Bump the pip group across 1 directory with 11 updates #77

dependabot · 2024-06-17T23:44:31Z

Bumps the pip group with 11 updates in the /script/get-dataset-cifar10 directory:

Package	From	To
certifi	`2020.12.5`	`2023.7.22`
grpcio	`1.34.0`	`1.53.2`
idna	`2.10`	`3.7`
joblib	`1.1.1`	`1.2.0`
pillow	`8.1.0`	`10.3.0`
protobuf	`3.14.0`	`3.18.3`
requests	`2.25.1`	`2.32.2`
scikit-learn	`0.24.1`	`1.5.0`
tensorflow	`2.5.0`	`2.11.1`
urllib3	`1.26.3`	`1.26.19`
werkzeug	`1.0.1`	`3.0.3`

Updates certifi from 2020.12.5 to 2023.7.22

Commits

8fb96ed 2023.07.22
afe7722 Bump actions/setup-python from 4.6.1 to 4.7.0 (#230)
2038739 Bump dessant/lock-threads from 3.0.0 to 4.0.1 (#229)
44df761 Hash pin Actions and enable dependabot (#228)
8b3d7ba 2023.05.07
53da240 ci: Add Python 3.12-dev to the testing (#224)
c2fc3b1 Create a Security Policy (#222)
c211ef4 Set up permissions to github workflows (#218)
2087de5 Don't let deprecation warning fail CI (#219)
e0b9fc5 remove paragraphs about 1024-bit roots from README
Additional commits viewable in compare view

Updates grpcio from 1.34.0 to 1.53.2

Release notes

Sourced from grpcio's releases.

Release v1.53.2

This is release gRPC Core 1.53.2 (glockenspiel).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Core

[backport][iomgr][EventEngine] Improve server handling of file descriptor exhaustion by @drfloob in grpc/grpc#33672

Release v1.53.1

This is release gRPC Core 1.53.1 (glockenspiel).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Fixed CVE-2023-32731

Fixed CVE-2023-32732

Release v1.53.0

This is release 1.53.0 (glockenspiel) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

xDS: fix crash when removing the last endpoint from the last locality in weighted_target. (#32592)

filter stack: pass peer name up via recv_initial_metadata batch. (#31933)

[EventEngine] Add advice against blocking work in callbacks. (#32397)

[http2] Dont drop connections on metadata limit exceeded. (#32309)

xDS: reject aggregate cluster with empty cluster list. (#32238)

Fix Python epoll1 Fork Support. (#32196)

server: introduce ServerMetricRecorder API and move per-call reporting from a C++ interceptor to a C-core filter. (#32106)

[EventEngine] Add invalid handle types to the public API. (#32202)

[EventEngine] Refactoring the EventEngine Test Suite: Part 1. (#32127)

xDS: fix WeightedClusters total weight handling. (#32134)

C++

Update minimum MSVC version to 2019. (#32615)

Use CMake variables for paths in pkg-config files. (#31671)

... (truncated)

Changelog

Sourced from grpcio's changelog.

gRPC Release Schedule

Below is the release schedule for gRPC Java, Go and Core and its dependent languages C++, C#, Objective-C, PHP, Python and Ruby.

Releases are scheduled every six weeks on Tuesdays on a best effort basis. In some unavoidable situations a release may be delayed or released early or a language may skip a release altogether and do the next release to catch up with other languages. See the past releases in the links above. A six-week cycle gives us a good balance between delivering new features/fixes quickly and keeping the release overhead low.

The gRPC release support policy can be found here.

Releases are cut from release branches. For Core and Java repos, the release branch is cut two weeks before the scheduled release date. For Go, the branch is cut just before the release. An RC (release candidate) is published for Core and its dependent languages just after the branch cut. This RC is later promoted to release version if no further changes are made to the release branch. We do our best to keep head of master branch stable at all times regardless of release schedule. Daily build packages from master branch for C#, PHP, Python, Ruby and Protoc plugins are published on packages.grpc.io. If you depend on gRPC in production we recommend to set up your CI system to test the RCs and, if possible, the daily builds.

Names of gRPC releases are here.

