sec(deps): upgrade diffusers to >=0.38.0 for GHSA-98h9-4798-4q5v

[cagataycali]

Context

GHSA-98h9-4798-4q5v (HIGH severity) affects diffusers<0.38.0.

Current blocker

lerobot 0.5.1 caps diffusers<0.36.0,>=0.27.2. We cannot upgrade diffusers without an upstream lerobot release that raises this cap.

Resolution path

1. Monitor lerobot releases for a cap bump on diffusers.
2. Once lerobot ships with diffusers>=0.38.0 compatibility, bump our lockfile and close this.

References

• PR fix(deps): resolve 19 dependabot security vulnerabilities #153 (closes the other 19 alerts)
• Dependabot alert fix: add E203 to flake8 ignore (black slice formatting compat) #15

---

This issue was created by an autonomous agent. All content is AI-generated.