Sourced from numpy's releases.

v1.22.0

NumPy 1.22.0 Release Notes

NumPy 1.22.0 is a big release featuring the work of 153 contributors spread over 609 pull requests. There have been many improvements, highlights are:

• Annotations of the main namespace are essentially complete. Upstream is a moving target, so there will likely be further improvements, but the major work is done. This is probably the most user visible enhancement in this release.
• A preliminary version of the proposed Array-API is provided. This is a step in creating a standard collection of functions that can be used across application such as CuPy and JAX.
• NumPy now has a DLPack backend. DLPack provides a common interchange format for array (tensor) data.
• New methods for quantile, percentile, and related functions. The new methods provide a complete set of the methods commonly found in the literature.
• A new configurable allocator for use by downstream projects.

These are in addition to the ongoing work to provide SIMD support for commonly used functions, improvements to F2PY, and better documentation.

The Python versions supported in this release are 3.8-3.10, Python 3.7 has been dropped. Note that 32 bit wheels are only provided for Python 3.8 and 3.9 on Windows, all other wheels are 64 bits on account of Ubuntu, Fedora, and other Linux distributions dropping 32 bit support. All 64 bit wheels are also linked with 64 bit integer OpenBLAS, which should fix the occasional problems encountered by folks using truly huge arrays.

Expired deprecations

Deprecated numeric style dtype strings have been removed

Using the strings "Bytes0", "Datetime64", "Str0", "Uint32", and "Uint64" as a dtype will now raise a TypeError.

(gh-19539)

Expired deprecations for loads, ndfromtxt, and mafromtxt in npyio

numpy.loads was deprecated in v1.15, with the recommendation that users use pickle.loads instead. ndfromtxt and mafromtxt were both deprecated in v1.17 - users should use numpy.genfromtxt instead with the appropriate value for the usemask parameter.

(gh-19615)

... (truncated)

• 4adc87d Merge pull request #20685 from charris/prepare-for-1.22.0-release
• fd66547 REL: Prepare for the NumPy 1.22.0 release.
• 125304b wip
• c283859 Merge pull request #20682 from charris/backport-20416
• 5399c03 Merge pull request #20681 from charris/backport-20954
• f9c45f8 Merge pull request #20680 from charris/backport-20663
• 794b36f Update armccompiler.py
• d93b14e Update test_public_api.py
• 7662c07 Update init.py
• 311ab52 Update armccompiler.py
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from pillow's releases.

9.0.1

https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html

Changes

• In show_file, use os.remove to remove temporary images. CVE-2022-24303 #6010 [@​radarhere, @​hugovk]
• Restrict builtins within lambdas for ImageMath.eval. CVE-2022-22817 #6009 [radarhere]

9.0.0

https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html

Changes

• Restrict builtins for ImageMath.eval() #5923 [@​radarhere]
• Ensure JpegImagePlugin stops at the end of a truncated file #5921 [@​radarhere]
• Fixed ImagePath.Path array handling #5920 [@​radarhere]
• Remove consecutive duplicate tiles that only differ by their offset #5919 [@​radarhere]
• Removed redundant part of condition #5915 [@​radarhere]
• Explicitly enable strip chopping for large uncompressed TIFFs #5517 [@​kmilos]
• Use the Windows method to get TCL functions on Cygwin #5807 [@​DWesl]
• Changed error type to allow for incremental WebP parsing #5404 [@​radarhere]
• Improved I;16 operations on big endian #5901 [@​radarhere]
• Ensure that BMP pixel data offset does not ignore palette #5899 [@​radarhere]
• Limit quantized palette to number of colors #5879 [@​radarhere]
• Use latin1 encoding to decode bytes #5870 [@​radarhere]
• Fixed palette index for zeroed color in FASTOCTREE quantize #5869 [@​radarhere]
• When saving RGBA to GIF, make use of first transparent palette entry #5859 [@​radarhere]
• Pass SAMPLEFORMAT to libtiff #5848 [@​radarhere]
• Added rounding when converting P and PA #5824 [@​radarhere]
• Improved putdata() documentation and data handling #5910 [@​radarhere]
• Exclude carriage return in PDF regex to help prevent ReDoS #5912 [@​radarhere]
• Image.NONE is only used for resampling and dithers #5908 [@​radarhere]
• Fixed freeing pointer in ImageDraw.Outline.transform #5909 [@​radarhere]
• Add Tidelift alignment action and badge #5763 [@​aclark4life]
• Replaced further direct invocations of setup.py #5906 [@​radarhere]
• Added ImageShow support for xdg-open #5897 [@​m-shinder]
• Fixed typo #5902 [@​radarhere]
• Switched from deprecated "setup.py install" to "pip install ." #5896 [@​radarhere]
• Support 16-bit grayscale ImageQt conversion #5856 [@​cmbruns]
• Fixed raising OSError in _safe_read when size is greater than SAFEBLOCK #5872 [@​radarhere]
• Convert subsequent GIF frames to RGB or RGBA #5857 [@​radarhere]
• WebP: Fix memory leak during decoding on failure #5798 [@​ilai-deutel]
• Do not prematurely return in ImageFile when saving to stdout #5665 [@​infmagic2047]
• Added support for top right and bottom right TGA orientations #5829 [@​radarhere]
• Corrected ICNS file length in header #5845 [@​radarhere]
• Block tile TIFF tags when saving #5839 [@​radarhere]
• Added line width argument to ImageDraw polygon #5694 [@​radarhere]
• Do not redeclare class each time when converting to NumPy #5844 [@​radarhere]
• Only prevent repeated polygon pixels when drawing with transparency #5835 [@​radarhere]

... (truncated)

Sourced from pillow's changelog.

9.0.1 (2022-02-03)

• In show_file, use os.remove to remove temporary images. CVE-2022-24303 #6010 [radarhere, hugovk]

• Restrict builtins within lambdas for ImageMath.eval. CVE-2022-22817 #6009 [radarhere]

9.0.0 (2022-01-02)

• Restrict builtins for ImageMath.eval(). CVE-2022-22817 #5923 [radarhere]

• Ensure JpegImagePlugin stops at the end of a truncated file #5921 [radarhere]

• Fixed ImagePath.Path array handling. CVE-2022-22815, CVE-2022-22816 #5920 [radarhere]

• Remove consecutive duplicate tiles that only differ by their offset #5919 [radarhere]

• Improved I;16 operations on big endian #5901 [radarhere]

• Limit quantized palette to number of colors #5879 [radarhere]

• Fixed palette index for zeroed color in FASTOCTREE quantize #5869 [radarhere]

• When saving RGBA to GIF, make use of first transparent palette entry #5859 [radarhere]

• Pass SAMPLEFORMAT to libtiff #5848 [radarhere]

• Added rounding when converting P and PA #5824 [radarhere]

• Improved putdata() documentation and data handling #5910 [radarhere]

• Exclude carriage return in PDF regex to help prevent ReDoS #5912 [hugovk]

• Fixed freeing pointer in ImageDraw.Outline.transform #5909 [radarhere]

... (truncated)

• 6deac9e 9.0.1 version bump
• c04d812 Update CHANGES.rst [ci skip]
• 4fabec3 Added release notes for 9.0.1
• 02affaa Added delay after opening image with xdg-open
• ca0b585 Updated formatting
• 427221e In show_file, use os.remove to remove temporary images
• c930be0 Restrict builtins within lambdas for ImageMath.eval
• 75b69dd Dont need to pin for GHA
• cd938a7 Autolink CWE numbers with sphinx-issues
• 2e9c461 Add CVE IDs
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from poetry's releases.

1.1.9

Fixed

• Fixed a security issue where file hashes were not checked prior to installation. (#4420, #4444, python-poetry/poetry-core#193)
• Fixed the detection of the system environment when the setting virtualenvs.create is deactivated. (#4507)
• Fixed an issue where unsafe parameters could be passed to git commands. (python-poetry/poetry-core#203)
• Fixed an issue where the wrong git executable could be used on Windows. (python-poetry/poetry-core#205)

1.1.8

Fixed

• Fixed an error with repository prioritization when specifying secondary repositories. (#4241)
• Fixed the detection of the system environment when the setting virtualenvs.create is deactivated. (#4330, #4407)
• Fixed the evaluation of relative path dependencies. (#4246)
• Fixed environment detection for Python 3.10 environments. (#4387)
• Fixed an error in the evaluation of in/not in markers (python-poetry/poetry-core#189)

1.1.7

Note: Lock files might need to be regenerated for the first fix below to take effect. You can use poetry lock to do so without the --no-update option.

Changed

• This release is compatible with the install-poetry.py installation script to ease the migration path from 1.1 releases to 1.2 releases. (#4192)

Fixed

• Fixed an issue where transitive dependencies of directory or VCS dependencies were not installed or otherwise removed. (#4203)
• Fixed an issue where the combination of the --tree and --no-dev options for the show command was still displaying development dependencies. (#3992)

Sourced from poetry's changelog.

