[lydhr]

Description

Diffuser library just released the fix we need yesterday, resolving the TODO from #5864.

• The new release solved: now that diffusers v0.42.1 includes huggingface/diffusers#14863 (huggingface-hub<3.0).

• So, we can put diffuser in the right dep list: moves diffusers from base_requirements/tpu-requirements.txt to the shared base_requirements/requirements.txt,

  • base_requirements/tpu-requirements.txt: remove the TPU-only diffusers>=0.40.0 entry.
  • base_requirements/requirements.txt: add diffusers (unpinned in the shared file because tpu-post-train-requirements.txt caps safetensors<0.8 for tunix, while diffusers>=0.38.0 requires safetensors>=0.8.0).
    • generated_requirements/tpu-requirements.txt: upgrades diffusers 0.41.0 → 0.42.1 and restores huggingface-hub 1.33.0 → 2.3.0 (along with httpcore2, httpx2, httpx2-jsfetch, truststore).
    • generated_requirements/cuda12-requirements.txt & generated_requirements/decoupled-requirements.txt: adds diffusers>=0.42.1 with huggingface-hub>=2.3.0.
    • generated_requirements/tpu-post-train-requirements.txt: adds diffusers>=0.37.1 (highest release compatible with safetensors<0.8), keeping google-tunix>=0.1.7 unchanged.

Tests

Regenerated all lockfiles following update_dependencies:

# TPU Pre-Training
bash src/dependencies/scripts/generate_requirements.sh \
  --base-requirements src/dependencies/requirements/base_requirements/tpu-requirements.txt \
  --generated-requirements tpu-requirements.txt \
  --override-requirements src/dependencies/extra_deps/tpu_overrides.txt \
  --seed-commit ab4c9b943c70bcb42baf4d379036a19c8aa2689d
mv generated_artifacts/python3_12/tpu-requirements.txt \
  src/dependencies/requirements/generated_requirements/tpu-requirements.txt

# TPU Post-Training
bash src/dependencies/scripts/generate_requirements.sh \
  --base-requirements src/dependencies/requirements/base_requirements/tpu-post-train-requirements.txt \
  --generated-requirements tpu-post-train-requirements.txt \
  --override-requirements src/dependencies/extra_deps/tpu_post_train_overrides.txt \
  --seed-commit 52d5cb3893727451d0f695bfa6f8206cdd9492c7
mv generated_artifacts/python3_12/tpu-post-train-requirements.txt \
  src/dependencies/requirements/generated_requirements/tpu-post-train-requirements.txt

# GPU (cuda12) Pre-Training
bash src/dependencies/scripts/generate_requirements.sh \
  --base-requirements src/dependencies/requirements/base_requirements/cuda12-requirements.txt \
  --generated-requirements cuda12-requirements.txt \
  --seed-commit ab4c9b943c70bcb42baf4d379036a19c8aa2689d \
  --override-requirements src/dependencies/extra_deps/cuda12_overrides.txt \
  --hardware cuda12
mv generated_artifacts/python3_12/cuda12-requirements.txt \
  src/dependencies/requirements/generated_requirements/cuda12-requirements.txt

# Decoupled Requirements
python3 src/dependencies/scripts/generate_decoupled_requirements.py

• python3 src/dependencies/scripts/generate_decoupled_requirements.py --check passes.
• uv pip compile --python-version 3.12 resolves cleanly for tpu-requirements.txt, cuda12-requirements.txt, and decoupled-requirements.txt.

Checklist

• I have performed a self-review of my code. For an optional AI review, add the gemini-review label.
• I have necessary comments in my code, particularly in hard-to-understand areas.
• I have run end-to-end tests tests and provided workload links above if applicable.
• I have made or will make corresponding changes to the doc if needed, including adding new documentation pages to the relevant Table of Contents (toctree directive) as explained in our documentation.

[github-actions]

🤖 Hi @lydhr, I'm running an automatic MaxText review of this pull request. You can track my progress in the logs. To request another review later, add the gemini-review label or comment @gemini-cli /review.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request centralizes the diffusers library dependency into the shared base requirements file, simplifying the project's dependency structure. It also includes several version bumps for various packages across multiple environment-specific requirement files to maintain compatibility and security, following the standard dependency update workflow.

Highlights

• Dependency Management: Moved diffusers from tpu-requirements.txt to the shared requirements.txt to streamline dependency management.
• Dependency Updates: Updated diffusers to v0.42.1 across various requirement files and synchronized related dependencies like huggingface-hub.
• Lockfile Regeneration: Regenerated all project lockfiles to ensure consistency across TPU, GPU, and decoupled environments.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

📋 Review Summary

Verdict: No significant issues found.

Inferred spec & validation

• Sources: PR #6029 description; PR #5864; docs/development/update_dependencies.md; base and generated requirement files before and after the change.
• Problem: diffusers was previously isolated to base_requirements/tpu-requirements.txt to avoid downgrading huggingface-hub across all environments; with diffusers>=0.42.1 supporting huggingface-hub<3.0, it can now reside in shared base requirements.

Spec item	Implementation	Validating test
R1 (stated): Move diffusers to base_requirements/requirements.txt and remove from base_requirements/tpu-requirements.txt	✅ met	Lockfile generation ✅
R2 (stated): TPU, GPU (cuda12), and decoupled lockfiles resolve diffusers>=0.42.1 and restore huggingface-hub>=2.3.0 with companion dependencies	✅ met	uv pip compile / lockfile generation ✅
R3 (stated): TPU post-training lockfile resolves diffusers>=0.37.1 without conflicting with safetensors<0.8 or changing google-tunix>=0.1.7	✅ met	uv pip compile / lockfile generation ✅
R4 (stated): Lockfiles for all environments are regenerated and consistent	✅ met	generate_decoupled_requirements.py --check ✅
C1 (stated): decoupled-requirements.txt stays synchronized with cuda12-requirements.txt	✅ preserved	generate_decoupled_requirements.py --check ✅
C2 (inferred): Existing dependencies across environments remain compatible without broken pins or unexpected regressions	✅ preserved	Lockfile resolution checks ✅