Python version requirement

[levicki]

Why is this repo still stuck on demanding Python 3.10.6?

It should at least be OK to update to latest security bugfix release of that branch (3.10.11) if not outright update to 3.11.9 or 3.12.10.

Can we get some clarification from maintainers on this?

[w-e-w]

Python 3.11 is fine
dose not work with Python 3.12 because of dependency spaghetti

[levicki]

@w-e-w I see, can the README be updated to reflect that? Assuming that all mainstream extensions also work with it?

[w-e-w]

can the README be updated to reflect that

AUTOMATIC1111 is currently the only one with rights to write to master branch, but unfortunately he has possibly been kidnapped by aliens
I at most can only write to the dev branch and wiki, but don't really intend to do so for security reasons

apart from developers accidentally implemented security holes I think the main threat that is more of a actual concern which has actually been seen is supply chain attack, is totally possible dependencies can be compromised
I don't know what is your threat model but to be honest if you are wary of security then you should probably use a container like docker to run webui, python security patches is not going to help with supply chain attack much

I myself would not trust to put webui on the open internet, I have seen extensions accidentally add in arbitrary remote code execution

my point of view having it work is more of a priority using the most update python for security reasons
don't even use it locally or via a secure connection (vpn or ssh)

---

Assuming that all mainstream extensions also work with it

while most extensions that don't require special dependencies will most likely work without any issues
some extension installers is only written for 3.10

what were you considered mainstream? how about sd-webui-controlnet
I can say that sd-webui-controlnet will work for the most part but, but I believe IP-adapter will not work out of the box because of the installer is written so that it only install the required dependencies for IP-adapter on 3.10
I did make a PR addressing that

• Auto install insightface for py 3.9 3.11 3.12 Mikubill/sd-webui-controlnet#3087

other extensions could have similar issues
asking everyone to text / update their code is non-realistic
the entire code base of webui and extensions is written by random unpaid voluntary enthusiasts, we don't have an organization that tries to maintain things in top shape

[levicki]

Thanks for clarifying. I certainly don't intend to put it on the internet and I am aware of supply chain attacks — I was just trying to follow best practices and have the latest patch instead of some arbitrary pinned down version of Python. As for mainstream, I meant stuff like controlnet, ipadapter, and even that training extension which keeps breaking all the time whose name eludes me at the moment. The one that depends on some ancient torch version in order for it to work and fights to install it over the latest ones.

In the worst case, I will just create python 3.10 venv for this only.

[w-e-w]

like if it works it's feel free to use any version of python you like
but the thing is we have seen things for both odor and newer version

I'm not sure but I believe it webui dose not work with 3.10.0 and I think some new version python in conda comes with a verison of sqlit the breaks stuff #16856 (comment)

I think you can understand that why we say you should use "that specific version" (at least to casual users)
if you are using other versions if it works working great, but if it's not then maybe you should try the specified version first, otherwise it adds tons of headache for us to debug

if it makes you a comfortable trying to use a different version python
I personally use 3.11 for webui most of the time just because of Fine-grained error locations in tracebacks