Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency scikit-learn to v1 [security] #28

Closed
wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 7, 2024

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
scikit-learn (source, changelog) ==0.22.2.post1 -> ==1.5.0 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2024-5206

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stop_words_ attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the stop_words_ attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.


Release Notes

scikit-learn/scikit-learn (scikit-learn)

v1.5.0: Scikit-learn 1.5.0

Compare Source

We're happy to announce the 1.5.0 release.

You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights\_1\_5\_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.5.html

This version supports Python versions 3.9 to 3.12.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

v1.4.2: Scikit-learn 1.4.2

Compare Source

We're happy to announce the 1.4.2 release.

This release only includes support for numpy 2.

This version supports Python versions 3.9 to 3.12.

You can upgrade with pip as usual:

pip install -U scikit-learn

v1.4.1.post1: Scikit-learn 1.4.1.post1

Compare Source

We're happy to announce the 1.4.1.post1 release.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.4.html#version-1-4-1-post1

This version supports Python versions 3.9 to 3.12.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

v1.4.0

Compare Source

v1.3.2: Scikit-learn 1.3.2

Compare Source

We're happy to announce the 1.3.2 release.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.3.html#version-1-3-2

This version supports Python versions 3.8 to 3.12.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

v1.3.1: Scikit-learn 1.3.1

Compare Source

We're happy to announce the 1.3.1 release.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.3.html#version-1-3-1

This version supports Python versions 3.8 to 3.12.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

v1.3.0: Scikit-learn 1.3.0

Compare Source

We're happy to announce the 1.3.0 release.

You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights\_1\_3\_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.3.html

This version supports Python versions 3.8 to 3.11.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

v1.2.2: Scikit-learn 1.2.2

Compare Source

We're happy to announce the 1.2.2 release.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.2.html#version-1-2-2

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds will be available shortly, which you can then install using:

conda install -c conda-forge scikit-learn

v1.2.1: scikit-learn 1.2.1

Compare Source

We're happy to announce the 1.2.1 release.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.2.html#version-1-2-1

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds will be available shortly, which you can then install using:

conda install -c conda-forge scikit-learn

v1.2.0: Scikit-learn 1.2.0

Compare Source

We're happy to announce the 1.2.0 release.

You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights\_1\_2\_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.2.html

This version supports Python versions 3.8 to 3.11.

v1.1.3: scikit-learn 1.1.3

Compare Source

We're happy to announce the 1.1.3 release.

This bugfix release only includes fixes for compatibility with the latest SciPy release >= 1.9.2 and wheels for Python 3.11. Note that support for 32-bit Python on Windows has been dropped in this release. This is due to the fact that SciPy 1.9.2 also dropped the support for that platform. Windows users are advised to install the 64-bit version of Python instead.

You can see the changelog here: https://scikit-learn.org/dev/whats_new/v1.1.html#version-1-1-3

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds will be available shortly, which you can then install using:

conda install -c conda-forge scikit-learn

v1.1.2: scikit-learn 1.1.2

Compare Source

We're happy to announce the 1.1.2 release with several bugfixes:

You can see the changelog here: https://scikit-learn.org/dev/whats_new/v1.1.html#version-1-1-2

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds will be available shortly, which you can then install using:

conda install -c conda-forge scikit-learn

v1.1.1: scikit-learn 1.1.1

Compare Source

We're happy to announce the 1.1.1 release with several bugfixes:

You can see the changelog here: https://scikit-learn.org/dev/whats_new/v1.1.html#version-1-1-1

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds will be available shortly, which you can then install using:

conda install -c conda-forge scikit-learn

v1.1.0: scikit-learn 1.1.0

Compare Source

We're happy to announce the 1.1.0 release.

