fix(security): Upgrade PyTorch to 2.6.0 (Dependabot #61)

[POWERFULMOVES]

Summary

Addresses critical CVE in torch.load with weights_only=True (Dependabot alert #61).

Changes

Package	Before	After
torch	2.3.1+cu121	2.6.0+cu124
torchvision	0.18.1+cu121	0.21.0+cu124
torchaudio	2.3.1+cu121	2.6.0+cu124

⚠️ Breaking Change

• Requires CUDA 12.4 runtime (was CUDA 12.1)
• Affects media-video service Docker image

Testing

• Rebuild media-video Docker image
• Verify YOLO object detection still works
• Run make smoke after rebuild

Related

• Dependabot alert: https://github.com/POWERFULMOVES/PMOVES.AI/security/dependabot/61

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated PyTorch dependencies to version 2.6.0 with CUDA 12.4 support
  • Updated associated package versions for improved compatibility
  • Updated security baseline requirements

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Walkthrough

The requirements.txt file for the media-video service is updated to upgrade PyTorch and dependencies from CUDA 12.1 (cu121) to CUDA 12.4 (cu124) wheels, updating package versions to 2.6.0 and related versions, while maintaining CPU fallback support.

Changes

Cohort / File(s)	Summary
PyTorch and CUDA dependency upgrade pmoves/services/media-video/requirements.txt	Replaces cu121 CPU/CUDA PyTorch pins with cu124 pins; updates package versions to 2.6.0/0.21.0+/2.6.0; adds cu124 extra-index-url; updates security note to reference newer minimums; maintains CPU fallback for non-x86_64 systems

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Verify CUDA 12.4 compatibility — Ensure that the CUDA 12.4 wheels are compatible with the target deployment environments and that no breaking changes exist in the dependency versions.
• Test CPU fallback path — Confirm that the CPU fallback configuration for non-x86_64 systems works correctly with the updated versions.

Poem

🐰 A hop, skip, and CUDA jump we take,
From one-two-one to one-two-four we remake,
PyTorch wheels now spin with newfound grace,
Twenty-point-six leads the race! 🚀

Pre-merge checks and finishing touches

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The PR description includes a summary and testing section, but the Required Checks, Review Coordination, and Follow-up Tasks sections from the template are missing or incomplete.	Complete all template sections: check off Required Checks items, confirm Codex/Copilot review requests, and document any follow-up tasks needed beyond this PR.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: upgrading PyTorch to version 2.6.0 to address a security issue, with reference to the Dependabot alert.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/pytorch-security-upgrade

---

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7beb60c and ac57c2f.

📒 Files selected for processing (1)

• pmoves/services/media-video/requirements.txt

🧰 Additional context used

🧠 Learnings (2)

📚 Learning: 2025-12-07T11:03:07.638Z

Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: GEMINI.md:0-0
Timestamp: 2025-12-07T11:03:07.638Z
Learning: Applies to **/pmoves/**/{media,analysis,pipeline}*.py : Implement `media-video` and `media-audio` analysis pipelines with GPU auto-detect for faster-whisper

Applied to files:

• pmoves/services/media-video/requirements.txt

📚 Learning: 2025-12-15T12:01:31.388Z

Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: pmoves/docs/ARTSTUFF/realtime/CLAUDE.md:0-0
Timestamp: 2025-12-15T12:01:31.388Z
Learning: Applies to pmoves/docs/ARTSTUFF/realtime/**/install.js : For AI/ML projects using PyTorch and related libraries, use the built-in torch.js script with parameters (xformers, triton, sageattention) to install cross-platform PyTorch dependencies

Applied to files:

• pmoves/services/media-video/requirements.txt

🪛 OSV Scanner (2.3.0)

pmoves/services/media-video/requirements.txt

[HIGH] 1-1: starlette 0.38.6: Starlette has possible denial-of-service vector when parsing large files in multipart forms

(GHSA-2c2j-9gv5-cj73)

---

[HIGH] 1-1: starlette 0.38.6: Starlette Denial of service (DoS) via multipart/form-data

(GHSA-f96h-pmfr-66vw)

---

[HIGH] 1-1: urllib3 1.26.20: urllib3 streaming API improperly handles highly compressed data

(GHSA-2xpw-w6gg-jr37)

---

[HIGH] 1-1: urllib3 1.26.20: urllib3 allows an unbounded number of links in the decompression chain

(GHSA-gm62-xv2j-4w53)

---

[HIGH] 1-1: urllib3 1.26.20: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

(GHSA-pq67-6m6q-mj2v)

🔇 Additional comments (1)

pmoves/services/media-video/requirements.txt (1)

1-10: Verify PyTorch 2.6.0 with torchvision 0.21.0 compatibility before merging.

