Update dependency joblib to v1.2.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
joblib	==1.1.0 -> ==1.2.0

GitHub Vulnerability Alerts

CVE-2022-21797

The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.

---

Release Notes

joblib/joblib (joblib)

v1.2.0

Compare Source

• Fix a security issue where eval(pre_dispatch) could potentially run
  arbitrary code. Now only basic numerics are supporthttps://github.com/joblib/joblib/pull/1327ull/1327

• Make sure that joblib works even when multiprocessing is not available,
  for instance with Pyodhttps://github.com/joblib/joblib/pull/1256ull/1256

• Avoid unnecessary warnings when workers and main process delete
  the temporary memmap folder contents concurrenthttps://github.com/joblib/joblib/pull/1263ull/1263

• Fix memory alignment bug for pickles containing numpy arrays.
  This is especially important when loading the pickle with
  mmap_mode != None as the resulting numpy.memmap object
  would not be able to correct the misalignment without performing
  a memory copy.
  This bug would cause invalid computation and segmentation faults
  with native code that would directly access the underlying data
  buffer of a numpy array, for instance C/C++/Cython code compiled
  with older GCC versions or some old OpenBLAS written in plathttps://github.com/joblib/joblib/pull/1254thub.com/Make sure arrays are bytes aligned in joblib pickles joblib/joblib#1254

• Vendor cloudpickle 2.2.0 which adds support for PyPy 3.8+.

• Vendor loky 3.3.0 which fixes several bugs including:

  • robustly forcibly terminating worker processes in case of a crash
    https://github.com/joblib/joblib/pull/1269ull/1269);

  • avoiding leaking worker processes in case of nested loky parallel
    calls;

  • reliability spawn the correct number of reusable workers.

v1.1.1

Compare Source

• Fix a security issue where eval(pre_dispatch) could potentially run
  arbitrary code. Now only basic numerics are supporthttps://github.com/joblib/joblib/pull/1327ull/1327

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[guardrails]

⚠️ We detected 4 security issues in this pull request:

Vulnerable Libraries (4)

Severity	Details
High	pkg:pypi/flask@1.1.2 (t) upgrade to: 2.3.2,70f906c51ce49c485f1d355703e9cc3386b1cc2b,afd63b16170b7c047f5758eb910c416511e9c965,2.2.5
Medium	pkg:pypi/jinja2@2.11.3 (t) upgrade to: 3.1.3
N/A	pkg:pypi/pillow@8.4.0 (t) upgrade to: 10.0.1
Low	pkg:pypi/werkzeug@1.0.1 (t) upgrade to: cf275f42acad1b5950c50ffe8ef58fe62cdce028,2.2.3

More info on how to fix Vulnerable Libraries in Python.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.