chore(deps): update dependency numpy to v1.22.0 [security] #26
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
changed the title
auto-merge was automatically disabled
August 7, 2024 22:47
Pull request was closed
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/pypi-numpy-vulnerability
branch
from
7c86b20
to
40a01b8
Compare
renovate
bot
force-pushed
the
renovate/pypi-numpy-vulnerability
branch
from
40a01b8
to
6c500a7
Compare
auto-merge was automatically disabled
August 8, 2024 21:07
Pull request was closed
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update ( If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==1.18.5->==1.22.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2021-33430
A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service.
NOTE: The vendor does not agree this is a vulnerability; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user.
CVE-2021-41496
Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values.
CVE-2021-41495
Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays.
CVE-2021-34141
Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.
Release Notes
numpy/numpy (numpy)
v1.22.0Compare Source
NumPy 1.22.0 Release Notes
NumPy 1.22.0 is a big release featuring the work of 153 contributors
spread over 609 pull requests. There have been many improvements,
highlights are:
is a moving target, so there will likely be further improvements,
but the major work is done. This is probably the most user visible
enhancement in this release.
a step in creating a standard collection of functions that can be
used across application such as CuPy and JAX.
format for array (tensor) data.
quantile,percentile, and related functions. Thenew methods provide a complete set of the methods commonly found in
the literature.
These are in addition to the ongoing work to provide SIMD support for
commonly used functions, improvements to F2PY, and better documentation.
The Python versions supported in this release are 3.8-3.10, Python 3.7
has been dropped. Note that 32 bit wheels are only provided for Python
3.8 and 3.9 on Windows, all other wheels are 64 bits on account of
Ubuntu, Fedora, and other Linux distributions dropping 32 bit support.
All 64 bit wheels are also linked with 64 bit integer OpenBLAS, which should fix
the occasional problems encountered by folks using truly huge arrays.
Expired deprecations
Deprecated numeric style dtype strings have been removed
Using the strings
"Bytes0","Datetime64","Str0","Uint32",and
"Uint64"as a dtype will now raise aTypeError.(gh-19539)
Expired deprecations for
loads,ndfromtxt, andmafromtxtin npyionumpy.loadswas deprecated in v1.15, with the recommendation thatusers use
pickle.loadsinstead.ndfromtxtandmafromtxtwere bothdeprecated in v1.17 - users should use
numpy.genfromtxtinstead withthe appropriate value for the
usemaskparameter.(gh-19615)
Deprecations
Use delimiter rather than delimitor as kwarg in mrecords
The misspelled keyword argument
delimitorofnumpy.ma.mrecords.fromtextfile()has been changed todelimiter,using it will emit a deprecation warning.
(gh-19921)
Passing boolean
kthvalues to (arg-)partition has been deprecatednumpy.partitionandnumpy.argpartitionwould previously acceptboolean values for the
kthparameter, which would subsequently beconverted into integers. This behavior has now been deprecated.
(gh-20000)
The
np.MachArclass has been deprecatedThe
numpy.MachArclass andfinfo.machar <numpy.finfo>attribute havebeen deprecated. Users are encouraged to access the property if interest
directly from the corresponding
numpy.finfoattribute.(gh-20201)
Compatibility notes
Distutils forces strict floating point model on clang
NumPy now sets the
-ftrapping-mathoption on clang to enforce correctfloating point error handling for universal functions. Clang defaults to
non-IEEE and C99 conform behaviour otherwise. This change (using the
equivalent but newer
-ffp-exception-behavior=strict) was attempted inNumPy 1.21, but was effectively never used.
(gh-19479)
Removed floor division support for complex types
Floor division of complex types will now result in a
TypeError(gh-19135)
numpy.vectorizefunctions now produce the same output class as the base functionWhen a function that respects
numpy.ndarraysubclasses is vectorizedusing
numpy.vectorize, the vectorized function will now besubclass-safe also for cases that a signature is given (i.e., when
creating a
gufunc): the output class will be the same as that returnedby the first call to the underlying function.
