Affected components
- Semantic embedding pipeline in
crates/arrowhead-core and crates/arrowhead-daemon
- Workspace dependency
fastembed = =5.2.0 in Cargo.toml
- Transitives reported by
cargo audit: paste 1.0.15 and number_prefix 0.4.0
Risk
cargo audit reports unmaintained transitive crates through the pinned fastembed stack. The pin exists because newer fastembed releases previously pulled image/zune-jpeg combinations that failed stable CI.
Impact
Semantic search ships by default, so dependency health in the embedding stack matters. A broad fastembed upgrade could affect model download behavior, runtime memory, vector dimensions, sqlite-vec compatibility, and CI stability.
Proposed fix
Re-evaluate the current latest fastembed release under Rust 1.88, test CI build stability, and either upgrade the pin or document/allowlist the warnings with a clear expiration plan. Consider whether feature selection can avoid unneeded image-related dependencies.
Suggested tests
cargo fmt --allcargo check --all-targetscargo clippy --all-targets -- -D warningscargo test --all-targets -- --nocapture- Embedding bootstrap/backfill tests with downloads disabled or controlled
- Smoke semantic/hybrid search against
tests/fixtures/test-vault using a temp index
cargo audit documents only accepted residual warnings
Why not implemented automatically
This touches the always-on semantic pipeline and a deliberately pinned dependency. It needs a dedicated compatibility pass rather than an opportunistic maintenance update.
Affected components
crates/arrowhead-coreandcrates/arrowhead-daemonfastembed = =5.2.0inCargo.tomlcargo audit:paste 1.0.15andnumber_prefix 0.4.0Risk
cargo auditreports unmaintained transitive crates through the pinnedfastembedstack. The pin exists because newer fastembed releases previously pulled image/zune-jpeg combinations that failed stable CI.Impact
Semantic search ships by default, so dependency health in the embedding stack matters. A broad fastembed upgrade could affect model download behavior, runtime memory, vector dimensions, sqlite-vec compatibility, and CI stability.
Proposed fix
Re-evaluate the current latest
fastembedrelease under Rust 1.88, test CI build stability, and either upgrade the pin or document/allowlist the warnings with a clear expiration plan. Consider whether feature selection can avoid unneeded image-related dependencies.Suggested tests
cargo fmt --allcargo check --all-targetscargo clippy --all-targets -- -D warningscargo test --all-targets -- --nocapturetests/fixtures/test-vaultusing a temp indexcargo auditdocuments only accepted residual warningsWhy not implemented automatically
This touches the always-on semantic pipeline and a deliberately pinned dependency. It needs a dedicated compatibility pass rather than an opportunistic maintenance update.