chore(deps): update dependency scikit-learn to v1.5.0 [security]

[anaconda-renovate]

This PR contains the following updates:

Package	Update	Change
scikit-learn (changelog)	minor	==1.3.0 → ==1.5.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

renovate update details

Field	Value
manager	pip_requirements
categories	python
datasource	pypi
depName	scikit-learn
depType¹
packageName	scikit-learn
sourceUrl	https://github.com/scikit-learn/scikit-learn
updateType	minor
versioning	pep440

¹ only available for some managers

---

scikit-learn sensitive data leakage vulnerability

CVE-2024-5206 / GHSA-jw8x-6495-233v / PYSEC-2024-110

More information

Details

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stop_words_ attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the stop_words_ attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-5206
• https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8
• https://github.com/pypa/advisory-database/tree/main/vulns/scikit-learn/PYSEC-2024-110.yaml
• https://github.com/scikit-learn/scikit-learn
• https://huntr.com/bounties/14bc0917-a85b-4106-a170-d09d5191517c

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

CVE-2024-5206 / GHSA-jw8x-6495-233v / PYSEC-2024-110

More information

Details

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stop_words_ attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the stop_words_ attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://huntr.com/bounties/14bc0917-a85b-4106-a170-d09d5191517c
• https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Release Notes

scikit-learn/scikit-learn (scikit-learn)

v1.5.0: Scikit-learn 1.5.0

Compare Source

We're happy to announce the 1.5.0 release.

You can read the release highlights under https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_5_0.html and the long version of the change log under https://scikit-learn.org/stable/whats_new/v1.5.html

This version supports Python versions 3.9 to 3.12.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

v1.4.2: Scikit-learn 1.4.2

Compare Source

We're happy to announce the 1.4.2 release.

This release only includes support for numpy 2.

This version supports Python versions 3.9 to 3.12.

You can upgrade with pip as usual:

pip install -U scikit-learn

v1.4.1.post1: Scikit-learn 1.4.1.post1

Compare Source

We're happy to announce the 1.4.1.post1 release.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.4.html#version-1-4-1-post1

This version supports Python versions 3.9 to 3.12.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

v1.4.0

Compare Source

v1.3.2: Scikit-learn 1.3.2

Compare Source

We're happy to announce the 1.3.2 release.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.3.html#version-1-3-2

This version supports Python versions 3.8 to 3.12.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

v1.3.1: Scikit-learn 1.3.1

Compare Source

We're happy to announce the 1.3.1 release.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.3.html#version-1-3-1

This version supports Python versions 3.8 to 3.12.

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.