profile
viewpoint
If you are wondering where the data of this site comes from, please visit https://api.github.com/users/blchu/events. GitMemory does not store any data, but only uses NGINX to cache data for a period of time. The idea behind GitMemory is simply to give users a better reading experience.

jeffmahler/GPIS 37

Work on Gaussian Process Implicit Surfaces

blchu/BodyBuilder 1

A collection of reinforcement learning algorithms for training in OpenAI Gym.

blchu/deeprl_exploration 1

OpenAI Baselines: high-quality implementations of reinforcement learning algorithms

blchu/mlab-intuit-fa18 1

Text Summarization Project

AshwinSreelal/CourseMaps 0

CalHacks2014 Project, designed to take a list of courses and prerequisites and present an easy to read map

blchu/incubator-mxnet 0

Lightweight, Portable, Flexible Distributed/Mobile Deep Learning with Dynamic, Mutation-aware Dataflow Dep Scheduler; for Python, R, Julia, Scala, Go, Javascript and more

blchu/INvironment 0

Cal Hacks 2.0 Project. A proof-of-concept virtual reality equivalent of a computer desktop.

blchu/sockeye 0

Sequence-to-sequence framework with a focus on Neural Machine Translation based on Apache MXNet

delete branch mlberkeley/sp20-nmep

delete branch : dependabot/pip/hw6/pillow-8.1.1

delete time in 11 days

PR closed mlberkeley/sp20-nmep

Bump pillow from 6.1.0 to 8.1.1 in /hw6 dependencies

Bumps pillow from 6.1.0 to 8.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>8.1.1</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html">https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html</a></p> <h2>8.1.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html</a></p> <h2>Changes</h2> <ul> <li>Fix TIFF OOB Write error <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5175">#5175</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix for Buffer Read Overrun in PCX Decoding <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5174">#5174</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix for SGI Decode buffer overrun <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5173">#5173</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix OOB Read when saving GIF of xsize=1 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5149">#5149</a> [<a href="https://github.com/wiredfool"><code>@​wiredfool</code></a>]</li> <li>Add support for PySide6 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5161">#5161</a> [<a href="https://github.com/hugovk"><code>@​hugovk</code></a>]</li> <li>Moved QApplication into one test <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5167">#5167</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Use disposal settings from previous frame in APNG <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5126">#5126</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Revert "skip wheels on 3.10-dev due to wheel#354" <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5163">#5163</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Better _binary module use <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5156">#5156</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Added exception explaining that <em>repr_png</em> saves to PNG <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5139">#5139</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Use previous disposal method in GIF load_end <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5125">#5125</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Do not catch a ValueError only to raise another <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5090">#5090</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Allow putpalette to accept 1024 integers to include alpha values <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5089">#5089</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix OOB Read when writing TIFF with custom Metadata <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5148">#5148</a> [<a href="https://github.com/wiredfool"><code>@​wiredfool</code></a>]</li> <li>Removed unused variable <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5140">#5140</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix dereferencing of potential null pointers <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5111">#5111</a> [<a href="https://github.com/cgohlke"><code>@​cgohlke</code></a>]</li> <li>Fixed warnings assigning to "unsigned char *" from "char *" <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5127">#5127</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Add append_images support for ICO <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/4568">#4568</a> [<a href="https://github.com/ziplantil"><code>@​ziplantil</code></a>]</li> <li>Fixed comparison warnings <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5122">#5122</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Block TIFFTAG_SUBIFD <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5120">#5120</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix dereferencing potential null pointer <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5108">#5108</a> [<a href="https://github.com/cgohlke"><code>@​cgohlke</code></a>]</li> <li>Replaced PyErr_NoMemory with ImagingError_MemoryError <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5113">#5113</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Remove duplicate code <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5109">#5109</a> [<a href="https://github.com/cgohlke"><code>@​cgohlke</code></a>]</li> <li>Moved warning to end