Skip to content
This repository was archived by the owner on Apr 4, 2024. It is now read-only.

Bump the pip group across 3 directories with 5 updates#2

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/pip-security-group-4d871bedde
Open

Bump the pip group across 3 directories with 5 updates#2
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/pip-security-group-4d871bedde

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Mar 20, 2024

Updates the requirements on ray, black, scikit-learn, torch and transformers to permit the latest version.
Updates ray to 2.8.1

Release notes

Sourced from ray's releases.

Ray-2.8.1

Release Highlights

The Ray 2.8.1 patch release contains fixes for the Ray Dashboard.

Additional context can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Ray Dashboard

🔨 Fixes:

[core][state][log] Cherry pick changes to prevent state API from reading files outside the Ray log directory (#41520) [Dashboard] Migrate Logs page to use state api. (#41474) (#41522)

Commits

Updates black from 22.8.0 to 24.3.0

Release notes

Sourced from black's releases.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

  • Don't move comments along with delimiters, which could cause crashes (#4248)
  • Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
  • Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

  • Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

  • Note what happens when --check is used with --quiet (#4236)

24.2.0

Stable style

  • Fixed a bug where comments where mistakenly removed along with redundant parentheses (#4218)

Preview style

  • Move the hug_parens_with_braces_and_square_brackets feature to the unstable style due to an outstanding crash and proposed formatting tweaks (#4198)
  • Fixed a bug where base expressions caused inconsistent formatting of ** in tenary expression (#4154)
  • Checking for newline before adding one on docstring that is almost at the line limit (#4185)
  • Remove redundant parentheses in case statement if guards (#4214).

Configuration

... (truncated)

Changelog

Sourced from black's changelog.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

  • Don't move comments along with delimiters, which could cause crashes (#4248)
  • Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
  • Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

  • Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

  • Note what happens when --check is used with --quiet (#4236)

24.2.0

Stable style

  • Fixed a bug where comments where mistakenly removed along with redundant parentheses (#4218)

Preview style

  • Move the hug_parens_with_braces_and_square_brackets feature to the unstable style due to an outstanding crash and proposed formatting tweaks (#4198)
  • Fixed a bug where base expressions caused inconsistent formatting of ** in tenary expression (#4154)
  • Checking for newline before adding one on docstring that is almost at the line limit (#4185)
  • Remove redundant parentheses in case statement if guards (#4214).

... (truncated)

Commits

Updates scikit-learn to 1.3.2

Release notes

Sourced from scikit-learn's releases.

Scikit-learn 1.3.2

We're happy to announce the 1.3.2 release.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.3.html#version-1-3-2

This version supports Python versions 3.8 to 3.12.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn
Commits
  • 093e0cf [cd build][azure parallel] trigger CI/CD
  • fc24542 TST change random seed to make graphical lasso test pass (#27616)
  • 7e3705d DOC move somes fixes from 1.4 to 1.3.2 (#27602)
  • e43ad8b MAINT remove prerelease flag for Python 3.12 (#27605)
  • b54a13a DOC add version 1.3.2 into landing page (#27604)
  • 6d086c2 REL bump to 1.3.2
  • 8a3c16c FIX Make decision tree pickles deterministic (#27580)
  • 9b977e9 FIX make sure that KernelPCA works with pandas output and arpack solver (#27583)
  • d53756e FIX validate properly zero_division=np.nan when used in parallel processing (...
  • 1df363c FIX make dataset fetchers accept os.Pathlike for data_home (#27468)
  • Additional commits viewable in compare view

Updates torch to 2.2.1

Release notes

Sourced from torch's releases.

PyTorch 2.2.1 Release, bug fix release

This release is meant to fix the following issues (regressions / silent correctness):

Release tracker pytorch/pytorch#119295 contains all relevant pull requests related to this release as well as links to related issues.

Changelog

Sourced from torch's changelog.

Releasing PyTorch

Release Compatibility Matrix

Following is the Release Compatibility Matrix for PyTorch releases:

... (truncated)

Commits

Updates scikit-learn to 1.3.2

Release notes

Sourced from scikit-learn's releases.

Scikit-learn 1.3.2

We're happy to announce the 1.3.2 release.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.3.html#version-1-3-2

This version supports Python versions 3.8 to 3.12.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn
Commits
  • 093e0cf [cd build][azure parallel] trigger CI/CD
  • fc24542 TST change random seed to make graphical lasso test pass (#27616)
  • 7e3705d DOC move somes fixes from 1.4 to 1.3.2 (#27602)
  • e43ad8b MAINT remove prerelease flag for Python 3.12 (#27605)
  • b54a13a DOC add version 1.3.2 into landing page (#27604)
  • 6d086c2 REL bump to 1.3.2
  • 8a3c16c FIX Make decision tree pickles deterministic (#27580)
  • 9b977e9 FIX make sure that KernelPCA works with pandas output and arpack solver (#27583)
  • d53756e FIX validate properly zero_division=np.nan when used in parallel processing (...
  • 1df363c FIX make dataset fetchers accept os.Pathlike for data_home (#27468)
  • Additional commits viewable in compare view

Updates transformers to 4.12.2

Release notes

Sourced from transformers's releases.

v4.12.2: Patch release

Fixes an issue with the image segmentation pipeline and PyTorch's inference mode.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the pip group across 3 directories with 5 updates
cc23f76 
Updates the requirements on [ray](https://github.com/ray-project/ray), [black](https://github.com/psf/black), [scikit-learn](https://github.com/scikit-learn/scikit-learn), [torch](https://github.com/pytorch/pytorch) and [transformers](https://github.com/huggingface/transformers) to permit the latest version.

Updates `ray` to 2.8.1
- [Release notes](https://github.com/ray-project/ray/releases)
- [Commits](ray-project/ray@ray-2.2.0...ray-2.8.1)

Updates `black` from 22.8.0 to 24.3.0
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@22.8.0...24.3.0)

Updates `scikit-learn` to 1.3.2
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](scikit-learn/scikit-learn@0.24.2...1.3.2)

Updates `torch` to 2.2.1
- [Release notes](https://github.com/pytorch/pytorch/releases)
- [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md)
- [Commits](pytorch/pytorch@v1.12.0...v2.2.1)

Updates `scikit-learn` to 1.3.2
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](scikit-learn/scikit-learn@0.24.2...1.3.2)

Updates `transformers` to 4.12.2
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v4.11.3...v4.12.2)

---
updated-dependencies:
- dependency-name: ray
  dependency-type: direct:production
  dependency-group: pip-security-group
- dependency-name: black
  dependency-type: direct:production
  dependency-group: pip-security-group
- dependency-name: scikit-learn
  dependency-type: direct:production
  dependency-group: pip-security-group
- dependency-name: torch
  dependency-type: direct:production
  dependency-group: pip-security-group
- dependency-name: scikit-learn
  dependency-type: direct:production
  dependency-group: pip-security-group
- dependency-name: transformers
  dependency-type: direct:production
  dependency-group: pip-security-group
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Mar 20, 2024
@dependabot dependabot Bot mentioned this pull request Mar 20, 2024
Closed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants