A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stop_words_ attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the stop_words_ attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.
Release Notes
scikit-learn/scikit-learn (scikit-learn)
### [`v1.5.0`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.5.0): Scikit-learn 1.5.0
[Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.4.2...1.5.0)
We're happy to announce the 1.5.0 release.
You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights\_1\_5\_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.5.html
This version supports Python versions 3.9 to 3.12.
You can upgrade with pip as usual:
pip install -U scikit-learn
The conda-forge builds can be installed using:
conda install -c conda-forge scikit-learn
### [`v1.4.2`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.4.2): Scikit-learn 1.4.2
[Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.4.0...1.4.2)
We're happy to announce the 1.4.2 release.
This release only includes support for numpy 2.
This version supports Python versions 3.9 to 3.12.
You can upgrade with pip as usual:
pip install -U scikit-learn
### [`v1.4.0`](https://togithub.com/scikit-learn/scikit-learn/compare/1.3.2...1.4.0)
[Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.3.2...1.4.0)
### [`v1.3.2`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.3.2): Scikit-learn 1.3.2
[Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.3.1...1.3.2)
We're happy to announce the 1.3.2 release.
You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.3.html#version-1-3-2
This version supports Python versions 3.8 to 3.12.
You can upgrade with pip as usual:
pip install -U scikit-learn
The conda-forge builds can be installed using:
conda install -c conda-forge scikit-learn
### [`v1.3.1`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.3.1): Scikit-learn 1.3.1
[Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.3.0...1.3.1)
We're happy to announce the 1.3.1 release.
You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.3.html#version-1-3-1
This version supports Python versions 3.8 to 3.12.
You can upgrade with pip as usual:
pip install -U scikit-learn
The conda-forge builds can be installed using:
conda install -c conda-forge scikit-learn
Configuration
📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
[ ] If you want to rebase/retry this PR, check this box
This PR contains the following updates:
1.3.0->1.5.0GitHub Vulnerability Alerts
CVE-2024-5206
A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the
stop_words_attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as thestop_words_attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.Release Notes
scikit-learn/scikit-learn (scikit-learn)
### [`v1.5.0`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.5.0): Scikit-learn 1.5.0 [Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.4.2...1.5.0) We're happy to announce the 1.5.0 release. You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights\_1\_5\_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.5.html This version supports Python versions 3.9 to 3.12. You can upgrade with pip as usual: pip install -U scikit-learn The conda-forge builds can be installed using: conda install -c conda-forge scikit-learn ### [`v1.4.2`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.4.2): Scikit-learn 1.4.2 [Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.4.0...1.4.2) We're happy to announce the 1.4.2 release. This release only includes support for numpy 2. This version supports Python versions 3.9 to 3.12. You can upgrade with pip as usual: pip install -U scikit-learn ### [`v1.4.0`](https://togithub.com/scikit-learn/scikit-learn/compare/1.3.2...1.4.0) [Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.3.2...1.4.0) ### [`v1.3.2`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.3.2): Scikit-learn 1.3.2 [Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.3.1...1.3.2) We're happy to announce the 1.3.2 release. You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.3.html#version-1-3-2 This version supports Python versions 3.8 to 3.12. You can upgrade with pip as usual: pip install -U scikit-learn The conda-forge builds can be installed using: conda install -c conda-forge scikit-learn ### [`v1.3.1`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.3.1): Scikit-learn 1.3.1 [Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.3.0...1.3.1) We're happy to announce the 1.3.1 release. You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.3.html#version-1-3-1 This version supports Python versions 3.8 to 3.12. You can upgrade with pip as usual: pip install -U scikit-learn The conda-forge builds can be installed using: conda install -c conda-forge scikit-learnConfiguration
📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.