PyTorch 2.6.0 addresses critical CVE-2025-32434 in torch.load, making this security update justified. However, a known compatibility issue exists: torchvision 0.21.0's wheel metadata declares torch >=2.8.0 as required, conflicting with torch 2.6.0.

Before merging:

1. Verify the torchvision 0.21.0 metadata issue is resolved or use a compatible torchvision version
2. Confirm Docker image for media-video service is updated to CUDA 12.4
3. Validate YOLO object detection and smoke tests pass post-upgrade

The CUDA 12.4 configuration and platform-specific pins are correctly set.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

pmoves/services/media-video/requirements.txt (1)

12-24: Address transitive dependency vulnerabilities in starlette and urllib3.

Static analysis detected vulnerabilities in starlette and urllib3, which are transitive dependencies of FastAPI and requests/boto3:

• GHSA-f96h-pmfr-66vw: HIGH severity (8.7 CVSS) DoS in starlette <0.40.0 via multipart/form-data
• GHSA-2c2j-9gv5-cj73: MEDIUM severity (5.3 CVSS) DoS in starlette <0.47.2 when parsing large multipart files
• GHSA-gm62-xv2j-4w53: HIGH severity (8.9 CVSS) unbounded decompression chain in urllib3 versions prior to 2.6.0

FastAPI 0.114.2 allows starlette <0.42.0 (>=0.40.0), which mitigates GHSA-f96h-pmfr-66vw but leaves the service vulnerable to GHSA-2c2j-9gv5-cj73 and urllib3 compression vulnerabilities. Upgrade FastAPI to a version supporting starlette >=0.47.2, and ensure urllib3 is updated to 2.6.0 or later to address the decompression attack surface in multipart upload and HTTP client functionality.

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7beb60c and ac57c2f.

📒 Files selected for processing (1)

• pmoves/services/media-video/requirements.txt

🧰 Additional context used

🧠 Learnings (2)

📚 Learning: 2025-12-07T11:03:07.638Z

Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: GEMINI.md:0-0
Timestamp: 2025-12-07T11:03:07.638Z
Learning: Applies to **/pmoves/**/{media,analysis,pipeline}*.py : Implement `media-video` and `media-audio` analysis pipelines with GPU auto-detect for faster-whisper

Applied to files:

• pmoves/services/media-video/requirements.txt

📚 Learning: 2025-12-15T12:01:31.388Z

Learnt from: CR
Repo: POWERFULMOVES/PMOVES.AI PR: 0
File: pmoves/docs/ARTSTUFF/realtime/CLAUDE.md:0-0
Timestamp: 2025-12-15T12:01:31.388Z
Learning: Applies to pmoves/docs/ARTSTUFF/realtime/**/install.js : For AI/ML projects using PyTorch and related libraries, use the built-in torch.js script with parameters (xformers, triton, sageattention) to install cross-platform PyTorch dependencies

Applied to files:

• pmoves/services/media-video/requirements.txt

🪛 OSV Scanner (2.3.0)

pmoves/services/media-video/requirements.txt

[HIGH] 1-1: starlette 0.38.6: Starlette has possible denial-of-service vector when parsing large files in multipart forms

(GHSA-2c2j-9gv5-cj73)

---

[HIGH] 1-1: starlette 0.38.6: Starlette Denial of service (DoS) via multipart/form-data

(GHSA-f96h-pmfr-66vw)

---

[HIGH] 1-1: urllib3 1.26.20: urllib3 streaming API improperly handles highly compressed data

(GHSA-2xpw-w6gg-jr37)

---

[HIGH] 1-1: urllib3 1.26.20: urllib3 allows an unbounded number of links in the decompression chain

(GHSA-gm62-xv2j-4w53)

---

[HIGH] 1-1: urllib3 1.26.20: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

(GHSA-pq67-6m6q-mj2v)

🔇 Additional comments (1)

pmoves/services/media-video/requirements.txt (1)

1-10: Verify PyTorch 2.6.0 with torchvision 0.21.0 compatibility before merging.

PyTorch 2.6.0 addresses critical CVE-2025-32434 in torch.load, making this security update justified. However, a known compatibility issue exists: torchvision 0.21.0's wheel metadata declares torch >=2.8.0 as required, conflicting with torch 2.6.0.

Before merging:

1. Verify the torchvision 0.21.0 metadata issue is resolved or use a compatible torchvision version
2. Confirm Docker image for media-video service is updated to CUDA 12.4
3. Validate YOLO object detection and smoke tests pass post-upgrade

The CUDA 12.4 configuration and platform-specific pins are correctly set.