From 3176da549951183a6eb535dac2f16f259ffbf62b Mon Sep 17 00:00:00 2001 From: sayakpaul Date: Wed, 14 Oct 2026 15:44:37 +0530 Subject: [PATCH 1/6] move to python 3.11. --- docker/diffusers-pytorch-cpu/Dockerfile | 2 +- docker/diffusers-pytorch-cuda/Dockerfile | 2 +- docker/diffusers-pytorch-minimum-cuda/Dockerfile | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docker/diffusers-pytorch-cpu/Dockerfile b/docker/diffusers-pytorch-cpu/Dockerfile index 0d2ca75940ec..e53b4ccd536b 100644 --- a/docker/diffusers-pytorch-cpu/Dockerfile +++ b/docker/diffusers-pytorch-cpu/Dockerfile @@ -1,4 +1,4 @@ -FROM python:3.10-slim +FROM python:3.11-slim ENV PYTHONDONTWRITEBYTECODE=1 LABEL maintainer="Hugging Face" LABEL repository="diffusers" diff --git a/docker/diffusers-pytorch-cuda/Dockerfile b/docker/diffusers-pytorch-cuda/Dockerfile index 8052022eb236..adbbb473fd49 100644 --- a/docker/diffusers-pytorch-cuda/Dockerfile +++ b/docker/diffusers-pytorch-cuda/Dockerfile @@ -2,7 +2,7 @@ FROM nvidia/cuda:12.9.1-runtime-ubuntu24.04 LABEL maintainer="Hugging Face" LABEL repository="diffusers" -ARG PYTHON_VERSION=3.10 +ARG PYTHON_VERSION=3.11 ENV DEBIAN_FRONTEND=noninteractive RUN apt-get -y update \ diff --git a/docker/diffusers-pytorch-minimum-cuda/Dockerfile b/docker/diffusers-pytorch-minimum-cuda/Dockerfile index 20e10509da33..0cfaae5837da 100644 --- a/docker/diffusers-pytorch-minimum-cuda/Dockerfile +++ b/docker/diffusers-pytorch-minimum-cuda/Dockerfile @@ -2,7 +2,7 @@ FROM nvidia/cuda:12.1.0-runtime-ubuntu20.04 LABEL maintainer="Hugging Face" LABEL repository="diffusers" -ARG PYTHON_VERSION=3.10 +ARG PYTHON_VERSION=3.11 ENV DEBIAN_FRONTEND=noninteractive ENV MINIMUM_SUPPORTED_TORCH_VERSION="2.6.0" ENV MINIMUM_SUPPORTED_TORCHVISION_VERSION="0.21.0" From f1d88807338c7b95ba81c68111d4666ba49239c0 Mon Sep 17 00:00:00 2001 From: sayakpaul Date: Wed, 14 Oct 2026 16:47:24 +0530 Subject: [PATCH 2/6] update setup.py along with others. --- .github/workflows/bot_style.yml | 2 +- .github/workflows/pr_dependency_test.yml | 2 +- .github/workflows/pr_modular_tests.yml | 4 ++-- .github/workflows/pr_tests.yml | 4 ++-- .github/workflows/pr_tests_gpu.yml | 4 ++-- .github/workflows/pr_torch_dependency_test.yml | 2 +- .github/workflows/pypi_publish.yaml | 2 +- docker/diffusers-doc-builder/Dockerfile | 2 +- docker/diffusers-pytorch-xformers-cuda/Dockerfile | 2 +- setup.py | 8 ++++---- src/diffusers/dependency_versions_table.py | 2 +- 11 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/bot_style.yml b/.github/workflows/bot_style.yml index 10e1ba4bf1d7..91e095e2ddf9 100644 --- a/.github/workflows/bot_style.yml +++ b/.github/workflows/bot_style.yml @@ -134,7 +134,7 @@ jobs: - name: Set up Python uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: - python-version: "3.10" + python-version: "3.11" - name: Install dependencies run: | diff --git a/.github/workflows/pr_dependency_test.yml b/.github/workflows/pr_dependency_test.yml index e59152532a2e..cd84b61b484c 100644 --- a/.github/workflows/pr_dependency_test.yml +++ b/.github/workflows/pr_dependency_test.yml @@ -28,7 +28,7 @@ jobs: - name: Set up Python uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: - python-version: "3.10" + python-version: "3.11" - name: Install dependencies run: | pip install -e . diff --git a/.github/workflows/pr_modular_tests.yml b/.github/workflows/pr_modular_tests.yml index e6f156235a53..31d9c60b2b92 100644 --- a/.github/workflows/pr_modular_tests.yml +++ b/.github/workflows/pr_modular_tests.yml @@ -50,7 +50,7 @@ jobs: - name: Set up Python uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: - python-version: "3.10" + python-version: "3.11" - name: Install dependencies run: | pip install --upgrade pip @@ -72,7 +72,7 @@ jobs: - name: Set up Python uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: - python-version: "3.10" + python-version: "3.11" - name: Install dependencies run: | pip install --upgrade pip diff --git a/.github/workflows/pr_tests.yml b/.github/workflows/pr_tests.yml index b5179e82a028..fa915ee17917 100644 --- a/.github/workflows/pr_tests.yml +++ b/.github/workflows/pr_tests.yml @@ -45,7 +45,7 @@ jobs: - name: Set up Python uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: - python-version: "3.10" + python-version: "3.11" - name: Install dependencies run: | pip install --upgrade pip @@ -67,7 +67,7 @@ jobs: - name: Set up Python uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: - python-version: "3.10" + python-version: "3.11" - name: Install dependencies run: | pip install --upgrade pip diff --git a/.github/workflows/pr_tests_gpu.yml b/.github/workflows/pr_tests_gpu.yml index cc51d0dd2c75..232ff7f3a5ca 100644 --- a/.github/workflows/pr_tests_gpu.yml +++ b/.github/workflows/pr_tests_gpu.yml @@ -47,7 +47,7 @@ jobs: - name: Set up Python uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: - python-version: "3.10" + python-version: "3.11" - name: Install dependencies run: | pip install --upgrade pip @@ -69,7 +69,7 @@ jobs: - name: Set up Python uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: - python-version: "3.10" + python-version: "3.11" - name: Install dependencies run: | pip install --upgrade pip diff --git a/.github/workflows/pr_torch_dependency_test.yml b/.github/workflows/pr_torch_dependency_test.yml index 8fe6401be0d7..1a45cb00f920 100644 --- a/.github/workflows/pr_torch_dependency_test.yml +++ b/.github/workflows/pr_torch_dependency_test.yml @@ -28,7 +28,7 @@ jobs: - name: Set up Python uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: - python-version: "3.10" + python-version: "3.11" - name: Install dependencies run: | pip install -e . diff --git a/.github/workflows/pypi_publish.yaml b/.github/workflows/pypi_publish.yaml index d31fa16b09e9..7497c08c8794 100644 --- a/.github/workflows/pypi_publish.yaml +++ b/.github/workflows/pypi_publish.yaml @@ -23,7 +23,7 @@ jobs: - name: Set up Python uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 with: - python-version: "3.10" + python-version: "3.11" - name: Install build dependencies run: | diff --git a/docker/diffusers-doc-builder/Dockerfile b/docker/diffusers-doc-builder/Dockerfile index e75e11783767..e927b21c89d4 100644 --- a/docker/diffusers-doc-builder/Dockerfile +++ b/docker/diffusers-doc-builder/Dockerfile @@ -1,4 +1,4 @@ -FROM python:3.10-slim +FROM python:3.11-slim ENV PYTHONDONTWRITEBYTECODE=1 LABEL maintainer="Hugging Face" LABEL repository="diffusers" diff --git a/docker/diffusers-pytorch-xformers-cuda/Dockerfile b/docker/diffusers-pytorch-xformers-cuda/Dockerfile index 9f8d93fb8d32..dc26eb2bf8cf 100644 --- a/docker/diffusers-pytorch-xformers-cuda/Dockerfile +++ b/docker/diffusers-pytorch-xformers-cuda/Dockerfile @@ -2,7 +2,7 @@ FROM nvidia/cuda:12.9.1-runtime-ubuntu24.04 LABEL maintainer="Hugging Face" LABEL repository="diffusers" -ARG PYTHON_VERSION=3.10 +ARG PYTHON_VERSION=3.11 ENV DEBIAN_FRONTEND=noninteractive RUN apt-get -y update \ diff --git a/setup.py b/setup.py index 14eff971970c..e62fe2989c1d 100644 --- a/setup.py +++ b/setup.py @@ -119,7 +119,7 @@ "pytest", "pytest-timeout", "pytest-xdist", - "python>=3.10.0", + "python>=3.11.0", "ruff==0.9.10", "safetensors>=0.8.0", "sentencepiece>=0.1.91,!=0.1.92", @@ -267,7 +267,7 @@ def run(self): deps["Pillow"], ] -version_range_max = max(sys.version_info[1], 10) + 1 +version_range_max = max(sys.version_info[1], 11) + 1 setup( name="diffusers", @@ -284,7 +284,7 @@ def run(self): packages=find_packages("src"), package_data={"diffusers": ["py.typed"]}, include_package_data=True, - python_requires=">=3.10.0", + python_requires=">=3.11.0", install_requires=list(install_requires), extras_require=extras, entry_points={"console_scripts": ["diffusers-cli=diffusers.commands.diffusers_cli:main"]}, @@ -298,6 +298,6 @@ def run(self): "Topic :: Scientific/Engineering :: Artificial Intelligence", "Programming Language :: Python :: 3", ] - + [f"Programming Language :: Python :: 3.{i}" for i in range(8, version_range_max)], + + [f"Programming Language :: Python :: 3.{i}" for i in range(11, version_range_max)], cmdclass={"deps_table_update": DepsTableUpdateCommand}, ) diff --git a/src/diffusers/dependency_versions_table.py b/src/diffusers/dependency_versions_table.py index 156d2a1066ca..da572914dc57 100644 --- a/src/diffusers/dependency_versions_table.py +++ b/src/diffusers/dependency_versions_table.py @@ -26,7 +26,7 @@ "pytest": "pytest", "pytest-timeout": "pytest-timeout", "pytest-xdist": "pytest-xdist", - "python": "python>=3.10.0", + "python": "python>=3.11.0", "ruff": "ruff==0.9.10", "safetensors": "safetensors>=0.8.0", "sentencepiece": "sentencepiece>=0.1.91,!