of execution <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/4965">#4965</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Removed unused fromstring and tostring C methods <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5026">#5026</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>init() if one of the formats is unrecognised <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5037">#5037</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Updated libtiff to 4.2.0 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5153">#5153</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Updated openjpeg to 2.4.0 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5151">#5151</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Updated harfbuzz to 2.7.4 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5138">#5138</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Updated harfbuzz to 2.7.3 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5128">#5128</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Updated libraqm to 0.7.1 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5070">#5070</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Updated libimagequant to 2.13.1 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5065">#5065</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Update FriBiDi to 1.0.10 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5064">#5064</a> [<a href="https://github.com/nulano"><code>@​nulano</code></a>]</li> <li>Updated libraqm to 0.7.1 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5063">#5063</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Updated libjpeg-turbo to 2.0.6 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5044">#5044</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> </ul> <h2>Deprecations</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst">pillow's changelog</a>.</em></p> <blockquote> <h2>8.1.1 (2021-03-01)</h2> <ul> <li> <p>Use more specific regex chars to prevent ReDoS. CVE-2021-25292 [hugovk]</p> </li> <li> <p>Fix OOB Read in TiffDecode.c, and check the tile validity before reading. CVE-2021-25291 [wiredfool]</p> </li> <li> <p>Fix negative size read in TiffDecode.c. CVE-2021-25290 [wiredfool]</p> </li> <li> <p>Fix OOB read in SgiRleDecode.c. CVE-2021-25293 [wiredfool]</p> </li> <li> <p>Incorrect error code checking in TiffDecode.c. CVE-2021-25289 [wiredfool]</p> </li> <li> <p>PyModule_AddObject fix for Python 3.10 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5194">#5194</a> [radarhere]</p> </li> </ul> <h2>8.1.0 (2021-01-02)</h2> <ul> <li> <p>Fix TIFF OOB Write error. CVE-2020-35654 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5175">#5175</a> [wiredfool]</p> </li> <li> <p>Fix for Read Overflow in PCX Decoding. CVE-2020-35653 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5174">#5174</a> [wiredfool, radarhere]</p> </li> <li> <p>Fix for SGI Decode buffer overrun. CVE-2020-35655 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5173">#5173</a> [wiredfool, radarhere]</p> </li> <li> <p>Fix OOB Read when saving GIF of xsize=1 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5149">#5149</a> [wiredfool]</p> </li> <li> <p>Makefile updates <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5159">#5159</a> [wiredfool, radarhere]</p> </li> <li> <p>Add support for PySide6 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5161">#5161</a> [hugovk]</p> </li> <li> <p>Use disposal settings from previous frame in APNG <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5126">#5126</a> [radarhere]</p> </li> <li> <p>Added exception explaining that <em>repr_png</em> saves to PNG <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5139">#5139</a> [radarhere]</p> </li> <li> <p>Use previous disposal method in GIF load_end <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5125">#5125</a> [radarhere]</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/741d8744a54bedbc49f16922c61a06fcb3681f53"><code>741d874</code></a> 8.1.1 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/179cd1c8f94aabc47e9e522e01683ea9aadbd3a5"><code>179cd1c</code></a> Added 8.1.1 release notes to index</li> <li><a href="https://github.com/python-pillow/Pillow/commit/7d296653da045e18b379c991797f933e054a7476"><code>7d29665</code></a> Update CHANGES.rst [ci skip]</li> <li><a href="https://github.com/python-pillow/Pillow/commit/d25036fca7c8658b698492088361453bb20073e2"><code>d25036f</code></a> Credits</li> <li><a href="https://github.com/python-pillow/Pillow/commit/973a4c333ab6d603e82f6eb2aa6f39d1cfcecccb"><code>973a4c3</code></a> Release notes for 8.1.1</li> <li><a href="https://github.com/python-pillow/Pillow/commit/521dab94c7ab72b037bd9a83e9663401e0fd2cee"><code>521dab9</code></a> Use more specific regex chars to prevent ReDoS</li> <li><a href="https://github.com/python-pillow/Pillow/commit/8b8076bdcb3815be0ef0d279651d8d1342b8ea61"><code>8b8076b</code></a> Fix for CVE-2021-25291</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e25be1e33dc526bfd1094bc778a54d8e29bf66c9"><code>e25be1e</code></a> Fix negative size read in TiffDecode.c</li> <li><a href="https://github.com/python-pillow/Pillow/commit/f891baa604636cd2506a9360d170bc2cf4963cc5"><code>f891baa</code></a> Fix OOB read in SgiRleDecode.c</li> <li><a href="https://github.com/python-pillow/Pillow/commit/cbfdde7b1f2295059a20a539ee9960f0bec7b299"><code>cbfdde7</code></a> Incorrect error code checking in TiffDecode.c</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/6.1.0...8.1.1">compare view</a></li> </ul> </details> <br />

