What

Bump the upper cap of the diffusers-dep extra from <0.36.0 to <0.39.0.

-diffusers-dep = ["diffusers>=0.27.2,<0.36.0"]
+diffusers-dep = ["diffusers>=0.27.2,<0.39.0"]

Why

diffusers<0.38.0 is affected by GHSA-98h9-4798-4q5v (HIGH, CVSS 8.8) — a trust_remote_code bypass via custom_pipeline and local custom components. The fix landed in diffusers==0.38.0.

The current cap (<0.36.0) means any project that depends on lerobot[diffusion] or lerobot[groot] is forced onto a vulnerable diffusers, with no path to the patched version. Downstream Dependabot alerts (e.g. https://github.com/strands-labs/robots/security/dependabot, alert #15) cannot be closed until this cap moves.

Compatibility analysis

lerobot only consumes a small, stable surface of the diffusers API. Auditing usages on main:

src/lerobot/optim/schedulers.py
  from diffusers.optimization import get_scheduler

src/lerobot/policies/diffusion/modeling_diffusion.py
  from diffusers.schedulers.scheduling_ddim import DDIMScheduler
  from diffusers.schedulers.scheduling_ddpm import DDPMScheduler

src/lerobot/policies/groot/action_head/cross_attention_dit.py
  from diffusers import ConfigMixin, ModelMixin
  from diffusers.configuration_utils import register_to_config
  from diffusers.models.attention import Attention, FeedForward
  from diffusers.models.embeddings import (...)

I reviewed the release notes for 0.36.0, 0.37.0, and 0.38.0 — none of these symbols were removed, renamed, signature-changed, or moved. The breaking-change items in those releases concern Stable Cascade, Qwen Image RoPE caching, Kandinsky 5, Chroma, Flax schedulers, torchao quantization config, etc. — none of them touch the schedulers / mixins / embeddings / optimization helpers that lerobot uses.

Risk

Low. The cap is widened by 3 minor versions of an internal-mixin / scheduler surface that lerobot uses in a stable way. Major-version safety is preserved (<0.39.0).

Validation

• One-line change in pyproject.toml.
• No source-code changes required.
• Diffusers 0.38.0 published 2026-05-01 on PyPI.

Downstream

Closes the path for downstream consumers like strands-labs/robots (strands-labs/robots#153) to fully resolve their Dependabot alerts.