Release Scheduled Branch Cut Scheduled Release Date

v1.17.0 Nov 19, 2018 Dec 4, 2018

v1.18.0 Jan 2, 2019 Jan 15, 2019

v1.19.0 Feb 12, 2019 Feb 26, 2019

v1.20.0 Mar 26, 2019 Apr 9, 2019

v1.21.0 May 7, 2019 May 21, 2019

v1.22.0 Jun 18, 2019 Jul 2, 2019

v1.23.0 Jul 30, 2019 Aug 13, 2019

v1.24.0 Sept 10, 2019 Sept 24, 2019

v1.25.0 Oct 22, 2019 Nov 5, 2019

v1.26.0 Dec 3, 2019 Dec 17, 2019

v1.27.0 Jan 14, 2020 Jan 28, 2020

v1.28.0 Feb 25, 2020 Mar 10, 2020

v1.29.0 Apr 7, 2020 Apr 21, 2020

v1.30.0 May 19, 2020 Jun 2, 2020

v1.31.0 Jul 14, 2020 Jul 28, 2020

v1.32.0 Aug 25, 2020 Sep 8, 2020

v1.33.0 Oct 6, 2020 Oct 20, 2020

Commits

afb307f [v1.53.x][Interop] Backport Python image update (#33864)
7a9373b [Backport] [dependency] Restrict cython to less than 3.X (#33770)
fdb64a6 [v1.53][Build] Update Phusion baseimage (#33767) (#33836)
cdf4186 [PSM Interop] Legacy tests: fix xDS test client build (v1.53.x backport) (#33...
ce5b93a [PSM Interop] Legacy test builds always pull the driver from master (v1.53.x ...
b24b6ea [release] Bump release version to 1.53.2 (#33709)
1e86ca5 [backport][iomgr][EventEngine] Improve server handling of file descriptor exh...
aff3066 [PSM interop] Don't fail url_map target if sub-target already failed (v1.53.x...
539d75c [PSM interop] Don't fail target if sub-target already failed (#33222) (v1.53....
3e79c88 [Release] Bump version to 1.53.1 (on v1.53.x branch) (#33047)
Additional commits viewable in compare view

Updates idna from 2.10 to 3.7

Release notes

Sourced from idna's releases.

v3.7

What's Changed

Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

Full Changelog: kjd/idna@v3.6...v3.7

Changelog

Sourced from idna's changelog.

3.7 (2024-04-11) ++++++++++++++++

Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

3.6 (2023-11-25) ++++++++++++++++

Fix regression to include tests in source distribution.

3.5 (2023-11-24) ++++++++++++++++

Update to Unicode 15.1.0

String codec name is now "idna2008" as overriding the system codec "idna" was not working.

Fix typing error for codec encoding

"setup.cfg" has been added for this release due to some downstream lack of adherence to PEP 517. Should be removed in a future release so please prepare accordingly.

Removed reliance on a symlink for the "idna-data" tool to comport with PEP 517 and the Python Packaging User Guide for sdist archives.

Added security reporting protocol for project

Thanks Jon Ribbens, Diogo Teles Sant'Anna, Wu Tingfeng for contributions to this release.

3.4 (2022-09-14) ++++++++++++++++

Update to Unicode 15.0.0

Migrate to pyproject.toml for build information (PEP 621)

Correct another instance where generic exception was raised instead of IDNAError for malformed input

Source distribution uses zeroized file ownership for improved reproducibility

Thanks to Seth Michael Larson for contributions to this release.

3.3 (2021-10-13) ++++++++++++++++

Update to Unicode 14.0.0

Update to in-line type annotations

Throw IDNAError exception correctly for some malformed input

Advertise support for Python 3.10

Improve testing regime on Github

... (truncated)

Commits

1d365e1 Release v3.7
c1b3154 Merge pull request #172 from kjd/optimize-contextj
0394ec7 Merge branch 'master' into optimize-contextj
cd58a23 Merge pull request #152 from elliotwutingfeng/dev
5beb28b More efficient resolution of joiner contexts
1b12148 Update ossf/scorecard-action to v2.3.1
d516b87 Update Github actions/checkout to v4
c095c75 Merge branch 'master' into dev
60a0a4c Fix typo in GitHub Actions workflow key
5918a0e Merge branch 'master' into dev
Additional commits viewable in compare view

Updates joblib from 1.1.1 to 1.2.0

Changelog

Sourced from joblib's changelog.