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

+1 -1

1 comment

1 changed file

dependabot[bot]

pr closed time in 11 days

pull request commentmlberkeley/sp20-nmep

Bump pillow from 6.1.0 to 8.1.1 in /hw6

Superseded by #8.

dependabot[bot]

comment created time in 11 days

PR opened mlberkeley/sp20-nmep

Bump pillow from 6.1.0 to 8.2.0 in /hw6

Bumps pillow from 6.1.0 to 8.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>8.2.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html</a></p> <h2>Changes</h2> <ul> <li>Security fixes for 8.2.0 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5377">#5377</a> [<a href="https://github.com/hugovk"><code>@​hugovk</code></a>]</li> <li>Move getxmp() to JpegImageFile <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5376">#5376</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Added getxmp() method <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5144">#5144</a> [<a href="https://github.com/UrielMaD"><code>@​UrielMaD</code></a>]</li> <li>Compile LibTIFF with CMake on Windows <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5359">#5359</a> [<a href="https://github.com/nulano"><code>@​nulano</code></a>]</li> <li>Add ImageShow support for GraphicsMagick <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5349">#5349</a> [<a href="https://github.com/latosha-maltba"><code>@​latosha-maltba</code></a>]</li> <li>Tiff crash fixes in TiffDecode.c <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5372">#5372</a> [<a href="https://github.com/wiredfool"><code>@​wiredfool</code></a>]</li> <li>Remove redundant check (addition to <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5364">#5364</a>) <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5366">#5366</a> [<a href="https://github.com/kkopachev"><code>@​kkopachev</code></a>]</li> <li>Do not load transparent pixels from subsequent GIF frames <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5333">#5333</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Use LZW encoding when saving GIF images <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5291">#5291</a> [<a href="https://github.com/raygard"><code>@​raygard</code></a>]</li> <li>Set all transparent colors to be equal in quantize() <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5282">#5282</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Allow PixelAccess to use Python <strong>int</strong> when parsing x and y <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5206">#5206</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Removed Image._MODEINFO <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5316">#5316</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Add preserve_tone option to autocontrast <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5350">#5350</a> [<a href="https://github.com/elejke"><code>@​elejke</code></a>]</li> <li>Only import numpy when necessary <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5323">#5323</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fixed linear_gradient and radial_gradient I and F modes <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5274">#5274</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Add support for reading TIFFs with PlanarConfiguration=2 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5364">#5364</a> [<a href="https://github.com/wiredfool"><code>@​wiredfool</code></a>]</li> <li>More OSS-Fuzz support <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5328">#5328</a> [<a href="https://github.com/wiredfool"><code>@​wiredfool</code></a>]</li> <li>Do not premultiply alpha when resizing with Image.NEAREST resampling <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5304">#5304</a> [<a href="https://github.com/nulano"><code>@​nulano</code></a>]</li> <li>Use quantization method attributes <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5353">#5353</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Dynamically link FriBiDi instead of Raqm <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5062">#5062</a> [<a href="https://github.com/nulano"><code>@​nulano</code></a>]</li> <li>Removed build_distance_tables return value <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5363">#5363</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Allow fewer PNG palette entries than the bit depth maximum when saving <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5330">#5330</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Use duration from info dictionary when saving WebP <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5338">#5338</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Improved efficiency when creating GIF disposal images <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5326">#5326</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Stop flattening EXIF IFD into getexif() <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/4947">#4947</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Replaced tiff_deflate with tiff_adobe_deflate compression when saving TIFF images <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5343">#5343</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Save ICC profile from TIFF encoderinfo <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5321">#5321</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Moved RGB fix inside ImageQt class <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5268">#5268</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix -Wformat error in TiffDecode <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5305">#5305</a> [<a href="https://github.com/lukegb"><code>@​lukegb</code></a>]</li> <li>Allow alpha_composite destination to be negative <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5313">#5313</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Ensure file is closed if it is opened by ImageQt.ImageQt <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5260">#5260</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Added ImageDraw rounded_rectangle method <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5208">#5208</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Added IPythonViewer <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5289">#5289</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Only draw each rectangle outline pixel once <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5183">#5183</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Use mmap instead of built-in Win32 mapper <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5224">#5224</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Handle PCX images with an odd stride <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5214">#5214</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Only read different sizes for "Large Thumbnail" MPO frames <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5168">#5168</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Updated harfbuzz to 2.8.0 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5334">#5334</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> </ul> <h2>Deprecations</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst">pillow's changelog</a>.</em></p> <blockquote> <h2>8.2.0 (2021-04-01)</h2> <ul> <li> <p>Added getxmp() method <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5144">#5144</a> [UrielMaD, radarhere]</p> </li> <li> <p>Add ImageShow support for GraphicsMagick <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5349">#5349</a> [latosha-maltba, radarhere]</p> </li> <li> <p>Do not load transparent pixels from subsequent GIF frames <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5333">#5333</a> [zewt, radarhere]</p> </li> <li> <p>Use LZW encoding when saving GIF images <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5291">#5291</a> [raygard]</p> </li> <li> <p>Set all transparent colors to be equal in quantize() <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5282">#5282</a> [radarhere]</p> </li> <li> <p>Allow PixelAccess to use Python <strong>int</strong> when parsing x and y <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5206">#5206</a> [radarhere]</p> </li> <li> <p>Removed Image._MODEINFO <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5316">#5316</a> [radarhere]</p> </li> <li> <p>Add preserve_tone option to autocontrast <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5350">#5350</a> [elejke, radarhere]</p> </li> <li> <p>Fixed linear_gradient and radial_gradient I and F modes <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5274">#5274</a> [radarhere]</p> </li> <li> <p>Add support for reading TIFFs with PlanarConfiguration=2 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5364">#5364</a> [kkopachev, wiredfool, nulano]</p> </li> <li> <p>Deprecated categories <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5351">#5351</a> [radarhere]</p> </li> <li> <p>Do not premultiply alpha when resizing with Image.NEAREST resampling <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5304">#5304</a> [nulano]</p> </li> <li> <p>Dynamically link FriBiDi instead of Raqm <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5062">#5062</a> [nulano]</p> </li> <li> <p>Allow fewer PNG palette entries than the bit depth maximum when saving <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5330">#5330</a> [radarhere]</p> </li> <li> <p>Use duration from info dictionary when saving WebP <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5338">#5338</a> [radarhere]</p> </li> <li> <p>Stop flattening EXIF IFD into getexif() <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/4947">#4947</a> [radarhere, kkopachev]</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/e0e353c0ef7516979a9aedce3792596649ce4433"><code>e0e353c</code></a> 8.2.0 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/ee635befc6497f1c6c4fdb58c232e62d922ec8b7"><code>ee635be</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5377">#5377</a> from hugovk/security-and-release-notes</li> <li><a href="https://github.com/python-pillow/Pillow/commit/694c84f88f4299319bac49b20bd9baae82ca41b8"><code>694c84f</code></a> Fix typo [ci skip]</li> <li><a href="https://github.com/python-pillow/Pillow/commit/8febdad8dd51ad5c75a1db78492973588c7cbf6b"><code>8febdad</code></a> Review, typos and lint</li> <li><a href="https://github.com/python-pillow/Pillow/commit/fea419665b75f11910e44cfe6f89622fda63e78b"><code>fea4196</code></a> Reorder, roughly alphabetic</li> <li><a href="https://github.com/python-pillow/Pillow/commit/496245aa4365d0827390bd0b6fbd11287453b3a1"><code>496245a</code></a> Fix BLP DOS -- CVE-2021-28678</li> <li><a href="https://github.com/python-pillow/Pillow/commit/22e9bee4ef225c0edbb9323f94c26cee0c623497"><code>22e9bee</code></a> Fix DOS in PSDImagePlugin -- CVE-2021-28675</li> <li><a href="https://github.com/python-pillow/Pillow/commit/ba65f0b08ee8b93195c3f3277820771f5b62aa52"><code>ba65f0b</code></a> Fix Memory DOS in ImageFont</li> <li><a href="https://github.com/python-pillow/Pillow/commit/bb6c11fb889e6c11b0ee122b828132ee763b5856"><code>bb6c11f</code></a> Fix FLI DOS -- CVE-2021-28676</li> <li><a href="https://github.com/python-pillow/Pillow/commit/5a5e6db0abf4e7a638fb1b3408c4e495a096cb92"><code>5a5e6db</code></a> Fix EPS DOS on _open -- CVE-2021-28677</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/6.1.0...8.2.0">compare view</a></li> </ul> </details> <br />

