chore: release main

[github-actions]

Summary

Prepare ModelAudit 0.2.53 and modelaudit-picklescan 0.1.11. Require PickleScan 0.1.11 so installed root packages include the advertised tensor-batch fixes. Keep Unreleased first, classify shipped fixes under their release, remove duplicate notes and the root-only cache claim from the standalone changelog, and update the root comparison link.

Validation

• 175 release and dependency tests passed. Ruff format/lint and Linux-platform mypy across 479 files passed.
• Rust fmt, check, Clippy, and all 187 Rust tests passed.
• Both wheel/sdist builds and Twine checks passed. Source archive metadata matches the checkout; the root wheel requires PickleScan >=0.1.11.
• Fresh-environment standalone and combined wheel installs passed: the benign pickle is complete/clean and the inert dangerous-global control remains malicious.
• Dependency audit passed with the repository's existing CVE-2026-4539 exception.
• macOS Python 3.11 fast suite: 12,519 passed and 11 skipped before the SafeTensors shard-location assertion failed. The exact failing test reproduces on current main 9631527b. The five native macOS mypy extended-attribute stub errors also match that main exactly.
• Frozen all-ci installation succeeds. macOS universal lock checking attempts an unsupported TensorRT wheel; current-head Linux lock CI is still required.

Runtime, package, and install validation above is anchored at 118e6722c5fe098711b916b31b190fd629338bc6. Documentation follow-up 5fcdea869a191a2e609b6b37316a7b5bdb0b1853 aligns all four dependency-floor references in the agent/release guides with the runtime requirement. Ruff and the reference consistency check passed again; the required fast-suite rerun again passed 12,519 tests with 11 skips before the same baseline SafeTensors assertion, and native macOS mypy results still match main exactly. Required current-head CI and code-owner review must pass before merge.

0.2.53

0.2.53 (2026-09-08)

Bug Fixes

• Upgrade locked GitPython to 3.1.59 to address four dependency audit advisories.
• Require modelaudit-picklescan 0.1.11 so installations include the bounded PyTorch tensor-batch fixes.
• cache: ignore macOS file access-time events (#1821) (b5341b5)
• cache: isolate Windows probes and stabilize nightly checks (#1782) (47f94ee)
• cache: keep Windows probes out of concurrently scanned trees (#1795) (c29586b)
• cache: preserve locked probes under directory aliases (#1787) (caa2afe)
• cache: preserve macOS entries during ancestor churn (#1800) (2c3512b)
• cache: preserve Windows source fingerprint cache hits (#1793) (f27ebac)
• cache: update scan-result entries atomically on hits (#1809) (a9720c0)
• ci: accept rotated pinned checkout digests (#1799) (704e070)
• ci: route hash timing test to performance lane (#1824) (b4c10f2)
• deps: bump gitpython from 3.1.51 to 3.1.54 (#1786) (32de965)
• deps: harden audit coverage and vulnerable packages (#1808) (995767e)
• deps: prevent incompatible XGBoost Renovate upgrades (#1810) (ee2025e)
• deps: update dependency xgboost to >=3.4,<3.5 (#1805) (e84cf95)
• docker: upgrade vulnerable util-linux runtime packages (#1813) (521e941)
• joblib: fail closed on inconclusive warning scans (#1796) (a54bddc)
• mlflow: restore SQL-backed registry support (#1818) (3e4e3c9)
• network: block README remote-code trust bypasses (#1788) (65111fe)
• network: preserve detections in README environment files (#1790) (5c1b267)
• network: reject side-effectful model-card image examples (#1825) (56417b8)
• picklescan: diagnose Windows call-graph source-stability failures (#1789) (89b5024)
• picklescan: safely parse bounded PyTorch tensor batches (#1783) (705059c)
• recognize bounded official image downloads in model cards (#1784) (64d4f52)
• remove tensor_name_count retention budget dimension for remote SafeTensors (#1822) (4c24e17)
• safely suppress verified Hugging Face model-card image examples (#1791) (6ee2b36)
• tests: preserve fail-closed multi-array Joblib scans (#1819) (217f127)
• validate manual release versions before outputs (#1794) (13431f6)
• ggml: detect embedded ZIP payloads, avoid false positives from tensor-data signatures, and preserve incomplete-scan diagnostics (#1780) (9631527)
• preserve caller-owned Hugging Face cache sidecars (#1792) (eeb0be6)