[1.1.9] - 2021-09-18

Fixed

• Fixed a security issue where file hashes were not checked prior to installation. (#4420, #4444, python-poetry/poetry-core#193)
• Fixed the detection of the system environment when the setting virtualenvs.create is deactivated. (#4507)
• Fixed an issue where unsafe parameters could be passed to git commands. (python-poetry/poetry-core#203)
• Fixed an issue where the wrong git executable could be used on Windows. (python-poetry/poetry-core#205)

[1.1.8] - 2021-08-19

Fixed

• Fixed an error with repository prioritization when specifying secondary repositories. (#4241)
• Fixed the detection of the system environment when the setting virtualenvs.create is deactivated. (#4330, #4407)
• Fixed the evaluation of relative path dependencies. (#4246)
• Fixed environment detection for Python 3.10 environments. (#4387)
• Fixed an error in the evaluation of in/not in markers (python-poetry/poetry-core#189)

[1.2.0a2] - 2021-08-01

Added

• Poetry now supports dependency groups. (#4260)
• The install command now supports a --sync option to synchronize the environment with the lock file. (#4336)

Changed

• Improved the way credentials are retrieved to better support keyring backends. (#4086)
• The --remove-untracked option of the install command is now deprecated in favor of the new --sync option. (#4336)
• The user experience when installing dependency groups has been improved. (#4336)

Fixed

• Fixed performance issues when resolving dependencies. (#3839)
• Fixed an issue where transitive dependencies of directory or VCS dependencies were not installed or otherwise removed. (#4202)
• Fixed the behavior of the init command in non-interactive mode. (#2899)
• Fixed the detection of the system environment when the setting virtualenvs.create is deactivated. (#4329)
• Fixed the display of possible solutions for some common errors. (#4332)

[1.1.7] - 2021-06-25

Note: Lock files might need to be regenerated for the first fix below to take effect.
You can use poetry lock to do so without the --no-update option.

Changed

• This release is compatible with the install-poetry.py installation script to ease the migration path from 1.1 releases to 1.2 releases. (#4192)

Fixed

... (truncated)

• 69bd682 Bump version to 1.1.9
• 9d8aed4 Update lock file
• a9e59ed Merge pull request #4507 from python-poetry/1.1-fix-system-env-detection
• 459c8c9 Fix system env detection
• 634bb23 Merge pull request #4420 from pietrodn/fix/hash-check-backport-1.1
• d033cba style: linting
• 8268795 Merge pull request #4444 from python-poetry/1.1-fix-archive-hash-generation
• 8238cab Fix archive hash generation
• 8956a0c fix: python 2.7 syntax
• 435ff81 Throw a RuntimeError on hash mismatch in Chooser._get_links (#3885)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from ujson's releases.

5.4.0

Added

• Add support for arbitrary size integers (#548) @​JustAnotherArchivist

Fixed

• CVE-2022-31116:
  • Replace wchar_t string decoding implementation with a uint32_t-based one (#555) @​JustAnotherArchivist
  • Fix handling of surrogates on decoding (#550) @​JustAnotherArchivist
• CVE-2022-31117: Potential double free of buffer during string decoding @​JustAnotherArchivist
• Fix memory leak on encoding errors when the buffer was resized (#549) @​JustAnotherArchivist
• Integer parsing: always detect overflows (#544) @​NaN-git
• Fix handling of surrogates on encoding (#530) @​JustAnotherArchivist

5.3.0

Added

• Test Python 3.11 beta (#539) @​hugovk

Changed

• Benchmark refactor - argparse CLI (#533) @​Erotemic

Fixed

• Fix segmentation faults when errors occur while handling unserialisable objects (#531) @​JustAnotherArchivist
• Fix segmentation fault when an exception is raised while converting a dict key to a string (#526) @​JustAnotherArchivist
• Fix memory leak dumping on non-string dict keys (#521) @​JustAnotherArchivist
• Fix ref counting on repeated default function calls (#524) @​JustAnotherArchivist
• Remove redundant wheel dependency from pyproject.toml (#535) @​hugovk

5.2.0

Added

• Support parsing NaN, Infinity and -Infinity (#514) @​Erotemic
• Support dynamically linking against system double-conversion library (#508) @​musicinmybrain
• Add env var to control stripping debug info (#507) @​musicinmybrain
• Add JSONDecodeError (#498) @​JustAnotherArchivist

Fixed

• Fix buffer overflows (CVE-2021-45958) (#519) @​JustAnotherArchivist
• Upgrade Black to fix Click (#515) @​hugovk
• simplify exception handling on integer overflow (#510) @​RouquinBlanc
• Remove dead code that used to handle the separate int type in Python 2 (#509) @​JustAnotherArchivist
• Fix exceptions on encoding list or dict elements and non-overflow errors on int handling getting silenced (#505) @​JustAnotherArchivist

5.1.0

Changed

... (truncated)

• 9c20de0 Merge pull request from GHSA-fm67-cv37-96ff
• b21da40 Fix double free on string decoding if realloc fails
• 67ec071 Merge pull request #555 from JustAnotherArchivist/fix-decode-surrogates-2
• bc7bdff Replace wchar_t string decoding implementation with a uint32_t-based one
• cc70119 Merge pull request #548 from JustAnotherArchivist/arbitrary-ints
• 4b5cccc Merge pull request #553 from bwoodsend/pypy-ci
• abe26fc Merge pull request #551 from bwoodsend/bye-bye-travis
• 3efb5cc Delete old TravisCI workflow and references.
• 404de1a xfail test_decode_surrogate_characters() on Windows PyPy.
• f7e66dc Switch to musl docker base images.
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from nltk's changelog.

Version 3.7 2022-02-09

• Improve and update the NLTK team page on nltk.org (#2855, #2941)
• Drop support for Python 3.6, support Python 3.10 (#2920)

Version 3.6.7 2021-12-28

• Resolve IndexError in sent_tokenize and word_tokenize (#2922)

Version 3.6.6 2021-12-21

• Refactor gensim.doctest to work for gensim 4.0.0 and up (#2914)
• Add Precision, Recall, F-measure, Confusion Matrix to Taggers (#2862)
• Added warnings if .zip files exist without any corresponding .csv files. (#2908)
• Fix FileNotFoundError when the download_dir is a non-existing nested folder (#2910)
• Rename omw to omw-1.4 (#2907)
• Resolve ReDoS opportunity by fixing incorrectly specified regex (#2906)
• Support OMW 1.4 (#2899)
• Deprecate Tree get and set node methods (#2900)
• Fix broken inaugural test case (#2903)
• Use Multilingual Wordnet Data from OMW with newer Wordnet versions (#2889)
• Keep NLTKs "tokenize" module working with pathlib (#2896)
• Make prettyprinter to be more readable (#2893)
• Update links to the nltk book (#2895)
• Add CITATION.cff to nltk (#2880)
• Resolve serious ReDoS in PunktSentenceTokenizer (#2869)
• Delete old CI config files (#2881)
• Improve Tokenize documentation + add TokenizerI as superclass for TweetTokenizer (#2878)
• Fix expected value for BLEU score doctest after changes from #2572
• Add multi Bleu functionality and tests (#2793)
• Deprecate 'return_str' parameter in NLTKWordTokenizer and TreebankWordTokenizer (#2883)
• Allow empty string in CFG's + more (#2888)
• Partition tree.py module into tree package + pickle fix (#2863)
• Fix several TreebankWordTokenizer and NLTKWordTokenizer bugs (#2877)
• Rewind Wordnet data file after each lookup (#2868)
• Correct init call for SyntaxCorpusReader subclasses (#2872)
• Documentation fixes (#2873)
• Fix levenstein distance for duplicated letters (#2849)
• Support alternative Wordnet versions (#2860)
• Remove hundreds of formatting warnings for nltk.org (#2859)
• Modernize nltk.org/howto pages (#2856)
• Fix Bleu Score smoothing function from taking log(0) (#2839)
• Update third party tools to newer versions and removing MaltParser fixed version (#2832)
• Fix TypeError: _pretty() takes 1 positional argument but 2 were given in sem/drt.py (#2854)
• Replace http with https in most URLs (#2852)

Thanks to the following contributors to 3.6.6 Adam Hawley, BatMrE, Danny Sepler, Eric Kafe, Gavish Poddar, Panagiotis Simakis, RnDevelover, Robby Horvath, Tom Aarsen, Yuta Nakamura, Mohaned Mashaly

... (truncated)

• 4862b09 updates for 3.6.6
• 6b60213 Refactor gensim.doctest to work for gensim 4.0.0 and up (#2914)
• 59aa3fb Fix decode error for bllip parser (#2897)
• a28d256 Add Precision, Recall, F-measure, Confusion Matrix to Taggers (#2862)
• 72d9885 Added warnings if .zip files exist without any corresponding .csv files. (#2908)
• dea7b44 Fix FileNotFoundError when the download_dir is a non-existing nested fold...
• abbe86b Undo #2909 due to unexpected test failure
• c075dab Allow commits with /nocache to not use the cache (#2909)
• d6d513d Renamed omw to omw-1.4 (#2907)
• 2a50a3e Resolve ReDoS opportunity by fixing incorrectly specified regex (#2906)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.