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

+1 -1

0 comment

1 changed file

pr created time in 11 days

create barnchmlberkeley/sp20-nmep

branch : dependabot/pip/hw6/pillow-8.2.0

created branch time in 11 days

push eventmlberkeley/scae-pytorch

axquaris

commit sha 1133e7e5663184ab73211a1caea394b4856c7f9c

debugging table logging

view details

push time in 18 days

push eventmlberkeley/scae-pytorch

Domas Buracas

commit sha f44748b0a146580cb41886336b6a35c80287f28b

Delete requirements.txt Outdated

view details

push time in 18 days

push eventmlberkeley/scae-pytorch

axquaris

commit sha d695d4b1515c484147013c3a04402798d302b181

capsule activation histogram notebook

view details

push time in 22 days

push eventmlberkeley/scae-pytorch

axquaris

commit sha 8bb5084fb2712add8de8f34d642edbecd73735fa

mnist training stable

view details

push time in 22 days

delete branch mlberkeley/scae-pytorch

delete branch : pcae-shvn

delete time in 22 days

delete branch mlberkeley/scae-pytorch

delete branch : nitish

delete time in 22 days

push eventmlberkeley/scae-pytorch

axquaris

commit sha 2d196e14c7b7a744a27ac2720bbd2abf1028b32c

refactoring and object gen tuning

view details

push time in 22 days

push eventmlberkeley/scae-pytorch

axquaris

commit sha 4fedc80db4cf86bfcb936da179543b2ccdc49048

refactoring and table logging

view details

push time in 23 days

push eventmlberkeley/scae-pytorch

axquaris

commit sha 3c0af5c7854cc03c7753b07088e302900af2760f

transforms debugging notebook

view details

push time in 23 days

PR closed mlberkeley/sp20-nmep

Bump tensorflow from 1.14.0 to 2.3.1 in /hw6 dependencies

Bumps tensorflow from 1.14.0 to 2.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tensorflow/tensorflow/releases">tensorflow's releases</a>.</em></p> <blockquote> <h2>TensorFlow 2.3.1</h2> <h1>Release 2.3.1</h1> <h2>Bug Fixes and Other Changes</h2> <ul> <li>Fixes an undefined behavior causing a segfault in <code>tf.raw_ops.Switch</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15190">CVE-2020-15190</a>)</li> <li>Fixes three vulnerabilities in conversion to DLPack format (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15191">CVE-2020-15191</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15192">CVE-2020-15192</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15193">CVE-2020-15193</a>)</li> <li>Fixes two vulnerabilities in <code>SparseFillEmptyRowsGrad</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15194">CVE-2020-15194</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15195">CVE-2020-15195</a>)</li> <li>Fixes several vulnerabilities in <code>RaggedCountSparseOutput</code> and <code>SparseCountSparseOutput</code> operations (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15196">CVE-2020-15196</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15197">CVE-2020-15197</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15198">CVE-2020-15198</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15199">CVE-2020-15199</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15200">CVE-2020-15200</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15201">CVE-2020-15201</a>)</li> <li>Fixes an integer truncation vulnerability in code using the work sharder API (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15202">CVE-2020-15202</a>)</li> <li>Fixes a format string vulnerability in <code>tf.strings.as_string</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15203">CVE-2020-15203</a>)</li> <li>Fixes segfault raised by calling session-only ops in eager mode (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15204">CVE-2020-15204</a>)</li> <li>Fixes data leak and potential ASLR violation from <code>tf.raw_ops.StringNGrams</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15205">CVE-2020-15205</a>)</li> <li>Fixes segfaults caused by incomplete <code>SavedModel</code> validation (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15206">CVE-2020-15206</a>)</li> <li>Fixes a data corruption due to a bug in negative indexing support in TFLite (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15207">CVE-2020-15207</a>)</li> <li>Fixes a data corruption due to dimension mismatch in TFLite (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15208">CVE-2020-15208</a>)</li> <li>Fixes several vulnerabilities in TFLite saved model format (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15209">CVE-2020-15209</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15210">CVE-2020-15210</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15211">CVE-2020-15211</a>)</li> <li>Fixes several vulnerabilities in TFLite implementation of segment sum (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15212">CVE-2020-15212</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15213">CVE-2020-15213</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15214">CVE-2020-15214</a>)</li> <li>Updates <code>sqlite3</code> to <code>3.33.00</code> to handle <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15358">CVE-2020-15358</a>.</li> <li>Fixes deprecated usage of <code>collections</code> API</li> <li>Removes <code>scipy</code> dependency from <code>setup.py</code> since TensorFlow does not need it to install the pip package</li> </ul> <h2>TensorFlow 2.3.0</h2> <h1>Release 2.3.0</h1> <h2>Major Features and Improvements</h2> <ul> <li><code>tf.data</code> adds two new mechanisms to solve input pipeline bottlenecks and save resources: <ul> <li><a href="https://www.tensorflow.org/api_docs/python/tf/data/experimental/snapshot">snapshot</a></li> <li><a href="https://www.tensorflow.org/api_docs/python/tf/data/experimental/service">tf.data service</a>.</li> </ul> </li> </ul> <p>In addition checkout the detailed <a href="https://www.tensorflow.org/guide/data_performance_analysis">guide</a> for analyzing input pipeline performance with TF Profiler.</p> <ul> <li> <p><a href="https://www.tensorflow.org/api_docs/python/tf/distribute/TPUStrategy"><code>tf.distribute.TPUStrategy</code></a> is now a stable API and no longer considered experimental for TensorFlow. (earlier <code>tf.distribute.experimental.TPUStrategy</code>).</p> </li> <li> <p><a href="https://www.tensorflow.org/guide/profiler">TF Profiler</a> introduces two new tools: a memory profiler to visualize your model’s memory usage over time and a <a href="https://www.tensorflow.org/guide/profiler#events">python tracer</a> which allows you to trace python function calls in your model. Usability improvements include better diagnostic messages and <a href="https://tensorflow.org/guide/profiler#collect_performance_data">profile options</a> to customize the host and device trace verbosity level.</p> </li> <li> <p>Introduces experimental support for Keras Preprocessing Layers API (<a href="https://www.tensorflow.org/api_docs/python/tf/keras/layers/experimental/preprocessing?version=nightly"><code>tf.keras.layers.experimental.preprocessing.*</code></a>) to handle data preprocessing operations, with support for composite tensor inputs. Please see below for additional details on these layers.</p> </li> <li> <p>TFLite now properly supports dynamic shapes during conversion and inference. We’ve also added opt-in support on Android and iOS for <a href="https://github.com/tensorflow/tensorflow/tree/master/tensorflow/lite/delegates/xnnpack">XNNPACK</a>, a highly optimized set of CPU kernels, as well as opt-in support for <a href="https://github.com/tensorflow/tensorflow/blob/master/tensorflow/lite/g3doc/performance/gpu_advanced.md#running-quantized-models-experimental">executing quantized models on the GPU</a>.</p> </li> <li> <p>Libtensorflow packages are available in GCS starting this release. We have also started to <a href="https://github.com/tensorflow/tensorflow#official-builds">release a nightly version of these packages</a>.</p> </li> <li> <p>The experimental Python API <a href="https://www.tensorflow.org/api_docs/python/tf/debugging/experimental/enable_dump_debug_info"><code>tf.debugging.experimental.enable_dump_debug_info()</code></a> now allows you to instrument a TensorFlow program and dump debugging information to a directory on the file system. The directory can be read and visualized by a new interactive dashboard in TensorBoard 2.3 called <a href="https://www.tensorflow.org/tensorboard/debugger_v2">Debugger V2</a>, which reveals the details of the TensorFlow program including graph structures, history of op executions at the Python (eager) and intra-graph levels, the runtime dtype, shape, and numerical composistion of tensors, as well as their code locations.</p> </li> </ul> <h2>Breaking Changes</h2> <ul> <li>Increases the <strong>minimum bazel version</strong> required to build TF to <strong>3.1.0</strong>.</li> <li><code>tf.data</code> <ul> <li>Makes the following (breaking) changes to the <code>tf.data</code>.</li> <li>C++ API: - <code>IteratorBase::RestoreInternal</code>, <code>IteratorBase::SaveInternal</code>, and <code>DatasetBase::CheckExternalState</code> become pure-virtual and subclasses are now expected to provide an implementation.</li> <li>The deprecated <code>DatasetBase::IsStateful</code> method is removed in favor of <code>DatasetBase::CheckExternalState</code>.</li> <li>Deprecated overrides of <code>DatasetBase::MakeIterator</code> and <code>MakeIteratorFromInputElement</code> are removed.</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tensorflow/tensorflow/blob/master/RELEASE.md">tensorflow's changelog</a>.</em></p> <blockquote> <h1>Release 2.3.1</h1> <h2>Bug Fixes and Other Changes</h2> <ul> <li>Fixes an undefined behavior causing a segfault in <code>tf.raw_ops.Switch</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15190">CVE-2020-15190</a>)</li> <li>Fixes three vulnerabilities in conversion to DLPack format (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15191">CVE-2020-15191</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15192">CVE-2020-15192</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15193">CVE-2020-15193</a>)</li> <li>Fixes two vulnerabilities in <code>SparseFillEmptyRowsGrad</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15194">CVE-2020-15194</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15195">CVE-2020-15195</a>)</li> <li>Fixes several vulnerabilities in <code>RaggedCountSparseOutput</code> and <code>SparseCountSparseOutput</code> operations (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15196">CVE-2020-15196</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15197">CVE-2020-15197</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15198">CVE-2020-15198</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15199">CVE-2020-15199</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15200">CVE-2020-15200</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15201">CVE-2020-15201</a>)</li> <li>Fixes an integer truncation vulnerability in code using the work sharder API (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15202">CVE-2020-15202</a>)</li> <li>Fixes a format string vulnerability in <code>tf.strings.as_string</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15203">CVE-2020-15203</a>)</li> <li>Fixes segfault raised by calling session-only ops in eager mode (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15204">CVE-2020-15204</a>)</li> <li>Fixes data leak and potential ASLR violation from <code>tf.raw_ops.StringNGrams</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15205">CVE-2020-15205</a>)</li> <li>Fixes segfaults caused by incomplete <code>SavedModel</code> validation (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15206">CVE-2020-15206</a>)</li> <li>Fixes a data corruption due to a bug in negative indexing support in TFLite (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15207">CVE-2020-15207</a>)</li> <li>Fixes a data corruption due to dimension mismatch in TFLite (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15208">CVE-2020-15208</a>)</li> <li>Fixes several vulnerabilities in TFLite saved model format (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15209">CVE-2020-15209</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15210">CVE-2020-15210</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15211">CVE-2020-15211</a>)</li> <li>Fixes several vulnerabilities in TFLite implementation of segment sum (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15212">CVE-2020-15212</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15213">CVE-2020-15213</a>, <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15214">CVE-2020-15214</a>)</li> <li>Updates <code>sqlite3</code> to <code>3.33.00</code> to handle <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15358">CVE-2020-15358</a>.</li> <li>Fixes deprecated usage of <code>collections</code> API</li> <li>Removes <code>scipy</code> dependency from <code>setup.py</code> since TensorFlow does not need it to install the pip package</li> </ul> <h1>Release 2.2.1</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tensorflow/tensorflow/commit/fcc4b966f1265f466e82617020af93670141b009"><code>fcc4b96</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/43446">#43446</a> from tensorflow-jenkins/version-numbers-2.3.1-16251</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/4cf223069a94c78b208e6c829d5f938a0fae7d07"><code>4cf2230</code></a> Update version numbers to 2.3.1</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/eee82247288e52e9b8a5c2badeb65f871b4da4c4"><code>eee8224</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/43441">#43441</a> from tensorflow-jenkins/relnotes-2.3.1-24672</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/0d41b1dfc97500e1177cb718a0b14b04914df661"><code>0d41b1d</code></a> Update RELEASE.md</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/d99bd631ea9b67ffc39c22b35fbf7deca77ad1f7"><code>d99bd63</code></a> Insert release notes place-fill</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/d71d3ce2520587b752e5d27b2d4a4ba8720e4bd5"><code>d71d3ce</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/43414">#43414</a> from tensorflow/mihaimaruseac-patch-1-1</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/9c91596d4d24bc07b6d36ae48581a2e7b2584edf"><code>9c91596</code></a> Fix missing import</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/f9f12f61867159120ce6eb08fdbd225d454232b5"><code>f9f12f6</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/43391">#43391</a> from tensorflow/mihaimaruseac-patch-4</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/3ed271b0b05b4f1dfd5660944c54b5fe8cc3d8dc"><code>3ed271b</code></a> Solve leftover from merge conflict</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/9cf3773b717dfd46b37be2ba8cad4f038a8ff6f7"><code>9cf3773</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/43358">#43358</a> from tensorflow/mm-patch-r2.3</li> <li>Additional commits viewable in <a href="https://github.com/tensorflow/tensorflow/compare/v1.14.0...v2.3.1">compare view</a></li> </ul> </details> <br />

