aoirint · Oct 24, 2026 · Oct 24, 2026
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -75,7 +75,7 @@ jobs:
           persist-credentials: false
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       - name: Derive Docker metadata
         id: meta
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
@@ -110,7 +110,7 @@ jobs:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Build and publish Docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: .

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,36 @@ releases.
 
 ## [Unreleased]
 
+### Changed
+
+- Update the bundled sd-scripts checkout from v0.11.1 to v0.12.0 and align
+  the runtime dependencies with its requirements.
+- Update Python from 3.10.19 to 3.12.15 so the image can use the supported
+  Pillow 13 and filelock security fixes.
+- Refresh the Python lockfile, uv to 0.13.1, Ubuntu CA certificates, Git,
+  GLib, and the Docker build/setup GitHub Actions.
+
+### Security
+
+- Update Pillow, certifi, filelock, and setuptools to releases containing
+  the fixes identified by the dependency advisory audit.
+- Remove the compromised emSign CA from the system and Python CA bundles.
+
+### Notes
+
+- Retain the CUDA 12.9.1 base image for ONNX Runtime GPU and the existing
+  PyTorch 2.13.0 / xformers 0.0.35 CUDA 13.0 wheels.
+- The maintainer authorized cooldown exceptions for trusted security
+  advisories. Apply narrow exceptions for certifi 2026.10.19
+  ([GHSA-6q48-6c7w-9gw2](https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2)),
+  filelock 4.2.1
+  ([GHSA-2g95-wg33-c5x2](https://github.com/tox-dev/filelock/security/advisories/GHSA-2g95-wg33-c5x2)),
+  setuptools 84.1.0
+  ([GHSA-xmj3-9gf7-h52w](https://github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w)),
+  and Ubuntu ca-certificates 20260816ubuntu0.24.04.1
+  ([USN-8944-1](https://ubuntu.com/security/notices/USN-8944-1)).
+  Review the temporary Python exceptions after 2026-10-27 UTC.
+
 ## [v0.4.0] - 2026-08-20 UTC
 
 ### Changed

diff --git a/Dockerfile b/Dockerfile
@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile:1
 
 ARG CUDA_RUNTIME_IMAGE=nvidia/cuda:12.9.1-cudnn-runtime-ubuntu24.04@sha256:d02c4310b6d57ca0b16cd80298bdb33a74187baafe2eccd8a6a16180ddc90802
-ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.12.3@sha256:2d890623d310b57771ce840f0da5eed5fc6d657da05ffaa45d82797b53fa3abc
-ARG PYTHON_VERSION=3.10.19
+ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.13.1@sha256:4a1f3666816dafadd20ceb71eac9a7d56d7ef30279f7d64048519ab901ada336
+ARG PYTHON_VERSION=3.12.15
 ARG SD_SCRIPTS_URL=https://github.com/kohya-ss/sd-scripts
-ARG SD_SCRIPTS_VERSION=6721028c79ee85a78b3a06dfd8954dae310a1cce
+ARG SD_SCRIPTS_VERSION=690ea7f96c23182352ec63def76d431c6120bd2f
 
 FROM ${UV_IMAGE} AS uv
 
@@ -30,8 +30,8 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     apt-get update
 
     apt-get install -y --no-install-recommends \
-        ca-certificates=20260601~24.04.1 \
-        git=1:2.43.0-1ubuntu7.3
+        ca-certificates=20260816ubuntu0.24.04.1 \
+        git=1:2.43.0-1ubuntu7.4
 SH
 
 COPY --from=uv /uv /usr/local/bin/uv
@@ -74,9 +74,9 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     apt-get update
 
     apt-get install -y --no-install-recommends \
-        ca-certificates=20260601~24.04.1 \
+        ca-certificates=20260816ubuntu0.24.04.1 \
         libgl1=1.7.0-1build1 \
-        libglib2.0-0t64=2.80.0-6ubuntu3.8 \
+        libglib2.0-0t64=2.80.0-6ubuntu3.10 \
         tk=8.6.14build1
 SH
 
@@ -97,7 +97,7 @@ SH
 
 # Install project and Pre-compile Python bytecode
 RUN --mount=type=cache,target=/root/.cache/uv,sharing=locked <<'SH'
-    uv pip install --editable .
+    uv pip install --no-deps --no-build-isolation --editable .
     python -m compileall .
 SH
 

diff --git a/README.md b/README.md
@@ -54,7 +54,7 @@ echo "f15812e65c2ea7f4e19ce37fb2a8445eb65c64da450a508dd9c8f237c73f6bb8  animagin
 Prepare a dataset directory `work/my_dataset-20230715.1` and a config file
 `work/my_dataset-20230715.1/config.toml` following [train_README].
 
-[train_README]: https://github.com/kohya-ss/sd-scripts/blob/6721028c79ee85a78b3a06dfd8954dae310a1cce/docs/train_README-ja.md#dreambooth%E3%82%AD%E3%83%A3%E3%83%97%E3%82%B7%E3%83%A7%E3%83%B3%E6%96%B9%E5%BC%8F%E6%AD%A3%E5%89%87%E5%8C%96%E7%94%BB%E5%83%8F%E4%BD%BF%E7%94%A8%E5%8F%AF
+[train_README]: https://github.com/kohya-ss/sd-scripts/blob/690ea7f96c23182352ec63def76d431c6120bd2f/docs/train_README-ja.md#dreambooth%E3%82%AD%E3%83%A3%E3%83%97%E3%82%B7%E3%83%A7%E3%83%B3%E6%96%B9%E5%BC%8F%E6%AD%A3%E5%89%87%E5%8C%96%E7%94%BB%E5%83%8F%E4%BD%BF%E7%94%A8%E5%8F%AF
 
 Set file ownership `UID:GID = 1000:1000` (`sudo chown -R 1000:1000 "./work"`).
 

diff --git a/docs/update-sd-scripts.md b/docs/update-sd-scripts.md
@@ -153,15 +153,15 @@ torchvision = { index = "pytorch-cu130" }
 xformers = { index = "pytorch-cu130" }
 ```
 
-Before locking, confirm that the selected wheels exist for Python 3.10 and
+Before locking, confirm that the selected wheels exist for Python 3.12 and
 Linux x86_64:
 
 ```shell
 curl -fsSL https://download.pytorch.org/whl/cu130/torch/ | \
-  rg 'torch-2\.13\.0\+cu130-cp310-cp310-.*x86_64'
+  rg 'torch-2\.13\.0\+cu130-cp312-cp312-.*x86_64'
 
 curl -fsSL https://download.pytorch.org/whl/cu130/torchvision/ | \
-  rg 'torchvision-0\.28\.0\+cu130-cp310-cp310-.*x86_64'
+  rg 'torchvision-0\.28\.0\+cu130-cp312-cp312-.*x86_64'
 
 curl -fsSL https://download.pytorch.org/whl/cu130/xformers/ | \
   rg 'xformers-0\.0\.35-.*x86_64'

diff --git a/pyproject.toml b/pyproject.toml
@@ -1,28 +1,29 @@
 [project]
 name = "sd-scripts-docker"
 version = "0.0.0"
-requires-python = "==3.10.*"
+requires-python = "==3.12.*"
 
 # Originally copied from kohya-ss/sd-scripts
-# https://github.com/kohya-ss/sd-scripts/blob/6721028c79ee85a78b3a06dfd8954dae310a1cce/requirements.txt
+# https://github.com/kohya-ss/sd-scripts/blob/690ea7f96c23182352ec63def76d431c6120bd2f/requirements.txt
 dependencies = [
-  "accelerate==1.6.0",
-  "transformers==5.8.0",
-  "diffusers[torch]==0.38.0",
+  "accelerate==1.15.0",
+  "transformers==5.17.0",
+  "diffusers[torch]==0.40.0",
   "ftfy==6.3.1",
-  "opencv-python==4.10.0.84",
+  'opencv-python==4.10.0.84; platform_machine != "ARM64"',
   "einops==0.7.0",
   "bitsandbytes",
   "lion-pytorch==0.2.3",
-  "schedulefree==1.4",
+  "schedulefree==1.4.1",
   "pytorch-optimizer==3.10.0",
   "prodigy-plus-schedule-free==1.9.2",
   "prodigyopt==1.1.2",
-  "tensorboard",
-  "safetensors==0.8.0rc0",
+  'tensorboard; platform_machine != "ARM64"',
+  'tensorboardX; platform_machine == "ARM64"',
+  "safetensors==0.8.0",
   "toml==0.10.2",
   "voluptuous==0.15.2",
-  "huggingface-hub==1.14.0",
+  "huggingface-hub==1.32.0",
   # for Image utils
   "imagesize==1.4.1",
   "numpy",
@@ -51,6 +52,17 @@ dependencies = [
 [tool.uv]
 package = false
 exclude-newer = "P7D"
+# Temporary exceptions for upstream security fixes; remove after 2026-10-27 UTC.
+# https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2
+# https://github.com/tox-dev/filelock/security/advisories/GHSA-2g95-wg33-c5x2
+# https://github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w
+exclude-newer-package = { certifi = "2026-10-21T00:00:00Z", filelock = "2026-10-18T00:00:00Z", setuptools = "2026-10-20T00:00:00Z" }
+constraint-dependencies = [
+  "certifi>=2026.10.19",
+  "filelock>=4.2.1",
+  "setuptools==84.1.0",
+  "pillow>=13.0.0",
+]
 
 [[tool.uv.index]]
 name = "pytorch-cu130"