Release 1.2.0

Fix a security issue where eval(pre_dispatch) could potentially run arbitrary code. Now only basic numerics are supported. joblib/joblib#1327

Make sure that joblib works even when multiprocessing is not available, for instance with Pyodide joblib/joblib#1256

Avoid unnecessary warnings when workers and main process delete the temporary memmap folder contents concurrently. joblib/joblib#1263

Fix memory alignment bug for pickles containing numpy arrays. This is especially important when loading the pickle with mmap_mode != None as the resulting numpy.memmap object would not be able to correct the misalignment without performing a memory copy. This bug would cause invalid computation and segmentation faults with native code that would directly access the underlying data buffer of a numpy array, for instance C/C++/Cython code compiled with older GCC versions or some old OpenBLAS written in platform specific assembly. joblib/joblib#1254

Vendor cloudpickle 2.2.0 which adds support for PyPy 3.8+.

Vendor loky 3.3.0 which fixes several bugs including:

robustly forcibly terminating worker processes in case of a crash (joblib/joblib#1269);

avoiding leaking worker processes in case of nested loky parallel calls;

reliability spawn the correct number of reusable workers.

Commits

5991350 Release 1.2.0
3fa2188 MAINT cleanup numpy warnings related to np.matrix in tests (#1340)
cea26ff CI test the future loky-3.3.0 branch (#1338)
8aca6f4 MAINT: remove pytest.warns(None) warnings in pytest 7 (#1264)
067ed4f XFAIL test_child_raises_parent_exits_cleanly with multiprocessing (#1339)
ac4ebd5 MAINT add back pytest warnings plugin (#1337)
a23427d Test child raises parent exits cleanly more reliable on macos (#1335)
ac09691 [MAINT] various test updates (#1334)
4a314b1 Vendor loky 3.2.0 (#1333)
bdf47e9 Make test_parallel_with_interactively_defined_functions_default_backend timeo...
Additional commits viewable in compare view

Updates pillow from 8.1.0 to 10.3.0

Release notes

Sourced from pillow's releases.

10.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html

Changes

CVE-2024-28219: Use strncpy to avoid buffer overflow #7928 [@hugovk]

Use functools.lru_cache for hopper() #7912 [@hugovk]

Raise ValueError if seeking to greater than offset-sized integer in TIFF #7883 [@radarhere]

Improve speed of loading QOI images #7925 [@radarhere]

Added RGB to I;16N conversion #7920 [@radarhere]

Add --report argument to main.py to omit supported formats #7818 [@nulano]

Added RGB to I;16, I;16L and I;16B conversion #7918 [@radarhere]

Fix editable installation with custom build backend and configuration options #7658 [@nulano]

Fix putdata() for I;16N on big-endian #7209 [@Yay295]

Determine MPO size from markers, not EXIF data #7884 [@radarhere]

Improved conversion from RGB to RGBa, LA and La #7888 [@radarhere]

Support FITS images with GZIP_1 compression #7894 [@radarhere]

Use I;16 mode for 9-bit JPEG 2000 images #7900 [@scaramallion]

Raise ValueError if kmeans is negative #7891 [@radarhere]

Remove TIFF tag OSUBFILETYPE when saving using libtiff #7893 [@radarhere]

Raise ValueError for negative values when loading P1-P3 PPM images #7882 [@radarhere]

Added reading of JPEG2000 palettes #7870 [@radarhere]

Added alpha_quality argument when saving WebP images #7872 [@radarhere]

Fixed joined corners for ImageDraw rounded_rectangle() non-integer dimensions #7881 [@radarhere]

Removed Python and NumPy pinning on Cygwin #7880 [@radarhere]

Update UnidentifiedImageError and version imports #7644 [@radarhere]

Stop reading EPS image at EOF marker #7753 [@radarhere]

PSD layer co-ordinates may be negative #7706 [@radarhere]

Use subprocess with CREATE_NO_WINDOW flag in ImageShow WindowsViewer #7791 [@radarhere]

When saving GIF frame that restores to background color, do not fill identical pixels #7788 [@radarhere]

Fixed reading PNG iCCP compression method #7823 [@radarhere]

Allow writing IFDRational to UNDEFINED tag #7840 [@radarhere]

Fix logged tag name when loading Exif data #7842 [@radarhere]

Use maximum frame size in IHDR chunk when saving APNG images #7821 [@radarhere]

Prevent opening P TGA images without a palette #7797 [@radarhere]

Use palette when loading ICO images #7798 [@radarhere]

Use consistent arguments for load_read and load_seek #7713 [@radarhere]

Turn off nullability warnings for macOS SDK #7827 [@radarhere]

Fix shift-sign issue in Convert.c #7838 [@r-barnes]

winbuild: Refactor dependency versions into constants #7843 [@hugovk]

Build macOS arm64 wheels natively #7852 [@radarhere]

