nanochat's checkpoint converter is missing the TRUST_REMOTE_CODE guard every other pickle.load site in the repo has

[vishalkelur28-cyber]

transformers already has a consistent internal pattern for safely reading pickled checkpoint files: check os.environ.get("TRUST_REMOTE_CODE") and raise a clear warning before calling pickle.load. It's used in convert_maskformer_resnet_to_pytorch.py, convert_reformer_trax_checkpoint_to_pytorch.py, convert_perceiver_haiku_to_pytorch.py, retrieval_rag.py (twice), and olmo3/convert_olmo3_weights_to_hf.py.

src/transformers/models/nanochat/convert_nanochat_checkpoints.py calls pickle.load(f) directly with no such guard, wrapped only in a generic try/except that just prints a warning if it fails. Since nanochat looks like a recently added model, this was probably just missed rather than a deliberate choice. Worth adding the same guard for consistency with the rest of the conversion scripts.

https://github.com/huggingface/transformers/blob/main/src/transformers/models/nanochat/convert_nanochat_checkpoints.py#L237

For comparison, the guarded pattern: https://github.com/huggingface/transformers/blob/main/src/transformers/models/reformer/convert_reformer_trax_checkpoint_to_pytorch.py#L195

Found via a static analysis pass with ArchSetu (archsetu.com). Full report at https://www.archsetu.com/r/huggingface/transformers if useful for spotting other patterns across the codebase.

[jyothimalla]

Hi @vishalkelur28-cyber,
I looked into this — confirmed convert_nanochat_checkpoints.py calls pickle.load(f) directly with no TRUST_REMOTE_CODE check, while the referenced files (reformer, perceiver, maskformer, olmo3, retrieval_rag) all have the same manually-repeated guard before their pickle.load calls. I'd like to add the same guard here for consistency. If this is okay, I will open a PR shortly.