| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-10-27 | 690 Bytes | |
| v0.42.1 -- fix component resolution in _from_pretrained_ to prevent _trust_remote_code_ bypass source code.tar.gz | 2026-10-27 | 12.0 MB | |
| v0.42.1 -- fix component resolution in _from_pretrained_ to prevent _trust_remote_code_ bypass source code.zip | 2026-10-27 | 15.1 MB | |
| Totals: 3 Items | 27.1 MB | 0 | |
This is a security release. See GHSA-4prv-5hj7-c2xr for details.
This patch release fixes how a component's declared library name is resolved when loading with from_pretrained.
Pipelines and models declare each component as a ["<library>", "<class>"] pair in model_index.json / config.json. This release changes how that library name is resolved across the DiffusionPipeline, AutoModel, and ModularPipeline loading paths, and adds a clearer error when the declared class is not found in the resolved module.
All users on 0.42.0 are encouraged to upgrade:
pip install diffusers==0.42.1
