Merge pull request #40 from FujitsuResearch/develop/v1-2-2

v1.2.2 -- bug-fix and add SECURITY.md

Author: FKKimura

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Change log
 
+## [v1.2.2] 2026-07-10
+
+### Bug Fix
+
+- Fixed `device="auto"` evaluation crashes in `Runner.calculate_perplexity()` and related paths by adding `ModelConfig.get_device()` and using a resolved `torch.device` for PyTorch operations such as `model.to()` and `empty_cache()`. Hugging Face `device_map="auto"` remains unchanged for model loading, but PyTorch no longer receives the raw `"auto"` string.
+
 ## [v1.2.1] 2026-07-03
 
 ### Security
@@ -8,6 +14,7 @@
   - **Breaking change**: existing callers of `load_quantized_model_pt()` must pass `allow_unsafe_deserialization=True` for trusted `.pt` files.
 - **`Quantizer.load_results()` / `ResultLoader`**: same hardening applied. Loading with `weights_only=False` now requires `allow_unsafe_deserialization=True` (added as a `ResultLoader` field), and logs a warning. The safe `weights_only=True` path is unchanged.
 - Updated docstrings, docs, and the LoRA SFT example to document the risk and the required opt-in.
+- **Credit**: this unsafe deserialization issue (CWE-502) was responsibly disclosed by **Nir Yehoshua, Cipher Security Labs**. Thank you for the report.
 
 ## [v1.2.0] 2026-06-08
 

README.md

@@ -311,6 +311,12 @@ pip install vllm
 See the [vLLM Inference guide](https://FujitsuResearch.github.io/OneCompression/user-guide/vllm-inference/) for details, including Open WebUI setup instructions.
 
 
+## 📬 Contact Us
+
+- For technical questions and feature requests, please use GitHub [Issues](https://github.com/FujitsuResearch/OneCompression/issues).
+- For security vulnerabilities, please **do not** open a public Issue. See our [Security Policy](./SECURITY.md) for how to report them privately.
+- For collaborations, partnerships, and other inquiries, please contact us at [contact-onecompression@cs.jp.fujitsu.com](mailto:contact-onecompression@cs.jp.fujitsu.com).
+
 ## 📄 License
 
 See [LICENSE](./LICENSE) for more details.

SECURITY.md

@@ -0,0 +1,45 @@
+# Security Policy
+
+## Supported Versions
+
+Security updates are provided for the latest release line of Fujitsu One Compression (OneComp).
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.2.2   | :white_check_mark: |
+| < 1.2.2 | :x:                |
+
+We recommend always upgrading to the latest release before reporting an issue.
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub Issues, discussions, or pull requests.**
+
+Instead, report them privately by email to:
+
+**[contact-onecompression@cs.jp.fujitsu.com](mailto:contact-onecompression@cs.jp.fujitsu.com)**
+
+To help us triage and resolve the issue quickly, please include as much of the following as you can:
+
+- The type of issue (e.g., remote code execution, information disclosure, denial of service).
+- The affected version(s) and, if applicable, the affected module or component.
+- Step-by-step instructions to reproduce the issue.
+- Proof-of-concept or exploit code, if available.
+- The potential impact of the issue, including how an attacker might exploit it.
+
+## Our Commitment
+
+- We will acknowledge receipt of your report within **5 business days**.
+- We will provide an initial assessment and expected timeline as soon as we have triaged the report.
+- We will keep you informed of our progress toward a fix and public disclosure.
+- We will credit you for the discovery unless you prefer to remain anonymous.
+
+Please make a good-faith effort to avoid privacy violations, data destruction, and service interruption while investigating. We ask that you give us a reasonable amount of time to address the issue before any public disclosure.
+
+Thank you for helping keep OneComp and its users safe.
+
+## Security Acknowledgments
+
+We thank the following researchers for responsibly disclosing security issues in OneComp:
+
+- **Nir Yehoshua, Cipher Security Labs** — unsafe deserialization in `QuantizedModelLoader.load_quantized_model_pt()` (CWE-502), fixed in v1.2.1.

onecomp/__version__.py

@@ -6,4 +6,4 @@
 
 """
 
-__version__ = "1.2.1"
+__version__ = "1.2.2"

onecomp/model_config.py

@@ -11,6 +11,7 @@
 import torch
 from transformers import AutoConfig, AutoModelForCausalLM, AutoTokenizer
 
+from .utils.device import get_default_device
 from .utils.dtype import needs_bfloat16
 
 try:
@@ -114,6 +115,12 @@ def load_model(self, device_map=None):
         self.logger.info("Model loaded with dtype=%s", next(model.parameters()).dtype)
         return model
 
+    def get_device(self) -> torch.device:
+        """Return a concrete torch.device for PyTorch operations."""
+        if self.device == "auto":
+            return get_default_device()
+        return torch.device(self.device)
+
     def load_tokenizer(self):
         """Load the tokenizer"""
 

onecomp/runner.py

@@ -327,7 +327,7 @@ def check(self):
 
         # MPS device validation: only GPTQ (or AutoBitQuantizer whose
         # candidates are all GPTQ, without DBF fallback) is supported on MPS
-        device = self.model_config.device
+        device = self.model_config.get_device()
         if is_mps_device(device):
             if self.multi_gpu:
                 raise ValueError("multi_gpu is not supported on MPS device.")
@@ -1139,24 +1139,24 @@ def _calculate_evaluation(
             tokenizer = self.model_config.load_tokenizer()
             original_result = eval_function(model=model, tokenizer=tokenizer, **eval_args)
             del model, tokenizer
-            empty_cache(self.model_config.device)
+            empty_cache(self.model_config.get_device())
 
         if quantized_model:
             try:
                 logger.info("Evaluating quantized model (%s)...", eval_name)
                 if self.quantized_model is not None:
                     model = self.quantized_model
-                    model.to(self.model_config.device)
+                    model.to(self.model_config.get_device())
                     tokenizer = self.model_config.load_tokenizer()
                     quantized_result = eval_function(model=model, tokenizer=tokenizer, **eval_args)
                     model.to("cpu")
                     del tokenizer
                 else:
                     model, tokenizer = self.create_quantized_model(quantizer=quantizer)
-                    model.to(self.model_config.device)
+                    model.to(self.model_config.get_device())
                     quantized_result = eval_function(model=model, tokenizer=tokenizer, **eval_args)
                     del model, tokenizer
-                empty_cache(self.model_config.device)
+                empty_cache(self.model_config.get_device())
             except NotImplementedError:
                 logger.warning(
                     "This quantization method does not support creating a quantized model; "
@@ -1171,7 +1171,7 @@ def _calculate_evaluation(
             self.update_model_weights(model, quantizer=quantizer)
             dequantized_result = eval_function(model=model, tokenizer=tokenizer, **eval_args)
             del model, tokenizer
-            empty_cache(self.model_config.device)
+            empty_cache(self.model_config.get_device())
 
         return original_result, dequantized_result, quantized_result
 
@@ -2117,7 +2117,7 @@ def analyze_cumulative_error(
             )
             # Release fragmented GPU memory from previous operations (e.g., run())
             gc.collect()
-            empty_cache(self.model_config.device)
+            empty_cache(self.model_config.get_device())
 
             model = self.model_config.load_model()
             input_device = next(model.parameters()).device
@@ -2141,7 +2141,7 @@ def analyze_cumulative_error(
                 )
                 # Release fragmented GPU memory from previous operations (e.g., run())
                 gc.collect()
-                empty_cache(self.model_config.device)
+                empty_cache(self.model_config.get_device())
 
                 model = self.model_config.load_model()
                 input_device = next(model.parameters()).device