Fixed typo #7855 [@radarhere]

Open 16-bit grayscale PNGs as I;16 #7849 [@radarhere]

Handle truncated chunks at the end of PNG images #7709 [@lajiyuan]

Match mask size to pasted image size in GifImagePlugin #7779 [@radarhere]

Changed SupportsGetMesh protocol to be public #7841 [@radarhere]

Release GIL while calling WebPAnimDecoderGetNext #7782 [@evanmiller]

Fixed reading FLI/FLC images with a prefix chunk #7804 [@twolife]

Updated package name for Tidelift #7810 [@radarhere]

Removed unused code #7744 [@radarhere]

... (truncated)

Changelog

Sourced from pillow's changelog.

10.3.0 (2024-04-01)

CVE-2024-28219: Use strncpy to avoid buffer overflow #7928 [radarhere, hugovk]

Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() #7927 [radarhere, hugovk]

Raise ValueError if seeking to greater than offset-sized integer in TIFF #7883 [radarhere]

Add --report argument to __main__.py to omit supported formats #7818 [nulano, radarhere, hugovk]

Added RGB to I;16, I;16L, I;16B and I;16N conversion #7918, #7920 [radarhere]

Fix editable installation with custom build backend and configuration options #7658 [nulano, radarhere]

Fix putdata() for I;16N on big-endian #7209 [Yay295, hugovk, radarhere]

Determine MPO size from markers, not EXIF data #7884 [radarhere]

Improved conversion from RGB to RGBa, LA and La #7888 [radarhere]

Support FITS images with GZIP_1 compression #7894 [radarhere]

Use I;16 mode for 9-bit JPEG 2000 images #7900 [scaramallion, radarhere]

Raise ValueError if kmeans is negative #7891 [radarhere]

Remove TIFF tag OSUBFILETYPE when saving using libtiff #7893 [radarhere]

Raise ValueError for negative values when loading P1-P3 PPM images #7882 [radarhere]

Added reading of JPEG2000 palettes #7870 [radarhere]

Added alpha_quality argument when saving WebP images #7872 [radarhere]

... (truncated)

Commits

5c89d88 10.3.0 version bump
63cbfcf Update CHANGES.rst [ci skip]
2776126 Merge pull request #7928 from python-pillow/lcms
aeb51cb Merge branch 'main' into lcms
5beb0b6 Update CHANGES.rst [ci skip]
cac6ffa Merge pull request #7927 from python-pillow/imagemath
f5eeeac Name as 'options' in lambda_eval and unsafe_eval, but '_dict' in deprecated eval
facf3af Added release notes
2a93aba Use strncpy to avoid buffer overflow
a670597 Update CHANGES.rst [ci skip]
Additional commits viewable in compare view

Updates protobuf from 3.14.0 to 3.18.3

Release notes

Sourced from protobuf's releases.

Protocol Buffers v3.18.3

C++

Reduce memory consumption of MessageSet parsing

This release addresses a Security Advisory for C++ and Python users

Protocol Buffers v3.18.2

Java

Improve performance characteristics of UnknownFieldSet parsing (#9371)

Protocol Buffers v3.18.1

Python

Update setup.py to reflect that we now require at least Python 3.5 (#8989)

Performance fix for DynamicMessage: force GetRaw() to be inlined (#9023)

Ruby

Update ruby_generator.cc to allow proto2 imports in proto3 (#9003)

Protocol Buffers v3.18.0

C++

Fix warnings raised by clang 11 (#8664)

Make StringPiece constructible from std::string_view (#8707)

Add missing capability attributes for LLVM 12 (#8714)

Stop using std::iterator (deprecated in C++17). (#8741)

Move field_access_listener from libprotobuf-lite to libprotobuf (#8775)

Fix #7047 Safely handle setlocale (#8735)

Remove deprecated version of SetTotalBytesLimit() (#8794)

Support arena allocation of google::protobuf::AnyMetadata (#8758)

Fix undefined symbol error around SharedCtor() (#8827)

Fix default value of enum(int) in json_util with proto2 (#8835)

Better Smaller ByteSizeLong

Introduce event filters for inject_field_listener_events

Reduce memory usage of DescriptorPool

For lazy fields copy serialized form when allowed.

Re-introduce the InlinedStringField class

v2 access listener

Reduce padding in the proto's ExtensionRegistry map.

