-
chore(release): v0.4.1 — security fix (diffusers, urllib3)
发布于
2026-05-17 20:14:50 +00:00 | 587 次提交 在此版本后已推送到 main- Bump diffusers minimum to 0.38.0 (closes GHSA-98h9-4798-4q5v).
- Refresh uv.lock to pull urllib3 2.7.0 (closes GHSA-qccp-gfcp-xxvc and
GHSA-mf9v-mfxr-j63j via transitive update from requests / huggingface-hub). - Allow pre-releases globally (
[tool.uv] prerelease = "allow") because
diffusers 0.38.0 declares a dependency on safetensors>=0.8.0rc0. Drop
once safetensors 0.8.0 stable is published or diffusers re-pins.
uv-secure --ignore-unfixed now reports zero vulnerabilities.
Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com
下载附件