Scheduled biweekly dependency update for week 32

[pyup-bot]

Update pandas from 0.19.2 to 2.0.3.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/pandas

Update tensorflow from 2.9.1 to 2.13.0.

Changelog

2.13.0

Breaking Changes

* <DOCUMENT BREAKING CHANGES HERE>
* <THIS SECTION SHOULD CONTAIN API, ABI AND BEHAVIORAL BREAKING CHANGES>

*  `tf.keras`

 *  Removed the Keras scikit-learn API wrappers (`KerasClassifier` and
    `KerasRegressor`), which had been deprecated in August 2021.
    We recommend using [SciKeras](https://github.com/adriangb/scikeras)
    instead.
 *  The default Keras model saving format is now the Keras v3 format:
    calling `model.save("xyz.keras")` will no longer create a H5 file,
    it will create a native Keras model file.
    This will only be breaking for you if you were manually inspecting or
    modifying H5 files saved by Keras under a `.keras` extension.
    If this breaks you, simply add `save_format="h5"` to your `.save()` call
    to revert back to the prior behavior.
 *  Added `keras.utils.TimedThread` utility to run a timed thread every x
    seconds. It can be used to run a threaded function alongside model
    training or any other snippet of code.
 *  In the `keras` PyPI package, accessible symbols are now restricted to
    symbols that are intended to be public.
    This may affect your code if you were using `import keras` and you used
    `keras` functions that were not public APIs, but were accessible in
    earlier versions with direct imports. In those cases, please use the
    following guideline:
     -  The API may be available in the public Keras API under a different
        name, so make sure to look for it on keras.io or TensorFlow docs
        and switch to the public version.
     -  It could also be a simple python or TF utility that you could easily
        copy over to your own codebase. In those case, just make it your own!
     -  If you believe it should definitely be a public Keras API,
        please open a feature request in keras GitHub repo.
     -  As a workaround, you could import the same private symbol keras
        `keras.src`, but keep in mind the `src` namespace is not stable and
        those APIs may change or be removed in the future.


* The LMDB kernels have been changed to return an error. This is in preparation
for completely removing them from TensorFlow. The LMDB dependency that these
kernels are bringing to TensorFlow has been dropped, thus making the build
slightly faster and more secure.

Known Caveats

* <CAVEATS REGARDING THE RELEASE (BUT NOT BREAKING CHANGES).>
* <ADDING/BUMPING DEPENDENCIES SHOULD GO HERE>
* <KNOWN LACK OF SUPPORT ON SOME PLATFORM, SHOULD GO HERE>

Major Features and Improvements

*   `tf.lite`:

 *   Add 16-bit and 64-bit float type support for built-in op `cast`.
 *   The Python TF Lite Interpreter bindings now have an option
     `experimental_disable_delegate_clustering` to turn-off delegate
     clustering.
 *   Add int16x8 support for the built-in op `exp`
 *   Add int16x8 support for the built-in op `mirror_pad`
 *   Add int16x8 support for the built-in ops `space_to_batch_nd` and
     `batch_to_space_nd`
 *   Add 16-bit int type support for built-in op `less`, `greater_than`,
     `equal`
 *   Add 8-bit and 16-bit support for `floor_div` and `floor_mod`.
 *   Add 16-bit and 32-bit int support for the built-in op `bitcast`.
 *   Add 8-bit/16-bit/32-bit int/uint support for the built-in op `bitwise_xor`
 *   Add int16 indices support for built-in op `gather` and `gather_nd`.
 *   Add 8-bit/16-bit/32-bit int/uint support for the built-in op `right_shift`
 *   Add reference implementation for 16-bit int unquantized `add`.
 *   Add reference implementation for 16-bit int and 32-bit unsigned int unquantized `mul`.
 *   `add_op` supports broadcasting up to 6 dimensions.
 *   Add 16-bit support for `top_k`.

*   `tf.keras`

 *   Added F-Score metrics `tf.keras.metrics.FBetaScore`,
     `tf.keras.metrics.F1Score`, and `tf.keras.metrics.R2Score`.
 *   Added activation function `tf.keras.activations.mish`.
 *   Added experimental `keras.metrics.experimental.PyMetric` API for metrics
     that run Python code on the host CPU (compiled outside of the TensorFlow
     graph). This can be used for integrating metrics from external Python
     libraries (like sklearn or pycocotools) into Keras as first-class Keras
     metrics.
 *   Added `tf.keras.optimizers.Lion` optimizer.
 *   Added `tf.keras.layers.SpectralNormalization` layer wrapper to perform
     spectral normalization on the weights of a target layer.
 *   The `SidecarEvaluatorModelExport` callback has been added to Keras as
     `keras.callbacks.SidecarEvaluatorModelExport`. This callback allows for
     exporting the model the best-scoring model as evaluated by a
     `SidecarEvaluator` evaluator. The evaluator regularly evaluates the
     model and exports it if the user-defined comparison function determines
     that it is an improvement.
 *   Added warmup capabilities to `tf.keras.optimizers.schedules.CosineDecay`
     learning rate scheduler. You can now specify an initial and target
     learning rate, and our scheduler will perform a linear interpolation
     between the two after which it will begin a decay phase.
 *   Added experimental support for an exactly-once visitation guarantee for
     evaluating Keras models trained with
     `tf.distribute.ParameterServerStrategy`, via the
     `exact_evaluation_shards` argument in `Model.fit` and `Model.evaluate`.
 *   Added `tf.keras.__internal__.KerasTensor`,
     `tf.keras.__internal__.SparseKerasTensor`, and
     `tf.keras.__internal__.RaggedKerasTensor` classes. You can use these
     classes to do instance type checking and type annotations for
     layer/model inputs and outputs.
 *   All the `tf.keras.dtensor.experimental.optimizers` classes have been 
     merged with `tf.keras.optimizers`. You can migrate your code to use
     `tf.keras.optimizers` directly. The API namespace for
     `tf.keras.dtensor.experimental.optimizers` will be removed in future
     releases.
 *   Added support for `class_weight` for 3+ dimensional targets (e.g.
     image segmentation masks) in `Model.fit`.
 *   Added a new loss, `keras.losses.CategoricalFocalCrossentropy`.
 *   Remove the `tf.keras.dtensor.experimental.layout_map_scope()`. You can
     user the `tf.keras.dtensor.experimental.LayoutMap.scope()` instead.

*   `tf.function`:

 *   ConcreteFunction (`tf.types.experimental.ConcreteFunction`) as generated
     through `get_concrete_function` now performs holistic input validation
     similar to calling `tf.function` directly. This can cause breakages
     where existing calls pass Tensors with the wrong shape or omit certain
     non-Tensor arguments (including default values).

*   `tf.nn`

 *   `tf.nn.embedding_lookup_sparse` and `tf.nn.safe_embedding_lookup_sparse`
     now support ids and weights described by `tf.RaggedTensor`s.
 *   Added a new boolean argument `allow_fast_lookup` to
     `tf.nn.embedding_lookup_sparse` and
     `tf.nn.safe_embedding_lookup_sparse`, which enables a simplified and
     typically faster lookup procedure.

*   `tf.data`

 *   `tf.data.Dataset.zip` now supports Python-style zipping, i.e.
     `Dataset.zip(a, b, c)`.
 *   `tf.data.Dataset.shuffle` now supports full shuffling. To specify that
     data should be fully shuffled, use
     `dataset = dataset.shuffle(dataset.cardinality())`. This will load the
     full dataset into memory so that it can be shuffled, so make sure to
     only use this with datasets of filenames or other small datasets.
 *   Added a new `tf.data.experimental.pad_to_cardinality` transformation
     which pads a dataset with zero elements up to a specified cardinality.
     This is useful for avoiding partial batches while not dropping any data.

