Bump torch to 2.6.0+cpu — required for torch.load on .bin model weights

CVE-2025-32434: transformers raises ValueError when loading pickle-based
.bin weights (ClinicalBERT, chest ViT) with torch < 2.6. Models using
safetensors (google/vit-base-patch16-224) were unaffected. Upgrade to
torch 2.6.0+cpu / torchvision 0.21.0+cpu to satisfy the requirement.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -19,7 +19,7 @@ RUN grep -vE "^(torch|torchvision)" requirements.txt | \
 # no choice but to install the CPU build. Running this after step 1 means
 # nothing can overwrite it.
 RUN pip install --no-cache-dir \
-    torch==2.4.0+cpu torchvision==0.19.0+cpu \
+    torch==2.6.0+cpu torchvision==0.21.0+cpu \
     --index-url https://download.pytorch.org/whl/cpu
 
 # Step 3: smoke test — if torch cannot be imported the build fails here

requirements.txt

@@ -8,8 +8,8 @@ huggingface_hub>=0.23.0
 sentence-transformers>=2.7.0
 transformers>=4.40.0
 # Installed from PyTorch CPU wheel server in Dockerfile (see step 2)
-torch==2.4.0+cpu
-torchvision==0.19.0+cpu
+torch==2.6.0+cpu
+torchvision==0.21.0+cpu
 
 # Image processing
 Pillow>=10.0.0