[PR #245] fix: load siglip checkpoints with weights_only=True #237

New issue

Open

opened 2026-10-26 21:14:27 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 21:14:27 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/deepseek-ai/Janus/pull/245
Author: @Dextheking1
Created: 10/23/2026
Status: 🔄 Open

Base: main ← Head: fix/siglip-weights-only

📝 Commits (1)

96ed27b fix: load siglip checkpoints with weights_only=True

📊 Changes

2 files changed (+2 additions, -2 deletions)

View changed files

📝 janus/janusflow/models/siglip_vit.py (+1 -1)
📝 janus/models/siglip_vit.py (+1 -1)

📄 Description

both copies of siglip_vit.py (janus/models and janus/janusflow/models) load the vision checkpoint with a plain torch.load, and the path comes from the checkpoint config. anyone who can swap that checkpoint file gets pickle code exec at load time.

the loaded value goes straight into model.load_state_dict, both call sites. it is a plain tensor state dict, nothing else, so weights_only=True covers the load with no behavior change for real checkpoints.

verified locally: a state dict saved with torch.save loads fine with weights_only=True. a checkpoint whose pickle runs a shell command on load executes under a plain torch.load and is rejected with weights_only=True. both files compile.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/deepseek-ai/Janus/pull/245 **Author:** [@Dextheking1](https://github.com/Dextheking1) **Created:** 10/23/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/siglip-weights-only` --- ### 📝 Commits (1) - [`96ed27b`](https://github.com/deepseek-ai/Janus/commit/96ed27ba4af70641ec279de0d4ef64a4a477e0c4) fix: load siglip checkpoints with weights_only=True ### 📊 Changes **2 files changed** (+2 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `janus/janusflow/models/siglip_vit.py` (+1 -1) 📝 `janus/models/siglip_vit.py` (+1 -1) </details> ### 📄 Description both copies of siglip_vit.py (janus/models and janus/janusflow/models) load the vision checkpoint with a plain torch.load, and the path comes from the checkpoint config. anyone who can swap that checkpoint file gets pickle code exec at load time. the loaded value goes straight into model.load_state_dict, both call sites. it is a plain tensor state dict, nothing else, so weights_only=True covers the load with no behavior change for real checkpoints. verified locally: a state dict saved with torch.save loads fine with weights_only=True. a checkpoint whose pickle runs a shell command on load executes under a plain torch.load and is rejected with weights_only=True. both files compile. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-26 21:14:27 +00:00

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

deepseek-ai/Janus#237

No description provided.

Rows
Columns