LoRA Pilot v2.5.4

[vavo]

LoRA Pilot v2.5.4

LoRA Pilot v2.5.4 is the next stable release after the stable tag, which points to the January v1.99 stable build. The v0.1.0-preview.* releases belong to the Windows preview line and are not the baseline for these notes.

This release covers the v2 product expansion, the Blackwell/CUDA 13.0 image, current bundled app pins, ComfyUI reliability, training visibility, safer dataset/model path handling, and the learning-docs pass.

Release Scope

• Full release tag: v2.5.4
• Baseline tag: stable
• Baseline build: January v1.99 stable build
• Commits covered since stable: 103
• Open GitHub code-scanning alerts at release prep: 0

Highlights

Product Expansion Since Stable

• Added AI Toolkit as a first-class trainer, exposed through the supervised app stack on port 8675.
• Added GitHub Copilot integration through the Copilot sidecar and a global ControlPilot drawer.
• Redesigned and refactored ControlPilot with a cleaner dashboard, services view, models flow, datasets flow, TrainPilot flow, and shared UI styling.
• Added MediaPilot as the built-in gallery and curation layer mounted under /mediapilot.
• Added model, dataset, training, inference, docs, and service management surfaces that work from the same ControlPilot entry point.
• Added a real Settings section for secrets, service behavior, UI preferences, shutdown behavior, and runtime configuration.
• Added service version discovery and update job endpoints while treating image-managed apps as image-managed where in-app updates would mislead users.
• Added TagPilot incremental save support for per-item save, reset, and finalized ZIP workflows.

Training and Inference Workflow Upgrades

• Added TensorBoard integration for Kohya and AI Toolkit runs.
• Improved Diffusion Pipe startup behavior for TensorBoard and training mode.
• Retired the legacy Diffusion Pipe Gradio path in favor of the maintained ControlPilot/Diffusion Pipe flow.
• Fixed Kohya transformer compatibility checks and warning noise.
• Added TrainPilot warnings before starting stopped services.
• Improved TrainPilot queue handling and TOML dependency pinning.
• Updated InvokeAI to 6.13.5 while keeping its CUDA 12.8-compatible Torch/xFormers stack isolated in its own venv.
• Refreshed model manifest entries for current SDXL, SD3/SD3.5, Flux, Hunyuan, Wan, Qwen, LTX, Ideogram, Lens, PixelDiT, and related ComfyUI model families.

Blackwell and CUDA Stack Refresh

• Made CUDA 13.0 the default build profile for Blackwell-focused images.
• Kept CUDA 12.8 available as the legacy build profile.
• Pinned the core CUDA 13.0 PyTorch stack to:
  • torch==2.11.0
  • torchvision==0.26.0
  • torchaudio==2.11.0
• Added or pinned runtime packages needed by modern ComfyUI and custom-node workflows, including uv, deepdiff, gguf, xformers, bitsandbytes, tomlkit, fastapi, uvicorn, httpx, and related web/runtime dependencies.
• Tightened Docker cache-busting inputs so build layers refresh when important app or dependency pins change.
• Expanded build arg coverage across Dockerfile, Makefile, build.env.example, and build documentation.

Bundled App Updates

• Updated ComfyUI to v0.27.0.
• Updated the built-in ComfyUI Manager package to 4.2.2.
• Pinned ComfyUI-Downloader to a specific commit instead of floating on upstream HEAD.
• Refreshed AI Toolkit, Kohya, Diffusion Pipe, JupyterLab, code-server, Node, npm, TensorBoard, and supporting Python dependencies.
• Preserved AI Toolkit's isolated environment while allowing it to import the shared core GPU stack where needed.

