Hugging Face releases Diffusers v0.42.1 with security fix
Hugging Face has released Diffusers v0.42.1, which includes a fix for component resolution in `from_pretrained`. This is a security release to prevent `trust_remote_code` bypass.
Hugging Face has released Diffusers v0.42.1. This patch release fixes how a component's declared library name is resolved when loading with `from_pretrained`, serving as a security release to prevent `trust_remote_code` bypass.
Pipelines and models declare each component as a "<library>" and "<class>" pair in `model_index.json` or `config.json`. This release changes how that library name is resolved across the `DiffusionPipeline`, `AutoModel`, and `ModularPipeline` loading paths, and adds a clearer error when the declared class is not found in the resolved module.
All users on 0.42.0 are encouraged to upgrade via `pip install diffusers==0.42.1`. For more details, see GHSA-4prv-5hj7-c2xr.
This item is a summary. The full, checkable version is at the original source:
Read the original at Diffusers ↗