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

+1 -1

1 comment

1 changed file

dependabot[bot]

pr closed time in a month

delete branch mlberkeley/sp20-nmep

delete branch : dependabot/pip/hw6/tensorflow-2.3.1

delete time in a month

pull request commentmlberkeley/sp20-nmep

Bump tensorflow from 1.14.0 to 2.3.1 in /hw6

Superseded by #7.

dependabot[bot]

comment created time in a month

PR opened mlberkeley/sp20-nmep

Bump tensorflow from 1.14.0 to 2.5.0 in /hw6

Bumps tensorflow from 1.14.0 to 2.5.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tensorflow/tensorflow/releases">tensorflow's releases</a>.</em></p> <blockquote> <h2>TensorFlow 2.5.0</h2> <h1>Release 2.5.0</h1> <h2>Major Features and Improvements</h2> <ul> <li>Support for Python3.9 has been added.</li> <li><code>tf.data</code>: <ul> <li><code>tf.data</code> service now supports strict round-robin reads, which is useful for synchronous training workloads where example sizes vary. With strict round robin reads, users can guarantee that consumers get similar-sized examples in the same step.</li> <li>tf.data service now supports optional compression. Previously data would always be compressed, but now you can disable compression by passing <code>compression=None</code> to <code>tf.data.experimental.service.distribute(...)</code>.</li> <li><code>tf.data.Dataset.batch()</code> now supports <code>num_parallel_calls</code> and <code>deterministic</code> arguments. <code>num_parallel_calls</code> is used to indicate that multiple input batches should be computed in parallel. With <code>num_parallel_calls</code> set, <code>deterministic</code> is used to indicate that outputs can be obtained in the non-deterministic order.</li> <li>Options returned by <code>tf.data.Dataset.options()</code> are no longer mutable.</li> <li>tf.data input pipelines can now be executed in debug mode, which disables any asynchrony, parallelism, or non-determinism and forces Python execution (as opposed to trace-compiled graph execution) of user-defined functions passed into transformations such as <code>map</code>. The debug mode can be enabled through <code>tf.data.experimental.enable_debug_mode()</code>.</li> </ul> </li> <li><code>tf.lite</code> <ul> <li>Enabled the new MLIR-based quantization backend by default <ul> <li>The new backend is used for 8 bits full integer post-training quantization</li> <li>The new backend removes the redundant rescales and fixes some bugs (shared weight/bias, extremely small scales, etc)</li> <li>Set <code>experimental_new_quantizer</code> in tf.lite.TFLiteConverter to False to disable this change</li> </ul> </li> </ul> </li> <li><code>tf.keras</code> <ul> <li><code>tf.keras.metrics.AUC</code> now support logit predictions.</li> <li>Enabled a new supported input type in <code>Model.fit</code>, <code>tf.keras.utils.experimental.DatasetCreator</code>, which takes a callable, <code>dataset_fn</code>. <code>DatasetCreator</code> is intended to work across all <code>tf.distribute</code> strategies, and is the only input type supported for Parameter Server strategy.</li> </ul> </li> <li><code>tf.distribute</code> <ul> <li><code>tf.distribute.experimental.ParameterServerStrategy</code> now supports training with Keras <code>Model.fit</code> when used with <code>DatasetCreator</code>.</li> <li>Creating <code>tf.random.Generator</code> under <code>tf.distribute.Strategy</code> scopes is now allowed (except for <code>tf.distribute.experimental.CentralStorageStrategy</code> and <code>tf.distribute.experimental.ParameterServerStrategy</code>). Different replicas will get different random-number streams.</li> </ul> </li> <li>TPU embedding support <ul> <li>Added <code>profile_data_directory</code> to <code>EmbeddingConfigSpec</code> in <code>_tpu_estimator_embedding.py</code>. This allows embedding lookup statistics gathered at runtime to be used in embedding layer partitioning decisions.</li> </ul> </li> <li>PluggableDevice <ul> <li>Third-party devices can now connect to TensorFlow as plug-ins through <a href="https://github.com/tensorflow/community/blob/master/rfcs/20200612-stream-executor-c-api.md">StreamExecutor C API</a>. and <a href="https://github.com/tensorflow/community/blob/master/rfcs/20200624-pluggable-device-for-tensorflow.md">PluggableDevice</a> interface. <ul> <li>Add custom ops and kernels through <a href="https://github.com/tensorflow/community/blob/master/rfcs/20190814-kernel-and-op-registration.md">kernel and op registration C API</a>.</li> <li>Register custom graph optimization passes with <a href="https://github.com/tensorflow/community/blob/master/rfcs/20201027-modular-tensorflow-graph-c-api.md">graph optimization C API</a>.</li> </ul> </li> </ul> </li> <li><a href="https://github.com/oneapi-src/oneDNN">oneAPI Deep Neural Network Library (oneDNN)</a> CPU performance optimizations from <a href="https://software.intel.com/content/www/us/en/develop/articles/intel-optimization-for-tensorflow-installation-guide.html">Intel-optimized TensorFlow</a> are now available in the official x86-64 Linux and Windows builds. <ul> <li>They are off by default. Enable them by setting the environment variable <code>TF_ENABLE_ONEDNN_OPTS=1</code>.</li> <li>We do not recommend using them in GPU systems, as they have not been sufficiently tested with GPUs yet.</li> </ul> </li> <li>TensorFlow pip packages are now built with CUDA11.2 and cuDNN 8.1.0</li> </ul> <h2>Breaking Changes</h2> <ul> <li>The <code>TF_CPP_MIN_VLOG_LEVEL</code> environment variable has been renamed to to <code>TF_CPP_MAX_VLOG_LEVEL</code> which correctly describes its effect.</li> </ul> <h2>Bug Fixes and Other Changes</h2> <ul> <li><code>tf.keras</code>: <ul> <li>Preprocessing layers API consistency changes: <ul> <li><code>StringLookup</code> added <code>output_mode</code>, <code>sparse</code>, and <code>pad_to_max_tokens</code> arguments with same semantics as <code>TextVectorization</code>.</li> <li><code>IntegerLookup</code> added <code>output_mode</code>, <code>sparse</code>, and <code>pad_to_max_tokens</code> arguments with same semantics as <code>TextVectorization</code>. Renamed <code>max_values</code>, <code>oov_value</code> and <code>mask_value</code> to <code>max_tokens</code>, <code>oov_token</code> and <code>mask_token</code> to align with <code>StringLookup</code> and <code>TextVectorization</code>.