Fixes a critical security vulnerability where malicious model checkpoints
could execute arbitrary code through pickle deserialization.
Changes:
- wan/modules/vae.py: Add weights_only=True to torch.load()
- wan/modules/clip.py: Add weights_only=True to torch.load()
- wan/modules/t5.py: Add weights_only=True to torch.load()
This prevents arbitrary code execution when loading untrusted checkpoints
while maintaining full compatibility with legitimate model weights.
Security Impact: Critical - prevents RCE attacks
Breaking Changes: None - weights_only=True is compatible with all standard
PyTorch state_dict files
