[Snyk] Security upgrade zipp from 3.15.0 to 3.19.1

[LowinLi]

Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• src/stable-diffusion-streamlit/requirements.txt

⚠️ Warning

transformers 4.22.2 requires tokenizers, which is not installed.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[Copilot]

Pull request overview

This Snyk-generated PR aims to remediate a reported vulnerability by adding an explicit zipp version requirement to the Streamlit app’s Python dependencies.

Changes:

• Adds zipp>=3.19.1 to src/stable-diffusion-streamlit/requirements.txt to address a Snyk vulnerability report.
• Normalizes the pandas==1.4.1 line formatting in the diff (no functional change).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This requirements file otherwise pins all dependencies with ==, but zipp is specified as >=3.19.1. That breaks reproducibility and is inconsistent with the established pattern in this file. Consider pinning to an exact version (e.g., ==3.19.1) or introducing a separate constraints file if ranges are desired.

[Copilot]

The inline comment says "pinned by Snyk", but zipp>=3.19.1 is not actually pinned. Also, note that the Docker build installs dependencies from docker/requirements.txt (see docker/dockerfile), so this change won’t affect the container environment; if the deployed artifact is the Docker image, the same zipp constraint likely needs to be applied there to fully remediate the vulnerability in production.