</li> <li><code>TextVectorization</code> default for <code>pad_to_max_tokens</code> switched to False.</li> <li><code>CategoryEncoding</code> no longer supports <code>adapt</code>, <code>IntegerLookup</code> now supports equivalent functionality. <code>max_tokens</code> argument renamed to <code>num_tokens</code>.</li> <li><code>Discretization</code> added <code>num_bins</code> argument for learning bins boundaries through calling <code>adapt</code> on a dataset. Renamed <code>bins</code> argument to <code>bin_boundaries</code> for specifying bins without <code>adapt</code>.</li> </ul> </li> <li>Improvements to model saving/loading: <ul> <li><code>model.load_weights</code> now accepts paths to saved models.</li> </ul> </li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tensorflow/tensorflow/blob/master/RELEASE.md">tensorflow's changelog</a>.</em></p> <blockquote> <h1>Release 2.5.0</h1> <!-- raw HTML omitted --> <h2>Breaking Changes</h2> <ul> <li> <!-- raw HTML omitted --> </li> <li>The <code>TF_CPP_MIN_VLOG_LEVEL</code> environment variable has been renamed to to <code>TF_CPP_MAX_VLOG_LEVEL</code> which correctly describes its effect.</li> </ul> <h2>Known Caveats</h2> <ul> <li><!-- raw HTML omitted --></li> <li><!-- raw HTML omitted --></li> <li><!-- raw HTML omitted --></li> </ul> <h2>Major Features and Improvements</h2> <ul> <li> <p><!-- raw HTML omitted --></p> </li> <li> <p><!-- raw HTML omitted --></p> </li> <li> <p>TPU embedding support</p> <ul> <li>Added <code>profile_data_directory</code> to <code>EmbeddingConfigSpec</code> in <code>_tpu_estimator_embedding.py</code>. This allows embedding lookup statistics gathered at runtime to be used in embedding layer partitioning decisions.</li> </ul> </li> <li> <p><code>tf.keras.metrics.AUC</code> now support logit predictions.</p> </li> <li> <p>Creating <code>tf.random.Generator</code> under <code>tf.distribute.Strategy</code> scopes is now allowed (except for <code>tf.distribute.experimental.CentralStorageStrategy</code> and <code>tf.distribute.experimental.ParameterServerStrategy</code>). Different replicas will get different random-number streams.</p> </li> <li> <p><code>tf.data</code>:</p> <ul> <li>tf.data service now supports strict round-robin reads, which is useful for synchronous training workloads where example sizes vary. With strict round robin reads, users can guarantee that consumers get similar-sized examples in the same step.</li> <li>tf.data service now supports optional compression. Previously data would always be compressed, but now you can disable compression by passing <code>compression=None</code> to <code>tf.data.experimental.service.distribute(...)</code>.</li> <li><code>tf.data.Dataset.batch()</code> now supports <code>num_parallel_calls</code> and <code>deterministic</code> arguments. <code>num_parallel_calls</code> is used to indicate that multiple input batches should be computed in parallel. With <code>num_parallel_calls</code> set, <code>deterministic</code> is used to indicate that outputs can be obtained in the non-deterministic order.</li> <li>Options returned by <code>tf.data.Dataset.options()</code> are no longer mutable.</li> <li>tf.data input pipelines can now be executed in debug mode, which disables any asynchrony, parallelism, or non-determinism and forces Python execution (as opposed to trace-compiled graph execution) of user-defined functions passed into transformations such as <code>map</code>. The debug mode can be enabled through <code>tf.data.experimental.enable_debug_mode()</code>.</li> </ul> </li> <li> <p><code>tf.lite</code></p> <ul> <li>Enabled the new MLIR-based quantization backend by default <ul> <li>The new backend is used for 8 bits full integer post-training quantization</li> <li>The new backend removes the redundant rescales and fixes some bugs (shared weight/bias, extremely small scales, etc)</li> </ul> </li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tensorflow/tensorflow/commit/a4dfb8d1a71385bd6d122e4f27f86dcebb96712d"><code>a4dfb8d</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/49124">#49124</a> from tensorflow/mm-cherrypick-tf-data-segfault-fix-...</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/2107b1dc414edb3fc78e632bca4f4936171093b2"><code>2107b1d</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/49116">#49116</a> from tensorflow-jenkins/version-numbers-2.5.0-17609</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/16b813906fcb46306aef29a04ddd0cbdb4e77918"><code>16b8139</code></a> Update snapshot_dataset_op.cc</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/86a0d86cb5da6a28b78ea7f886ec2831d23f6d6b"><code>86a0d86</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/49126">#49126</a> from geetachavan1/cherrypicks_X9ZNY</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/9436ae693ef66a9efb7e7e7888134173d9a0821d"><code>9436ae6</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/49128">#49128</a> from geetachavan1/cherrypicks_D73J5</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/6b2bf99cd9336026689579b683a709c5efcb4ae9"><code>6b2bf99</code></a> Validate that a and b are proper sparse tensors</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/c03ad1a46d5b3f23df67dad03185a0ee16020c96"><code>c03ad1a</code></a> Ensure validation sticks in banded_triangular_solve_op</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/12a6ead7ac968c402feb85ce0a8069ccbc6bf735"><code>12a6ead</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/49120">#49120</a> from geetachavan1/cherrypicks_KJ5M9</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/b67f5b8a0a098c34c71c679aa46480035c46886e"><code>b67f5b8</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/49118">#49118</a> from geetachavan1/cherrypicks_BIDTR</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/a13c0ade86295bd3a8356b4b8cc980cf0c5e70e0"><code>a13c0ad</code></a> [tf.data][cherrypick] Fix snapshot segfault when using repeat and prefecth</li> <li>Additional commits viewable in <a href="https://github.com/tensorflow/tensorflow/compare/v1.14.0...v2.5.0">compare view</a></li> </ul> </details> <br />

