This is a security fix release for the 2.2.x release branch. Note that 2.3.x is the currently supported release branch; please upgrade to the latest version if possible.
This is a feature release, which includes new features and removes previously deprecated code. The 2.2.x branch is now the supported bug fix branch, the 2.1.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades.
Below is the release schedule for gRPC Java, Go and Core and its dependent languages C++, C#, Objective-C, PHP, Python and Ruby.
Releases are scheduled every six weeks on Tuesdays on a best effort basis. In some unavoidable situations a release may be delayed or released early or a language may skip a release altogether and do the next release to catch up with other languages. See the past releases in the links above. A six-week cycle gives us a good balance between delivering new features/fixes quickly and keeping the release overhead low.
The gRPC release support policy can be found here.
Releases are cut from release branches. For Core and Java repos, the release branch is cut two weeks before the scheduled release date. For Go, the branch is cut just before the release. An RC (release candidate) is published for Core and its dependent languages just after the branch cut. This RC is later promoted to release version if no further changes are made to the release branch. We do our best to keep head of master branch stable at all times regardless of release schedule. Daily build packages from master branch for C#, PHP, Python, Ruby and Protoc plugins are published on packages.grpc.io. If you depend on gRPC in production we recommend to set up your CI system to test the RCs and, if possible, the daily builds.
This is a feature release, which includes new features and removes previously deprecated features. The 3.1.x branch is now the supported bugfix branch, the 3.0.x branch has become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. We also encourage upgrading to MarkupSafe 2.1.1, the latest version at this time.
Follow our blog, Twitter, or GitHub to see future announcements.
This represents a significant amount of work, and there are quite a few changes. Be sure to carefully read the changelog, and use tools such as pip-compile and Dependabot to pin your dependencies and control your updates.
3.0.0rc2
Fixes an issue with the deprecated Markup subclass, #1401.
Fix compiler error when checking if required blocks in parent templates are
empty. :pr:1858
xmlattr filter does not allow keys with spaces. GHSA-h5c8-rqwp-cp95
Make error messages stemming from invalid nesting of {% trans %} blocks
more helpful. :pr:1918
Version 3.1.2
Released 2022-04-28
Add parameters to Environment.overlay to match __init__.
:issue:1645
Handle race condition in FileSystemBytecodeCache. :issue:1654
Version 3.1.1
Released 2022-03-25
The template filename on Windows uses the primary path separator.
:issue:1637
Version 3.1.0
Released 2022-03-24
Drop support for Python 3.6. :pr:1534
Remove previously deprecated code. :pr:1544
WithExtension and AutoEscapeExtension are built-in now.
contextfilter and contextfunction are replaced by
pass_context. evalcontextfilter and
evalcontextfunction are replaced by pass_eval_context.
environmentfilter and environmentfunction are replaced
by pass_environment.
Markup and escape should be imported from MarkupSafe.
Compiled templates from very old Jinja versions may need to be
recompiled.
Legacy resolve mode for Context subclasses is no longer
supported. Override resolve_or_missing instead of
Fix a security issue where eval(pre_dispatch) could potentially run
arbitrary code. Now only basic numerics are supported.
joblib/joblib#1327
Make sure that joblib works even when multiprocessing is not available,
for instance with Pyodide
joblib/joblib#1256
Avoid unnecessary warnings when workers and main process delete
the temporary memmap folder contents concurrently.
joblib/joblib#1263
Fix memory alignment bug for pickles containing numpy arrays.
This is especially important when loading the pickle with
mmap_mode != None as the resulting numpy.memmap object
would not be able to correct the misalignment without performing
a memory copy.
This bug would cause invalid computation and segmentation faults
with native code that would directly access the underlying data
buffer of a numpy array, for instance C/C++/Cython code compiled
with older GCC versions or some old OpenBLAS written in platform
specific assembly.
joblib/joblib#1254
Vendor cloudpickle 2.2.0 which adds support for PyPy 3.8+.
Vendor loky 3.3.0 which fixes several bugs including:
robustly forcibly terminating worker processes in case of a crash
(joblib/joblib#1269);
avoiding leaking worker processes in case of nested loky parallel
calls;
reliability spawn the correct number of reusable workers.
