CVE-2023-25399

Advisory

Embedded-topic-model 1.2.0 updates its dependency 'scipy' to versions '>=1.11.*' to include security fixes.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Added

- ([61730d](https://github.com/lffloyd/embedded-topic-model/commit/61730d), [#224995](https://github.com/lffloyd/embedded-topic-model/commit/224995), [#331fc0](https://github.com/lffloyd/embedded-topic-model/commit/331fc0)) adds support for macOS MPS devices and updates outdated `numpy`/`sklearn` code - thanks to [d-jiao](https://github.com/d-jiao)
- ([c48016](https://github.com/lffloyd/embedded-topic-model/commit/c48016), [#2fe517](https://github.com/lffloyd/embedded-topic-model/commit/2fe517), [#c965b1](https://github.com/lffloyd/embedded-topic-model/commit/c965b1), [#5578ca](https://github.com/lffloyd/embedded-topic-model/commit/5578ca), [#5b0d85](https://github.com/lffloyd/embedded-topic-model/commit/5b0d85)) adds security guidelines and request templates

Changed

- ([331fc0](https://github.com/lffloyd/embedded-topic-model/commit/331fc0)) updates actions pipeline, supported python versions and internal dependencies to the latest available like `torch`, `gensim`, among others. Support for `python<=3.8` was dropped as a result. Numerous security vulnerabilities were solved

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25399
• https://github.com/lffloyd/embedded-topic-model/commit/331fc0