Holistic Evaluation of Language Models (HELM), a framework to increase the transparency of language models (https://arxiv.org/abs/2211.09110). This framework is also used to evaluate text-to-image models in Holistic Evaluation of Text-to-Image Models (HEIM) (https://arxiv.org/abs/2311.04287).
Changed the type annotations to allow dict on :meth:aiohttp.MultipartWriter.append,
:meth:aiohttp.MultipartWriter.append_json and
:meth:aiohttp.MultipartWriter.append_form -- by :user:cakemanny
The asynchronous internals now set the underlying causes
when assigning exceptions to the future objects
-- by :user:webknjaz.
Related issues and pull requests on GitHub:
:issue:8089.
Treated values of Accept-Encoding header as case-insensitive when checking
for gzip files -- by :user:steverep.
Related issues and pull requests on GitHub:
:issue:8104.
Improved the DNS resolution performance on cache hit -- by :user:bdraco.
This is achieved by avoiding an :mod:asyncio task creation in this case.
Related issues and pull requests on GitHub:
:issue:8163.
Changed the type annotations to allow dict on :meth:aiohttp.MultipartWriter.append,
:meth:aiohttp.MultipartWriter.append_json and
:meth:aiohttp.MultipartWriter.append_form -- by :user:cakemanny
Related issues and pull requests on GitHub:
:issue:7741.
Ensure websocket transport is closed when client does not close it
-- by :user:bdraco.
The transport could remain open if the client did not close it. This
change ensures the transport is closed when the client does not close
it.
Fix issue where specially crafted inputs to encode() could
take exceptionally long amount of time to process. [CVE-2024-3651]
Thanks to Guido Vranken for reporting the issue.
3.6 (2023-11-25)
++++++++++++++++
Fix regression to include tests in source distribution.
3.5 (2023-11-24)
++++++++++++++++
Update to Unicode 15.1.0
String codec name is now "idna2008" as overriding the system codec
"idna" was not working.
Fix typing error for codec encoding
"setup.cfg" has been added for this release due to some downstream
lack of adherence to PEP 517. Should be removed in a future release
so please prepare accordingly.
Removed reliance on a symlink for the "idna-data" tool to comport
with PEP 517 and the Python Packaging User Guide for sdist archives.
Added security reporting protocol for project
Thanks Jon Ribbens, Diogo Teles Sant'Anna, Wu Tingfeng for contributions
to this release.
ONNX v1.16.0 is now available with exciting new features! We would like to thank everyone who contributed to this release! Please visit onnx.ai to learn more about ONNX and associated projects.
To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed _get_connection to
a new public API, get_connection_with_tls_context. Existing custom
HTTPAdapters will need to migrate their code to use this new API.
get_connection is considered deprecated in all versions of Requests>=2.32.0.
A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
v2.32.1
2.32.1 (2024-05-20)
Bugfixes
Add missing test certs to the sdist distributed on PyPI.
verify=True now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. (#6667)
Requests now supports optional use of character detection
(chardet or charset_normalizer) when repackaged or vendored.
This enables pip and other projects to minimize their vendoring
surface area. The Response.text() and apparent_encoding APIs
will default to utf-8 if neither library is present. (#6702)
Bugfixes
Fixed bug in length detection where emoji length was incorrectly
calculated in the request content-length. (#6589)
Fixed deserialization bug in JSONDecodeError. (#6629)
Fixed bug where an extra leading / (path separator) could lead
urllib3 to unnecessarily reparse the request URI. (#6644)
To provide a more stable migration for custom HTTPAdapters impacted
by the CVE changes in 2.32.0, we've renamed _get_connection to
a new public API, get_connection_with_tls_context. Existing custom
HTTPAdapters will need to migrate their code to use this new API.
get_connection is considered deprecated in all versions of Requests>=2.32.0.
