Main -> release 2026-07-10 12:00 - #386
Closed
oriolpetithelical wants to merge 2 commits into
Closed
Conversation
* build: pin GitHub Actions to full commit SHAs Pin every `uses:` reference in the workflows to a full 40-char commit SHA and add .github/dependabot.yml. Mutable action tags (e.g. @v4, @release/v1) can be silently repointed by the action owner, enabling supply-chain attacks (OWASP A08, CWE-1357 / CWE-353) -- as seen in the tj-actions / trivy-action compromises. Pinning to an immutable SHA removes that risk; the trailing `# <version>` comment keeps it readable and lets Dependabot open reviewable update PRs. Runners are confirmed on Node24, so actions were bumped to their latest majors (checkout v5, ecr-login v2.1.6, etc.). Refs helicalAI/dashboard#1154
…rep) (#385) * fix(security): harden CWE-502 torch.load sites with weights_only + nosemgrep Follow-up to the annotation-only PR #384. Mitigates the CWE-502 (unsafe deserialization) scan findings from helicalAI/dashboard#1154 for the torch.load sites, and suppresses the Trail of Bits scanner on the sites that are now safe or unavoidably require full unpickling. Groups A + B (torch.load) addressed here; group C (raw pickle.load of gene dictionaries) is intentionally deferred to a follow-up. - weights_only=True (real mitigation) added to the loads whose payloads are tensors / plain state dicts: scgpt best_model.pt, uce all_tokens.torch, uce gene-embedding dicts, and the uce model-weights load (the last was missed by the Bastion scan but hardened for consistency). Under the pinned torch 2.7.0 this matches the existing default, so it is a no-op at runtime and only hardens intent. - HyenaDNA keeps weights_only=False: its Lightning-style .ckpt carries non-tensor objects the safe loader rejects. Documented + suppressed with a "trusted sources" justification (a try-safe-first attempt was rejected in review: it fired a misleading CWE-502 warning and double-read the file on every legitimate load). - base_models legacy fallback keeps weights_only=False (pre-v2.0.0 full-model pickles); documented + suppressed, reached only when the safe load fails. - Every torch.load carries a `# nosemgrep: trailofbits.python.pickles-in-pytorch.pickles-in-pytorch` on the line immediately preceding the call (Semgrep only honors adjacent suppressions) plus a per-site CWE-502 justification. Validated: scGPT and HyenaDNA load real downloaded checkpoints end-to-end; py_compile passes on all touched files. CI exercises these load paths against real (non-mocked) upstream artifacts. Refs helicalAI/dashboard#1154
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bringing security fixes to release branch