Bump fickling from 0.1.10 to 0.1.12 in /services/quarantine

[dependabot]

Bumps fickling from 0.1.10 to 0.1.12.

Release notes

Sourced from fickling's releases.

v0.1.12

Security

• Fix MLAllowlist shadowing (trailofbits/fickling@41ce7cb). Thanks to @​reapermunky for the report! (GHSA-cffv-grgg-g429)
  • This fix makes MLAllowlist functional again, and opt-in as originally intended. If you need to scan ML pickles with an import allowlist, update calls to check_safety() to pass MLAllowList in the analyzer parameter:

pickled = Pickled([ ... ])
analyzer = Analyzer([MLAllowlist()])
res = check_safety(pickled, analyzer=analyzer)

• Detect dotted attribute names in STACK_GLOBAL (trailofbits/fickling@d985f89). Thanks to @​seankohjs for the report! (GHSA-5j3x-jp52-966f)

General

• Add ScannerDeactivation analysis to detect pickle scanner tampering in #249
• Use a pre-generated TorchScript fixture to avoid torch.jit deprecation warnings in #254
• Various Dependabot updates (too many to list)

Full Changelog: trailofbits/fickling@v0.1.11...v0.1.12

v0.1.11

What's Changed

Security

• Expanded the unsafe modules blocklist with:
  • doctest, unittest, and test (trailofbits/fickling@bbeeb0c + trailofbits/fickling@21fa48a). Thanks to @​Lyutoon for the report! (GHSA-pc6j-px3p-rrj4)
  • _posixsubprocess, site and atexit (trailofbits/fickling@e840861). Thanks to @​reapermunky for the report! (GHSA-m6fh-58r7-x697)

General

• Add DoS protection against expansion attacks (Billion Laughs style) by @​dguido in trailofbits/fickling#211
• Add HuggingFace Hub direct scanning support by @​dguido in trailofbits/fickling#219
• Add graceful degradation and scan API for robust scanning by @​dguido in trailofbits/fickling#218
• Uncomment passing test_legacy_pickle test by @​thomas-chauchefoin-tob in trailofbits/fickling#250
• Fix check_pickle to seek to file start and use correct opcode count API by @​thomas-chauchefoin-tob in trailofbits/fickling#253
• Various https://github.com/dependabot updates (too many to list)

Full Changelog: trailofbits/fickling@v0.1.10...v0.1.11

Commits

• c3c695c Bump version to 0.1.12 (#288)
• 596abd0 Add ScannerDeactivation analysis to detect scanner tampering (#249)
• d985f89 Detect dotted attribute names in STACK_GLOBAL (GHSA-5j3x-jp52-966f) (#287)
• 2aaa5d1 Bump the all group with 6 updates (#286)
• 0196977 Bump actions/checkout from 6.0.3 to 7.0.0 in the all group (#285)
• 891d2a9 Use pre-generated TorchScript fixture to avoid torch.jit deprecation warnings...
• 41ce7cb Fix MLAllowlist shadowing (GHSA-cffv-grgg-g429) (#278)
• 91a40fc Bump py7zr from 1.1.0 to 1.1.3 (#284)
• 5fcd2b7 Bump the all group with 3 updates (#282)
• 0db3537 Bump the all group with 3 updates (#280)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)