Release 1.1.1
Fix a security issue where eval(pre_dispatch) could potentially run
arbitrary code. Now only basic numerics are supported.
joblib/joblib#1327
Release 1.1.0
Fix byte order inconsistency issue during deserialization using joblib.load
Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential
forwarding of Proxy-Authorization headers to destination servers when
following HTTPS redirects.
When proxies are defined with user info (https://user:pass@proxy:8080), Requests
will construct a Proxy-Authorization header that is attached to the request to
authenticate with the proxy.
In cases where Requests receives a redirect response, it previously reattached
the Proxy-Authorization header incorrectly, resulting in the value being
sent through the tunneled connection to the destination server. Users who rely on
defining their proxy credentials in the URL are strongly encouraged to upgrade
to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy
credentials once the change has been fully deployed.
Users who do not use a proxy or do not supply their proxy credentials through
the user information portion of their proxy URL are not subject to this
vulnerability.
Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential
forwarding of Proxy-Authorization headers to destination servers when
following HTTPS redirects.
When proxies are defined with user info (https://user:pass@proxy:8080), Requests
will construct a Proxy-Authorization header that is attached to the request to
authenticate with the proxy.
In cases where Requests receives a redirect response, it previously reattached
the Proxy-Authorization header incorrectly, resulting in the value being
sent through the tunneled connection to the destination server. Users who rely on
defining their proxy credentials in the URL are strongly encouraged to upgrade
to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy
credentials once the change has been fully deployed.
Users who do not use a proxy or do not supply their proxy credentials through
the user information portion of their proxy URL are not subject to this
vulnerability.
Bumps the pip group with 15 updates in the /spark/spark_nlp directory:
2020.6.202023.7.221.1.22.2.51.30.01.53.02.11.23.1.30.16.01.2.01.1.01.3.07.0.010.2.00.14.114.0.12.23.02.31.01.4.11.11.10.3.10.4.42.2.02.11.15.1.16.3.31.24.31.26.181.0.12.3.8Updates
certififrom 2020.6.20 to 2023.7.22Commits
8fb96ed2023.07.22afe7722Bump actions/setup-python from 4.6.1 to 4.7.0 (#230)2038739Bump dessant/lock-threads from 3.0.0 to 4.0.1 (#229)44df761Hash pin Actions and enable dependabot (#228)8b3d7ba2023.05.0753da240ci: Add Python 3.12-dev to the testing (#224)c2fc3b1Create a Security Policy (#222)c211ef4Set up permissions to github workflows (#218)2087de5Don't let deprecation warning fail CI (#219)e0b9fc5remove paragraphs about 1024-bit roots from READMEUpdates
flaskfrom 1.1.2 to 2.2.5Release notes
Sourced from flask's releases.
... (truncated)
Changelog
Sourced from flask's changelog.
... (truncated)
Commits
47af817release version 2.2.5afd63b1Merge pull request #5109 from pallets/backport-vary-cookie8646edcsetVary: Cookieheader consistently for sessiona6367daMerge pull request #5108 from pallets/werkzeug-compat3fbfbadwerkzeug 2.3.3 compatibility726d3f4start version 2.2.5ddc7accMerge pull request #5081 from pallets/release-2.2.474e0329release version 2.2.42d46068update dev env64bc458update dev dependenciesUpdates
grpciofrom 1.30.0 to 1.53.0Release notes
Sourced from grpcio's releases.
... (truncated)
Changelog
Sourced from grpcio's changelog.
Commits
358bfb5Bump version to 1.53.0 (#32685)6e1ebe7Backport: Ensure compatibility with the new custom kokoro win2019 image (#326...44a77f6Backport 1.53: Update minimum MSVC version to 2019 (#32615)c11153cbackport to 1.53: xDS: fix crash when removing the last endpoint from the las...7c7712aBump version to 1.53.0-pre2. (#32545)a4017dcbackport to 1.53: [promises] Make Poll<T> its own type, not a variant<> (#32540)3f93c16Fuzzer fix backport to v1.53 (#32511)5b244b2Bump release version to 1.53.0-pre1 (#32428)6589340Bump core version 202302161703 (#32416)d49e151[backoff] Add random early detection classifier (#32354)Updates
jinja2from 2.11.2 to 3.1.3Release notes
Sourced from jinja2's releases.
... (truncated)
Changelog
Sourced from jinja2's changelog.