(gh-19356)
Python 3.7 is no longer supported
Python support has been dropped. This is rather strict, there are
changes that require Python >= 3.8.
(gh-19665)
str/repr of complex dtypes now include space after punctuation
The repr of
np.dtype({"names": ["a"], "formats": [int], "offsets": [2]})is nowdtype({'names': ['a'], 'formats': ['<i8'], 'offsets': [2], 'itemsize': 10}),whereas spaces where previously omitted after colons and between fields.
The old behavior can be restored via
np.set_printoptions(legacy="1.21").(gh-19687)
Corrected
advanceinPCG64DSXMandPCG64Fixed a bug in the$2^{64}$ on platforms
advancemethod ofPCG64DSXMandPCG64. The bugonly affects results when the step was larger than
that do not support 128-bit integers(e.g., Windows and 32-bit Linux).
(gh-20049)
Change in generation of random 32 bit floating point variates
There was bug in the generation of 32 bit floating point values from the
uniform distribution that would result in the least significant bit of
the random variate always being 0. This has been fixed.
This change affects the variates produced by the
random.Generatormethods
random,standard_normal,standard_exponential, andstandard_gamma, but only when the dtype is specified asnumpy.float32.(gh-20314)
C API changes
Masked inner-loops cannot be customized anymore
The masked inner-loop selector is now never used. A warning will be
given in the unlikely event that it was customized.
We do not expect that any code uses this. If you do use it, you must
unset the selector on newer NumPy version. Please also contact the NumPy
developers, we do anticipate providing a new, more specific, mechanism.
The customization was part of a never-implemented feature to allow for
faster masked operations.
(gh-19259)
New Features
NEP 49 configurable allocators
As detailed in NEP 49, the
function used for allocation of the data segment of a ndarray can be
changed. The policy can be set globally or in a context. For more
information see the NEP and the
data_memory{.interpreted-textrole="ref"} reference docs. Also add a
NUMPY_WARN_IF_NO_MEM_POLICYoverride to warn on dangerous use of transfering ownership by setting
NPY_ARRAY_OWNDATA.(gh-17582)
Implementation of the NEP 47 (adopting the array API standard)
An initial implementation of NEP47, adoption
of the array API standard, has been added as
numpy.array_api. Theimplementation is experimental and will issue a UserWarning on import,
as the array API standard is still in
draft state.
numpy.array_apiis a conforming implementation of thearray API standard, which is also minimal, meaning that only those
functions and behaviors that are required by the standard are
implemented (see the NEP for more info). Libraries wishing to make use
of the array API standard are encouraged to use
numpy.array_apitocheck that they are only using functionality that is guaranteed to be
present in standard conforming implementations.
(gh-18585)
Generate C/C++ API reference documentation from comments blocks is now possible
This feature depends on Doxygen in
the generation process and on
Breathe to integrate it
with Sphinx.
(gh-18884)
Assign the platform-specific
c_intpprecision via a mypy pluginThe mypy plugin, introduced in
numpy/numpy#17843, has
again been expanded: the plugin now is now responsible for setting the
platform-specific precision of
numpy.ctypeslib.c_intp, the latterbeing used as data type for various
numpy.ndarray.ctypesattributes.Without the plugin, aforementioned type will default to
ctypes.c_int64.To enable the plugin, one must add it to their mypy configuration
file:
(gh-19062)
Add NEP 47-compatible dlpack support
Add a
ndarray.__dlpack__()method which returns adlpackC structurewrapped in a
PyCapsule. Also add anp._from_dlpack(obj)function,where
objsupports__dlpack__(), and returns anndarray.(gh-19083)
keepdimsoptional argument added tonumpy.argmin,numpy.argmaxkeepdimsargument is added tonumpy.argmin,numpy.argmax. If setto
True, the axes which are reduced are left in the result asdimensions with size one. The resulting array has the same number of
dimensions and will broadcast with the input array.