*   `tf.math`

 * `tf.nn.top_k` now supports specifying the output index type via parameter
    `index_type`.  Supported types are `tf.int16`, `tf.int32`
    (default), and `tf.int64`.

*   `tf.SavedModel`

 *   Introduce class method
     `tf.saved_model.experimental.Fingerprint.from_proto(proto)`, which can
     be used to construct a `Fingerprint` object directly from a protobuf.
 *   Introduce member method
     `tf.saved_model.experimental.Fingerprint.singleprint()`, which provides
     a convenient way to uniquely identify a SavedModel.

Bug Fixes and Other Changes

* <SIMILAR TO ABOVE SECTION, BUT FOR OTHER IMPORTANT CHANGES / BUG FIXES>
* <IF A CHANGE CLOSES A GITHUB ISSUE, IT SHOULD BE DOCUMENTED HERE>
* <NOTES SHOULD BE GROUPED PER AREA>

*   `tf.Variable`

 *   Changed resource variables to inherit from `tf.compat.v2.Variable`
     instead of `tf.compat.v1.Variable`. Some checks for 
     `isinstance(v, tf.compat.v1.Variable)` that previously returned True
     may now return False.

*   `tf.distribute`

 *   Opened an experimental API,
     `tf.distribute.experimental.coordinator.get_current_worker_index`, for
     retrieving the worker index from within a worker, when using parameter
     server training with a custom training loop.

*   `tf.experimental.dtensor`:

 *   Deprecated `dtensor.run_on` in favor of `dtensor.default_mesh` to
     correctly indicate that the context does not override the mesh that the
     ops and functions will run on, it only sets a fallback default mesh.
 *   List of members of dtensor.Layout and dtensor.Mesh have slightly changed
     as part of efforts to consolidate the C++ and Python source
     code with pybind11. Most notably, Layout.serialized_string is removed.
 *   Minor API changes to represent Single Device Layout for non-distributed
     Tensors inside DTensor functions. Runtime support will be added soon.

*   `tf.experimental.ExtensionType`:

 *   `tf.experimental.ExtensionType` now supports Python `tuple` as
     the type annotation of its fields.

*    `tf.nest`:
 *   Deprecated API `tf.nest.is_sequence` has now been deleted.
     Please use `tf.nest.is_nested` instead.

*   `tf.lite`:
 *   Add UINT32 support to tfl.pack
 *   Add INT64 support to tfl.range
 *   Add UINT32 support to tfl.concatenation

Thanks to our Contributors

This release contains contributions from many people at Google, as well as:

<INSERT>, <NAME>, <HERE>, <USING>, <GITHUB>, <HANDLE>

2.12.0

Breaking Changes

*   Build, Compilation and Packaging

 *   Removed redundant packages `tensorflow-gpu` and `tf-nightly-gpu`. These packages were removed and replaced with packages that direct users to switch to `tensorflow` or `tf-nightly` respectively. Since TensorFlow 2.1, the only difference between these two sets of packages was their names, so there is no loss of functionality or GPU support. See https://pypi.org/project/tensorflow-gpu for more details.

*   `tf.function`:

 *   `tf.function` now uses the Python inspect library directly for parsing the signature of the Python function it is decorated on. This change may break code where the function signature is malformed, but was ignored previously, such as:
     *   Using `functools.wraps` on a function with different signature
     *   Using `functools.partial` with an invalid `tf.function` input
 *   `tf.function` now enforces input parameter names to be valid Python identifiers. Incompatible names are automatically sanitized similarly to existing SavedModel signature behavior.
 *   Parameterless `tf.function`s are assumed to have an empty `input_signature` instead of an undefined one even if the `input_signature` is unspecified.
 *   `tf.types.experimental.TraceType` now requires an additional `placeholder_value` method to be defined.
 *   `tf.function` now traces with placeholder values generated by TraceType instead of the value itself.

*   Experimental APIs `tf.config.experimental.enable_mlir_graph_optimization` and `tf.config.experimental.disable_mlir_graph_optimization` were removed.

Major Features and Improvements

*  Support for Python 3.11 has been added.
*  Support for Python 3.7 has been removed. We are not releasing any more patches for Python 3.7.

*   `tf.lite`:

 *   Add 16-bit float type support for built-in op `fill`.
 *   Transpose now supports 6D tensors.
 *   Float LSTM now supports diagonal recurrent tensors: https://arxiv.org/abs/1903.08023

*   `tf.experimental.dtensor`:

 *   Coordination service now works with `dtensor.initialize_accelerator_system`, and enabled by default.
 *   Add `tf.experimental.dtensor.is_dtensor` to check if a tensor is a DTensor instance.

*   `tf.data`:

 *   Added support for alternative checkpointing protocol which makes it possible to checkpoint the state of the input pipeline without having to store the contents of internal buffers. The new functionality can be enabled through the `experimental_symbolic_checkpoint` option of `tf.data.Options()`.
 *   Added a new `rerandomize_each_iteration` argument for the `tf.data.Dataset.random()` operation, which controls whether the sequence of generated random numbers should be re-randomized every epoch or not (the default behavior). If `seed` is set and `rerandomize_each_iteration=True`, the `random()` operation will produce a different (deterministic) sequence of numbers every epoch.
 *   Added a new `rerandomize_each_iteration` argument for the `tf.data.Dataset.sample_from_datasets()` operation, which controls whether the sequence of generated random numbers used for sampling should be re-randomized every epoch or not. If `seed` is set and `rerandomize_each_iteration=True`, the `sample_from_datasets()` operation will use a different (deterministic) sequence of numbers every epoch.

*   `tf.test`:

 *   Added `tf.test.experimental.sync_devices`, which is useful for accurately measuring performance in benchmarks.

*   `tf.experimental.dtensor`:

 *   Added experimental support to ReduceScatter fuse on GPU (NCCL).

Bug Fixes and Other Changes

*   `tf.SavedModel`:
 * Introduced new class `tf.saved_model.experimental.Fingerprint` that contains the fingerprint of the SavedModel. See the [SavedModel Fingerprinting RFC](https://github.com/tensorflow/community/pull/415) for details.
 * Introduced API `tf.saved_model.experimental.read_fingerprint(export_dir)` for reading the fingerprint of a SavedModel.
* `tf.random`
* Added non-experimental aliases for `tf.random.split` and `tf.random.fold_in`, the experimental endpoints are still available so no code changes are necessary.
* `tf.experimental.ExtensionType`
* Added function `experimental.extension_type.as_dict()`, which converts an instance of `tf.experimental.ExtensionType` to a `dict` representation.
* `stream_executor`
* Top level `stream_executor` directory has been deleted, users should use equivalent headers and targets under `compiler/xla/stream_executor`.
* `tf.nn`
* Added `tf.nn.experimental.general_dropout`, which is similar to `tf.random.experimental.stateless_dropout` but accepts a custom sampler function.
* `tf.types.experimental.GenericFunction`
* The `experimental_get_compiler_ir` method supports tf.TensorSpec compilation arguments.
*  `tf.config.experimental.mlir_bridge_rollout`
 *   Removed enums `MLIR_BRIDGE_ROLLOUT_SAFE_MODE_ENABLED` and `MLIR_BRIDGE_ROLLOUT_SAFE_MODE_FALLBACK_ENABLED` which are no longer used by the tf2xla bridge

Keras

Keras is a framework built on top of the TensorFlow. See more details on the Keras [website](https://keras.io/).

