Bump keras from 3.12.2 to 3.12.4

[dependabot]

Bumps keras from 3.12.2 to 3.12.4.

Release notes

Sourced from keras's releases.

Keras 3.12.4

Keras 3.12.4 is a security patch release that hardens dataset loading and model file handling against insecure deserialization and decompression-bomb attacks.

Security Fixes

• Restrict unpickling when loading IMDB and Reuters datasets — Replaces np.load(allow_pickle=True) with a restricted unpickler that only permits numpy array reconstruction, preventing arbitrary code execution via crafted .npz files (CWE-502). (#23047) by @​LinZiyuu
• Verify all intermediary H5 groups when navigating H5 files — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal. (#23168) by @​hertschuh
• Reject decompression-bomb members on the .keras asset extraction path — Adds per-member decompression-ratio checks before extracting .keras archives to disk, preventing disk-exhaustion attacks via crafted archives. (#23101) by @​LinZiyuu
• Restrict unpickling when loading CIFAR datasets — Replaces bare cPickle.load in CIFAR-10/100 batch loading with the numpy-only RestrictedUnpickler, blocking arbitrary code execution via pickle gadgets. (#23252) by @​SABITHSAHEB

---

Contributors

Thank you to all the contributors who made this release possible! 🎉

• @​LinZiyuu — Security hardening for IMDB, Reuters, and .keras asset extraction (#23047, #23101)
• @​hertschuh — H5 group verification (#23168)
• @​SABITHSAHEB — CIFAR dataset pickle restriction (#23252)

---

Full Changelog: keras-team/keras@v3.12.3...v3.12.4

v3.12.3

Keras 3.12.3 is a security patch release that hardens model saving, loading, and deserialization against a range of attack vectors.

HDF5 Hardening

• Eject ExternalLink/SoftLink groups in KerasFileEditor (#22899)
  • Prevents HDF5 external/soft links from being exploited to read arbitrary files during model editing.
• Reject ExternalLink/SoftLink on legacy .h5 dispatcher (#22900)
  • Extends HDF5 link rejection to the legacy load_weights path for .h5 files.
• Reject HDF5 shape-bomb datasets (#22975)
  • Blocks HDF5 datasets that declare excessively large shapes to trigger out-of-memory crashes during load_model/load_weights.
• Reject HDF5 virtual datasets in KerasFileEditor (#22976)
  • Prevents virtual dataset references from being used to access external files.

Archive Hardening

• Reject hard-link tar members escaping extraction directory (#22973)
  • Blocks tar hard links whose target resolves outside the extraction root.
• Reject decompression-bomb archive members (#23010)
  • Detects and rejects .keras archive members that declare far more data than is actually stored, preventing memory exhaustion.
• Prevent symlink traversal during extraction (#23015)
  • Resolves paths with realpath to prevent symlink-based directory traversal attacks.
• Reject npz weight bombs (#23016)
  • Validates npz weight members against shape/decompression bombs before allocating memory.
• Validate DiskIOStore asset paths (#23017)

... (truncated)

Commits

• 6c0caa7 Bump version to 3.12.4 (#23356)
• 64ab216 Remove nested container warnings (#23172)
• d338a45 Security Fixes 3.12.3 (#23165)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.16%. Comparing base (b43cbed) to head (c05515f).

❗ There is a different number of reports uploaded between BASE (b43cbed) and HEAD (c05515f). Click for more details.

HEAD has 6 uploads less than BASE

Flag	BASE (b43cbed)	HEAD (c05515f)
	11	5

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #612      +/-   ##
==========================================
- Coverage   79.71%   72.16%   -7.55%     
==========================================
  Files         166      166              
  Lines       10573    10573              
==========================================
- Hits         8428     7630     -798     
- Misses       2145     2943     +798     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.