You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights\_1\_1\_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.1.html#changes-1-1

This version supports Python versions 3.8 to 3.10.

v1.0.2: scikit-learn 1.0.2

Compare Source

We're happy to announce the 1.0.2 release with several bugfixes:

You can see the changelog here: https://scikit-learn.org/dev/whats_new/v1.0.html#version-1-0-2

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds will be available shortly, which you can then install using:

conda install -c conda-forge scikit-learn

v1.0.1: scikit-learn 1.0.1

Compare Source

We're happy to announce the 1.0.1 release with several bugfixes:

You can see the changelog here: https://scikit-learn.org/dev/whats_new/v1.0.html#version-1-0-1

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds will be available shortly, which you can then install using:

conda install -c conda-forge scikit-learn

v1.0: scikit-learn 1.0

Compare Source

We're happy to announce the 1.0 release. You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights\_1\_0\_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.0.html#changes-1-0

This version supports Python versions 3.7 to 3.9.

v0.24.2: scikit-learn 0.24.2

Compare Source

We're happy to announce the 0.24.2 release with several bugfixes:

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v0.24.html#version-0-24-2

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds will be available shortly, which you can then install using:

conda install -c conda-forge scikit-learn

v0.24.1: scikit-learn 0.24.1

Compare Source

We're happy to announce the 0.24.1 release with several bugfixes:

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v0.24.html#version-0-24-1

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds will be available shortly, which you can then install using:

conda install -c conda-forge scikit-learn

v0.24.0: scikit-learn 0.24.0

Compare Source

We're happy to announce the 0.24 release. You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights\_0\_24\_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v0.24.html#version-0-24-0

This version supports Python versions 3.6 to 3.9.

v0.23.2: scikit-learn 0.23.2

Compare Source

We're happy to announce the 0.23.2 release with several bugfixes:

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v0.23.html#version-0-23-2

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds will be available shortly, which you can then install using:

conda install -c conda-forge scikit-learn

v0.23.1: scikit-learn 0.23.1

Compare Source

We're happy to announce the 0.23.1 release which fixes a few issues affecting many users, namely: K-Means should be faster for small sample sizes, and the representation of third-party estimators was fixed.

You can check this version out using:

    pip install -U scikit-learn

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v0.23.html#version-0-23-1
The conda-forge builds will be available shortly, which you can then install using:

    conda install -c conda-forge scikit-learn

v0.23.0: scikit-learn 0.23.0

Compare Source

We're happy to announce the 0.23 release. You can read
the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights\_0\_23\_0.html
and the long version of the change log under https://scikit-learn.org/stable/whats_new/v0.23.html#version-0-23-0

This version supports Python versions 3.6 to 3.8.


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


Thanks for the PR!

Deployments, as required, will be available below:

Please create PRs in draft mode. Mark as ready to enable:

After merge, new images are deployed in:

@renovate renovate bot enabled auto-merge (squash) August 7, 2024 21:37
@renovate renovate bot changed the title chore(deps): update dependency scikit-learn to v1 [security] chore(deps): update dependency scikit-learn to v1 [security] - autoclosed Aug 7, 2024
@renovate renovate bot closed this Aug 7, 2024
auto-merge was automatically disabled August 7, 2024 22:47

Pull request was closed

@renovate renovate bot deleted the renovate/pypi-scikit-learn-vulnerability branch August 7, 2024 22:47
@renovate renovate bot changed the title chore(deps): update dependency scikit-learn to v1 [security] - autoclosed chore(deps): update dependency scikit-learn to v1 [security] Aug 7, 2024
@renovate renovate bot restored the renovate/pypi-scikit-learn-vulnerability branch August 7, 2024 23:16
@renovate renovate bot reopened this Aug 7, 2024
@renovate renovate bot requested review from DerekRoberts and a team as code owners August 7, 2024 23:16
@renovate renovate bot enabled auto-merge (squash) August 7, 2024 23:17
@renovate renovate bot force-pushed the renovate/pypi-scikit-learn-vulnerability branch from 2673c3e to afa18c1 Compare August 7, 2024 23:17
@renovate renovate bot force-pushed the renovate/pypi-scikit-learn-vulnerability branch from afa18c1 to 0fe06b0 Compare August 8, 2024 17:34
auto-merge was automatically disabled August 8, 2024 21:07

Pull request was closed

Copy link
Contributor Author

renovate bot commented Aug 8, 2024

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 1.x releases. But if you manually upgrade to 1.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate bot deleted the renovate/pypi-scikit-learn-vulnerability branch August 8, 2024 21:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant