Main -> release 2026-07-10 (conflicts resolved) - #388
Merged
Conversation
* build: pin GitHub Actions to full commit SHAs Pin every `uses:` reference in the workflows to a full 40-char commit SHA and add .github/dependabot.yml. Mutable action tags (e.g. @v4, @release/v1) can be silently repointed by the action owner, enabling supply-chain attacks (OWASP A08, CWE-1357 / CWE-353) -- as seen in the tj-actions / trivy-action compromises. Pinning to an immutable SHA removes that risk; the trailing `# <version>` comment keeps it readable and lets Dependabot open reviewable update PRs. Runners are confirmed on Node24, so actions were bumped to their latest majors (checkout v5, ecr-login v2.1.6, etc.). Refs helicalAI/dashboard#1154
…rep) (#385) * fix(security): harden CWE-502 torch.load sites with weights_only + nosemgrep Follow-up to the annotation-only PR #384. Mitigates the CWE-502 (unsafe deserialization) scan findings from helicalAI/dashboard#1154 for the torch.load sites, and suppresses the Trail of Bits scanner on the sites that are now safe or unavoidably require full unpickling. Groups A + B (torch.load) addressed here; group C (raw pickle.load of gene dictionaries) is intentionally deferred to a follow-up. - weights_only=True (real mitigation) added to the loads whose payloads are tensors / plain state dicts: scgpt best_model.pt, uce all_tokens.torch, uce gene-embedding dicts, and the uce model-weights load (the last was missed by the Bastion scan but hardened for consistency). Under the pinned torch 2.7.0 this matches the existing default, so it is a no-op at runtime and only hardens intent. - HyenaDNA keeps weights_only=False: its Lightning-style .ckpt carries non-tensor objects the safe loader rejects. Documented + suppressed with a "trusted sources" justification (a try-safe-first attempt was rejected in review: it fired a misleading CWE-502 warning and double-read the file on every legitimate load). - base_models legacy fallback keeps weights_only=False (pre-v2.0.0 full-model pickles); documented + suppressed, reached only when the safe load fails. - Every torch.load carries a `# nosemgrep: trailofbits.python.pickles-in-pytorch.pickles-in-pytorch` on the line immediately preceding the call (Semgrep only honors adjacent suppressions) plus a per-site CWE-502 justification. Validated: scGPT and HyenaDNA load real downloaded checkpoints end-to-end; py_compile passes on all touched files. CI exercises these load paths against real (non-mocked) upstream artifacts. Refs helicalAI/dashboard#1154
…se-2026-07-10 # Conflicts: # pyproject.toml
dmiv-helical
approved these changes
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #386, which was unmergeable due to a
pyproject.tomlconflict.The conflict came from the squash-merge of #383:
main's GH-Actions pinning commit landed onreleaseas a new SHA, so re-mergingmainreplayed overlapping edits from the common base. Both branches had also bumped the version independently (main: 2.1.4, release: 2.1.3).Resolution: merged
origin/releaseinto a branch offmain, keptversion = "2.1.4"(higher, from main). Only conflict was the version line; everything else auto-merged. Net change into release is the #385 torch.load hardening + the version bump (the workflow/dependabot pinning is already on release via #383).Checks were green on #386.