Security updates are provided for the latest published release of koopman-graph on PyPI.

Check the installed version with:

python -c "import koopman_graph; print(koopman_graph.__version__)"

Upgrade when a fixed release is available:

pip install -U koopman-graph

Please do not open a public GitHub issue for security vulnerabilities.

Report privately by email to the maintainer:

travis.j.kessler@gmail.com

Include:

• A description of the issue and its impact
• Steps to reproduce or a proof of concept (if available)
• Affected versions / commit if known

You should receive an acknowledgment when the report is reviewed. Fixes are coordinated with the reporter when practical before a public disclosure or release notes mention.

This channel is the same maintainer contact used for Code of Conduct enforcement.

Model checkpoints, conformal calibration files, hierarchical wrappers, and on-disk teaching caches (*.pt) are loaded with PyTorch torch.load(..., weights_only=False). That API deserializes Python objects and can execute code from a malicious file.

Trust boundary: only load checkpoints and cache artifacts that you created yourself or obtained from a source you trust. Do not load untrusted .pt / checkpoint files shared over the network or from unknown mirrors. Prefer rebuilding teaching caches with the repository download scripts (SHA256-verified where digests are pinned) rather than accepting third-party traffic.pt / contact.pt blobs.