(gh-19211)
bit_countto compute the number of 1-bits in an integerComputes the number of 1-bits in the absolute value of the input. This
works on all the numpy integer types. Analogous to the builtin
int.bit_countorpopcountin C++.(gh-19355)
The
ndimandaxisattributes have been added tonumpy.AxisErrorThe
ndimandaxisparameters are now also stored as attributeswithin each
numpy.AxisErrorinstance.(gh-19459)
Preliminary support for
windows/arm64targetnumpyadded support for windows/arm64 target. Please noteOpenBLASsupport is not yet available for windows/arm64 target.
(gh-19513)
Added support for LoongArch
LoongArch is a new instruction set, numpy compilation failure on
LoongArch architecture, so add the commit.
(gh-19527)
A
.clang-formatfile has been addedClang-format is a C/C++ code formatter, together with the added
.clang-formatfile, it produces code close enough to the NumPyC_STYLE_GUIDE for general use. Clang-format version 12+ is required
due to the use of several new features, it is available in Fedora 34 and
Ubuntu Focal among other distributions.
(gh-19754)
is_integeris now available tonumpy.floatingandnumpy.integerBased on its counterpart in Python
floatandint, the numpy floatingpoint and integer types now support
float.is_integer. ReturnsTrueif the number is finite with integral value, and
Falseotherwise.(gh-19803)
Symbolic parser for Fortran dimension specifications
A new symbolic parser has been added to f2py in order to correctly parse
dimension specifications. The parser is the basis for future
improvements and provides compatibility with Draft Fortran 202x.
(gh-19805)
ndarray,dtypeandnumberare now runtime-subscriptableMimicking PEP-585, the
numpy.ndarray,numpy.dtypeandnumpy.numberclasses are now subscriptable forpython 3.9 and later. Consequently, expressions that were previously
only allowed in .pyi stub files or with the help of
from __future__ import annotationsare now also legal during runtime.(gh-19879)
Improvements
ctypeslib.load_librarycan now take any path-like objectAll parameters in the can now take any
python:path-like object{.interpreted-text role="term"}. This includesthe likes of strings, bytes and objects implementing the
__fspath__<os.PathLike.__fspath__>{.interpreted-text role="meth"}protocol.
(gh-17530)
Add
smallest_normalandsmallest_subnormalattributes tofinfoThe attributes
smallest_normalandsmallest_subnormalare availableas an extension of
finfoclass for any floating-point data type. Touse these new attributes, write
np.finfo(np.float64).smallest_normalor
np.finfo(np.float64).smallest_subnormal.(gh-18536)
numpy.linalg.qraccepts stacked matrices as inputsnumpy.linalg.qris able to produce results for stacked matrices asinputs. Moreover, the implementation of QR decomposition has been
shifted to C from Python.
(gh-19151)
numpy.fromregexnow acceptsos.PathLikeimplementationsnumpy.fromregexnow accepts objects implementing the__fspath__<os.PathLike>protocol, e.g.pathlib.Path.(gh-19680)
Add new methods for
quantileandpercentilequantileandpercentilenow have have amethod=keyword argumentsupporting 13 different methods. This replaces the
interpolation=keyword argument.
The methods are now aligned with nine methods which can be found in
scientific literature and the R language. The remaining methods are the
previous discontinuous variations of the default "linear" one.
Please see the documentation of
numpy.percentilefor more information.(gh-19857)
Missing parameters have been added to the
nan<x>functionsA number of the
nan<x>functions previously lacked parameters thatwere present in their
<x>-based counterpart, e.g. thewhereparameter was present in
numpy.meanbut absent fromnumpy.nanmean.The following parameters have now been added to the
nan<x>functions:initial&whereinitial&wherekeepdims&outkeepdims&outinitial&whereinitial&wherewherewherewhere(gh-20027)
Annotating the main Numpy namespace
Starting from the 1.20 release, PEP 484 type annotations have been
included for parts of the NumPy library; annotating the remaining
functions being a work in progress. With the release of 1.22 this
process has been completed for the main NumPy namespace, which is now
fully annotated.