ComfyUI Manager and Runtime Fixes

• Enabled ComfyUI Manager through ComfyUI's current frontend integration by default.
• Added COMFY_MANAGER_LEGACY_UI=1 as an explicit fallback for the old Manager UI.
• Seeded ComfyUI Manager policy at startup with:
  • network_mode=personal_cloud
  • security_level=normal
• Left arbitrary direct Git URL installs and standalone pip installs opt-in through:
  • COMFY_MANAGER_ALLOW_GIT_URL_INSTALL=true
  • COMFY_MANAGER_ALLOW_PIP_INSTALL=true
• Fixed the missing torchaudio path for the default CUDA 13.0 image.
• Preserved startup checks for uv, deepdiff, gguf, and xformers.
• Recreated the expected ComfyUI model directory tree after rewiring /opt/pilot/repos/ComfyUI/models to /workspace/models.
• Removed stale workspace copies of old Manager custom-node installs so the built-in Manager path wins.

TagPilot, ControlPilot, and Provider Updates

• Updated the TagPilot frontend and embedded theme sync.
• Improved TagPilot settings, dataset handoff, workspace export, and dark-mode behavior.
• Added and hardened backend TagPilot provider APIs for OpenAI, Gemini, and Grok-style provider flows.
• Fixed provider upload behavior and documented the hotfix path.
• Fixed TagPilot dataset loading on Python 3.11.
• Hardened dataset path handling across Portal, TagPilot, TrainPilot, MediaPilot, and model-pull flows.

Security and Code Scanning

• Closed the latest GitHub code-scanning alerts.
• Reduced open code-scanning vulnerabilities to 0.
• Hardened path construction and traversal checks for datasets, model downloads, static routes, and training paths.
• Reduced command-injection and path-injection exposure in Portal and Copilot sidecar surfaces.
• Added regression coverage for build pins, manifest behavior, static security checks, TagPilot APIs, TrainPilot frontend behavior, service update reconciliation, and Python venv helper behavior.

Windows, Compose, and Local Deployment

• Kept Windows installer and WSL runtime work separate from the stable release baseline.
• Updated WSL and Windows runtime artifact workflows.
• Improved Docker Compose docs and env templates.
• Added COMFY_MANAGER_LEGACY_UI=0 to .env.example and compose files so local users can force the old Manager UI when needed.
• Kept standard, dev, and CPU compose configs aligned.

Documentation Refresh

• Reworked the getting-started and 101 guides for inference, datasets, LoRA training, and Stable Diffusion basics.
• Added or refreshed component docs for ComfyUI, InvokeAI, Diffusion Pipe, AI Toolkit, Kohya, MediaPilot, TagPilot, TrainPilot, and the Copilot sidecar.
• Added ComfyUI API diagnostics and missing-node/model troubleshooting guidance.
• Updated environment-variable, Docker Compose, build, model manifest, and changelog reference docs.
• Added guidance around dataset validation, data rights, model family choice, prompt/settings basics, and training evaluation.

Upgrade Notes

• Use the default CUDA 13.0 profile for Blackwell GPUs.
• Use CUDA_PROFILE=cu128 for the legacy CUDA 12.8 profile.
• ComfyUI Manager now opens through the current ComfyUI Extensions manager by default.
• Set COMFY_MANAGER_LEGACY_UI=1 if you need the old Manager UI.
• For RunPod-style non-local pod URLs, keep the default Manager policy values unless you have a reason to restrict installs.
• Direct arbitrary Git URL installs and standalone pip installs stay disabled unless you opt in with the Manager env flags listed above.
• Rebuild the image from this tag to pick up the refreshed app pins and runtime dependency set.

Known Notes

• The GitHub release does not include a prebuilt Docker image asset.
• Existing workspace data under /workspace remains user-owned. Fresh pods get the cleanest ComfyUI Manager and model-directory state.
• Older pods may still have stale workspace custom-node installs. The startup script removes stale Manager custom-node copies, but unrelated third-party custom nodes remain untouched.

Verification

• Confirmed open GitHub code-scanning alerts: 0
• Ran python3 -m unittest discover tests
• Ran shell syntax checks for ComfyUI and build helper scripts
• Ran docker compose config for standard, dev, and CPU compose files
• Ran git diff --check

Compare

• Since the stable release baseline: stable...v2.5.4

---

This discussion was created from the release LoRA Pilot v2.5.4.