0.1.11

0.1.11 (2026-09-08)

Bug Fixes

• Report which snapshot gate invalidated a shared call-graph source-stability failure (#1789) (89b5024)
• Validate bounded batched PyTorch state-dictionary entries without falsely flagging canonical tensor reconstruction (#1783) (705059c)
• Keep scanning storage members between the trusted and expanded pickle probe sizes.

This release PR was generated with Release Please.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7443a9b4b3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cfcbce8b27

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 76ac63fdb3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 85c5e7e1cb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ee98d35ec4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3d128f4624

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T06:39:22.338408Z	5fcdea8	New commits
🔒 Security Review	✅ Completed 2026-09-08T06:43:14.854512Z	5fcdea8	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Workflow run and artifacts

Performance Benchmarks

Compared 13 shared benchmarks with a regression threshold of 15%.
Status: 0 regressions, 0 improved, 13 stable, 0 new, 0 missing.
Aggregate shared-benchmark median: 4.402s -> 4.270s (-3.0%).

Workload	Benchmark	Target	Size	Files	Baseline	Current	Change	Status
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_raw]	nested_raw	78 B	1	294.6us	279.4us	-5.1%	stable
rejected-basic-auth-candidates	tests/benchmarks/test_scan_benchmarks.py::test_rejected_basic_auth_candidates_scan_linearly	-	371.1 KiB	1	2.531s	2.408s	-4.9%	stable
direct-malicious-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_direct_malicious_upload	malicious_reduce	52 B	1	222.8us	232.5us	+4.4%	stable
suspicious-pickle-intake	tests/benchmarks/test_scan_benchmarks.py::test_scan_suspicious_pickle_intake	suspicious-intake	183.8 KiB	4	154.07ms	149.82ms	-2.8%	stable
warm-cache-rescan	tests/benchmarks/test_scan_benchmarks.py::test_scan_warm_cached_repository_rescan	release-candidate	547.3 KiB	32	156.24ms	153.70ms	-1.6%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_base64]	nested_base64	98 B	1	308.2us	303.8us	-1.4%	stable
chunked-upload-stream	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_chunked_upload_stream	chunked_stream	278.2 KiB	1	113.51ms	114.87ms	+1.2%	stable
nested-payload-review	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payload_review[nested_hex]	nested_hex	130 B	1	322.1us	318.5us	-1.1%	stable
single-checkpoint-preflight	tests/benchmarks/test_scan_benchmarks.py::test_scan_single_checkpoint_before_load	single_checkpoint.pkl	183.0 KiB	1	105.53ms	104.45ms	-1.0%	stable
clean-training-checkpoint	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_clean_training_checkpoint	safe_large	278.2 KiB	1	110.36ms	111.15ms	+0.7%	stable
padded-multi-stream-upload	tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_padded_multi_stream_upload	multi_stream_padded	4.1 KiB	1	358.0us	355.8us	-0.6%	stable
mixed-model-repository	tests/benchmarks/test_scan_benchmarks.py::test_scan_release_candidate_repository	release-candidate	547.3 KiB	32	653.04ms	650.51ms	-0.4%	stable
duplicate-heavy-registry	tests/benchmarks/test_scan_benchmarks.py::test_scan_duplicate_registry_snapshot	registry-snapshot	915.2 KiB	13	577.21ms	576.12ms	-0.2%	stable

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 118e6722c5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Unknown error

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".