docs(models): pickle weight files are rejected by default; document trust_pickle The docs listed pytorch_model.bin (and .bin/.pt/.pth) as accepted LLM weight formats with no caveat. The runtime runs every declared weights path for a `file`-source model through reject_unsafe_weight_formats, which fails the load with UnsafePickleWeight for .bin/.pt/.pth/.ckpt unless trust_pickle is set — a parameter that was undocumented in every version despite being security-relevant. Marked those formats rejected-by-default, added the missing .ckpt extension, and documented the trust_pickle parameter. Propagated to version-2.1.x, which has both the guard and the ParameterSpec.

docs(models): pickle weight files are rejected by default; document trust_pickle The docs listed pytorch_model.bin (and .bin/.pt/.pth) as accepted LLM weight formats with no caveat. The runtime runs every declared weights path for a `file`-source model through reject_unsafe_weight_formats, which fails the load with UnsafePickleWeight for .bin/.pt/.pth/.ckpt unless trust_pickle is set — a parameter that was undocumented in every version despite being security-relevant. Marked those formats rejected-by-default, added the missing .ckpt extension, and documented the trust_pickle parameter. Propagated to version-2.1.x, which has both the guard and the ParameterSpec.