Breaking Changes


`tf.keras`:

* Moved all saving-related utilities to a new namespace, `keras.saving`, for example: `keras.saving.load_model`, `keras.saving.save_model`, `keras.saving.custom_object_scope`, `keras.saving.get_custom_objects`, `keras.saving.register_keras_serializable`,`keras.saving.get_registered_name` and `keras.saving.get_registered_object`. The previous API locations (in `keras.utils` and `keras.models`) will be available indefinitely, but we recommend you update your code to point to the new API locations.
* Improvements and fixes in Keras loss masking:
 * Whether you represent a ragged tensor as a `tf.RaggedTensor` or using [keras masking](https://www.tensorflow.org/guide/keras/masking_and_padding), the returned loss values should be the identical to each other. In previous versions Keras may have silently ignored the mask.
* If you use masked losses with Keras the loss values may be different in TensorFlow `2.12` compared to previous versions.
* In cases where the mask was previously ignored, you will now get an error if you pass a mask with an incompatible shape.

Major Features and Improvements

`tf.keras`:

*   The new Keras model saving format (`.keras`) is available. You can start using it via `model.save(f"{fname}.keras", save_format="keras_v3")`. In the future it will become the default for all files with the `.keras` extension. This file format targets the Python runtime only and makes it possible to reload Python objects identical to the saved originals. The format supports non-numerical state such as vocabulary files and lookup tables, and it is easy to customize in the case of custom layers with exotic elements of state (e.g. a FIFOQueue). The format does not rely on bytecode or pickling, and is safe by default. Note that as a result, Python `lambdas` are disallowed at loading time. If you want to use `lambdas`, you can pass `safe_mode=False` to the loading method (only do this if you trust the source of the model).
*   Added a `model.export(filepath)` API to create a lightweight SavedModel artifact that can be used for inference (e.g. with TF-Serving).
*   Added `keras.export.ExportArchive` class for low-level customization of the process of exporting SavedModel artifacts for inference. Both ways of exporting models are based on `tf.function` tracing and produce a TF program composed of TF ops. They are meant primarily for environments where the TF runtime is available, but not the Python interpreter, as is typical for production with TF Serving.
*   Added utility `tf.keras.utils.FeatureSpace`, a one-stop shop for structured data preprocessing and encoding.
*   Added `tf.SparseTensor` input support to `tf.keras.layers.Embedding` layer. The layer now accepts a new boolean argument `sparse`. If `sparse` is set to True, the layer returns a SparseTensor instead of a dense Tensor. Defaults to False.
*   Added `jit_compile` as a settable property to `tf.keras.Model`.
*   Added `synchronized` optional parameter to `layers.BatchNormalization`.
*   Added deprecation warning to `layers.experimental.SyncBatchNormalization` and suggested to use `layers.BatchNormalization` with `synchronized=True` instead.
*   Updated `tf.keras.layers.BatchNormalization` to support masking of the inputs (`mask` argument) when computing the mean and variance.
*   Add `tf.keras.layers.Identity`, a placeholder pass-through layer.
*   Add `show_trainable` option to `tf.keras.utils.model_to_dot` to display layer trainable status in model plots.
*   Add ability to save a `tf.keras.utils.FeatureSpace` object, via `feature_space.save("myfeaturespace.keras")`, and reload it via `feature_space = tf.keras.models.load_model("myfeaturespace.keras")`.
*   Added utility `tf.keras.utils.to_ordinal` to convert class vector to ordinal regression / classification matrix.

Bug Fixes and Other Changes

*   N/A

Security

*   Moving forward, TensorFlow will no longer update [TFSAs](https://github.com/tensorflow/tensorflow/tree/master/tensorflow/security). Please refer instead to our [GitHub security advisories](https://github.com/tensorflow/tensorflow/security/advisories), which are attached to [CVEs](https://cve.mitre.org/cve/).
*   Fixes an FPE in TFLite in conv kernel [CVE-2023-27579](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27579)
*   Fixes a double free in Fractional(Max/Avg)Pool [CVE-2023-25801](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25801)
*   Fixes a null dereference on ParallelConcat with XLA [CVE-2023-25676](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25676)
*   Fixes a segfault in Bincount with XLA [CVE-2023-25675](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25675)
*   Fixes an NPE in RandomShuffle with XLA enable [CVE-2023-25674](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25674)
*   Fixes an FPE in TensorListSplit with XLA [CVE-2023-25673](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25673)
*   Fixes segmentation fault in tfg-translate [CVE-2023-25671](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25671)
*   Fixes an NPE in QuantizedMatMulWithBiasAndDequantize [CVE-2023-25670](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25670)
*   Fixes an FPE in AvgPoolGrad with XLA [CVE-2023-25669](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25669)
*   Fixes a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation [CVE-2023-25668](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25668)
*   Fixes a segfault when opening multiframe gif [CVE-2023-25667](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25667)
*   Fixes an NPE in SparseSparseMaximum [CVE-2023-25665](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25665)
*   Fixes an FPE in AudioSpectrogram [CVE-2023-25666](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25666)
*   Fixes a heap-buffer-overflow in AvgPoolGrad  [CVE-2023-25664](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25664)
*   Fixes a NPE in TensorArrayConcatV2  [CVE-2023-25663](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25663)
*   Fixes a Integer overflow in EditDistance  [CVE-2023-25662](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25662)
*   Fixes a Seg fault in `tf.raw_ops.Print` [CVE-2023-25660](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25660)
*   Fixes a OOB read in DynamicStitch [CVE-2023-25659](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25659)
*   Fixes a OOB Read in GRUBlockCellGrad [CVE-2023-25658](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25658)

Thanks to our Contributors

This release contains contributions from many people at Google, as well as:

103yiran, 8bitmp3, Aakar, Aakar Dwivedi, Abinash Satapathy, Aditya Kane, ag.ramesh, Alexander Grund, Andrei Pikas, andreii, Andrew Goodbody, angerson, Anthony_256, Ashay Rane, Ashiq Imran, Awsaf, Balint Cristian, Banikumar Maiti (Intel Aipg), Ben Barsdell, bhack, cfRod, Chao Chen, chenchongsong, Chris Mc, Daniil Kutz, David Rubinstein, dianjiaogit, dixr, Dongfeng Yu, dongfengy, drah, Eric Kunze, Feiyue Chen, Frederic Bastien, Gauri1 Deshpande, guozhong.zhuang, hDn248, HYChou, ingkarat, James Hilliard, Jason Furmanek, Jaya, Jens Glaser, Jerry Ge, Jiao Dian'S Power Plant, Jie Fu, Jinzhe Zeng, Jukyy, Kaixi Hou, Kanvi Khanna, Karel Ha, karllessard, Koan-Sin Tan, Konstantin Beluchenko, Kulin Seth, Kun Lu, Kyle Gerard Felker, Leopold Cambier, Lianmin Zheng, linlifan, liuyuanqiang, Lukas Geiger, Luke Hutton, Mahmoud Abuzaina, Manas Mohanty, Mateo Fidabel, Maxiwell S. Garcia, Mayank Raunak, mdfaijul, meatybobby, Meenakshi Venkataraman, Michael Holman, Nathan John Sircombe, Nathan Luehr, nitins17, Om Thakkar, Patrice Vignola, Pavani Majety, per1234, Philipp Hack, pollfly, Prianka Liz Kariat, Rahul Batra, rahulbatra85, ratnam.parikh, Rickard Hallerbäck, Roger Iyengar, Rohit Santhanam, Roman Baranchuk, Sachin Muradi, sanadani, Saoirse Stewart, seanshpark, Shawn Wang, shuw, Srinivasan Narayanamoorthy, Stewart Miles, Sunita Nadampalli, SuryanarayanaY, Takahashi Shuuji, Tatwai Chong, Thibaut Goetghebuer-Planchon, tilakrayal, Tirumalesh, TJ, Tony Sung, Trevor Morris, unda, Vertexwahn, Vinila S, William Muir, Xavier Bonaventura, xiang.zhang, Xiao-Yong Jin, yleeeee, Yong Tang, Yuriy Chernyshov, Zhang, Xiangze, zhaozheng09

2.11.1

**Note**: TensorFlow 2.10 was the last TensorFlow release that supported GPU on native-Windows. Starting with TensorFlow 2.11, you will need to install TensorFlow in WSL2, or install tensorflow-cpu and, optionally, try the TensorFlow-DirectML-Plugin.
*   Security vulnerability fixes will no longer be patched to this Tensorflow version. The latest Tensorflow version includes the security vulnerability fixes. You can update to the latest version (recommended) or patch security vulnerabilities yourself [steps](https://github.com/tensorflow/tensorflow#patching-guidelines). You can refer to the [release notes](https://github.com/tensorflow/tensorflow/releases) of the latest Tensorflow version for a list of newly fixed vulnerabilities. If you have any questions, please create a GitHub issue to let us know.

This release also introduces several vulnerability fixes:

*   Fixes an FPE in TFLite in conv kernel [CVE-2023-27579](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27579)
*   Fixes a double free in Fractional(Max/Avg)Pool [CVE-2023-25801](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25801)
*   Fixes a null dereference on ParallelConcat with XLA [CVE-2023-25676](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25676)
*   Fixes a segfault in Bincount with XLA [CVE-2023-25675](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25675)
*   Fixes an NPE in RandomShuffle with XLA enable [CVE-2023-25674](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25674)
*   Fixes an FPE in TensorListSplit with XLA [CVE-2023-25673](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25673)
*   Fixes segmentation fault in tfg-translate [CVE-2023-25671](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25671)
*   Fixes an NPE in QuantizedMatMulWithBiasAndDequantize [CVE-2023-25670](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25670)
*   Fixes an FPE in AvgPoolGrad with XLA [CVE-2023-25669](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25669)
*   Fixes a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation [CVE-2023-25668](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25668)
*   Fixes a segfault when opening multiframe gif [CVE-2023-25667](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25667)
*   Fixes an NPE in SparseSparseMaximum [CVE-2023-25665](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25665)
*   Fixes an FPE in AudioSpectrogram [CVE-2023-25666](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25666)
*   Fixes a heap-buffer-overflow in AvgPoolGrad  [CVE-2023-25664](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25664)
*   Fixes a NPE in TensorArrayConcatV2  [CVE-2023-25663](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25663)
*   Fixes a Integer overflow in EditDistance  [CVE-2023-25662](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25662)
*   Fixes a Seg fault in `tf.raw_ops.Print` [CVE-2023-25660](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25660)
*   Fixes a OOB read in DynamicStitch [CVE-2023-25659](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25659)
*   Fixes a OOB Read in GRUBlockCellGrad [CVE-2023-25658](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25658)

2.11

which means `tf.keras.optimizers.Optimizer` will be an alias of
 `tf.keras.optimizers.experimental.Optimizer`. The current
 `tf.keras.optimizers.Optimizer` will continue to be supported as
 `tf.keras.optimizers.legacy.Optimizer`,
 e.g.,`tf.keras.optimizers.legacy.Adam`. Most users won't be affected by this
 change, but please check the
 [API doc](https://www.tensorflow.org/api_docs/python/tf/keras/optimizers/experimental)
 if any API used in your workflow is changed or deprecated, and make
 adaptations. If you decide to keep using the old optimizer, please
 explicitly change your optimizer to `tf.keras.optimizers.legacy.Optimizer`.
*   RNG behavior change for `tf.keras.initializers`. Keras initializers will now
 use stateless random ops to generate random numbers.
 *   Both seeded and unseeded initializers will always generate the same
     values every time they are called (for a given variable shape). For
     unseeded initializers (`seed=None`), a random seed will be created and
     assigned at initializer creation (different initializer instances get
     different seeds).
 *   An unseeded initializer will raise a warning if it is reused (called)
     multiple times. This is because it would produce the same values each
     time, which may not be intended.
*   API changes under `tf.experimental.dtensor`:
 *   New API for initialization of CPU/GPU/TPU in dtensor.
     `dtensor.initialize_accelerator_system` and
     `dtensor.shutdown_accelerator_system`.
 *   The following existing API will be removed:
     `dtensor.initialize_multi_client`, `dtensor.initialize_tpu_system`, and
     `dtensor.shutdown_tpu_system`.

Deprecations

*   The C++ `tensorflow::Code` and `tensorflow::Status` will become aliases of
 respectively `absl::StatusCode` and `absl::Status` in some future release.
 *   Use `tensorflow::OkStatus()` instead of `tensorflow::Status::OK()`.
 *   Stop constructing `Status` objects from `tensorflow::error::Code`.
 *   One MUST NOT access `tensorflow::errors::Code` fields. Accessing
     `tensorflow::error::Code` fields is fine.
     *   Use the constructors such as `tensorflow::errors:InvalidArgument` to
         create status using an error code without accessing it.
     *   Use the free functions such as
         `tensorflow::errors::IsInvalidArgument` if needed.
     *   In the last resort, use
         e.g.`static_cast<tensorflow::errors::Code>(error::Code::INVALID_ARGUMENT)`
         or `static_cast<int>(code)` for comparisons.
*   `tensorflow::StatusOr` will also become in the future an alias to
 `absl::StatusOr`, so use `StatusOr::value` instead of
 `StatusOr::ConsumeValueOrDie`.

Major Features and Improvements

*   `tf.lite`:

 *   New operations supported:
     *   tflite SelectV2 now supports 5D.
     *   `tf.einsum` is supported with multiple unknown shapes.
     *   `tf.unsortedsegmentprod` op is supported.
     *   `tf.unsortedsegmentmax` op is supported.
     *   `tf.unsortedsegmentsum` op is supported.
 *   Updates to existing operations:
     *   `tfl.scatter_nd` now supports I1 for the `update` arg.
 *   Upgrade Flatbuffers v2.0.5 from v1.12.0

*   `tf.keras`:

