HumanSignal / HumanSignal/label-studio-sdk
Hard pin datamodel-code-generator==0.26.1 blocks consumers from security patches (8 GHSA advisories fixed in >=0.64)
- Dominant language
- Python
- Stars
- 192
- Forks
- 127
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 1
Description
label-studio-sdk 2.1.0 pins `datamodel-code-generator==0.26.1` exactly. GitHub currently reports 8 high-severity advisories against that version range (fixed progressively in 0.60.1 through 0.64.0), so every downstream project that locks label-studio-sdk inherits un-patchable dependabot alerts — an exact `==` pin leaves no resolver room.
Request: relax to a compatible range (e.g. `>=0.60.2,<1`) or bump to a patched release, whichever your codegen surface supports.
Context: we consume label-studio-sdk in a document-graph evaluation pipeline (human-eval task export/import) and can't move the transitive dependency without an override that would void your tested pin.
Implementation by Claude (Anthropic) in collaboration with @dirkenglund
Contributor guide
No contributing guide indexed for this repository
Research direction
Inspect the dependency declaration for datamodel-code-generator and the SDK's code-generation surface; no specific file or test is named in the issue. Check compatibility with a patched release, update the constraint, run the relevant test suite, and confirm the SDK no longer forces 0.26.1.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- Half a day
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100