Skip to content

Update keras requirement from <=3.13.2 to <=3.15.1 in /tests - #218

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/tests/keras-lte-3.15.1
Open

Update keras requirement from <=3.13.2 to <=3.15.1 in /tests#218
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/tests/keras-lte-3.15.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown

Updates the requirements on keras to permit the latest version.

Release notes

Sourced from keras's releases.

Keras 3.15.1

Release Notes

Keras 3.15.1 is a patch release containing important security hardening, bug fixes, and Python 3.14 compatibility improvements.

Security Fixes

  • Restrict unpickling when loading IMDB and Reuters datasets — Prevents insecure deserialization (CWE-502) by replacing bare np.load(allow_pickle=True) with a restricted unpickler that only permits numpy array reconstruction. (#23047) by @​LinZiyuu
  • Verify all intermediary H5 groups when navigating H5 files — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal issues. (#23168) by @​hertschuh
  • Reject decompression-bomb members on the .keras asset extraction path — Adds per-member decompression-ratio checks before extracting .keras archives to disk, preventing disk-exhaustion attacks via crafted archives. (#23101) by @​LinZiyuu
  • Restrict unpickling when loading CIFAR datasets — Replaces bare cPickle.load in CIFAR-10/100 batch loading with the numpy-only RestrictedUnpickler, blocking arbitrary code execution via pickle gadgets. (#23252) by @​SABITHSAHEB

Bug Fixes

  • Refactor _load_state to capture weight store while preserving Keras test passing — Improves model loading efficiency by capturing the weight store into a local variable, and enhances nested container detection in legacy files with isolated failure tracking. (#23226) by @​buildwithsuhana
  • Fix TraceContext error for NNX backend — Fixes TraceContext errors when using JAX NNX backend with models like T5 that lack a build method. Skips trace-level checks during symbolic shape inference and handles Flax 0.12 API changes. Fixes #23289. (#23326) by @​divyashreepathihalli

Compatibility

  • Fixes for Python 3.14 — Resolves NotImplementedError boolean coercion changes in Python 3.14 and fixes dimension filtering in shape utilities. (#23259) by @​hertschuh

Contributors

Thank you to all the contributors who made this release possible! 🎉


Full Changelog: keras-team/keras@v3.15.0...v3.15.1

Commits
  • 250b421 Bump version to 3.15.1 (#23350)
  • 9d1bbf9 Add erfinv tests and TensorFlow CPU fallback for half precision (#23086)
  • b34af30 Fix pad_sequences string dtype check (np.bytes_ instead of duplicate np.str_)...
  • f512e93 Fix wrong parameter names in ops.select and ops.argpartition docstrings (#23091)
  • 915ec7e Support native Grouped-Query Attention (GQA) Key/Value head broadcast. (#23081)
  • 49d668d Add JAX multi-process distribution tests (#23105)
  • b49fde7 Refactor rematerialization logic into Operation and support more modes (#23107)
  • e0bfa2d Add to the list of APIs that should not be part of a reloaded model. (#23115)
  • 69d7fd6 Suppress spurious 'Skipping nested container' warning on freshly-saved files ...
  • 048d142 Delete temp files after loading model from remote path. (#23113)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Updates the requirements on [keras](https://github.com/keras-team/keras) to permit the latest version.
- [Release notes](https://github.com/keras-team/keras/releases)
- [Commits](keras-team/keras@0.1.0...v3.15.1)

---
updated-dependencies:
- dependency-name: keras
  dependency-version: 3.15.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Author

Assignees

The following users could not be added as assignees: akuporos, p-wysocki, rkazants. Either they do not exist or they do not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jul 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants