Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency joblib to v1 [security] #8

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jan 13, 2023

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
joblib ==0.14.1 -> ==1.2.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-21797

The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.


Release Notes

joblib/joblib (joblib)

v1.2.0

Compare Source

  • Fix a security issue where eval(pre_dispatch) could potentially run
    arbitrary code. Now only basic numerics are supporthttps://github.com/joblib/joblib/pull/1327ull/1327

  • Make sure that joblib works even when multiprocessing is not available,
    for instance with Pyodhttps://github.com/joblib/joblib/pull/1256ull/1256

  • Avoid unnecessary warnings when workers and main process delete
    the temporary memmap folder contents concurrenthttps://github.com/joblib/joblib/pull/1263ull/1263

  • Fix memory alignment bug for pickles containing numpy arrays.
    This is especially important when loading the pickle with
    mmap_mode != None as the resulting numpy.memmap object
    would not be able to correct the misalignment without performing
    a memory copy.
    This bug would cause invalid computation and segmentation faults
    with native code that would directly access the underlying data
    buffer of a numpy array, for instance C/C++/Cython code compiled
    with older GCC versions or some old OpenBLAS written in plathttps://github.com/joblib/joblib/pull/1254thub.com/Make sure arrays are bytes aligned in joblib picklesΒ joblib/joblib#1254

  • Vendor cloudpickle 2.2.0 which adds support for PyPy 3.8+.

  • Vendor loky 3.3.0 which fixes several bugs including:

    • robustly forcibly terminating worker processes in case of a crash
      https://github.com/joblib/joblib/pull/1269ull/1269);

    • avoiding leaking worker processes in case of nested loky parallel
      calls;

    • reliability spawn the correct number of reusable workers.

v1.1.1

Compare Source

v1.1.0

Compare Source

v1.0.1

Compare Source

v1.0.0

Compare Source

  • Make joblib.hash and joblib.Memory caching system compatible with `numpy

    = 1.20.0. Also make it explicit in the documentation that users should now expect to have their joblib.Memorycache invalidated when eitherjoblibor a third party library involved in the cached values definition is upgraded. In particular, users updatingjoblibto a release that includes this fix will see their previous cache invalidated if they contained reference tonumpy` objects.https://github.com/joblib/joblib/pull/1136ll/1136

  • Remove deprecated check_pickle argument in delayed.
    https://github.com/joblib/joblib/pull/903/903

v0.17.0

Compare Source

  • Fix a spurious invalidation of Memory.cache'd functions called with
    Parallel under Jupyter or IPython.
    https://github.com/joblib/joblib/pull/10931093

  • Bump vendored loky to 2.9.0 and cloudpickle to 1.6.0. In particular
    this fixes a problem to add compat for Python 3.9.

v0.16.0

Compare Source

v0.15.1

Compare Source

  • Make joblib work on Python 3 installation that do not ship with the lzma
    package in their standard library.

v0.15.0

Compare Source

  • Drop support for Python 2 and Python 3.5. All objects in
    joblib.my_exceptions and joblib.format_stack are now deprecated and
    will be removed in joblib 0.16. Note that no deprecation warning will be
    raised for these objects Pythonhttps://github.com/joblib/joblib/pull/1018ib/pull/1018

  • Fix many bugs related to the temporary files and folder generated when
    automatically memory mapping large numpy arrays for efficient inter-process
    communication. In particular, this would cause PermissionError exceptions
    to be raised under Windows and large leaked files in /dev/shm under Linux
    in case of crahttps://github.com/joblib/joblib/pull/966pull/966

  • Make the dask backend collect results as soon as they complete
    leading to a performance improvemehttps://github.com/joblib/joblib/pull/1025ull/1025

  • Fix the number of jobs reported by effective_n_jobs when n_jobs=None
    called in a parallel backend contehttps://github.com/joblib/joblib/pull/985pull/985

  • Upgraded vendored cloupickle to 1.4.1 and loky to 2.8.0. This allows for
    Parallel calls of dynamically defined functions with type annotations
    in particular.


Configuration

πŸ“… Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

β™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

πŸ”• Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@vercel
Copy link

vercel bot commented Jan 13, 2023

The latest updates on your projects. Learn more about Vercel for Git β†—οΈŽ

Name Status Preview Comments Updated (UTC)
sheetson-docs βœ… Ready (Inspect) Visit Preview πŸ’¬ Add feedback Jul 7, 2023 5:52pm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants