chore(deps): update dependency numpy to v2 [security]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
numpy (changelog)	~1.20 → ~2.5.0

---

NumPy Buffer Overflow (Disputed)

CVE-2021-33430 / GHSA-6p56-wp2h-9hxr

More information

Details

A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service.

NOTE: The vendor does not agree this is a vulnerability; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user.

Severity

• CVSS Score: 6.0 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-33430
• https://github.com/numpy/numpy/issues/18939
• https://github.com/numpy/numpy/commit/ae317fd9ff3e79c0eac357d723bfc29cbd625f2e
• https://github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2021-854.yaml
• https://github.com/advisories/GHSA-6p56-wp2h-9hxr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Incorrect Comparison in NumPy

CVE-2021-34141 / GHSA-fpfv-jqm9-f5jm

More information

Details

Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-34141
• https://github.com/numpy/numpy/issues/18993
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://github.com/numpy/numpy/issues/18993#issuecomment-1010735102
• https://github.com/advisories/GHSA-fpfv-jqm9-f5jm
• https://github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2021-855.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock

Creating virtualenv cloud-datasets-02SzFaNK-py3.8 in /home/ubuntu/.cache/pypoetry/virtualenvs
Updating dependencies
Resolving dependencies...

/opt/containerbase/tools/poetry/1.2.2/3.8.12/lib/python3.8/site-packages/secretstorage/util.py:23: CryptographyDeprecationWarning: Python 3.8 is no longer supported by the Python core team and support for it is deprecated in cryptography. The next release of cryptography will remove support for Python 3.8.
  from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

The current project's Python requirement (3.8.12) is not compatible with some of the required packages Python requirement:
  - numpy requires Python >=3.12, so it will not be satisfied for Python 3.8.12

Because numpy (2.5.0) requires Python >=3.12
 and no versions of numpy match >2.5.0,<2.6.0, numpy is forbidden.
So, because cloud-datasets depends on numpy (~2.5.0), version solving failed.

  • Check your dependencies Python requirement: The Python requirement can be specified via the `python` or `markers` properties
    
    For numpy, a possible solution would be to set the `python` property to "<empty>"

    https://python-poetry.org/docs/dependency-specification/#python-restricted-dependencies,
    https://python-poetry.org/docs/dependency-specification/#using-environment-markers