GetExtension performance optimizations

Make tracker a static variable rather than call static functions

Support extensions in field access listener

Annotate MergeFrom for field access listener

Fix incomplete types for field access listener

Add map_entry/new_map_entry to SpecificField in MessageDifferencer. They record the map items which are different in MessageDifferencer's reporter.

Reduce binary size due to fieldless proto messages

TextFormat: ParseInfoTree supports getting field end location in addition to start.

Fix repeated enum extension size in field listener

Enable Any Text Expansion for Descriptors::DebugString()

Switch from int{8,16,32,64} to int{8,16,32,64}_t

... (truncated)

Commits

a902b39 No-op whitespace change
ae62acd Updating version.json and repo version numbers to: 18.3
f43ac49 Merge pull request #10542 from deannagarcia/3.18.x
9efdf55 Add missing includes
d1635e1 Apply patch
5b37c91 Update version.json with "lts": true (#10534)
c39d622 Merge pull request #10529 from protocolbuffers/deannagarcia-patch-5
f77d3b6 Update version.json
8178b06 Merge pull request #10503 from deannagarcia/3.18.x
24ca839 Add version file
Additional commits viewable in compare view

Updates requests from 2.25.1 to 2.32.2

Release notes

Sourced from requests's releases.

v2.32.2

2.32.2 (2024-05-21)

Deprecations

To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

v2.32.1

2.32.1 (2024-05-20)

Bugfixes

Add missing test certs to the sdist distributed on PyPI.

v2.32.0

2.32.0 (2024-05-20)

🐍 PYCON US 2024 EDITION 🐍

Security

Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)

Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their vendoring surface area. The Response.text() and apparent_encoding APIs will default to utf-8 if neither library is present. (#6702)

Bugfixes

Fixed bug in length detection where emoji length was incorrectly calculated in the request content-length. (#6589)

Fixed deserialization bug in JSONDecodeError. (#6629)

Fixed bug where an extra leading / (path separator) could lead urllib3 to unnecessarily reparse the request URI. (#6644)

... (truncated)

Changelog

Sourced from requests's changelog.

2.32.2 (2024-05-21)

Deprecations

To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

2.32.1 (2024-05-20)

Bugfixes

Add missing test certs to the sdist distributed on PyPI.

2.32.0 (2024-05-20)

Security

Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)

Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their vendoring surface area. The Response.text() and apparent_encoding APIs will default to utf-8 if neither library is present. (#6702)

Bugfixes

Fixed bug in length detection where emoji length was incorrectly calculated in the request content-length. (#6589)

Fixed deserialization bug in JSONDecodeError. (#6629)

Fixed bug where an extra leading / (path separator) could lead urllib3 to unnecessarily reparse the request URI. (#6644)

Deprecations

... (truncated)

Commits

88dce9d v2.32.2
c98e4d1 Merge pull request #6710 from nateprewitt/api_rename
92075b3 Add deprecation warning
aa1461b Move _get_connection to get_connection_with_tls_context
970e8ce v2.32.1
d6ebc4a v2.32.0
9a40d12 Avoid reloading root certificates to improve concurrent performance (#6667)
0c030f7 Merge pull request #6702 from nateprewitt/no_char_detection
555b870 Allow character detection dependencies to be optional in post-packaging steps
d6dded3 Merge pull request #6700 from franekmagiera/update-redirect-to-invalid-uri-test
Additional commits viewable in compare view

Updates scikit-learn from 0.24.1 to 1.5.0

Release notes

Sourced from scikit-learn's releases.

Scikit-learn 1.5.0

We're happy to announce the 1.5.0 release.

You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_5_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.5.html

This version supports Python versions 3.9 to 3.12.

You can upgrade with pip as usual:
pip install -U scikit-learn
The conda-forge builds can be installed using:
conda install -c conda-forge scikit-learn
Scikit-learn 1.4.2

We're happy to announce the 1.4.2 release.

This release only includes support for numpy 2.

This version supports Python versions 3.9 to 3.12.

You can upgrade with pip as usual:
pip install -U scikit-learn
Scikit-learn 1.4.1.post1

We're happy to announce the 1.4.1.post1 release.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.4.html#version-1-4-1-post1

This version supports Python versions 3.9 to 3.12.

