chore(deps): bump diffusers to 0.40.0

[lstein]

Summary

Bumps the diffusers pin from 0.39.0 to 0.40.0 and regenerates uv.lock.

Beyond diffusers itself, the bump forces two transitive updates, both driven by diffusers 0.40 raising its floor to huggingface-hub>=1.23.0 (0.39 required only >=0.34.0):

diffusers        0.39.0 -> 0.40.0
huggingface-hub  1.21.0 -> 1.28.0
hf-xet           1.5.1  -> 1.6.0

No source changes were needed. Every upstream file this repo vendors or monkeypatches is byte-identical in 0.40 — models/attention.py, attention_processor.py, unets/unet_2d_condition.py, unet_2d_blocks.py, controlnets/controlnet.py, embeddings.py, normalization.py, image_processor.py, and both the SD and SDXL pipelines — so backend/hidiffusion/hidiffusion.py, backend/util/hotfixes.py, custom_atttention.py and diffusers_pipeline.py are unaffected. The largest deletion in the release is the Flax backend, which this repo does not use.

tests/backend/model_manager/load/test_diffusers_039_compatibility.py is renamed to ..._040_... with its version assertion updated. The other ten contract assertions in that file pass unchanged.

Related Issues / Discussions

None.

QA Instructions

uv sync
uv run pytest tests/ -q

Full suite was run against both versions to separate pre-existing failures from bump-induced ones:

	result
diffusers 0.39.0	9 failed, 5394 passed
diffusers 0.40.0	8 failed, 5395 passed

The single delta is the version-pin test itself, which fails under 0.39 and passes under 0.40 — exactly as intended. The remaining 8 failures are byte-identical across both runs and pre-existing on main (test_model_manager_authorization, test_mistral_tokenizer_ladder ×2, test_encoder_offload ×2, test_pid_chunked_equivalence ×3 — the last group emitting CUDA error: invalid device ordinal, environmental).

Behavior changes in 0.40 that were traced to call sites and confirmed unreachable:

• FlowMatchEulerDiscreteScheduler.set_timesteps no longer honors an explicitly passed timesteps=; it now always recomputes timesteps = sigmas * num_train_timesteps. All 26 set_timesteps( call sites pass sigmas= or num_inference_steps=, never timesteps=, so the changed branch is unreachable.
• Qwen-Image RoPE now dispatches per device via ROPE_PER_DEVICE, but falls back to the old CUDA path for every device type except neuron. Numerically unchanged on cuda/cpu/mps/xpu/rocm.
• WanTransformer3DModel._keep_in_fp32_modules gained "rope", whose buffers are persistent=False and never appear in a state dict. The Wan loader also builds the model directly and calls load_state_dict, bypassing from_pretrained entirely.
• Flux/Flux2/Qwen attention switched to unflatten(-1, (-1, head_dim)) for tensor-parallel support; the reshape is identical at tp_degree == 1.

Since these were verified by reading upstream diffs rather than by generating images, a smoke test of the Krea-2 and Qwen-Image paths against a real model before merge would be worthwhile.

Merge Plan

Ordinary merge, but it moves huggingface-hub by seven minor versions, so it is worth landing clear of a release cut. The hub API surface this repo touches (get_token, hf_hub_url, hf_hub_download, login/logout/whoami, HfApi.*, errors.*) was diffed across 1.21.0 → 1.28.0 with zero signature differences, and contributors will need uv sync after pulling.

Follow-up (deliberately not in this PR)

• torch_dtype= is now deprecated on pipeline loads (FutureWarning, removal targeted at 1.0.0) and will be emitted by backend/model_manager/load/model_loaders/stable_diffusion.py. It remains a silent alias on model loads. Passing both dtype and torch_dtype raises ValueError, which no call site does.
• Upstream's Krea2AttnProcessor now performs the same repeat_interleave GQA expansion that backend/krea2/attention.py was written to provide. The override still adds an explicit sdpa_kernel backend preference so it is not dead, but its docstring rationale is stale.
• backend/wan/memory_optimization.py vendors a WanTransformer3DModel.forward replacement that is now one line behind upstream (a .contiguous() added after the patch-embed transpose). Pre-existing, not introduced here.

Checklist

• The PR has a short but descriptive title, suitable for a changelog
• Tests added / updated (if applicable)
• ❗Changes to a redux slice have a corresponding migration
• Documentation added / updated (if applicable)
• Updated What's New copy (if doing a release after this PR)

🤖 Generated with Claude Code

https://claude.ai/code/session_01WGWPxZg9rHrDz51b4BzsdY