImageTask extends TaskProviderHelper implements TextToImag
 		);
 	}
 }
+
+interface ZaiLayoutParsingResponse {
+	md_results?: string;
+}
+
+export class ZaiImageToTextTask extends ZaiTask implements ImageToTextTaskHelper {
+	override makeRoute(): string {
+		return "/api/paas/v4/layout_parsing";
+	}
+
+	async preparePayloadAsync(args: ImageToTextArgs): Promise<RequestArgs> {
+		const blob =
+			"data" in args && args.data instanceof Blob
+				? args.data
+				: "inputs" in args
+					? typeof args.inputs === "string" && isUrl(args.inputs)
+						? await fetch(args.inputs).then((r) => r.blob())
+						: args.inputs instanceof Blob
+							? args.inputs
+							: undefined
+					: undefined;
+
+		if (!blob || !(blob instanceof Blob)) {
+			throw new InferenceClientInputError("ZAI image-to-text requires a URL string or Blob as inputs");
+		}
+
+		const mimeType = blob.type || "image/png";
+		const b64 = base64FromBytes(new Uint8Array(await blob.arrayBuffer()));
+		const file = `data:${mimeType};base64,${b64}`;
+
+		return {
+			...("data" in args ? omit(args, "data") : omit(args, "inputs")),
+			inputs: file,
+		} as RequestArgs;
+	}
+
+	override preparePayload(params: BodyParams): Record<string, unknown> {
+		return {
+			model: params.model,
+			file: params.args.inputs,
+		};
+	}
+
+	override async getResponse(response: ZaiLayoutParsingResponse): Promise<ImageToTextOutput> {
+		const mdResults = response?.md_results;
+		if (typeof mdResults !== "string") {
+			throw new InferenceClientProviderOutputError(
+				`Received malformed response from ZAI layout_parsing API: expected { md_results: string }, got: ${JSON.stringify(response)}`,
+			);
+		}
+		return { generated_text: mdResults, generatedText: mdResults };
+	}
+}
diff --git a/packages/inference/src/tasks/cv/imageToText.ts b/packages/inference/src/tasks/cv/imageToText.ts
@@ -4,7 +4,6 @@ import { getProviderHelper } from "../../lib/getProviderHelper.js";
 import type { BaseArgs, Options } from "../../types.js";
 import { innerRequest } from "../../utils/request.js";
 import type { LegacyImageInput } from "./utils.js";
-import { preparePayload } from "./utils.js";
 
 export type ImageToTextArgs = BaseArgs & (ImageToTextInput | LegacyImageInput);
 /**
@@ -13,11 +12,11 @@ export type ImageToTextArgs = BaseArgs & (ImageToTextInput | LegacyImageInput);
 export async function imageToText(args: ImageToTextArgs, options?: Options): Promise<ImageToTextOutput> {
 	const provider = await resolveProvider(args.provider, args.model, args.endpointUrl);
 	const providerHelper = getProviderHelper(provider, "image-to-text");
-	const payload = preparePayload(args);
-	const { data: res } = await innerRequest<[ImageToTextOutput]>(payload, providerHelper, {
+	const payload = await providerHelper.preparePayloadAsync(args);
+	const { data: res } = await innerRequest<ImageToTextOutput>(payload, providerHelper, {
 		...options,
 		task: "image-to-text",
 	});
 
-	return providerHelper.getResponse(res[0]);
+	return providerHelper.getResponse(res);
 }
diff --git a/packages/tasks/package.json b/packages/tasks/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@huggingface/tasks",
-	"version": "0.19.89",
+	"version": "0.19.90",
 	"description": "List of ML tasks for huggingface.co/tasks",
 	"keywords": [
 		"hub",
diff --git a/packages/tasks/src/eval.ts b/packages/tasks/src/eval.ts
@@ -17,8 +17,8 @@ export const EVALUATION_FRAMEWORKS = {
 		description: "Multimodal toolbox for evaluating embeddings and retrieval systems.",
 		url: "https://github.com/embeddings-benchmark/mteb",
 	},
-	"olmo-bench": {
-		name: "olmo-bench",
+	"olmocr-bench": {
+		name: "olmocr-bench",
 		description: "olmOCR-Bench is a framework for evaluating document-level OCR of various tools.",
 		url: "https://github.com/allenai/olmocr/tree/main/olmocr/bench",
 	},
@@ -43,4 +43,10 @@ export const EVALUATION_FRAMEWORKS = {
 			"SWE-Bench Pro is a challenging benchmark evaluating LLMs/Agents on long-horizon software engineering tasks.",
 		url: "https://github.com/scaleapi/SWE-bench_Pro-os",
 	},
+	"nemo-evaluator": {
+		name: "nemo-evaluator",
+		description:
+			"NeMo Evaluator is an open-source platform for robust, reproducible, and scalable evaluation of Large Language Models across 100+ benchmarks.",
+		url: "https://github.com/NVIDIA-NeMo/Evaluator",
+	},
 } as const;

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@huggingface/gguf",`
`3`		`- "version": "0.3.5",`
	`3`	`+ "version": "0.3.6",`
`4`	`4`	`"description": "a GGUF parser that works on remotely hosted files",`
`5`	`5`	`"keywords": [`
`6`	`6`	`"gguf",`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@huggingface/inference",`
`3`		`- "version": "4.13.14",`
	`3`	`+ "version": "4.13.15",`
`4`	`4`	`"description": "Typescript client for the Hugging Face Inference Providers and Inference Endpoints",`
`5`	`5`	`"keywords": [`
`6`	`6`	`"ai",`
Original file line number	Diff line number	Diff line change
`@@ -78,6 +78,7 @@ import type { ImageToImageArgs } from "../tasks/cv/imageToImage.js";`
`78`	`78`	`import type { AutomaticSpeechRecognitionArgs } from "../tasks/audio/automaticSpeechRecognition.js";`
`79`	`79`	`import { omit } from "../utils/omit.js";`
`80`	`80`	`import type { ImageSegmentationArgs } from "../tasks/cv/imageSegmentation.js";`
	`81`	`+import type { ImageToTextArgs } from "../tasks/cv/imageToText.js";`
`81`	`82`	`interface Base64ImageGeneration {`
`82`	`83`	`data: Array<{`
`83`	`84`	`b64_json: string;`
`@@ -378,6 +379,10 @@ export class HFInferenceImageToTextTask extends HFInferenceTask implements Image`
`378`	`379`	`}`
`379`	`380`	`return response;`
`380`	`381`	`}`
	`382`	`+`
	`383`	`+ async preparePayloadAsync(args: ImageToTextArgs): Promise<RequestArgs> {`
	`384`	`+ return "data" in args ? args : { ...omit(args, "inputs"), data: args.inputs };`
	`385`	`+ }`
`381`	`386`	`}`
`382`	`387`
`383`	`388`	`export class HFInferenceImageToImageTask extends HFInferenceTask implements ImageToImageTaskHelper {`