deepmodeling / deepmodeling/deepmd-gnn
[Code scan] Avoid package-wide TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD side effect
- Dominant language
- Python
- Stars
- 56
- Forks
- 10
- Avg merge
- 15d 8h
- Merged PRs (30d)
- 12
Description
This issue was found by a Codex global scan of the repository at commit 19f9265efe8825a4383e5a13ce128361533b5ac6.
Importing `deepmd_gnn` sets `TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD=1` for the entire process:
https://github.com/deepmodeling/deepmd-gnn/blob/19f9265efe8825a4383e5a13ce128361533b5ac6/deepmd_gnn/__init__.py#L15-L16
That affects every later `torch.load()` call in the process that omits `weights_only`, not just the MACE/e3nn compatibility path that needs pickle compatibility. During the local scan, importing the package produced PyTorch warnings showing this environment variable forced `weights_only=False` in e3nn's constant loading.
There is already a scoped explicit trusted load in the MACE-OFF helper:
https://github.com/deepmodeling/deepmd-gnn/blob/19f9265efe8825a4383e5a13ce128361533b5ac6/deepmd_gnn/mace_off.py#L270-L282
Suggested fix: avoid setting this environment variable at package import time. Prefer explicit `weights_only=False` only at trusted call sites, or a narrowly scoped compatibility wrapper around imports/loads that require legacy pickle behavior.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.