starter extra has no lower bound on `sentence-transformers`, so v1.0.3 installs 0.2.3 and embeddings raise TypeError

System Info

Reviewing ogx for JOSS, openjournals/joss-reviews#11234. This is a dependency resolution defect rather than a runtime one, so there is no GPU or CUDA detail worth giving.

ogx at 5393c94b2, the v1.0.3 tag Python 3.12.3 Clean Linux container, x86_64, no GPU uv as the installer Observed 2026-09-17 and checked again on 2026-09-18

Information

• The official example scripts
• My own modified scripts

Describe the bug

An LLM based assistant helped run the tests and edit the wording of this report, and the finding is mine.

At the tag, pyproject.toml declares sentence-transformers in the starter extra with no lower bound. A plain install picks a release from 2019.

git checkout v1.0.3
uv pip install ".[starter]"

Two things have to line up for that. pyproject.toml also pins transformers>=4.57.2,<5.0.0 under [tool.uv] constraint-dependencies, and transformers 4.57.6 declares tokenizers<=0.23.0,>=0.22.0 and huggingface-hub<1.0,>=0.34.0. With no floor on sentence-transformers the resolver maximises tokenizers and huggingface-hub straight past both of those bounds, then backtracks past every sentence transformers release that depends on transformers until it reaches 0.2.3.

I checked both counterfactuals. Drop the transformers constraint and leave the floor missing, and the resolver takes transformers 5.17.0, whose bounds accommodate tokenizers 0.23.2 and huggingface-hub 1.32.0, so the walk back never happens. Keep the constraint and add a floor on sentence-transformers, and it resolves cleanly to 5.7.0 against transformers 4.57.6 and tokenizers 0.22.2. Either change removes the defect. The floor is the one that leaves the cap doing its job.

That pairing also explains why transformers is absent from the install. 0.2.3 is from 2019 and its metadata asks for pytorch-transformers==1.1.0, the pre rename package, so once the resolver settles there nothing in the graph requires transformers at all.

The practical effect is that the first embedding call fails. 0.2.3 predates Hugging Face Hub integration and its SentenceTransformer.__init__ has no trust_remote_code parameter, so the call in src/ogx/providers/utils/inference/embedding_mixin.py raises. The resolved versions and the traceback are both in the error logs field below.

main is already correct and uv.lock pins 5.6.0 against transformers 4.57.6, so a uv sync on main is fine. This is specific to the v1.0.3 tree, which is the release the JOSS paper points readers at.

Error logs

The versions a plain uv pip install ".[starter]" resolved to at 5393c94b2.

sentence-transformers 0.2.3
transformers          not installed
tokenizers            0.23.2
huggingface-hub       1.32.0

The first embedding call then raises.

TypeError: SentenceTransformer.__init__() got an unexpected keyword argument 'trust_remote_code'

Expected behavior

A plain uv pip install ".[starter]" at v1.0.3 should install a sentence-transformers the embedding path can actually call, and the first embedding call should succeed rather than raise TypeError.

Suggested fix. Add a lower bound on sentence-transformers to the 1.0.x release branch. v1.0.3 sits on release-1.0.x, which diverged from main before the bound landed there, so this needs a small manual edit on the branch rather than a cherry pick.