Besides the main namespace, a limited number of sub-packages contain
annotations as well. This includes, among others,
numpy.testing,numpy.linalgandnumpy.random(available since 1.21).(gh-20217)
Vectorize umath module using AVX-512
By leveraging Intel Short Vector Math Library (SVML), 18 umath functions
(
exp2,log2,log10,expm1,log1p,cbrt,sin,cos,tan,arcsin,arccos,arctan,sinh,cosh,tanh,arcsinh,arccosh,arctanh) are vectorized using AVX-512 instruction set forboth single and double precision implementations. This change is
currently enabled only for Linux users and on processors with AVX-512
instruction set. It provides an average speed up of 32x and 14x for
single and double precision functions respectively.
(gh-19478)
OpenBLAS v0.3.18
Update the OpenBLAS used in testing and in wheels to v0.3.18
(gh-20058)
Checksums
MD5
SHA256
v1.21.6Compare Source
NumPy 1.21.6 Release Notes
NumPy 1.21.6 is a very small release that achieves two things:
The provision of the 32 bit wheel is intended to make life easier for
oldest-supported-numpy.
Checksums
MD5
SHA256
v1.21.5Compare Source
NumPy 1.21.5 Release Notes
NumPy 1.21.5 is a maintenance release that fixes a few bugs discovered
after the 1.21.4 release and does some maintenance to extend the 1.21.x
lifetime. The Python versions supported in this release are 3.7-3.10. If
you want to compile your own version using gcc-11, you will need to use
gcc-11.2+ to avoid problems.
Contributors
A total of 7 people contributed to this release. People with a "+" by
their names contributed a patch for the first time.
Pull requests merged
A total of 11 pull requests were merged for this release.
__(deep)copy__calls of_GenericAlias...npymathto respectnpy_longdoublenpy_load_moduleChecksums
MD5
SHA256
v1.21.4Compare Source
NumPy 1.21.4 Release Notes
The NumPy 1.21.4 is a maintenance release that fixes a few bugs
discovered after 1.21.3. The most important fix here is a fix for the
NumPy header files to make them work for both x86_64 and M1 hardware
when included in the Mac universal2 wheels. Previously, the header files
only worked for M1 and this caused problems for folks building x86_64
extensions. This problem was not seen before Python 3.10 because there
were thin wheels for x86_64 that had precedence. This release also
provides thin x86_64 Mac wheels for Python 3.10.
The Python versions supported in this release are 3.7-3.10. If you want
to compile your own version using gcc-11, you will need to use gcc-11.2+
to avoid problems.
Contributors
A total of 7 people contributed to this release. People with a "+" by
their names contributed a patch for the first time.
Pull requests merged
A total of 9 pull requests were merged for this release.
dtypein type stubVOID_nonzerocould sometimes mutate alignment flagArrayteratortyping test failureChecksums
MD5
SHA256
v1.21.3Compare Source
NumPy 1.21.3 Release Notes
The NumPy 1.21.3 is a maintenance release the fixes a few bugs
discovered after 1.21.2. It also provides 64 bit Python 3.10.0 wheels.
Note a few oddities about Python 3.10:
The Python versions supported in this release are 3.7-3.10. If you want
to compile your own version using gcc-11 you will need to use gcc-11.2+
to avoid problems.
Contributors
A total of 7 people contributed to this release. People with a "+" by
their names contributed a patch for the first time.
Pull requests merged
A total of 8 pull requests were merged for this release.
`generic/ndarraymethodsChecksums
MD5
SHA256
v1.21.2Compare Source
NumPy 1.21.2 Release Notes
The NumPy 1.21.2 is maintenance release that fixes bugs discovered after
1.21.1. It also provides 64 bit manylinux Python 3.10.0rc1 wheels for
downstream testing. Note that Python 3.10 is not yet final. There is
also preliminary support for Windows on ARM64 builds, but there is no
OpenBLAS for that platform and no wheels are available.
The Python versions supported for this release are 3.7-3.9. The 1.21.x
series is compatible with Python 3.10.0rc1 and Python 3.10 will be
officially supported after it is released. T
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
Thanks for the PR!
Deployments, as required, will be available below:
Please create PRs in draft mode. Mark as ready to enable:
After merge, new images are deployed in: