CVE-2021-42343

Advisory

Dask-image 2023.03.0 updates its dependency 'dask' to v2021.10.0 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-----------------------

We're pleased to announce the release of dask-image v2023.03.0!

Highlights

This version of dask-image drops support for python 3.7,
now requires a minimum Dask version of 2021.10.0 or higher
(due to a security patch), and makes tifffile a regular requirement.
We also now build and publish wheel files to PyPI.

Improvements

* Documentation
* Add GPU CI info to contributing docs (300)
* Docs: add GPU support info to coverage table (301)

* Testing
* Test `gaussian` alias (287)
* Update NaN block size tests for threshold_local function (289)
* Test `find_objects` w/incorrect array type (292)

Deprecations and updated requirements

* Update supported python versions to 3.8, 3.9, 3.10, & 3.11 (drop python 3.7) (284)
* Security update: Dask v2021.10.0 as minimum allowable version (288)
* Make tifffile regular requirement (295)

Build Tools

* Continuous integration
* Refresh doc environment (273)
* Setup Coveralls with GitHub Actions (274)
* Pin to jinja2<3.1 to avoid Readthedocs build error (278)
* Updates `setup.py`'s Python versions (285)
* Combine CI workflows for testing and release upload to PyPI (291)
* Enable option to restart GHA (293)
* Readd `environment-latest.yml` symlink (294)
* Add python 3.10 to gpuCI matrix (298)
* Releases
* ENH: Build and publish wheels in GitHub CI (272)
* Update release notes script (299)
* Release notes for v2022.09.0 (270)
* Dependabot updates
* Create dependabot.yml (279)
* Bump actions/setup-python from 2 to 4 (280)
* Bump actions/checkout from 2 to 3 (281)
* Bump coverallsapp/github-action from 1.1.3 to 1.2.2 (282)
* Bump coverallsapp/github-action from 1.2.2 to 1.2.4 (283)
* Bump coverallsapp/github-action from 1.2.4 to 2.0.0 (296)

Other Pull Requests

* Group all imread functions together in the same file (290)

7 authors added to this release (alphabetical)

* `Charles Blackmon-Luca <https://github.com/dask/dask-image/commits?author=charlesbluca>`_ - charlesbluca
* `dependabot[bot] <https://github.com/dask/dask-image/commits?author=dependabot[bot]>`_ - dependabot[bot]
* `Genevieve Buckley <https://github.com/dask/dask-image/commits?author=GenevieveBuckley>`_ - GenevieveBuckley
* `jakirkham <https://github.com/dask/dask-image/commits?author=jakirkham>`_ - jakirkham
* `Marvin Albert <https://github.com/dask/dask-image/commits?author=m-albert>`_ - m-albert
* `Matt McCormick <https://github.com/dask/dask-image/commits?author=thewtex>`_ - thewtex
* `Volker Hilsenstein <https://github.com/dask/dask-image/commits?author=VolkerH>`_ - VolkerH


3 reviewers added to this release (alphabetical)

* `Genevieve Buckley <https://github.com/dask/dask-image/commits?author=GenevieveBuckley>`_ - GenevieveBuckley
* `jakirkham <https://github.com/dask/dask-image/commits?author=jakirkham>`_ - jakirkham
* `Matt McCormick <https://github.com/dask/dask-image/commits?author=thewtex>`_ - thewtex

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42343