Fix mutable default args in lora_base.py

[PrakshaaleJain]

What does this PR do?

Fixes#14052

This PR fixes a bug in src/diffusers/loaders/lora_base.py where a mutable default argument (components: list[str] = []) was used in the signatures of fuse_lora and unfuse_lora. It updates the default value to None and initializes it as a clean, empty list inside the method body if no explicit argument is passed.

Why this change is important:

1. Prevents Side Effects & State Leakage:
2. Robustness in Workflows:

Before submitting

• Did you use an AI agent (Claude Code, Codex, Cursor, etc.) to help with this PR? If so:
  • Did you read the Coding with AI agents guide?
  • Did you self-review the diff against .ai/review-rules.md?
• Did you read the contributor guideline?
• Did you read our philosophy doc? (important for complex PRs)
• Was this discussed/approved via a GitHub issue or the forum? Please add a link to it if that's the case.
• Did you make sure to update the documentation with your changes? Here are the
  documentation guidelines, and
  here are tips on formatting docstrings.
• Did you write any new necessary tests?
• Are you the author (or part of the team) of the model/pipeline (only applicable for model/pipeline related PRs)?

Who can review?

Core library / PEFT integrations:

• @sayakpaul@yiyixuxu@DN6@BenjaminBossan@dg845

[sayakpaul]

Thanks! Do we have an example reproducer reflecting the issue that this PR attempts to solve?

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[PrakshaaleJain]

Hi @sayakpaul!

Although fuse_lora() raises early when components=[], the mutable default argument is still a latent Python bug. Since default arguments are shared across calls, mutating the default list changes the function's default value for the whole Python process.

We can reproduce this directly on the live LoraBaseMixin code using standard reflection without spinning up any pipelines:

importinspectfromdiffusers.loaders.lora_baseimportLoraBaseMixinsig=inspect.signature(LoraBaseMixin.fuse_lora)
default_object=sig.parameters["components"].defaultprint(f"Initial default type: {type(default_object)}") # Expected: <class 'list'>default_object.append("leaked_state_or_component")
new_sig=inspect.signature(LoraBaseMixin.fuse_lora)
print(f"Mutated default value: {new_sig.parameters['components'].default}") # Expected: ['leaked_state_or_component']assertlen(new_sig.parameters["components"].default) >0, "Global signature state polluted!"

[github-actions]

Hi @PrakshaaleJain, thanks for the PR! It does not appear to link an issue it fixes. If this PR addresses an existing issue, please add a closing keyword (e.g. Fixes #1234) to the PR description so the issue is linked. See the contribution guide for more details. If this PR intentionally does not fix a tracked issue, a maintainer can add the no-issue-needed label to silence this reminder.

[PrakshaaleJain]

Hi @sayakpaul, can you help me in merging this change?

[PrakshaaleJain]

Thanks!! @sayakpaul