chore(backend): evaluate torch 2.11.0 to close the remaining low-severity advisories

[Abhash-Chakraborty]

Context

After the dependency sweep (#377, #379, #381) the repo is down to 5 open Dependabot alerts from 96. Four of them are torch, and they need a decision rather than a lockfile change.

Current state: torch==2.9.1, torchvision==0.24.1.

Alert	Severity	Needs	Status
#85, #87	low	torch >= 2.10.0	Possible — see below
#121, #122	low	torch >= 2.13.0	Blocked upstream

Why 2.13.0 is impossible right now

[tool.uv.sources] pulls torch from the pinned PyTorch indexes:

• pytorch-cpu publishes up to 2.13.0
• pytorch-cu128 publishes up to 2.11.0

Since the nvidia extra resolves against cu128, any pin above 2.11.0 makes find-backend[nvidia] unsatisfiable on every platform. That is exactly why Dependabot's #369 failed hardware-accel-matrix on all three runners and had to be closed. #121/#122 stay open until cu128 ships 2.13.0 — nothing to do here but wait.

What this issue is actually for: 2.9.1 → 2.11.0

2.11.0 exists on both indexes, so it would resolve and would close #85 and #87. It was deliberately not done in #377 because it is a two-minor-version jump under the whole ML stack, and mock-mode tests do not exercise any of it.

Needs validating against real inference before merging:

• transformers>=5.5.0 (captioning / SigLIP)
• open-clip-torch>=2.24.0 (embeddings)
• timm>=0.9.16
• ultralytics>=8.2.0 (YOLO detection)
• insightface==0.7.3 (faces — the usual first thing to break on a torch bump)
• torchvision needs to move to the matching 0.26.0

Acceptance criteria

• torch==2.11.0, torchvision==0.26.0 in backend/pyproject.toml
• uv sync --group dev --locked resolves on Linux, macOS, and Windows (watch hardware-accel-matrix)
• Full stack up via docker compose up --build, not the mock profile
• Upload a batch of real images and confirm all stages still produce output: embeddings, captions, OCR, object detection, face detection and clustering
• Search relevance spot-checked — embeddings changing shape or normalisation silently degrades results without erroring
• Alerts feat: add reprocess action for failed or incomplete media #85 and test: add backend API tests for upload, status, gallery, and search #87 auto-close
• Both the CPU and NVIDIA packs verified, since they resolve from different indexes

Notes

Do not bundle this with the paddlepaddle/paddleocr or onnxruntime bumps. If something regresses, the whole point is knowing it was torch.

Both remaining alerts are low severity, so there is no urgency — correctness over speed here.