 *   `EinsumDense` layer is moved from experimental to core. Its import path
     is moved from `tf.keras.layers.experimental.EinsumDense` to
     `tf.keras.layers.EinsumDense`.
 *   Added `tf.keras.utils.audio_dataset_from_directory` utility to easily
     generate audio classification datasets from directories of `.wav` files.
 *   Added `subset="both"` support in
     `tf.keras.utils.image_dataset_from_directory`,`tf.keras.utils.text_dataset_from_directory`,
     and `audio_dataset_from_directory`, to be used with the
     `validation_split` argument, for returning both dataset splits at once,
     as a tuple.
 *   Added `tf.keras.utils.split_dataset` utility to split a `Dataset` object
     or a list/tuple of arrays into two `Dataset` objects (e.g. train/test).
 *   Added step granularity to `BackupAndRestore` callback for handling
     distributed training failures & restarts. The training state can now be
     restored at the exact epoch and step at which it was previously saved
     before failing.
 *   Added
     [`tf.keras.dtensor.experimental.optimizers.AdamW`](https://www.tensorflow.org/api_docs/python/tf/keras/dtensor/experimental/optimizers/AdamW).
     This optimizer is similar to the existing
     [`keras.optimizers.experimental.AdamW`](https://www.tensorflow.org/api_docs/python/tf/keras/optimizers/experimental/AdamW),
     and works in the DTensor training use case.
 *   Improved masking support for
     [`tf.keras.layers.MultiHeadAttention`](https://www.tensorflow.org/api_docs/python/tf/keras/layers/MultiHeadAttention).
     *   Implicit masks for `query`, `key` and `value` inputs will
         automatically be used to compute a correct attention mask for the
         layer. These padding masks will be combined with any
         `attention_mask` passed in directly when calling the layer. This can
         be used with
         [`tf.keras.layers.Embedding`](https://www.tensorflow.org/api_docs/python/tf/keras/layers/Embedding)
         with `mask_zero=True` to automatically infer a correct padding mask.
     *   Added a `use_causal_mask` call time argument to the layer. Passing
         `use_causal_mask=True` will compute a causal attention mask, and
         optionally combine it with any `attention_mask` passed in directly
         when calling the layer.
 *   Added `ignore_class` argument in the loss
     `SparseCategoricalCrossentropy` and metrics `IoU` and `MeanIoU`, to
     specify a class index to be ignored during loss/metric computation (e.g.
     a background/void class).
 *   Added
     [`tf.keras.models.experimental.SharpnessAwareMinimization`](https://www.tensorflow.org/api_docs/python/tf/keras/models/experimental/SharpnessAwareMinimization).
     This class implements the sharpness-aware minimization technique, which
     boosts model performance on various tasks, e.g., ResNet on image
     classification.

*   `tf.data`:

 *   Added support for cross-trainer data caching in tf.data service. This
     saves computation resources when concurrent training jobs train from the
     same dataset. See
     (https://www.tensorflow.org/api_docs/python/tf/data/experimental/service#sharing_tfdata_service_with_concurrent_trainers)
     for more details.
 *   Added `dataset_id` to `tf.data.experimental.service.register_dataset`.
     If provided, `tf.data` service will use the provided ID for the dataset.
     If the dataset ID already exists, no new dataset will be registered.
     This is useful if multiple training jobs need to use the same dataset
     for training. In this case, users should call `register_dataset` with
     the same `dataset_id`.
 *   Added a new field, `inject_prefetch`, to
     `tf.data.experimental.OptimizationOptions`. If it is set to
     `True`,`tf.data` will now automatically add a `prefetch` transformation
     to datasets that end in synchronous transformations. This enables data
     generation to be overlapped with data consumption. This may cause a
     small increase in memory usage due to buffering. To enable this
     behavior, set `inject_prefetch=True` in
     `tf.data.experimental.OptimizationOptions`.
 *   Added a new value to `tf.data.Options.autotune.autotune_algorithm`:
     `STAGE_BASED`. If the autotune algorithm is set to `STAGE_BASED`, then
     it runs a new algorithm that can get the same performance with lower
     CPU/memory usage.
 *   Added
     [`tf.data.experimental.from_list`](https://www.tensorflow.org/api_docs/python/tf/data/experimental/from_list),
     a new API for creating `Dataset`s from lists of elements.
 *   Graduated experimental APIs:
     *   [`tf.data.Dataset.counter`](https://www.tensorflow.org/api_docs/python/tf/data/Dataset/#counter),
         which creates `Dataset`s of indefinite sequences of numbers.
     *   [`tf.data.Dataset.ignore_errors`](https://www.tensorflow.org/api_docs/python/tf/data/Dataset/#ignore_errors),
         which drops erroneous elements from `Dataset`s.
 *   Added
     [`tf.data.Dataset.rebatch`](https://www.tensorflow.org/api_docs/python/tf/data/Dataset#rebatch),
     a new API for rebatching the elements of a dataset.

*   `tf.distribute`:

 *   Added
     [`tf.distribute.experimental.PreemptionCheckpointHandler`](https://www.tensorflow.org/api_docs/python/tf/distribute/experimental/PreemptionCheckpointHandler)
     to handle worker preemption/maintenance and cluster-wise consistent
     error reporting for `tf.distribute.MultiWorkerMirroredStrategy`.
     Specifically, for the type of interruption with advance notice, it
     automatically saves a checkpoint, exits the program without raising an
     unrecoverable error, and restores the progress when training restarts.

*   `tf.math`:

 *   Added `tf.math.approx_max_k` and `tf.math.approx_min_k` which are the
     optimized alternatives to `tf.math.top_k` on TPU. The performance
     difference ranges from 8 to 100 times depending on the size of k. When
     running on CPU and GPU, a non-optimized XLA kernel is used.

*   `tf.train`:

 *   Added `tf.train.TrackableView` which allows users to inspect the
     TensorFlow Trackable object (e.g. `tf.Module`, Keras Layers and models).

*   `tf.vectorized_map`:

 *   Added an optional parameter: `warn`. This parameter controls whether or
     not warnings will be printed when operations in the provided `fn` fall
     back to a while loop.

*   XLA:

 *   `tf.distribute.MultiWorkerMirroredStrategy` is now compilable with XLA.
 *   [Compute Library for the Arm® Architecture (ACL)](https://github.com/ARM-software/ComputeLibrary)
     is supported for aarch64 CPU XLA runtime

*   CPU performance optimizations:

 *   **x86 CPUs**:
     [oneDNN](https://github.com/tensorflow/community/blob/master/rfcs/20210930-enable-onednn-ops.md)
     bfloat16 auto-mixed precision grappler graph optimization pass has been
     renamed from `auto_mixed_precision_mkl` to
     `auto_mixed_precision_onednn_bfloat16`. See example usage
     [here](https://www.intel.com/content/www/us/en/developer/articles/guide/getting-started-with-automixedprecisionmkl.html).
 *   **aarch64 CPUs:** Experimental performance optimizations from
     [Compute Library for the Arm® Architecture (ACL)](https://github.com/ARM-software/ComputeLibrary)
     are available through oneDNN in the default Linux aarch64 package (`pip
     install tensorflow`).
     *   The optimizations are disabled by default.
     *   Set the environment variable `TF_ENABLE_ONEDNN_OPTS=1` to enable the
         optimizations. Setting the variable to 0 or unsetting it will
         disable the optimizations.
     *   These optimizations can yield slightly different numerical results
         from when they are off due to floating-point round-off errors from
         different computation approaches and orders.
     *   To verify that the optimizations are on, look for a message with
         "*oneDNN custom operations are on*" in the log. If the exact phrase
         is not there, it means they are off.

Bug Fixes and Other Changes

*   New argument `experimental_device_ordinal` in `LogicalDeviceConfiguration`
 to control the order of logical devices (GPU only).

*   `tf.keras`:

 *   Changed the TensorBoard tag names produced by the
     `tf.keras.callbacks.TensorBoard` callback, so that summaries logged
     automatically for model weights now include either a `/histogram` or
     `/image` suffix in their tag names, in order to prevent tag name
     collisions across summary types.

*   When running on GPU (with cuDNN version 7.6.3 or
 later),`tf.nn.depthwise_conv2d` backprop to `filter` (and therefore also
 `tf.keras.layers.DepthwiseConv2D`) now operate deterministically (and
 `tf.errors.UnimplementedError` is no longer thrown) when op-determinism has
 been enabled via `tf.config.experimental.enable_op_determinism`. This closes
 issue [47174](https://github.com/tensorflow/tensorflow/issues/47174).

*   `tf.random`

 *   Added `tf.random.experimental.stateless_shuffle`, a stateless version of
     `tf.random.shuffle`.