A minimal (2-line) example has been provided in the linked PR to ease
migration, but we strongly urge users to evaluate if their custom adapter
is subject to the same issue described in CVE-2024-35195. (#6710)
2.32.1 (2024-05-20)
Bugfixes
Add missing test certs to the sdist distributed on PyPI.
verify=True now reuses a global SSLContext which should improve
request time variance between first and subsequent requests. It should
also minimize certificate load time on Windows systems when using a Python
version built with OpenSSL 3.x. (#6667)
Requests now supports optional use of character detection
(chardet or charset_normalizer) when repackaged or vendored.
This enables pip and other projects to minimize their vendoring
surface area. The Response.text() and apparent_encoding APIs
will default to utf-8 if neither library is present. (#6702)
Bugfixes
Fixed bug in length detection where emoji length was incorrectly
calculated in the request content-length. (#6589)
Fixed deserialization bug in JSONDecodeError. (#6629)
Fixed bug where an extra leading / (path separator) could lead
urllib3 to unnecessarily reparse the request URI. (#6644)
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Changes
Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.
Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.
Fixed handling of OpenSSL 3.2.0 new error message for misconfiguring an HTTP proxy as HTTPS. ([#3405](https://github.com/urllib3/urllib3/issues/3405) <https://github.com/urllib3/urllib3/issues/3405>__)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/stanford-crfm/helm/network/alerts).
Bumps the pip group with 8 updates in the / directory:
3.9.3
3.9.4
2024.2.2
2024.7.4
20.1.0
22.0.0
3.4
3.7
1.12.0
1.16.0
2.31.0
2.32.2
1.3.2
1.5.0
1.26.18
1.26.19
Updates
aiohttp
from 3.9.3 to 3.9.4Release notes
Sourced from aiohttp's releases.
... (truncated)
Changelog
Sourced from aiohttp's changelog.
... (truncated)
Commits
b3397c7
Release v3.9.4 (#8201)a7e240a
[PR #8320/9ba9a4e5 backport][3.9] Fix Python parser to mark responses without...2833552
Escape filenames and paths in HTML when generating index pages (#8317) (#8319)ed43040
[PR #8309/c29945a1 backport][3.9] Improve reliability of run_app test (#8315)ec2be05
[PR #8299/28d026eb backport][3.9] Create marker for internal tests (#8307)292d961
[PR #8304/88c80c14 backport][3.9] Check for backports in CI (#8305)cebe526
Fix handling of multipart/form-data (#8280) (#8302)270ae9c
[PR #8297/d15f07cf backport][3.9] Upgrade to llhttp 9.2.1 (#8292) (#8298)bb23105
[PR #8283/54e13b0a backport][3.9] Fix blocking I/O in the event loop while pr...3f79241
[PR #8286/28f1fd88 backport][3.9] docs: remove repetitive word in comment (#8...Updates
certifi
from 2024.2.2 to 2024.7.4Commits
bd81538
2024.07.04 (#295)06a2cbf
Bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (#294)13bba02
Bump actions/checkout from 4.1.6 to 4.1.7 (#293)e8abcd0
Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (#292)124f4ad
2024.06.02 (#291)c2196ce
--- (#290)fefdeec
Bump actions/checkout from 4.1.4 to 4.1.5 (#289)3c5fb15
Bump actions/download-artifact from 4.1.6 to 4.1.7 (#286)4a9569a
Bump actions/checkout from 4.1.2 to 4.1.4 (#287)1fc8086
Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (#288)Updates
gunicorn
from 20.1.0 to 22.0.0Release notes
Sourced from gunicorn's releases.
... (truncated)
Commits
f63d59e
bump to 22.04ac81e0
Merge pull request #3175 from e-kwsm/typo401cecf
Merge pull request #3179 from dhdaines/exclude-eventlet-03600243ec3
fix(deps): exclude eventlet 0.36.0628a0bc
chore: fix typos88fc4a4
Merge pull request #3131 from pajod/patch-py12-rebaseddeae2fc
CI: back off the agressive timeoutf470382
docs: promise 3.12 compat5e30bfa
add changelog to project.urls (updated for PEP621)481c3f9
remove setup.cfg - overridden by pyproject.tomlUpdates
idna
from 3.4 to 3.7Release notes
Sourced from idna's releases.
