Update dependency joblib to v1 [SECURITY] #72
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==0.14.0
->==1.2.0
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2022-21797
The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the
pre_dispatch
flag inParallel()
class due to theeval()
statement.Release Notes
joblib/joblib (joblib)
v1.2.0
Compare Source
Fix a security issue where
eval(pre_dispatch)
could potentially runarbitrary code. Now only basic numerics are supporthttps://github.com/joblib/joblib/pull/1327ull/1327
Make sure that joblib works even when multiprocessing is not available,
for instance with Pyodhttps://github.com/joblib/joblib/pull/1256ull/1256
Avoid unnecessary warnings when workers and main process delete
the temporary memmap folder contents concurrenthttps://github.com/joblib/joblib/pull/1263ull/1263
Fix memory alignment bug for pickles containing numpy arrays.
This is especially important when loading the pickle with
mmap_mode != None
as the resultingnumpy.memmap
objectwould not be able to correct the misalignment without performing
a memory copy.
This bug would cause invalid computation and segmentation faults
with native code that would directly access the underlying data
buffer of a numpy array, for instance C/C++/Cython code compiled
with older GCC versions or some old OpenBLAS written in plathttps://github.com/joblib/joblib/pull/1254thub.com/Make sure arrays are bytes aligned in joblib pickles joblib/joblib#1254
Vendor cloudpickle 2.2.0 which adds support for PyPy 3.8+.
Vendor loky 3.3.0 which fixes several bugs including:
robustly forcibly terminating worker processes in case of a crash
https://github.com/joblib/joblib/pull/1269ull/1269);
avoiding leaking worker processes in case of nested loky parallel
calls;
reliability spawn the correct number of reusable workers.
v1.1.1
Compare Source
eval(pre_dispatch)
could potentially runarbitrary code. Now only basic numerics are supporthttps://github.com/joblib/joblib/pull/1327ull/1327
v1.1.0
Compare Source
Fix byte order inconsistency issue during deserialization using joblib.load
in cross-endian environment: the numpy arrays are now always loaded to
use the system byte order, independently of the byte order of the system
that serialized https://github.com/joblib/joblib/pull/1181joblib/pull/1181
Fix joblib.Memory bug with the
ignore
parameter when the cached functionis a decorated functihttps://github.com/joblib/joblib/pull/1165ull/1165
Fix
joblib.Memory
to properly handle caching for functions definedinteractively in a IPython session or in Jupyter notebook cehttps://github.com/joblib/joblib/pull/1214ull/1214
Update vendored loky (from version 2.9 to 3.0) and cloudpickle (from
version 1.6 to 2https://github.com/joblib/joblib/pull/1218ull/1218
v1.0.1
Compare Source
Add check_call_in_cache method to check cache without calling function.
https://github.com/joblib/joblib/pull/820/820
dask: avoid redundant scattering of large arguments to make a more
efficient use of the network resources and avoid crashing dask with
"OSError: [Errno 55] No buffer space available"
or "ConnectionResetError: [Errno 104] connection rehttps://github.com/joblib/joblib/pull/1133b/joblib/pull/1133
v1.0.0
Compare Source
Make
joblib.hash
andjoblib.Memory
caching system compatible with `numpyRemove deprecated
check_pickle
argument indelayed
.https://github.com/joblib/joblib/pull/903/903
v0.17.0
Compare Source
Fix a spurious invalidation of
Memory.cache
'd functions called withParallel
under Jupyter or IPython.https://github.com/joblib/joblib/pull/10931093
Bump vendored loky to 2.9.0 and cloudpickle to 1.6.0. In particular
this fixes a problem to add compat for Python 3.9.
v0.16.0
Compare Source
Fix a problem in the constructors of Parallel backends classes that
inherit from the
AutoBatchingMixin
that prevented the dask backend toproperly batch short tashttps://github.com/joblib/joblib/pull/1062ull/1062
Fix a problem in the way the joblib dask backend batches calls that would
badly interact with the dask callable pickling cache and lead to wrong
results or https://github.com/joblib/joblib/pull/1055ib/pull/1055
Prevent a dask.distributed bug from surfacing in joblib's dask backend
during nested Parallel calls (due to joblib's auto-scattering featuhttps://github.com/joblib/joblib/pull/1061ull/1061
Workaround for a race condition after Parallel calls with the dask backend
that would cause low level warnings from asyncio coroutinhttps://github.com/joblib/joblib/pull/1078ull/1078
v0.15.1
Compare Source
package in their standard library.
v0.15.0
Compare Source
Drop support for Python 2 and Python 3.5. All objects in
joblib.my_exceptions
andjoblib.format_stack
are now deprecated andwill be removed in joblib 0.16. Note that no deprecation warning will be
raised for these objects Pythonhttps://github.com/joblib/joblib/pull/1018ib/pull/1018
Fix many bugs related to the temporary files and folder generated when
automatically memory mapping large numpy arrays for efficient inter-process
communication. In particular, this would cause
PermissionError
exceptionsto be raised under Windows and large leaked files in
/dev/shm
under Linuxin case of crahttps://github.com/joblib/joblib/pull/966pull/966
Make the dask backend collect results as soon as they complete
leading to a performance improvemehttps://github.com/joblib/joblib/pull/1025ull/1025
Fix the number of jobs reported by
effective_n_jobs
whenn_jobs=None
called in a parallel backend contehttps://github.com/joblib/joblib/pull/985pull/985
Upgraded vendored cloupickle to 1.4.1 and loky to 2.8.0. This allows for
Parallel calls of dynamically defined functions with type annotations
in particular.
v0.14.1
Compare Source
Configure the loky workers' environment to mitigate oversubsription with
nested multi-threaded code in the following case:
allow for a suitable number of threads for numba (
NUMBA_NUM_THREADS
);enable Interprocess Communication for scheduler coordination when the
nested code uses Threading Building Blocks (TBB) (
ENABLE_IPC=1
)https://github.com/joblib/joblib/pull/951
Fix a regression where the loky backend was not reusing previously
spawned workehttps://github.com/joblib/joblib/pull/968pull/968
Revert https://github.com/joblib/joblib/pull/847 to avoid using
pkg_resources
that introduced a performance regression under Windows:https://github.com/joblib/joblib/issues/965/965
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.