Harden optional Stable Audio dependencies

.github/workflows/ci.yml

@@ -22,6 +22,19 @@ jobs:
         run: uv run pytest -q
       - name: Ruff
         run: uv run ruff check server tests
+      # Stable Audio 3 still pins Torch 2.7.1 upstream. GERM overrides it with
+      # the validated 2.10 pair. The two remaining local-only API findings are
+      # tracked with a review deadline in SECURITY.md.
+      - name: Audit all dependency extras
+        run: |
+          uv export --all-extras --no-emit-project --no-emit-local \
+            --no-emit-package akousma --no-emit-package stable-audio-3 |
+            uvx --from pip-audit==2.10.1 pip-audit \
+              --requirement /dev/stdin \
+              --disable-pip \
+              --progress-spinner=off \
+              --ignore-vuln PYSEC-2026-139 \
+              --ignore-vuln CVE-2025-3000
       - name: Dashboard syntax
         run: |
           node --check dashboard/static/app.js

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## Unreleased
+
+- Overrode Stable Audio 3's upstream Torch 2.7.1 constraint with the locally
+  validated Torch and Torchaudio 2.10 pair, removing every fixable advisory
+  from the optional Python-provider dependency graph.
+- Added an all-extras dependency audit and a dated security exception for the
+  two remaining upstream PyTorch findings in APIs GERM does not call directly.
+- Updated Setuptools to 83.0.0 to close its Unicode-normalization sdist issue.
+
 ## 0.3.0 — Cosmoaudition, Matter Analysis, and audio reliability
 
 - Added the loopback-only Cosmoaudition bridge, explicit observation mappings,

SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes target the current `main` branch and the latest tagged minor
+release. Older release lines receive fixes only when explicitly announced.
+
+## Reporting a Vulnerability
+
+Please report security issues privately to Sonic Field Labs before public
+disclosure. Include the affected commit, local configuration, reproduction
+steps, and whether generated audio, model files, or listening records can be
+exposed.
+
+## Local-First Boundary
+
+GERM is a local sidecar. Its optional Python provider loads model and LoRA files
+only through configured model roots. Treat every model artifact as executable
+input: use the official Safetensors releases, verify provenance, and do not load
+untrusted pickle-based checkpoints.
+
+## Temporary Upstream PyTorch Exceptions
+
+Stable Audio 3 still pins PyTorch 2.7.1 upstream. GERM overrides that constraint
+with Torch and Torchaudio 2.10.0, validated on macOS by the full GERM suite and
+the upstream Stable Audio CLI suite. This removes every currently fixable
+finding below PyTorch 2.10.
+
+Two findings remain accepted temporarily for the optional local provider:
+
+| Advisory | Affected API | GERM exposure | Review deadline |
+| --- | --- | --- | --- |
+| `PYSEC-2026-139` / `CVE-2026-4538` | `torch.export.load` of `.pt2` artifacts | GERM does not call this API or accept `.pt2` model artifacts. No patched PyTorch release is currently published. | 2026-09-02 |
+| `GHSA-rrmf-rvhw-rf47` / `CVE-2025-3000` | TorchScript compilation | GERM does not compile user-supplied TorchScript. Moving to PyTorch 2.13 requires upstream Stable Audio and accelerator validation. | 2026-09-02 |
+
+The exception ends immediately if GERM begins calling either API, if its model
+trust boundary changes, or when a compatible upstream runtime is available.
+The all-extras CI audit ignores only these identifiers and fails on any new
+finding.

pyproject.toml

@@ -16,6 +16,12 @@ dependencies = [
     "uvicorn[standard]>=0.30.0",
 ]
 
+[tool.uv]
+override-dependencies = [
+    "torch==2.10.0",
+    "torchaudio==2.10.0",
+]
+
 [tool.uv.sources]
 akousma = { git = "https://github.com/sonicfieldlabs/earworm.git", tag = "v0.4.0", subdirectory = "packages/py-akousma" }
 

tests/test_project_consistency.py

@@ -43,6 +43,12 @@ def test_akousma_dependency_matches_the_current_earworm_store_contract() -> None
     assert 'path = "../earworm' not in project
 
 
+def test_stable_audio_uses_the_audited_torch_override() -> None:
+    project = _read("pyproject.toml")
+    assert '"torch==2.10.0"' in project
+    assert '"torchaudio==2.10.0"' in project
+
+
 def test_release_version_is_consistent_across_runtime_and_packaging() -> None:
     assert __version__ == "0.3.0"
     assert 'version = "0.3.0"' in _read("pyproject.toml")