Security

*   Fixes a `CHECK` failure in tf.reshape caused by overflows ([CVE-2022-35934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35934))
*   Fixes a `CHECK` failure in `SobolSample` caused by missing validation ([CVE-2022-35935](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35935))
*   Fixes an OOB read in `Gather_nd` op in TF Lite ([CVE-2022-35937](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35937))
*   Fixes a `CHECK` failure in `TensorListReserve` caused by missing validation ([CVE-2022-35960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35960))
*   Fixes an OOB write in `Scatter_nd` op in TF Lite ([CVE-2022-35939](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35939))
*   Fixes an integer overflow in `RaggedRangeOp` ([CVE-2022-35940](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35940))
*   Fixes a `CHECK` failure in `AvgPoolOp` ([CVE-2022-35941](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35941))
*   Fixes a `CHECK` failures in `UnbatchGradOp` ([CVE-2022-35952](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35952))
*   Fixes a segfault TFLite converter on per-channel quantized transposed convolutions ([CVE-2022-36027](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36027))
*   Fixes a `CHECK` failures in `AvgPool3DGrad` ([CVE-2022-35959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35959))
*   Fixes a `CHECK` failures in `FractionalAvgPoolGrad` ([CVE-2022-35963](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35963))
*   Fixes a segfault in `BlockLSTMGradV2` ([CVE-2022-35964](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35964))
*   Fixes a segfault in `LowerBound` and `UpperBound` ([CVE-2022-35965](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35965))
*   Fixes a segfault in `QuantizedAvgPool` ([CVE-2022-35966](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35966))
*   Fixes a segfault in `QuantizedAdd` ([CVE-2022-35967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35967))
*   Fixes a `CHECK` fail in `AvgPoolGrad` ([CVE-2022-35968](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35968))
*   Fixes a `CHECK` fail in `Conv2DBackpropInput` ([CVE-2022-35969](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35969))
*   Fixes a segfault in `QuantizedInstanceNorm` ([CVE-2022-35970](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35970))
*   Fixes a `CHECK` fail in `FakeQuantWithMinMaxVars` ([CVE-2022-35971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35971))
*   Fixes a segfault in `Requantize` ([CVE-2022-36017](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36017))
*   Fixes a segfault in `QuantizedBiasAdd` ([CVE-2022-35972](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35972))
*   Fixes a `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannel` ([CVE-2022-36019](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36019))
*   Fixes a segfault in `QuantizedMatMul` ([CVE-2022-35973](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35973))
*   Fixes a segfault in `QuantizeDownAndShrinkRange` ([CVE-2022-35974](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35974))
*   Fixes segfaults in `QuantizedRelu` and `QuantizedRelu6` ([CVE-2022-35979](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35979))
*   Fixes a `CHECK` fail in `FractionalMaxPoolGrad` ([CVE-2022-35981](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35981))
*   Fixes a `CHECK` fail in `RaggedTensorToVariant` ([CVE-2022-36018](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36018))
*   Fixes a `CHECK` fail in `QuantizeAndDequantizeV3` ([CVE-2022-36026](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36026))
*   Fixes a segfault in `SparseBincount` ([CVE-2022-35982](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35982))
*   Fixes a `CHECK` fail in `Save` and `SaveSlices` ([CVE-2022-35983](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35983))
*   Fixes a `CHECK` fail in `ParameterizedTruncatedNormal` ([CVE-2022-35984](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35984))
*   Fixes a `CHECK` fail in `LRNGrad` ([CVE-2022-35985](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35985))
*   Fixes a segfault in `RaggedBincount` ([CVE-2022-35986](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35986))
*   Fixes a `CHECK` fail in `DenseBincount` ([CVE-2022-35987](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35987))
*   Fixes a `CHECK` fail in `tf.linalg.matrix_rank` ([CVE-2022-35988](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35988))
*   Fixes a `CHECK` fail in `MaxPool` ([CVE-2022-35989](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35989))
*   Fixes a `CHECK` fail in `Conv2DBackpropInput` ([CVE-2022-35999](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35999))
*   Fixes a `CHECK` fail in `EmptyTensorList` ([CVE-2022-35998](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35998))
*   Fixes a `CHECK` fail in `tf.sparse.cross` ([CVE-2022-35997](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35997))
*   Fixes a floating point exception in `Conv2D` ([CVE-2022-35996](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35996))
*   Fixes a `CHECK` fail in `AudioSummaryV2` ([CVE-2022-35995](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35995))
*   Fixes a `CHECK` fail in `CollectiveGather` ([CVE-2022-35994](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35994))
*   Fixes a `CHECK` fail in `SetSize` ([CVE-2022-35993](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35993))
*   Fixes a `CHECK` fail in `TensorListFromTensor` ([CVE-2022-35992](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35992))
*   Fixes a `CHECK` fail in `TensorListScatter` and `TensorListScatterV2` ([CVE-2022-35991](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35991))
*   Fixes a `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannelGradient` ([CVE-2022-35990](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35990))
*   Fixes a `CHECK` fail in `FakeQuantWithMinMaxVarsGradient` ([CVE-2022-36005](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36005))
*   Fixes a `CHECK` fail in `tf.random.gamma` ([CVE-2022-36004](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36004))
*   Fixes a `CHECK` fail in `RandomPoissonV2` ([CVE-2022-36003](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36003))
*   Fixes a `CHECK` fail in `Unbatch` ([CVE-2022-36002](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36002))
*   Fixes a `CHECK` fail in `DrawBoundingBoxes` ([CVE-2022-36001](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36001))
*   Fixes a `CHECK` fail in `Eig` ([CVE-2022-36000](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36000))
*   Fixes a null dereference on MLIR on empty function attributes ([CVE-2022-36011](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36011))
*   Fixes an assertion failure on MLIR empty edge names ([CVE-2022-36012](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36012))
*   Fixes a null-dereference in `mlir::tfg::GraphDefImporter::ConvertNodeDef` ([CVE-2022-36013](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36013))
*   Fixes a null-dereference in `mlir::tfg::TFOp::nameAttr` ([CVE-2022-36014](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36014))
*   Fixes an integer overflow in math ops ([CVE-2022-36015](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36015))
*   Fixes a `CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs` ([CVE-2022-36016](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36016))
*   Fixes an OOB read in `Gather_nd` op in TF Lite Micro ([CVE-2022-35938](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35938))

Thanks to our Contributors

This release contains contributions from many people at Google, as well as:

