Safety vulnerability ID: 66028
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Pyspi version 0.4.2 updates its Scikit-learn dependency to version 1.0.1 from 0.24.1 in response to security concerns highlighted by CVE-2020-28975.
Latest version: 1.1.1
Library for pairwise analysis of time series data.
Introduction
This patch release brings a few minor updates including a new high contrast logo for dark mode users, improved SPI unit testing (with a new benchmarking dataset) and fixes for potential security vulnerability issues.
Highlights of this release
- New high contrast logo for dark-mode users.
- Improved SPI unit testing with z-scoring approach to flag SPIs with differing outputs.
- New coupled map lattice (CML) benchmarking dataset.
- Fix for potential security vulnerability issues in scikit-learn.
What's Changed
- Replaced the old `standard_normal.npy` benchmarking dataset with a coupled map lattice (`cml7.npy`), along with its associated .pkl file containing the benchmark values (`CML7_benchmark_tables.pkl`) generated in a fresh Ubuntu environment.
- Updated the README to automatically select either the regular or new dark mode logo based on the user's theme.
- Added new `conftest.py` file for pytest to customise the unit testing outputs.
- Added a new `pyproject.toml` file for configuring the package for publishing to PyPI.
New features
- Improved SPI unit testing with a new coupled map lattice benchmarking dataset (`cml7.npy`) consisting of 7 processes and 100 observations per process.
- Z-scoring approach in unit testing pipeline to flag potential changes in SPI outputs as a result of algorithmic changes, etc. SPIs with outputs differing by more than a specified threshold are "flagged" and summarised in a table.
- Added a darkmode _pyspi_ logo to the README which is shown for users with the dark-mode GitHub theme.
Bug Fixes
- Fixed a scikit-learn security vulnerability issue with severity "high" (pertaining to denial of service) by upgrading scikit-learn from version `0.24.1` to version `1.0.1`.
- Fixed Int64 deprecation issue (cannot import name `Int64Index` from `pandas`) by fixing pandas to version `1.5.0`.
- Fixed unknown character issue for Windows users resulting from not specifying an encoding when loading the "README" in `setup.py`. Now fixed to `utf-8` for consistency across platforms.
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application