Hugging Face has released Diffusers 0.42.1 as a security update. It changes how from_pretrained resolves the library name declared for a component. The company encourages all users of version 0.42.0 to upgrade.
When a pipeline or model lists its components in model_index.json or config.json, each component is declared as a pair: a library name and a class name. The patch changes how the library name in that pair is resolved during loading.
According to the release notes, the change applies across three loading paths: DiffusionPipeline, AutoModel and ModularPipeline. Hugging Face identifies each of those paths as part of the component resolution fix in this release.
Read nextAi2 releases OlmoEarth v1.3 with global satellite embeddingsThe update also adds a clearer error when the declared class cannot be found in the resolved module. Hugging Face calls 0.42.1 a security release and directs readers to advisory GHSA-4prv-5hj7-c2xr for details.
The company's upgrade recommendation is directed at everyone using Diffusers 0.42.0. Version 0.42.1 is available to install with the command pip install diffusers==0.42.1.
