Re-land cve security fix

[lucylq]

Summary: Was reverted by D78689027

Differential Revision: D88502561

[pytorch-bot]

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/executorch/16103

• 📄 Preview Python docs built from this PR

Note: Links to docs will display an error until the docs builds have been completed.

❗ 1 Active SEVs

There are 1 currently active SEVs. If your PR is affected, please view them below:

• Replace all macOS instances with nextjs due CVE-2025-55182

✅ You can merge normally! (1 Unrelated Failure)

As of commit 235f992 with merge base 4014597 ():

BROKEN TRUNK - The following job failed but were present on the merge base:

👉 Rebase onto the `viable/strict` branch to avoid these failures

• pull / android / run-emulator (gh) (trunk failure)
  Timeout waiting for emulator to boot.

This comment was automatically generated by Dr. CI and updates every 15 minutes.

[meta-codesync]

@lucylq has exported this pull request. If you are a Meta employee, you can view the originating Diff in D88502561.

[github-actions]

This PR needs a release notes: label

If your change should be included in the release notes (i.e. would users of this library care about this change?), please use a label starting with release notes:. This helps us keep track and include your important work in the next release notes.

To add a label, you can comment to pytorchbot, for example
@pytorchbot label "release notes: none"

For more information, see
https://github.com/pytorch/pytorch/wiki/PyTorch-AutoLabel-Bot#why-categorize-for-release-notes-and-how-does-it-work.

[zingo]

This extra print seem to have broken the Cortex-M size tests :(

https://ossci-raw-job-status.s3.amazonaws.com/log/pytorch/executorch/57296837413

2025-12-05T22:30:33.4891777Z + echo 'size: 135776, threshold: 135768'
2025-12-05T22:30:33.4892092Z size: 135776, threshold: 135768
2025-12-05T22:30:33.4892364Z + [[ 135776 -le 135768 ]]
2025-12-05T22:30:33.4892607Z + echo 'Fail 135776 > 135768'
2025-12-05T22:30:33.4892870Z Fail 135776 > 135768

Im not sure but it might been detected ig the trunk label was set on this PR. Mybe it should be set when the c/c++ code is changed, or maybe the size test could be moved to "pull" ?
If the later is wished for I can try to make a PR?