fix-issues-plan.md

# Fix Issues Plan

## Top-Level Overview

Eight issues were identified across `app.py` and `requirements.txt`. This plan addresses each one in focused, independently reviewable sub-tasks. The goal is to bring the project to a safe, correct, and deployable state without adding new features or refactors beyond what is needed to fix the identified problems.

---

## Sub-Task 1 — Fix `requirements.txt` dependency issues

**Intent**
Correct the four dependency problems: wrong version operator for `transformers`, unpinned `gradio`, and missing `torch` and `Pillow`.

**Expected Outcomes**
- `requirements.txt` installs correctly on a clean environment
- `gradio` version matches `README.md` `sdk_version: 5.32.0`
- `torch` and `Pillow` are explicitly listed

**Todo List**
1. Change `transformers<=5.5.3` → `transformers>=4.40.0`
2. Change `gradio` → `gradio==5.32.0`
3. Add `torch>=2.0.0` (HuggingFace Spaces pre-installs it, but it should be declared)
4. Add `Pillow>=9.0.0`

**Relevant Context**
- [`requirements.txt`](requirements.txt)
- [`README.md`](README.md) — `sdk_version: 5.32.0`

**Status** — `[x] done`

---

## Sub-Task 2 — Replace `tempfile.mktemp()` with safe alternative

**Intent**
`tempfile.mktemp()` is deprecated and has a TOCTOU race condition vulnerability. Replace with `tempfile.NamedTemporaryFile`.

**Expected Outcomes**
- `save_png()` no longer uses `mktemp()`
- Temp file is created safely with no race condition window

**Todo List**
1. In `save_png()`, replace `tempfile.mktemp(".png")` with a `NamedTemporaryFile(suffix=".png", delete=False)` pattern that returns the file path

**Relevant Context**
- [`app.py:53-59`](app.py:53) — `save_png()` function

**Status** — `[x] done`

---

## Sub-Task 3 — Fix `torch.seed()` overflow risk in seed generation

**Intent**
`torch.seed()` can return values larger than `2^63 - 1`, which may overflow `torch.Generator.manual_seed()`. Replace with a bounded random integer.

**Expected Outcomes**
- Random seed is always within a safe range for `manual_seed()`
- No change to user-visible behaviour

**Todo List**
1. Replace `seed = torch.seed()` in `generate_txt2img()` with `seed = torch.randint(0, 2**32 - 1, (1,)).item()`

**Relevant Context**
- [`app.py:64-65`](app.py:64) — `generate_txt2img()` seed handling

**Status** — `[x] done`

---

## Sub-Task 4 — Offload pipelines from GPU after inference

**Intent**
Neither pipeline calls `.to("cpu")` after inference inside the `@spaces.GPU` context. Before the ZeroGPU context releases, pipelines should be moved back to CPU and VRAM explicitly cleared to avoid memory pressure between requests.

**Expected Outcomes**
- After each generation function returns, the pipeline is moved back to CPU
- `torch.cuda.empty_cache()` is called to release VRAM before the ZeroGPU context drops
- Both `generate_txt2img()` and `generate_img2img()` follow this pattern

**Todo List**
1. In `generate_txt2img()`, after `image` is captured, call `txt2img_pipe.to("cpu")` then `torch.cuda.empty_cache()`
2. In `generate_img2img()`, after `result` is captured, call `img2img_pipe.to("cpu")` then `torch.cuda.empty_cache()`

**Relevant Context**
- [`app.py:62-93`](app.py:62) — `generate_txt2img()`
- [`app.py:95-116`](app.py:95) — `generate_img2img()`

**Status** — `[x] done`

---

## Notes on Accepted / Out-of-Scope Issues

- **Shared model weights (shallow copy of components)** — This is intentional. Sharing weights between the two pipeline instances saves RAM. The schedulers are correctly set independently after construction. No change needed.