Abolfazl Shahbazi, Adam Lanicek, Amin Benarieb, andreii, Andrew Fitzgibbon, Andrew Goodbody, angerson, Ashiq Imran, Aurélien Geron, Banikumar Maiti (Intel Aipg), Ben Barsdell, Ben Mares, bhack, Bhavani Subramanian, Bill Schnurr, Byungsoo Oh, Chandra Sr Potula, Chengji Yao, Chris Carpita, Christopher Bate, chunduriv, Cliff Woolley, Cliffs Dover, Cloud Han, Code-Review-Doctor, DEKHTIARJonathan, Deven Desai, Djacon, Duncan Riach, fedotoff, fo40225, Frederic Bastien, gadagashwini, Gauri1 Deshpande, guozhong.zhuang, Hui Peng, James Gerity, Jason Furmanek, Jonathan Dekhtiar, Jueon Park, Kaixi Hou, Kanvi Khanna, Keith Smiley, Koan-Sin Tan, Kulin Seth, kushanam, Learning-To-Play, Li-Wen Chang, lipracer, liuyuanqiang, Louis Sugy, Lucas David, Lukas Geiger, Mahmoud Abuzaina, Marius Brehler, Maxiwell S. Garcia, mdfaijul, Meenakshi Venkataraman, Michal Szutenberg, Michele Di Giorgio, Mickaël Salamin, Nathan John Sircombe, Nathan Luehr, Neil Girdhar, Nils Reichardt, Nishidha Panpaliya, Nobuo Tsukamoto, Om Thakkar, Patrice Vignola, Philipp Hack, Pooya Jannaty, Prianka Liz Kariat, pshiko, Rajeshwar Reddy T, rdl4199, Rohit Santhanam, Rsanthanam-Amd, Sachin Muradi, Saoirse Stewart, Serge Panev, Shu Wang, Srinivasan Narayanamoorthy, Stella Stamenova, Stephan Hartmann, Sunita Nadampalli, synandi, Tamas Bela Feher, Tao Xu, Thibaut Goetghebuer-Planchon, Trevor Morris, Xiaoming (Jason) Cui, Yimei Sun, Yong Tang, Yuanqiang Liu, Yulv-Git, Zhoulong Jiang, ZihengJiang

2.11.0

Breaking Changes
*   `tf.keras.optimizers.Optimizer` now points to the new Keras optimizer, and
 old optimizers have moved to the `tf.keras.optimizers.legacy` namespace.
 If you find your workflow failing due to this change,
 you may be facing one of the following issues:

 *   **Checkpoint loading failure.** The new optimizer handles optimizer
     state differently from the old optimizer, which simplies the logic of
     checkpoint saving/loading, but at the cost of breaking checkpoint
     backward compatibility in some cases. If you want to keep using an old
     checkpoint, please change your optimizer to
     `tf.keras.optimizers.legacy.XXX` (e.g.
     `tf.keras.optimizers.legacy.Adam`).
 *   **TF1 compatibility.** The new optimizer does not support TF1 any more,
     so please use the legacy optimizer `tf.keras.optimizer.legacy.XXX`.
     We highly recommend to migrate your workflow to TF2 for stable
     support and new features.
 *   **API not found.** The new optimizer has a different set of public APIs
     from the old optimizer. These API changes are mostly related to
     getting rid of slot variables and TF1 support. Please check the API
     documentation to find alternatives to the missing API. If you must
     call the deprecated API, please change your optimizer to the legacy
     optimizer.
 *   **Learning rate schedule access.** When using a `LearningRateSchedule`,
     The new optimizer's `learning_rate` property returns the
     current learning rate value instead of a `LearningRateSchedule` object
     as before. If you need to access the `LearningRateSchedule` object,
     please use `optimizer._learning_rate`.
 *   **You implemented a custom optimizer based on the old optimizer.**
     Please set your optimizer to subclass
     `tf.keras.optimizer.legacy.XXX`. If you want to migrate to the new
     optimizer and find it does not support your optimizer, please file
     an issue in the Keras GitHub repo.
 *   **Error such as `Cannot recognize variable...`.** The new optimizer
     requires all optimizer variables to be created at the first
     `apply_gradients()` or `minimize()` call. If your workflow calls
     optimizer to update different parts of model in multiple stages,
     please call `optimizer.build(model.trainable_variables)` before the
     training loop.
 *   **Performance regression on `ParameterServerStrategy`.** This could be
     significant if you have many PS servers. We are aware of this issue and
     working on fixes, for now we suggest using the legacy optimizers when
     using `ParameterServerStrategy`.
 *   **Timeout or performance loss.** We don't anticipate this to happen, but
     if you see such issues, please use the legacy optimizer, and file
     an issue in the Keras GitHub repo.

 The old Keras optimizer will never be deleted, but will not see any
 new feature additions.
 New optimizers (e.g., `Adafactor`) will
 only be implemented based on `tf.keras.optimizers.Optimizer`, the new
 base class.

Major Features and Improvements

*   `tf.lite`:

 *   New operations supported:
       * tf.unsortedsegmentmin op is supported.
       * tf.atan2 op is supported.
       * tf.sign op is supported.
 *   Updates to existing operations:
       * tfl.mul now supports complex32 inputs.

*   `tf.experimental.StructuredTensor`

 *   Introduced `tf.experimental.StructuredTensor`, which provides a flexible
     and Tensorflow-native way to encode structured data such as protocol
     buffers or pandas dataframes.

*   `tf.keras`:

 *   Added method `get_metrics_result()` to `tf.keras.models.Model`.
     *   Returns the current metrics values of the model as a dict.
 *   Added group normalization layer `tf.keras.layers.GroupNormalization`.
 *   Added weight decay support for all Keras optimizers.
 *   Added Adafactor optimizer `tf.keras.optimizers.Adafactor`.
 *   Added `warmstart_embedding_matrix` to `tf.keras.utils`.
     This utility can be used to warmstart an embeddings matrix so you
     reuse previously-learned word embeddings when working with a new set
     of words which may include previously unseen words (the embedding
     vectors for unseen words will be randomly initialized).

*   `tf.Variable`:

 *   Added `CompositeTensor` as a baseclass to `ResourceVariable`. This
     allows `tf.Variable`s to be nested in `tf.experimental.ExtensionType`s.
 *   Added a new constructor argument `experimental_enable_variable_lifting`
     to `tf.Variable`, defaulting to True. When it's `False`, the variable
     won't be lifted out of `tf.function`, thus it can be used as a
     `tf.function`-local variable: during each execution of the
     `tf.function`, the variable will be created and then disposed, similar
     to a local (i.e. stack-allocated) variable in C/C++. Currently
     `experimental_enable_variable_lifting=False` only works on non-XLA
     devices (e.g. under `tf.function(jit_compile=False)`).

*   TF SavedModel:
 *   Added `fingerprint.pb` to the SavedModel directory. The `fingerprint.pb`
     file is a protobuf containing the "fingerprint" of the SavedModel. See
     the [RFC](https://github.com/tensorflow/community/pull/415) for more
     details regarding its design and properties.

*   `tf.data`:
 *   Graduated experimental APIs:
     * [`tf.data.Dataset.ragged_batch`](https://www.tensorflow.org/api_docs/python/tf/data/Dataset/#ragged_batch), which batches elements of `tf.data.Dataset`s into `tf.RaggedTensor`s.
     * [`tf.data.Dataset.sparse_batch`](https://www.tensorflow.org/api_docs/python/tf/data/Dataset/#sparse_batch), which batches elements of `tf.data.Dataset`s into `tf.sparse.SparseTensor`s.

Bug Fixes and Other Changes

*   `tf.image`
 *   Added an optional parameter `return_index_map` to `tf.image.ssim` which
     causes the returned value to be the local SSIM map instead of the global
     mean.

*   TF Core:

 *   `tf.custom_gradient` can now be applied to functions that accept
     "composite" tensors, such as `tf.RaggedTensor`, as inputs.
 *   Fix device placement issues related to datasets with ragged tensors of
     strings (i.e. variant encoded data with types not supported on GPU).
 *   'experimental_follow_type_hints' for tf.function has been deprecated.
     Please use input_signature or reduce_retracing to minimize retracing.

*   `tf.SparseTensor`:
 *   Introduced `set_shape`, which sets the static dense shape of the sparse tensor and has the same semantics as `tf.Tensor.set_shape`.

Security

* TF is currently using giflib 5.2.1 which has [CVE-2022-28506](https://nvd.nist.gov/vuln/detail/CVE-2022-28506). TF is not affected by the CVE as it does not use `DumpScreen2RGB` at all.
*   Fixes an OOB seg fault in `DynamicStitch` due to missing validation ([CVE-2022-41883](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41883))
*   Fixes an overflow in `tf.keras.losses.poisson` ([CVE-2022-41887](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41887))
*   Fixes a heap OOB failure in `ThreadUnsafeUnigramCandidateSampler` caused by missing validation ([CVE-2022-41880](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41880))
*   Fixes a segfault in `ndarray_tensor_bridge` ([CVE-2022-41884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41884))
*   Fixes an overflow in `FusedResizeAndPadConv2D` ([CVE-2022-41885](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41885))
*   Fixes a overflow in `ImageProjectiveTransformV2` ([CVE-2022-41886](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41886))
*   Fixes an FPE in `tf.image.generate_bounding_box_proposals` on GPU ([CVE-2022-41888](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41888))
*   Fixes a segfault in `pywrap_tfe_src` caused by invalid attributes ([CVE-2022-41889](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41889))
*   Fixes a `CHECK` fail in `BCast` ([CVE-2022-41890](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41890))
*   Fixes a segfault in `TensorListConcat` ([CVE-2022-41891](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41891))
*   Fixes a `CHECK_EQ` fail in `TensorListResize` ([CVE-2022-41893](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41893))
*   Fixes an overflow in `CONV_3D_TRANSPOSE` on TFLite ([CVE-2022-41894](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41894))
*   Fixes a heap OOB in `MirrorPadGrad` ([CVE-2022-41895](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41895))
*   Fixes a crash in `Mfcc` ([CVE-2022-41896](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41896))
*   Fixes a heap OOB in `FractionalMaxPoolGrad` ([CVE-2022-41897](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41897))
*   Fixes a `CHECK` fail in `SparseFillEmptyRowsGrad` ([CVE-2022-41898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41898))
*   Fixes a `CHECK` fail in `SdcaOptimizer` ([CVE-2022-41899](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41899))
*   Fixes a heap OOB in `FractionalAvgPool` and `FractionalMaxPool`([CVE-2022-41900](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41900))
*   Fixes a `CHECK_EQ` in `SparseMatrixNNZ` ([CVE-2022-41901](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41901))
*   Fixes an OOB write in grappler ([CVE-2022-41902](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41902))
*   Fixes a overflow in `ResizeNearestNeighborGrad` ([CVE-2022-41907](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41907))
*   Fixes a `CHECK` fail in `PyFunc` ([CVE-2022-41908](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41908))
*   Fixes a segfault in `CompositeTensorVariantToComponents` ([CVE-2022-41909](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41909))
*   Fixes a invalid char to bool conversion in printing a tensor ([CVE-2022-41911](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41911))
*   Fixes a heap overflow in `QuantizeAndDequantizeV2` ([CVE-2022-41910](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41910))
*   Fixes a `CHECK` failure in `SobolSample` via missing validation ([CVE-2022-35935](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35935))
*   Fixes a `CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in eager mode ([CVE-2022-35935](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35935))

Thanks to our Contributors

This release contains contributions from many people at Google, as well as:

103yiran, 8bitmp3, Aakar Dwivedi, Alexander Grund, alif_elham, Aman Agarwal,
amoitra, Andrei Ivanov, andreii, Andrew Goodbody, angerson, Ashay Rane,
Azeem Shaikh, Ben Barsdell, bhack, Bhavani Subramanian, Cedric Nugteren,
Chandra Kumar Ramasamy, Christopher Bate, CohenAriel, Cotarou, cramasam,
Enrico Minack, Francisco Unda, Frederic Bastien, gadagashwini, Gauri1 Deshpande,
george, Jake, Jeff, Jerry Ge, Jingxuan He, Jojimon Varghese, Jonathan Dekhtiar,
Kaixi Hou, Kanvi Khanna, kcoul, Keith Smiley, Kevin Hu, Kun Lu, kushanam,
Lianmin Zheng, liuyuanqiang, Louis Sugy, Mahmoud Abuzaina, Marius Brehler,
mdfaijul, Meenakshi Venkataraman, Milos Puzovic, mohantym, Namrata-Ibm,
Nathan John Sircombe, Nathan Luehr, Olaf Lipinski, Om Thakkar, Osman F Bayram,
Patrice Vignola, Pavani Majety, Philipp Hack, Prianka Liz Kariat, Rahul Batra,
RajeshT, Renato Golin, riestere, Roger Iyengar, Rohit Santhanam, Rsanthanam-Amd,
Sadeed Pv, Samuel Marks, Shimokawa, Naoaki, Siddhesh Kothadi, Simengliu-Nv,
Sindre Seppola, snadampal, Srinivasan Narayanamoorthy, sushreebarsa,
syedshahbaaz, Tamas Bela Feher, Tatwai Chong, Thibaut Goetghebuer-Planchon,
tilakrayal, Tom Anderson, Tomohiro Endo, Trevor Morris, vibhutisawant,
Victor Zhang, Vremold, Xavier Bonaventura, Yanming Wang, Yasir Modak,
Yimei Sun, Yong Tang, Yulv-Git, zhuoran.liu, zotanika

2.10.1

This release introduces several vulnerability fixes:

*   Fixes an OOB seg fault in `DynamicStitch` due to missing validation ([CVE-2022-41883](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41883))
*   Fixes an overflow in `tf.keras.losses.poisson` ([CVE-2022-41887](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41887))
*   Fixes a heap OOB failure in `ThreadUnsafeUnigramCandidateSampler` caused by missing validation ([CVE-2022-41880](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41880))
*   Fixes a segfault in `ndarray_tensor_bridge` ([CVE-2022-41884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41884))
*   Fixes an overflow in `FusedResizeAndPadConv2D` ([CVE-2022-41885](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41885))
*   Fixes a overflow in `ImageProjectiveTransformV2` ([CVE-2022-41886](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41886))
*   Fixes an FPE in `tf.image.generate_bounding_box_proposals` on GPU ([CVE-2022-41888](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41888))
*   Fixes a segfault in `pywrap_tfe_src` caused by invalid attributes ([CVE-2022-41889](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41889))
*   Fixes a `CHECK` fail in `BCast` ([CVE-2022-41890](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41890))
*   Fixes a segfault in `TensorListConcat` ([CVE-2022-41891](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41891))
*   Fixes a `CHECK_EQ` fail in `TensorListResize` ([CVE-2022-41893](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41893))
*   Fixes an overflow in `CONV_3D_TRANSPOSE` on TFLite ([CVE-2022-41894](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41894))
*   Fixes a heap OOB in `MirrorPadGrad` ([CVE-2022-41895](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41895))
*   Fixes a crash in `Mfcc` ([CVE-2022-41896](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41896))
*   Fixes a heap OOB in `FractionalMaxPoolGrad` ([CVE-2022-41897](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41897))
*   Fixes a `CHECK` fail in `SparseFillEmptyRowsGrad` ([CVE-2022-41898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41898))
*   Fixes a `CHECK` fail in `SdcaOptimizer` ([CVE-2022-41899](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41899))
*   Fixes a heap OOB in `FractionalAvgPool` and `FractionalMaxPool`([CVE-2022-41900](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41900))
*   Fixes a `CHECK_EQ` in `SparseMatrixNNZ` ([CVE-2022-41901](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41901))
*   Fixes an OOB write in grappler ([CVE-2022-41902](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41902))
*   Fixes a overflow in `ResizeNearestNeighborGrad` ([CVE-2022-41907](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41907))
*   Fixes a `CHECK` fail in `PyFunc` ([CVE-2022-41908](http

[pyup-bot]

Closing this in favor of #1273