You can upgrade with pip as usual:
pip install -U scikit-learn
The conda-forge builds can be installed using:
conda install -c conda-forge scikit-learn

... (truncated)

Commits

b51d0c9 trigger whell builder [cd build]
919ae9b MAINT Reoder what's new for 1.5 (#29039)
0ac28ad DOC Release highlights 1.5 (#29007)
729b54d test py3.12 against numpy 2 [cd build]
1e50434 set version
ffbe4ab DOC remove obsolete SVM example (#27108)
4647729 DOC Fix time complexity of MLP (#28592)
9bd7047 FIX convergence criterion of MeanShift (#28951)
b79420f FIX add long long for int32/int64 windows compat in NumPy 2.0 (#29029)
37f544d DOC replace pandas with Polars in examples/gaussian_process/plot_gpr_co2.py (...
Additional commits viewable in compare view

Updates tensorflow from 2.5.0 to 2.11.1

Release notes

Sourced from tensorflow's releases.

TensorFlow 2.11.1

Release 2.11.1

Note: TensorFlow 2.10 was the last TensorFlow release that supported GPU on native-Windows. Starting with TensorFlow 2.11, you will need to install TensorFlow in WSL2, or install tensorflow-cpu and, optionally, try the TensorFlow-DirectML-Plugin.

Security vulnerability fixes will no longer be patched to this Tensorflow version. The latest Tensorflow version includes the security vulnerability fixes. You can update to the latest version (recommended) or patch security vulnerabilities yourself steps. You can refer to the release notes of the latest Tensorflow version for a list of newly fixed vulnerabilities. If you have any questions, please create a GitHub issue to let us know.

This release also introduces several vulnerability fixes:

Fixes an FPE in TFLite in conv kernel CVE-2023-27579

Fixes a double free in Fractional(Max/Avg)Pool CVE-2023-25801

Fixes a null dereference on ParallelConcat with XLA CVE-2023-25676

Fixes a segfault in Bincount with XLA CVE-2023-25675

Fixes an NPE in RandomShuffle with XLA enable CVE-2023-25674

Fixes an FPE in TensorListSplit with XLA CVE-2023-25673

Fixes segmentation fault in tfg-translate CVE-2023-25671

Fixes an NPE in QuantizedMatMulWithBiasAndDequantize CVE-2023-25670

Fixes an FPE in AvgPoolGrad with XLA CVE-2023-25669

Fixes a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation CVE-2023-25668

Fixes a segfault when opening multiframe gif CVE-2023-25667

Fixes an NPE in SparseSparseMaximum CVE-2023-25665

Fixes an FPE in AudioSpectrogram CVE-2023-25666

Fixes a heap-buffer-overflow in AvgPoolGrad CVE-2023-25664

Fixes a NPE in TensorArrayConcatV2 CVE-2023-25663

Fixes a Integer overflow in EditDistance CVE-2023-25662

Fixes a Seg fault in tf.raw_ops.Print CVE-2023-25660

Fixes a OOB read in DynamicStitch CVE-2023-25659

Fixes a OOB Read in GRUBlockCellGrad CVE-2023-25658

TensorFlow 2.11.0

Release 2.11.0

Breaking Changes

The tf.keras.optimizers.Optimizer base class now points to the new Keras optimizer, while the old optimizers have been moved to the tf.keras.optimizers.legacy namespace.

If you find your workflow failing due to this change, you may be facing one of the following issues:

Checkpoint loading failure. The new optimizer handles optimizer state differently from the old optimizer, which simplifies the logic of checkpoint saving/loading, but at the cost of breaking checkpoint backward compatibility in some cases. If you want to keep using an old checkpoint, please change your optimizer to tf.keras.optimizer.legacy.XXX (e.g. tf.keras.optimizer.legacy.Adam).

TF1 compatibility. The new optimizer, tf.keras.optimizers.Optimizer, does not support TF1 any more, so please use the legacy optimizer tf.keras.optimizer.legacy.XXX. We highly recommend migrating your workflow to TF2 for stable support and new features.

Old optimizer API not found. The new optimizer, tf.keras.optimizers.Optimizer, has a different set of public APIs from the old optimizer. These API changes are mostly related to getting rid of slot variables and TF1 support. Please check the API documentation to find alternatives to the missing API. If you must call the deprecated API, please change your optimizer to the legacy optimizer.

Learning rate schedule access. When using a tf.keras.optimizers.schedules.LearningRateSchedule, the new optimizer's learning_rate property returns the current learning rate value instead of a LearningRateSchedule object as before. If you need to access the LearningRateSchedule object, please use optimizer._learning_rate.

If you implemented a custom optimizer based on the old optimizer. Please set your optimizer to subclass tf.keras.optimizer.legacy.XXX. If you want to migrate to the new optimizer and find it does not support your optimizer, please file an issue in the Keras GitHub repo.

