[aoirint]

Warning

This pull request was created with assistance from LLMs.

Summary

Update the bundled application to kohya-ss/sd-scripts v0.12.0, align upstream runtime requirements, and refresh the locked Python dependencies. Update Python to 3.12.15, uv to 0.13.1, Ubuntu packages, and Docker build/setup Actions using immutable pins.

Python 3.12 enables the Pillow 13 and filelock security fixes. Preserve the existing PyTorch/xformers and CUDA base combination for ONNX Runtime compatibility. Install the upstream package with the locked build environment.

Security

Retain the seven-day cooldown except for maintainer-authorized fixes supported by upstream advisories:

• certifi 2026.10.19: GHSA-6q48-6c7w-9gw2.
• filelock 4.2.1: GHSA-2g95-wg33-c5x2 and related upstream advisories.
• setuptools 84.1.0: GHSA-xmj3-9gf7-h52w.
• Ubuntu CA bundle 20260816ubuntu0.24.04.1: USN-8944-1.

Package-specific cutoffs restrict the Python exceptions; review them after October 27, 2026 UTC. The resolved dependency audit reports no remaining OSV advisories. Docker login-action remains at v4.6.0 because v4.7.0 has not completed the cooldown.

Testing

• Passed: uv lock --check, Docker BuildKit checks, hadolint, actionlint, pinact run --check --min-age 7, Markdown lint, and git diff --check.
• Passed: final Docker image build; upstream release gate (159 passed, 7 skipped); SDXL training and WD14 tagging CLI startup; uv pip check against /opt/python-venv.
• Passed on RTX 5070 Ti (driver 617.42): PyTorch forward/backward, xformers attention forward/backward, bitsandbytes Adam8bit update, and ONNX Runtime CUDA Add with CPU fallback disabled. The ONNX provider resolves its CUDA 12/cuDNN libraries without missing dependencies.
• Not exercised: full checkpoint-backed training or diffusion inference; no model checkpoint is bundled with this repository.
• The local GHCR client rejects public pulls. Local validation imports the same upstream uv Linux image through the registry API with manifest/config/layer digest verification and overrides only UV_IMAGE with that local copy.

AI-assisted inspections

• Request: review upstream requirements, dependency provenance, release age, and practical security exposure.
  • AI-assisted result: selected exact upstream commits, kept changes focused, and limited cooldown exceptions to the linked security fixes.

Proposed merge attribution

• Primary author: aoirint (GitHub user ID: 27213639), the requesting maintainer and PR creator.
• Included: Co-authored-by: Codex noreply@openai.com