deepmodeling / deepmodeling/deepmd-gnn

[Code scan] Avoid package-wide TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD side effect

Open
#149 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
56
Forks
10
Avg merge
15d 8h
Merged PRs (30d)
12

Description

This issue was found by a Codex global scan of the repository at commit 19f9265efe8825a4383e5a13ce128361533b5ac6.

Importing `deepmd_gnn` sets `TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD=1` for the entire process:

https://github.com/deepmodeling/deepmd-gnn/blob/19f9265efe8825a4383e5a13ce128361533b5ac6/deepmd_gnn/__init__.py#L15-L16

That affects every later `torch.load()` call in the process that omits `weights_only`, not just the MACE/e3nn compatibility path that needs pickle compatibility. During the local scan, importing the package produced PyTorch warnings showing this environment variable forced `weights_only=False` in e3nn's constant loading.

There is already a scoped explicit trusted load in the MACE-OFF helper:

https://github.com/deepmodeling/deepmd-gnn/blob/19f9265efe8825a4383e5a13ce128361533b5ac6/deepmd_gnn/mace_off.py#L270-L282

Suggested fix: avoid setting this environment variable at package import time. Prefer explicit `weights_only=False` only at trusted call sites, or a narrowly scoped compatibility wrapper around imports/loads that require legacy pickle behavior.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.