... (truncated)
Commits
d9de4bbrelease version 3.1.350124e1skip test pypi9ea7222use trusted publishingda703f7use trusted publishingbce1746use trusted publishing7277d80update pre-commit hooks5c8a105Make nested-trans-block exceptions nicer (#1918)19a55dbMake nested-trans-block exceptions nicer7167953Merge pull request from GHSA-h5c8-rqwp-cp957dd3680xmlattr filter disallows keys with spacesUpdates
joblibfrom 0.16.0 to 1.2.0Changelog
Sourced from joblib's changelog.
... (truncated)
Commits
5991350Release 1.2.03fa2188MAINT cleanup numpy warnings related to np.matrix in tests (#1340)cea26ffCI test the future loky-3.3.0 branch (#1338)8aca6f4MAINT: remove pytest.warns(None) warnings in pytest 7 (#1264)067ed4fXFAIL test_child_raises_parent_exits_cleanly with multiprocessing (#1339)ac4ebd5MAINT add back pytest warnings plugin (#1337)a23427dTest child raises parent exits cleanly more reliable on macos (#1335)ac09691[MAINT] various test updates (#1334)4a314b1Vendor loky 3.2.0 (#1333)bdf47e9Make test_parallel_with_interactively_defined_functions_default_backend timeo...Updates
mpmathfrom 1.1.0 to 1.3.0Release notes
Sourced from mpmath's releases.
Changelog
Sourced from mpmath's changelog.
... (truncated)
Commits
b5c0450version 1.3.0a27581cMerge pull request #656 from cclauss/patch-29d7884bdon't use .ae method in library code967de83Downgrade to ubuntu-20.04 for Py35 and Py366425c6abuild: strategy: fail-fast: falsee2341c7GitHub Actions: Test on Python 3.11 production release1258e33fix failing doctestsb7c15d6include signals documentation; remove duplicate docstrings1b476eaupdate doc building instructions5f57bebMerge pull request #646 from cclauss/patch-1Updates
pillowfrom 7.0.0 to 10.2.0Release notes
Sourced from pillow's releases.
... (truncated)
Changelog
Sourced from pillow's changelog.
... (truncated)
Commits
6956d0b10.2.0 version bump31c8dacMerge pull request #7675 from python-pillow/pre-commit-ci-update-config40a3f91Merge pull request #7674 from nulano/url-examplecb41b0c[pre-commit.ci] pre-commit autoupdatede62b25fix image url in "Reading from URL" example7c526a6Update CHANGES.rst [ci skip]d93a5adMerge pull request #7553 from bgilbert/jpeg-rgbaed764fUpdate CHANGES.rst [ci skip]f8df530Merge pull request #7672 from nulano/imagefont-negative-crop24e9485Merge pull request #7671 from radarhere/imagetransformUpdates
pyarrowfrom 0.14.1 to 14.0.1Commits
ba53748MINOR: [Release] Update versions for 14.0.1529f376MINOR: [Release] Update .deb/.rpm changelogs for 14.0.1b84bbcaMINOR: [Release] Update CHANGELOG.md for 14.0.1f141709GH-38607: [Python] Disable PyExtensionType autoload (#38608)5a37e74GH-38431: [Python][CI] Update fs.type_name checks for s3fs tests (#38455)2dcee3fMINOR: [Release] Update versions for 14.0.0297428cMINOR: [Release] Update .deb/.rpm changelogs for 14.0.03e9734fMINOR: [Release] Update CHANGELOG.md for 14.0.09f90995GH-38332: [CI][Release] Resolve symlinks in RAT lint (#38337)bd61239GH-35531: [Python] C Data Interface PyCapsule Protocol (#37797)Updates
requestsfrom 2.23.0 to 2.31.0Release notes
Sourced from requests's releases.
... (truncated)
Changelog
Sourced from requests's changelog.
... (truncated)
Commits
147c851v2.31.074ea7cfMerge pull request from GHSA-j8r2-6x86-q33q3022253test on pypy 3.8 and pypy 3.9 on windows and macos (#6424)b639e66test on py3.12 (#6448)d3d5044Fixed a small typo (#6452)2ad18e0v2.30.0f2629e9Remove strict parameter (#6434)87d63dev2.29.051716c4enable the warnings plugin (#6416)a7da1abtry on ubuntu 22.04 (#6418)Updates
scipyfrom 1.4.1 to 1.11.1Release notes
Sourced from scipy's releases.