CVE-2024-34062

Advisory

OpenMDAO pins `tqdm` to version `>=4.66.3` to address security concerns, including CVE-2024-34062.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

What's Changed
* Incremented version to 3.32.1-dev by swryan in https://github.com/OpenMDAO/OpenMDAO/pull/3222
* Moved get_free_port function to utils directory file by hschilling in https://github.com/OpenMDAO/OpenMDAO/pull/3224
* Added minimum version requirements to address vulnerable dependencies by swryan in https://github.com/OpenMDAO/OpenMDAO/pull/3227
* Added ability to set print_results to "minimal" by crecine in https://github.com/OpenMDAO/OpenMDAO/pull/3216
* Add a new method to list all variables by component in execution order. by Kenneth-T-Moore in https://github.com/OpenMDAO/OpenMDAO/pull/3233
* Added ability to handle reading case recorder files with class instances when the associated class cannot be imported by hschilling in https://github.com/OpenMDAO/OpenMDAO/pull/3228
* Updated tests for constrained differential evolution by swryan in https://github.com/OpenMDAO/OpenMDAO/pull/3232
* a couple of fixes for 'om total_coloring' and 'om partial_coloring' by naylor-b in https://github.com/OpenMDAO/OpenMDAO/pull/3234
* Fix Cut&Paste error in docstring for `list_vars`. by Kenneth-T-Moore in https://github.com/OpenMDAO/OpenMDAO/pull/3238
* Changed return of `prob.run_driver()` from a bool to an object containing information about the Driver execution. by robfalck in https://github.com/OpenMDAO/OpenMDAO/pull/3214
* Added `usedforsecurity=False` flag to hashlib.md5 uses for FIPS-enabled systems. by robfalck in https://github.com/OpenMDAO/OpenMDAO/pull/3237
* Fix for SubmodelComp indexing bug. by naylor-b in https://github.com/OpenMDAO/OpenMDAO/pull/3239
* Updates for NumPy 2.0 compatibility and testing by swryan in https://github.com/OpenMDAO/OpenMDAO/pull/3241
* Removed the 'distributed' option from ExecComp by swryan in https://github.com/OpenMDAO/OpenMDAO/pull/3245
* Fixed a NumPy 2.0 compatibility issue in the test suite by swryan in https://github.com/OpenMDAO/OpenMDAO/pull/3251
* fix for group set_val when using set_input_defaults by naylor-b in https://github.com/OpenMDAO/OpenMDAO/pull/3248
* Fixed error message when a component has an inconsistent set of variables across ranks. by naylor-b in https://github.com/OpenMDAO/OpenMDAO/pull/3254
* fix for incorrect warning about response size vs. dv size by naylor-b in https://github.com/OpenMDAO/OpenMDAO/pull/3255
* Fixed a bug in Case when a VOI is not recorded by swryan in https://github.com/OpenMDAO/OpenMDAO/pull/3256
* Adjusted the CS step size in an approx_totals test for compatibility with SciPy 1.13 by swryan in https://github.com/OpenMDAO/OpenMDAO/pull/3257
* Fix the sparkline plots in the optimization report - height was too small by hschilling in https://github.com/OpenMDAO/OpenMDAO/pull/3258
* Added a wrapper for lambda functions to allow pickling. by naylor-b in https://github.com/OpenMDAO/OpenMDAO/pull/3259
* Updated the test workflow to fail if a security issue is found by swryan in https://github.com/OpenMDAO/OpenMDAO/pull/3261
* Added `minimum` option to `KSComp` by eytanadler in https://github.com/OpenMDAO/OpenMDAO/pull/3229
* Removed unnecessary setup() from doc page by swryan in https://github.com/OpenMDAO/OpenMDAO/pull/3263
* Fix relevance check for empty groups by andrewellis55 in https://github.com/OpenMDAO/OpenMDAO/pull/3265
* Update version/notes for 3.33.0 release by swryan in https://github.com/OpenMDAO/OpenMDAO/pull/3270
* Release notes for 3.33.0 by robfalck in https://github.com/OpenMDAO/OpenMDAO/pull/3264


**Full Changelog**: https://github.com/OpenMDAO/OpenMDAO/compare/3.32.0...3.33.0

Resources

• https://github.com/OpenMDAO/OpenMDAO/pull/3227/files#diff-50c86b7ed8ac2cf95bd48334961bf0530cdc77b5a56f852c5c61b89d735fd711R54
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34062