Dependencies

The pinned dependency list is in requirements_versions.txt. The shorter floating list in requirements.txt is informational; the launcher uses the pinned list.

Direct Python dependencies

Package	Pinned	Where it's used
torch	not pinned (TORCH_COMMAND-controlled)	Everywhere
torchdiffeq==0.2.3, torchsde==0.2.6	–	Sampler ODEs
transformers==4.30.2	–	CLIP / OpenCLIP / BLIP
accelerate==0.21.0	–	Optional speedups; loaded by transformers
safetensors==0.4.2	–	Checkpoint loading
gradio==3.41.2	strict	The entire UI layer; the version is critical
fastapi==0.94.0	–	The API
pydantic (via fastapi)	–	API models
httpx==0.24.1, httpcore==0.15	–	Pinned to silence deprecation warnings
requests	–	Outbound HTTP
Pillow==9.5.0	–	Image I/O; pinned because of breaking changes in 10.x
pillow-avif-plugin==1.4.3	–	AVIF saving
piexif==1.1.3	–	EXIF metadata
numpy==1.26.2	–	numpy 2.x has an incompatible ABI
scikit-image==0.21.0	–	Color correction (apply_color_correction)
kornia==0.6.7	–	Image augmentation in trainer
einops==0.4.1	–	Tensor reshaping (notably xformers paths)
omegaconf==2.2.3	–	YAML configs for ldm
pytorch_lightning==1.9.4	–	Imported by ldm; not used otherwise
lark==1.1.2	–	Prompt grammar
clean-fid==0.1.35	–	(legacy CLIP-FID; rarely used)
inflection==0.5.1	–	Naming helpers in API model generation
jsonmerge==1.8.0	–	Settings merging
blendmodes==2022	–	Photoshop-style blend modes for color correction
resize-right==0.0.2	–	High-quality resize
psutil==5.9.5	–	Memory monitor
diskcache==5.6.3	–	(used by some imports; minimal direct use)
protobuf==3.20.0	strict	Pinned for transformers compatibility
GitPython==3.1.32	–	Extensions tab
facexlib==0.3.0	–	GFPGAN / CodeFormer face detection
tomesd==0.1.3	–	Token merging optimisation
spandrel==0.3.4, spandrel-extra-arches==0.1.1	–	Upscaler model loading
open-clip-torch==2.20.0	–	OpenCLIP encoder for SD2/SDXL
setuptools==69.5.1	–	Pinned to fix old-package compatibility

Test-only dependencies

requirements-test.txt adds:

• pytest
• pytest-base-url
• requests

Vendored repositories

The launcher clones four repos into repositories/ on first boot:

Repo	Path	Purpose
stable-diffusion-stability-ai	repositories/stable-diffusion-stability-ai	The ldm package — UNet, encoders, samplers
generative-models	repositories/generative-models	The sgm package — SDXL definitions
k-diffusion	repositories/k-diffusion	k-diffusion samplers (Euler, DPM++, …)
BLIP	repositories/BLIP	BLIP captioner, used in interrogate / Train preprocess

Pinned commit hashes are in modules/launch_utils.py (look for stable_diffusion_repo, stable_diffusion_xl_repo, k_diffusion_repo, blip_repo). Updating any of them is a deliberate operation; SDXL support landed by bumping generative-models, SD3 landed by adding modules/models/sd3/ rather than vendoring a new repo.

JavaScript dependencies

package.json declares only eslint^8.40.0. There is no runtime JS dependency manager — every .js file in javascript/ is plain ES6 served as-is.

What's not a dependency

• No bundler — webpack/vite/esbuild are not used.
• No CSS preprocessor — style.css is hand-written.
• No type checker — mypy, pyright, pytype are not used. Some modules use type hints; nothing checks them.
• No formatter — Ruff's format subcommand is not invoked. Style is informal.
• No Docker base image — third-party Dockerfiles exist but are not part of the repo.
• No package — the project is run from the source tree, not pip-installed. There is no setup.py or pyproject.toml [project] table; pyproject.toml exists only for ruff config.