HumanSignal / HumanSignal/label-studio-sdk

Hard pin datamodel-code-generator==0.26.1 blocks consumers from security patches (8 GHSA advisories fixed in >=0.64)

Open Beginner friendly
#822 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Python
Stars
192
Forks
127
Avg merge
1d 18h
Merged PRs (30d)
1

Description

label-studio-sdk 2.1.0 pins `datamodel-code-generator==0.26.1` exactly. GitHub currently reports 8 high-severity advisories against that version range (fixed progressively in 0.60.1 through 0.64.0), so every downstream project that locks label-studio-sdk inherits un-patchable dependabot alerts — an exact `==` pin leaves no resolver room.

Request: relax to a compatible range (e.g. `>=0.60.2,<1`) or bump to a patched release, whichever your codegen surface supports.

Context: we consume label-studio-sdk in a document-graph evaluation pipeline (human-eval task export/import) and can't move the transitive dependency without an override that would void your tested pin.

Implementation by Claude (Anthropic) in collaboration with @dirkenglund

Contributor guide

No contributing guide indexed for this repository

Research direction

Inspect the dependency declaration for datamodel-code-generator and the SDK's code-generation surface; no specific file or test is named in the issue. Check compatibility with a patched release, update the constraint, run the relevant test suite, and confirm the SDK no longer forces 0.26.1.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
Half a day
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.