发布

  • chore(release): v0.4.1 — security fix (diffusers, urllib3)

    frostbyte_neo 发布于 2026-05-17 20:14:50 +00:00 | 587 次提交 在此版本后已推送到 main

    • Bump diffusers minimum to 0.38.0 (closes GHSA-98h9-4798-4q5v).
    • Refresh uv.lock to pull urllib3 2.7.0 (closes GHSA-qccp-gfcp-xxvc and
      GHSA-mf9v-mfxr-j63j via transitive update from requests / huggingface-hub).
    • Allow pre-releases globally ([tool.uv] prerelease = "allow") because
      diffusers 0.38.0 declares a dependency on safetensors>=0.8.0rc0. Drop
      once safetensors 0.8.0 stable is published or diffusers re-pins.

    uv-secure --ignore-unfixed now reports zero vulnerabilities.

    Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

    下载附件