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

+1 -1

0 comment

1 changed file

pr created time in a month

create barnchmlberkeley/sp20-nmep

branch : dependabot/pip/hw6/tensorflow-2.5.0

created branch time in a month

push eventmlberkeley/scae-pytorch

axquaris

commit sha f7fbe0c15d2fb31aa5952b29b661ed298953251a

group equivariant first layer only

view details

push time in a month

push eventmlberkeley/scae-pytorch

axquaris

commit sha 46f6039d78c1a20af2be89e00f8f04ba4a9a7f91

group equivariant cnn imp (p4)

view details

push time in a month

push eventmlberkeley/scae-pytorch

axquaris

commit sha 7b9eedf3ddd6ae7f2492b7b0496729dc7f90dccb

tidying code + wandb table (artifact) test

view details

push time in a month

push eventmlberkeley/scae-pytorch

Nitish Dashora

commit sha e5a4bffcc3bdf4102458dfc7c441553cfb14a728

Notebook upload

view details

push time in a month

push eventmlberkeley/scae-pytorch

axquaris

commit sha cdd244cb722f4259c3eaf4bf38499b5a5ac0ebd6

resonator scae updates

view details

push time in a month

push eventmlberkeley/scae-pytorch

axquaris

commit sha 655185aa6e36dca5e04aed351db3a678b4770c6b

tabling resonator work

view details

push time in a month

push eventmlberkeley/scae-pytorch

axquaris

commit sha 7ffd1f207295785dd85a8900f9183f27744fadec

template tinkering + better vis grid

view details

push time in a month

push eventmlberkeley/scae-pytorch

axquaris

commit sha ab8f97e4d5fa00d3e334af27427bade6b65fa99a

single mnist template resonating

view details

push time in a month

push eventmlberkeley/scae-pytorch

axquaris

commit sha c668fdc79bb629b361ffa50b55889132e303e415

diffing numpy and torch algorithms

view details

axquaris

commit sha 72d7c947c7fbd0cba460ca68f66e8aef87703213

torch resonator imp working

view details

axquaris

commit sha 5f6f45bda8e11ed83b37d324953c697cbfae1a8f

tidy resonator code

view details

push time in a month

PR opened mlberkeley/reading-list

Bump json from 9.0.6 to 10.0.0

Bumps json from 9.0.6 to 10.0.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/trentm/json/blob/master/CHANGES.md">json's changelog</a>.</em></p> <blockquote> <h2>10.0.0</h2> <ul> <li> <p><strong>Backward incompatible</strong> and <strong>security-related</strong> change to parsing "lookup" strings.</p> <p>This version restricts the supported syntax for bracketed <a href="https://trentm.com/json/#FEATURE-Lookups">"lookup" strings</a> to fix a possible vulnerability (CVE-2020-7712). With a carefully crafted lookup string, command injection was possible. See <a href="https://github-redirect.dependabot.com/trentm/json/issues/144">#144</a> for a repro. If you use <code>json</code> (the CLI or as a node.js module) and run arbitrary user-provided strings as a "lookup", then you should upgrade.</p> <p>For the <code>json</code> CLI, a "lookup" string is the 'foo' in:</p> <pre><code> echo ...some json... | json foo </code></pre> <p>which allows you to lookup fields on the given JSON, e.g.:</p> <pre><code> $ echo '{"foo": {"bar": "baz"}}' | json foo.bar baz </code></pre> <p>If one of the lookup fields isn't a valid JS identifier, then the JS array notation is supported:</p> <pre><code> $ echo '{"https://example.com": "my-value"}' | json '["https://example.com"]' my-value </code></pre> <p>Before this change, <code>json</code> would effectively <em>exec</em> the string between the brackets as JS code such that things like the following were possible:</p> <pre><code> $ echo '{"foo3": "bar"}' | json '["foo" + 3]' bar </code></pre> <p>This change limits supported bracket syntax in lookups to a simple quoted string:</p> <pre><code> ["..."] ['...'] [...] # no variable interpolation </code></pre> <p>Otherwise generating an error of the form:</p> <pre><code> json: error: invalid bracketed lookup string: "[&quot;foo&quot; + 3]" (must be of the form ['...'], ["..."], or [...]) </code></pre> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/trentm/json/commit/cc4798169f9e0f181f8aa61905b88479badcd483"><code>cc47981</code></a> BREAKING CHANGE: limit syntax for bracketed lookup strings to fix vuln (<a href="https://github-redirect.dependabot.com/trentm/json/issues/145">#145</a>)</li> <li><a href="https://github.com/trentm/json/commit/8d3cf253e4c71193d16d9d304685e66ee650dc93"><code>8d3cf25</code></a> Update README.md</li> <li>See full diff in <a href="https://github.com/trentm/json/compare/9.0.6...10.0.0">compare view</a></li> </ul> </details> <br />

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

+4 -4

0 comment

2 changed files

pr created time in a month

create barnchmlberkeley/reading-list

branch : dependabot/npm_and_yarn/json-10.0.0

created branch time in a month