fix-issues-plan.md

Fix Issues Plan

Top-Level Overview

Eight issues were identified across app.py and requirements.txt. This plan addresses each one in focused, independently reviewable sub-tasks. The goal is to bring the project to a safe, correct, and deployable state without adding new features or refactors beyond what is needed to fix the identified problems.

---

Sub-Task 1 — Fix requirements.txt dependency issues

Intent Correct the four dependency problems: wrong version operator for transformers, unpinned gradio, and missing torch and Pillow.

Expected Outcomes

• requirements.txt installs correctly on a clean environment
• gradio version matches README.md sdk_version: 5.32.0
• torch and Pillow are explicitly listed

Todo List

1. Change transformers<=5.5.3 → transformers>=4.40.0
2. Change gradio → gradio==5.32.0
3. Add torch>=2.0.0 (HuggingFace Spaces pre-installs it, but it should be declared)
4. Add Pillow>=9.0.0

Relevant Context

• requirements.txt
• README.md — sdk_version: 5.32.0

Status — [x] done

---

Sub-Task 2 — Replace tempfile.mktemp() with safe alternative

Intent tempfile.mktemp() is deprecated and has a TOCTOU race condition vulnerability. Replace with tempfile.NamedTemporaryFile.

Expected Outcomes

• save_png() no longer uses mktemp()
• Temp file is created safely with no race condition window

Todo List

1. In save_png(), replace tempfile.mktemp(".png") with a NamedTemporaryFile(suffix=".png", delete=False) pattern that returns the file path

Relevant Context

• app.py:53-59 — save_png() function

Status — [x] done

---

Sub-Task 3 — Fix torch.seed() overflow risk in seed generation

Intent torch.seed() can return values larger than 2^63 - 1, which may overflow torch.Generator.manual_seed(). Replace with a bounded random integer.

Expected Outcomes

• Random seed is always within a safe range for manual_seed()
• No change to user-visible behaviour

Todo List

1. Replace seed = torch.seed() in generate_txt2img() with seed = torch.randint(0, 2**32 - 1, (1,)).item()

Relevant Context

• app.py:64-65 — generate_txt2img() seed handling

Status — [x] done

---

Sub-Task 4 — Offload pipelines from GPU after inference

Intent Neither pipeline calls .to("cpu") after inference inside the @spaces.GPU context. Before the ZeroGPU context releases, pipelines should be moved back to CPU and VRAM explicitly cleared to avoid memory pressure between requests.

Expected Outcomes

• After each generation function returns, the pipeline is moved back to CPU
• torch.cuda.empty_cache() is called to release VRAM before the ZeroGPU context drops
• Both generate_txt2img() and generate_img2img() follow this pattern

Todo List

1. In generate_txt2img(), after image is captured, call txt2img_pipe.to("cpu") then torch.cuda.empty_cache()
2. In generate_img2img(), after result is captured, call img2img_pipe.to("cpu") then torch.cuda.empty_cache()

Relevant Context

• app.py:62-93 — generate_txt2img()
• app.py:95-116 — generate_img2img()

Status — [x] done

---

Notes on Accepted / Out-of-Scope Issues

• Shared model weights (shallow copy of components) — This is intentional. Sharing weights between the two pipeline instances saves RAM. The schedulers are correctly set independently after construction. No change needed.