Skip to content

Adding VoyageAI integration - #345

Open
fzowl wants to merge 9 commits into
microsoft:mainfrom
fzowl:voyageai_integration
Open

Adding VoyageAI integration#345
fzowl wants to merge 9 commits into
microsoft:mainfrom
fzowl:voyageai_integration

Conversation

@fzowl

@fzowl fzowl commented Nov 17, 2025

Copy link
Copy Markdown

Motivation and Context

VoyageAI provides state-of-the-art embeddings models

Description

Adding VoyageAI integration
MicrosoftDocs/semantic-kernel-docs#327

Contribution Checklist

@karianna

Copy link
Copy Markdown
Member

fzowl - test / build failures if you can PTAL?

@karianna

Copy link
Copy Markdown
Member

fzowl - seeing errors such as:

Error: Medium: Exception thrown in class com.microsoft.semantickernel.services.reranking.RerankResult at new com.microsoft.semantickernel.services.reranking.RerankResult(int, String, double) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks. [com.microsoft.semantickernel.services.reranking.RerankResult, com.microsoft.semantickernel.services.reranking.RerankResult] At RerankResult.java:[line 21]At RerankResult.java:[line 21] CT_CONSTRUCTOR_THROW

fzowl and others added 6 commits January 24, 2026 15:55
…CONSTRUCTOR_THROW

SpotBugs (bug-check profile) flagged CT_CONSTRUCTOR_THROW on classes whose
constructors throw validation exceptions while being non-final, which the
Java CI build treats as an error and fails merge-gatekeeper. Marking these
value/service classes final removes the finalizer-attack vector SpotBugs
warns about while preserving the existing constructor validation.
After merging upstream/main, the repository version advanced to
1.5.1-SNAPSHOT while the VoyageAI module still pinned the old
1.4.4-RC3-SNAPSHOT parent, which made the semantickernel-bom import
unresolvable and broke the reactor build.
The VoyageAIModels request/response DTOs expose their mutable list and
array fields directly through getters, setters and one constructor, which
SpotBugs (bug-check profile) flags as EI_EXPOSE_REP/EI_EXPOSE_REP2. These
are plain Jackson-mapped data holders, so annotate the individual accessors
with @SuppressFBWarnings, matching the pattern already used by the other
aiservices DTOs (e.g. HuggingFace, OpenAI, Google).
@fzowl

fzowl commented Aug 16, 2026

Copy link
Copy Markdown
Author

Thanks Martijn Verburg (@karianna) — pushed a fix. The bug-check profile was failing on SpotBugs in two stages:

  • CT_CONSTRUCTOR_THROW: RerankResult, the four VoyageAI service classes, and VoyageAIClient throw validation exceptions from their constructors. Marked those classes final so they can't be subclassed for a finalizer attack — the validation itself is unchanged. This was the failure that stopped the build at semantickernel-api.
  • EI_EXPOSE_REP / EI_EXPOSE_REP2: the VoyageAIModels Jackson DTO accessors expose mutable list/array fields, so I annotated the getters/setters/constructor with @SuppressFBWarnings, matching the existing HuggingFace/OpenAI DTOs. (This only surfaced once the first fix let the build reach the VoyageAI module.)

I also merged current main and bumped the module's parent from 1.4.4-RC3-SNAPSHOT to 1.5.1-SNAPSHOT — the old pin made the semantickernel-bom import unresolvable. A full ./mvnw -Pbug-check -Pcompile-jdk17 clean install reactor build is green locally now. PTAL.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants