Update dependency scikit-learn to v1.5.0 [SECURITY] - abandoned

[renovate[bot]]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
scikit-learn (source, changelog)	==1.2.2 -> ==1.5.0

GitHub Vulnerability Alerts

CVE-2024-5206

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stop_words_ attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the stop_words_ attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.

---

Release Notes

scikit-learn/scikit-learn (scikit-learn)

### [`v1.5.0`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.5.0): Scikit-learn 1.5.0 [Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.4.2...1.5.0) We're happy to announce the 1.5.0 release. You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights\_1\_5\_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.5.html This version supports Python versions 3.9 to 3.12. You can upgrade with pip as usual: pip install -U scikit-learn The conda-forge builds can be installed using: conda install -c conda-forge scikit-learn ### [`v1.4.2`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.4.2): Scikit-learn 1.4.2 [Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.4.1.post1...1.4.2) We're happy to announce the 1.4.2 release. This release only includes support for numpy 2. This version supports Python versions 3.9 to 3.12. You can upgrade with pip as usual: pip install -U scikit-learn ### [`v1.4.1.post1`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.4.1.post1): Scikit-learn 1.4.1.post1 [Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.4.0...1.4.1.post1) We're happy to announce the 1.4.1.post1 release. You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.4.html#version-1-4-1-post1 This version supports Python versions 3.9 to 3.12. You can upgrade with pip as usual: pip install -U scikit-learn The conda-forge builds can be installed using: conda install -c conda-forge scikit-learn ### [`v1.4.0`](https://togithub.com/scikit-learn/scikit-learn/compare/1.3.2...1.4.0) [Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.3.2...1.4.0) ### [`v1.3.2`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.3.2): Scikit-learn 1.3.2 [Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.3.1...1.3.2) We're happy to announce the 1.3.2 release. You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.3.html#version-1-3-2 This version supports Python versions 3.8 to 3.12. You can upgrade with pip as usual: pip install -U scikit-learn The conda-forge builds can be installed using: conda install -c conda-forge scikit-learn ### [`v1.3.1`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.3.1): Scikit-learn 1.3.1 [Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.3.0...1.3.1) We're happy to announce the 1.3.1 release. You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.3.html#version-1-3-1 This version supports Python versions 3.8 to 3.12. You can upgrade with pip as usual: pip install -U scikit-learn The conda-forge builds can be installed using: conda install -c conda-forge scikit-learn ### [`v1.3.0`](https://togithub.com/scikit-learn/scikit-learn/releases/tag/1.3.0): Scikit-learn 1.3.0 [Compare Source](https://togithub.com/scikit-learn/scikit-learn/compare/1.2.2...1.3.0) We're happy to announce the 1.3.0 release. You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights\_1\_3\_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.3.html This version supports Python versions 3.8 to 3.11. You can upgrade with pip as usual: pip install -U scikit-learn The conda-forge builds can be installed using: conda install -c conda-forge scikit-learn

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• [ ] If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cr-gpt[bot]]

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

[github-actions[bot]]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/scikit-learn	1.5.0	:green_circle: 9.5	Details Check Score Reason Maintained :green_circle: 10 30 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10 Code-Review :green_circle: 10 all changesets reviewed CII-Best-Practices :warning: 0 no effort to earn an OpenSSF best practices badge detected License :green_circle: 10 license file detected Signed-Releases :warning: -1 no releases found Branch-Protection :warning: -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Packaging :warning: -1 packaging workflow not detected Token-Permissions :warning: -1 No tokens found Dangerous-Workflow :warning: -1 no workflows found Security-Policy :green_circle: 10 security policy file detected Binary-Artifacts :green_circle: 10 no binaries found in the repo Vulnerabilities :green_circle: 10 0 existing vulnerabilities detected Pinned-Dependencies :warning: -1 no dependencies found Fuzzing :green_circle: 10 project is fuzzed SAST :green_circle: 10 SAST tool is run on all commits

Scanned Manifest Files

requirements.txt

• scikit-learn@1.2.2
• scikit-learn@1.5.0

[cr-gpt[bot]]

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

[renovate[bot]]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[renovate[bot]]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.