Changelog
Sourced from idna's changelog.
Commits
1d365e1
Release v3.7c1b3154
Merge pull request #172 from kjd/optimize-contextj0394ec7
Merge branch 'master' into optimize-contextjcd58a23
Merge pull request #152 from elliotwutingfeng/dev5beb28b
More efficient resolution of joiner contexts1b12148
Update ossf/scorecard-action to v2.3.1d516b87
Update Github actions/checkout to v4c095c75
Merge branch 'master' into dev60a0a4c
Fix typo in GitHub Actions workflow key5918a0e
Merge branch 'master' into devUpdates
onnx
from 1.12.0 to 1.16.0Release notes
Sourced from onnx's releases.
... (truncated)
Commits
990217f
Set version number for official release (#6033)2159934
[Cherry-pick] Fix builds from source and pip tar.gz on s390x systems (#5986)f46a3f8
[Cherry-pick] Use CMAKE_PREFIX_PATH in finding libprotobuf (#5975) (#5997)c867683
[Cherry-pick]Fix SegFault bug in shape inference (#5995)e6ff7b9
[Cherry-pick] Fix unique_name (#5994)34e00dd
Set version inrel-1.16.0
to 1.16.0rc2 (#5987)309a0b0
[Cherry-pick] Fix Check URLs errors inrel-1.16
(#5973)69ec4b6
Set version inrel-1.16.0
to 1.16.0rc1 (#5969)ff60ddc
Update top-k documentation (#5948)833575e
Prepare for rel-1.16.0 (#5959)Updates
requests
from 2.31.0 to 2.32.2Release notes
Sourced from requests's releases.
... (truncated)
Changelog
Sourced from requests's changelog.
... (truncated)
Commits
88dce9d
v2.32.2c98e4d1
Merge pull request #6710 from nateprewitt/api_rename92075b3
Add deprecation warningaa1461b
Move _get_connection to get_connection_with_tls_context970e8ce
v2.32.1d6ebc4a
v2.32.09a40d12
Avoid reloading root certificates to improve concurrent performance (#6667)0c030f7
Merge pull request #6702 from nateprewitt/no_char_detection555b870
Allow character detection dependencies to be optional in post-packaging stepsd6dded3
Merge pull request #6700 from franekmagiera/update-redirect-to-invalid-uri-testUpdates
scikit-learn
from 1.3.2 to 1.5.0Release notes
Sourced from scikit-learn's releases.
... (truncated)
Commits
b51d0c9
trigger whell builder [cd build]919ae9b
MAINT Reoder what's new for 1.5 (#29039)0ac28ad
DOC Release highlights 1.5 (#29007)729b54d
test py3.12 against numpy 2 [cd build]1e50434
set versionffbe4ab
DOC remove obsolete SVM example (#27108)4647729
DOC Fix time complexity of MLP (#28592)9bd7047
FIX convergence criterion of MeanShift (#28951)b79420f
FIX add long long for int32/int64 windows compat in NumPy 2.0 (#29029)37f544d
DOC replace pandas with Polars in examples/gaussian_process/plot_gpr_co2.py (...Updates
urllib3
from 1.26.18 to 1.26.19Release notes
Sourced from urllib3's releases.
Changelog
Sourced from urllib3's changelog.
Commits
d9d85c8
Release 1.26.198528b63
[1.26] Fix downstream tests (#3409)40b6d16
Merge pull request from GHSA-34jh-p97f-mpxf29cfd02
Fix handling of OpenSSL 3.2.0 new error message "record layer failure" (#3405)b600643
[1.26] Bump RECENT_DATE (#3404)7e2d389
[1.26] Fix running CPython 2.7 tests in CI (#3137)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show