Update dependency joblib to v1 [SECURITY]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
joblib	==0.17.0 -> ==1.2.0

GitHub Vulnerability Alerts

CVE-2022-21797

The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.

---

Release Notes

joblib/joblib (joblib)

v1.2.0

Compare Source

• Fix a security issue where eval(pre_dispatch) could potentially run
  arbitrary code. Now only basic numerics are supporthttps://github.com/joblib/joblib/pull/1327ull/1327

• Make sure that joblib works even when multiprocessing is not available,
  for instance with Pyodhttps://github.com/joblib/joblib/pull/1256ull/1256

• Avoid unnecessary warnings when workers and main process delete
  the temporary memmap folder contents concurrenthttps://github.com/joblib/joblib/pull/1263ull/1263

• Fix memory alignment bug for pickles containing numpy arrays.
  This is especially important when loading the pickle with
  mmap_mode != None as the resulting numpy.memmap object
  would not be able to correct the misalignment without performing
  a memory copy.
  This bug would cause invalid computation and segmentation faults
  with native code that would directly access the underlying data
  buffer of a numpy array, for instance C/C++/Cython code compiled
  with older GCC versions or some old OpenBLAS written in plathttps://github.com/joblib/joblib/pull/1254thub.com/Make sure arrays are bytes aligned in joblib pickles joblib/joblib#1254

• Vendor cloudpickle 2.2.0 which adds support for PyPy 3.8+.

• Vendor loky 3.3.0 which fixes several bugs including:

  • robustly forcibly terminating worker processes in case of a crash
    https://github.com/joblib/joblib/pull/1269ull/1269);

  • avoiding leaking worker processes in case of nested loky parallel
    calls;

  • reliability spawn the correct number of reusable workers.

v1.1.1

Compare Source

• Fix a security issue where eval(pre_dispatch) could potentially run
  arbitrary code. Now only basic numerics are supporthttps://github.com/joblib/joblib/pull/1327ull/1327

v1.1.0

Compare Source

• Fix byte order inconsistency issue during deserialization using joblib.load
  in cross-endian environment: the numpy arrays are now always loaded to
  use the system byte order, independently of the byte order of the system
  that serialized https://github.com/joblib/joblib/pull/1181joblib/pull/1181

• Fix joblib.Memory bug with the ignore parameter when the cached function
  is a decorated functihttps://github.com/joblib/joblib/pull/1165ull/1165

• Fix joblib.Memory to properly handle caching for functions defined
  interactively in a IPython session or in Jupyter notebook cehttps://github.com/joblib/joblib/pull/1214ull/1214

• Update vendored loky (from version 2.9 to 3.0) and cloudpickle (from
  version 1.6 to 2https://github.com/joblib/joblib/pull/1218ull/1218

v1.0.1

Compare Source

• Add check_call_in_cache method to check cache without calling function.
  https://github.com/joblib/joblib/pull/820/820

• dask: avoid redundant scattering of large arguments to make a more
  efficient use of the network resources and avoid crashing dask with
  "OSError: [Errno 55] No buffer space available"
  or "ConnectionResetError: [Errno 104] connection rehttps://github.com/joblib/joblib/pull/1133b/joblib/pull/1133

v1.0.0

Compare Source

• Make joblib.hash and joblib.Memory caching system compatible with `numpy

  = 1.20.0. Also make it explicit in the documentation that users should now expect to have their joblib.Memorycache invalidated when eitherjoblibor a third party library involved in the cached values definition is upgraded. In particular, users updatingjoblibto a release that includes this fix will see their previous cache invalidated if they contained reference tonumpy` objects.https://github.com/joblib/joblib/pull/1136ll/1136

• Remove deprecated check_pickle argument in delayed.
  https://github.com/joblib/joblib/pull/903/903

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.