Five seconds of reference audio can start a local voice clone
GPT-SoVITS accepts a short voice sample for zero-shot text to speech, while its fine-tuning path uses roughly 1 minute of training audio. The WebUI can slice recordings, separate accompaniment, transcribe speech, correct the transcript, and train the GPT and SoVITS parts. Inference supports English, Chinese, Cantonese, Japanese, and Korean, including a language different from the reference recording.
Audio and weights can remain on hardware you control instead of going through a hosted voice API. That control carries weight in a literal sense. Our dependency environment used 6,247 MB before we downloaded the pretrained models listed in the README. A clean workstation or GPU server needs storage planning well beyond the 36.6 MB checkout.
Dataset preparation is built in, but judgment is still manual
A user can point the WebUI at audio, split it into clips, run optional denoising, transcribe with one of the ASR choices, proofread labels, and move to fine-tuning. The annotation format is a path, speaker name, language code, and text. Corrections remain inspectable instead of disappearing into an internal database.
Five supported language codes do not remove the need for native review. Transcription errors become training labels unless someone catches them. Background music, pronunciation, pacing, and speaker consent also sit outside a successful model run. The 5-second and 1-minute inputs describe usable audio amounts, not a promise that any recording yields a faithful clone. Compare spoken words with the requested text before release.
What happened when we ran it
Our sandbox installed commit 48b1a01 in 166 seconds. It added 224 Python packages and occupied 6,247 MB on disk. The build completed in 5 seconds. We used a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, Python 3.12, and no secrets. These numbers exclude model downloads, training, and speech generation.
There was no test script or target, so we skipped tests. Our scan also found no tests directory. This is different from a passing suite: the repository gave the harness no automated check to execute. It had 2 CI workflow files and a Dockerfile, but neither substitutes for tests covering model selection, preprocessing, APIs, or audio output.
Pip-audit reported 57 known vulnerabilities in the installed environment. That count does not say 57 parts of GPT-SoVITS are directly exploitable, and we did not assign severities beyond the supplied result. It makes dependency review necessary before exposing the WebUI or API. Pin the approved environment and rerun the audit in your own image build.
Hardware choice changes both installation and operation
The README splits setup among Windows bundles, Linux scripts, macOS, manual Conda work, and Docker. Its tested table spans Python 3.9 through 3.11 with CPU, Apple Silicon, and several CUDA combinations, while the badge names Python 3.10 to 3.12. Debian manual setup also needs FFmpeg and libsox-dev. The installer offers CUDA 12.6, CUDA 12.8, ROCm, CPU, or MPS choices by platform.
Docker does not reduce this to one image. Full and Lite services exist for 2 CUDA lines, with Lite omitting ASR and UVR5 models. Image releases can trail source development, and Compose mounts every file in the current directory. On Windows the README suggests increasing shared memory, with 16 GB as an example. GPU compatibility and weight downloads still belong to the operator.
Core weights, Chinese G2PW files, optional UVR5 weights, FunASR models, and Faster Whisper models have separate locations and download behavior. Some arrive automatically on first use; others need exact directories. An offline deployment should obtain and checksum each required asset before serving users.
The command-line model selector has an open correctness report
Open issue 2829 reports that change_sovits_weights() returns a generator, but inference_cli.py calls it without iterating it. The reporter's checks found that --sovits_model could leave the previous model loaded while producing plausible audio. The report opened August 25, 2026. Until verified fixed, log model identity and check sample rates when switching versions through the CLI.
Issue 2828, opened August 24, says the Windows package has a .pth file with 6 absolute directories from the packager's machine. Python ignores nonexistent paths after extraction elsewhere, which can later cause missing-module errors in ASR or dataset subprocesses. The report does not prove every installation fails. It does justify smoke-testing each packaged workflow you will use.
August code activity matters more than the 2025 release tag
GitHub listed 61,267 stars and 889 combined issues and pull requests when fetched. The last push was August 18, 2026, and a ROCm pull request was updated August 27. That is current work around a large user queue; 889 is not a confirmed-bug count. The MIT-licensed project has an English default README plus Chinese, Japanese, Korean, and Turkish versions.
The latest release was 20250606v2pro, published June 6, 2025. Its age alone does not mean abandonment because pushes and issue work continued in August 2026. Release archives, source, model generations, and Docker tags may not line up automatically. Choose one known combination and record it. With no test target and 57 audit findings in our install, adoption includes your own audio fixtures and security review.