=0.1.92", From 7885a2b8d514ce81f8b637cdbf0971d5c88da930 Mon Sep 17 00:00:00 2001 From: "hf-security-analysis[bot]" <265538906+hf-security-analysis[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 13:18:41 +0200 Subject: [PATCH 3/6] fix(ci): pin GitHub Actions to commit SHAs (#15030) (#15033) fix(ci): pin actions in workflows flagged on #15030 Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com> --- .github/workflows/pypi_publish.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pypi_publish.yaml b/.github/workflows/pypi_publish.yaml index 7497c08c8794..0c9b50f4a63a 100644 --- a/.github/workflows/pypi_publish.yaml +++ b/.github/workflows/pypi_publish.yaml @@ -21,7 +21,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.11" @@ -51,7 +51,7 @@ jobs: python -c "from diffusers import *" - name: Upload build artifacts - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: python-dist path: dist/ @@ -74,6 +74,6 @@ jobs: path: dist/ - name: Publish package distributions to TestPyPI - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1 + uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 with: verbose: true From 880670e52bfa55937ce6a9af02cde8ef23466ed3 Mon Sep 17 00:00:00 2001 From: sayakpaul Date: Wed, 14 Oct 2026 17:08:39 +0530 Subject: [PATCH 4/6] up --- .github/workflows/build_documentation.yml | 1 + .github/workflows/build_pr_documentation.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/build_documentation.yml b/.github/workflows/build_documentation.yml index 0b2c2b85f5a4..b5126e13d990 100644 --- a/.github/workflows/build_documentation.yml +++ b/.github/workflows/build_documentation.yml @@ -22,6 +22,7 @@ jobs: commit_sha: ${{ github.sha }} install_libgl1: true package: diffusers + python_version: "3.11" notebook_folder: diffusers_doc languages: en ko zh ja pt pre_command: uv pip uninstall transformers huggingface_hub && UV_PRERELEASE=allow uv pip install -U transformers@git+https://github.com/huggingface/transformers.git diff --git a/.github/workflows/build_pr_documentation.yml b/.github/workflows/build_pr_documentation.yml index 0a3d298f68e6..c378184fee99 100644 --- a/.github/workflows/build_pr_documentation.yml +++ b/.github/workflows/build_pr_documentation.yml @@ -50,5 +50,6 @@ jobs: pr_number: ${{ github.event.number }} install_libgl1: true package: diffusers + python_version: "3.11" languages: en ko zh ja pt pre_command: uv pip uninstall transformers huggingface_hub && UV_PRERELEASE=allow uv pip install -U transformers@git+https://github.com/huggingface/transformers.git From 06d6f3f3a68595b8d5dc5b55836bf7df82e703c5 Mon Sep 17 00:00:00 2001 From: "hf-security-analysis[bot]" <265538906+hf-security-analysis[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 14:13:52 +0200 Subject: [PATCH 5/6] fix(ci): pin GitHub Actions to commit SHAs (#15030) (#15036) fix(ci): pin actions in workflows flagged on #15030 Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com> --- .github/workflows/build_pr_documentation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build_pr_documentation.yml b/.github/workflows/build_pr_documentation.yml index c378184fee99..df1e4139f1b6 100644 --- a/.github/workflows/build_pr_documentation.yml +++ b/.github/workflows/build_pr_documentation.yml @@ -25,7 +25,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.10' From 85dc0d27f4b57f84b4e65850bc66142a58b38604 Mon Sep 17 00:00:00 2001 From: sayakpaul Date: Wed, 14 Oct 2026 18:18:17 +0530 Subject: [PATCH 6/6] up --- docker/diffusers-cli-cuda/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/diffusers-cli-cuda/Dockerfile b/docker/diffusers-cli-cuda/Dockerfile index 86c73142dccc..5b83d098e08f 100644 --- a/docker/diffusers-cli-cuda/Dockerfile +++ b/docker/diffusers-cli-cuda/Dockerfile @@ -46,7 +46,7 @@ RUN python -c "import torch, torchvision, torchaudio" # other build) can install over it with `--dependencies` or point `--image` at a custom image. RUN uv pip install --system --break-system-packages --no-cache-dir \ "huggingface_hub[hf_xet]>=1.32" \ - diffusers \ + "diffusers>=0.41.0" \ accelerate \ transformers \ "tokenizers>=0.14.0" \