Errors, such as Cannot recognize variable.... The new optimizer requires all optimizer variables to be created at the first apply_gradients() or minimize() call. If your workflow calls the optimizer to update different parts of the model in multiple stages, please call optimizer.build(model.trainable_variables) before the training loop.

Timeout or performance loss. We don't anticipate this to happen, but if you see such issues, please use the legacy optimizer, and file an issue in the Keras GitHub repo.

The old Keras optimizer will never be deleted, but will not see any new feature additions. New optimizers (for example, tf.keras.optimizers.Adafactor) will only be implemented based on the new tf.keras.optimizers.Optimizer base class.

tensorflow/python/keras code is a legacy copy of Keras since the TensorFlow v2.7 release, and will be deleted in the v2.12 release. Please remove any import of tensorflow.python.keras and use the public API with from tensorflow import keras or import tensorflow as tf; tf.keras.

Major Features and Improvements

... (truncated)

Changelog

Sourced from tensorflow's changelog.

Release 2.11.1

Note: TensorFlow 2.10 was the last TensorFlow release that supported GPU on native-Windows. Starting with TensorFlow 2.11, you will need to install TensorFlow in WSL2, or install tensorflow-cpu and, optionally, try the TensorFlow-DirectML-Plugin.

Security vulnerability fixes will no longer be patched to this Tensorflow version. The latest Tensorflow version includes the security vulnerability fixes. You can update to the latest version (recommended) or patch security vulnerabilities yourself steps. You can refer to the release notes of the latest Tensorflow version for a list of newly fixed vulnerabilities. If you have any questions, please create a GitHub issue to let us know.

This release also introduces several vulnerability fixes:

Fixes an FPE in TFLite in conv kernel CVE-2023-27579

Fixes a double free in Fractional(Max/Avg)Pool CVE-2023-25801

Fixes a null dereference on ParallelConc...
Description has been truncated

Bumps the pip group with 11 updates in the /script/get-dataset-cifar10 directory: | Package | From | To | | --- | --- | --- | | [certifi](https://github.com/certifi/python-certifi) | `2020.12.5` | `2023.7.22` | | [grpcio](https://github.com/grpc/grpc) | `1.34.0` | `1.53.2` | | [idna](https://github.com/kjd/idna) | `2.10` | `3.7` | | [joblib](https://github.com/joblib/joblib) | `1.1.1` | `1.2.0` | | [pillow](https://github.com/python-pillow/Pillow) | `8.1.0` | `10.3.0` | | [protobuf](https://github.com/protocolbuffers/protobuf) | `3.14.0` | `3.18.3` | | [requests](https://github.com/psf/requests) | `2.25.1` | `2.32.2` | | [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `0.24.1` | `1.5.0` | | [tensorflow](https://github.com/tensorflow/tensorflow) | `2.5.0` | `2.11.1` | | [urllib3](https://github.com/urllib3/urllib3) | `1.26.3` | `1.26.19` | | [werkzeug](https://github.com/pallets/werkzeug) | `1.0.1` | `3.0.3` | Updates `certifi` from 2020.12.5 to 2023.7.22 - [Commits](certifi/python-certifi@2020.12.05...2023.07.22) Updates `grpcio` from 1.34.0 to 1.53.2 - [Release notes](https://github.com/grpc/grpc/releases) - [Changelog](https://github.com/grpc/grpc/blob/master/doc/grpc_release_schedule.md) - [Commits](grpc/grpc@v1.34.0...v1.53.2) Updates `idna` from 2.10 to 3.7 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst) - [Commits](kjd/idna@v2.10...v3.7) Updates `joblib` from 1.1.1 to 1.2.0 - [Release notes](https://github.com/joblib/joblib/releases) - [Changelog](https://github.com/joblib/joblib/blob/main/CHANGES.rst) - [Commits](joblib/joblib@1.1.1...1.2.0) Updates `pillow` from 8.1.0 to 10.3.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@8.1.0...10.3.0) Updates `protobuf` from 3.14.0 to 3.18.3 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Changelog](https://github.com/protocolbuffers/protobuf/blob/main/protobuf_release.bzl) - [Commits](protocolbuffers/protobuf@v3.14.0...v3.18.3) Updates `requests` from 2.25.1 to 2.32.2 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.25.1...v2.32.2) Updates `scikit-learn` from 0.24.1 to 1.5.0 - [Release notes](https://github.com/scikit-learn/scikit-learn/releases) - [Commits](scikit-learn/scikit-learn@0.24.1...1.5.0) Updates `tensorflow` from 2.5.0 to 2.11.1 - [Release notes](https://github.com/tensorflow/tensorflow/releases) - [Changelog](https://github.com/tensorflow/tensorflow/blob/master/RELEASE.md) - [Commits](tensorflow/tensorflow@v2.5.0...v2.11.1) Updates `urllib3` from 1.26.3 to 1.26.19 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/1.26.19/CHANGES.rst) - [Commits](urllib3/urllib3@1.26.3...1.26.19) Updates `werkzeug` from 1.0.1 to 3.0.3 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@1.0.1...3.0.3) --- updated-dependencies: - dependency-name: certifi dependency-type: direct:production dependency-group: pip - dependency-name: grpcio dependency-type: direct:production dependency-group: pip - dependency-name: idna dependency-type: direct:production dependency-group: pip - dependency-name: joblib dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-type: direct:production dependency-group: pip - dependency-name: protobuf dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-type: direct:production dependency-group: pip - dependency-name: scikit-learn dependency-type: direct:production dependency-group: pip - dependency-name: tensorflow dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2024-06-17T23:44:49Z

MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅

dependabot · 2024-06-25T06:31:43Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot bot requested a review from a team as a code owner June 17, 2024 23:44

dependabot bot added the dependencies Pull requests that update a dependency file label Jun 17, 2024

ctuning-admin closed this Jun 25, 2024

dependabot bot deleted the dependabot/pip/script/get-dataset-cifar10/pip-26803d2b5e branch June 25, 2024 06:31

github-actions bot locked and limited conversation to collaborators Jun 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the pip group across 1 directory with 11 updates #77

Bump the pip group across 1 directory with 11 updates #77

dependabot bot commented on behalf of github Jun 17, 2024

github-actions bot commented Jun 17, 2024

dependabot bot commented on behalf of github Jun 25, 2024

Release	Scheduled Branch Cut	Scheduled Release Date
v1.17.0	Nov 19, 2018	Dec 4, 2018
v1.18.0	Jan 2, 2019	Jan 15, 2019
v1.19.0	Feb 12, 2019	Feb 26, 2019
v1.20.0	Mar 26, 2019	Apr 9, 2019
v1.21.0	May 7, 2019	May 21, 2019
v1.22.0	Jun 18, 2019	Jul 2, 2019
v1.23.0	Jul 30, 2019	Aug 13, 2019
v1.24.0	Sept 10, 2019	Sept 24, 2019
v1.25.0	Oct 22, 2019	Nov 5, 2019
v1.26.0	Dec 3, 2019	Dec 17, 2019
v1.27.0	Jan 14, 2020	Jan 28, 2020
v1.28.0	Feb 25, 2020	Mar 10, 2020
v1.29.0	Apr 7, 2020	Apr 21, 2020
v1.30.0	May 19, 2020	Jun 2, 2020
v1.31.0	Jul 14, 2020	Jul 28, 2020
v1.32.0	Aug 25, 2020	Sep 8, 2020
v1.33.0	Oct 6, 2020	Oct 20, 2020

Bump the pip group across 1 directory with 11 updates #77

Bump the pip group across 1 directory with 11 updates #77

Conversation

dependabot bot commented on behalf of github Jun 17, 2024

Release v1.53.2

Core

Release v1.53.1

Release v1.53.0

Core

C++

gRPC Release Schedule

v3.7

What's Changed

Release 1.2.0

10.3.0

Changes

10.3.0 (2024-04-01)

Protocol Buffers v3.18.3

C++

Protocol Buffers v3.18.2

Java

Protocol Buffers v3.18.1

Python

Ruby

Protocol Buffers v3.18.0

C++

v2.32.2

2.32.2 (2024-05-21)

v2.32.1

2.32.1 (2024-05-20)

v2.32.0

2.32.0 (2024-05-20)

🐍 PYCON US 2024 EDITION 🐍

2.32.2 (2024-05-21)

2.32.1 (2024-05-20)

2.32.0 (2024-05-20)

Scikit-learn 1.5.0

Scikit-learn 1.4.2

Scikit-learn 1.4.1.post1

TensorFlow 2.11.1

Release 2.11.1

TensorFlow 2.11.0

Release 2.11.0

Breaking Changes

Major Features and Improvements

Release 2.11.1

github-actions bot commented Jun 17, 2024

dependabot bot commented on behalf of github Jun 25, 2024