[fvaloppi-nv]

Description

Restrict EgoPost checkpoint deserialization to tensors and primitive metadata.

• This was reported internally by Sonar.
• Pass weights_only=True at each EgoPost torch.load call site.
• Prevent checkpoint pickle globals from executing during model loading.
• Keep concise comments beside each loader documenting the data-only checkpoint contract.
• Do not provide an unsafe compatibility fallback.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Testing

• python3 -m compileall on all changed Python modules
• AST validation that every EgoPost torch.load call explicitly sets weights_only=True
• SKIP=check-copyright-year pre-commit run --all-files

Checklist

• The branch is based on main
• All changed Python files are formatted
• The commit includes DCO sign-off
• No unsafe deserialization fallback is present

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}