Update dependency lightgbm to v4.6.0 [SECURITY]

[renovate]

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Change	Age	Confidence
lightgbm (changelog)	==4.3.0 -> ==4.6.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2024-43598

LightGBM Remote Code Execution Vulnerability

---

Release Notes

microsoft/LightGBM (lightgbm)

v4.6.0

Compare Source

Changes

💡 New Features

• [CUDA] fix setting of CUDA architectures and enable support for NVIDIA Blackwell @​StrikerRUS (#​6812)
• [python-package] support Python 3.13 @​jameslamb (#​6668)
• [GPU] Add support for linear tree with device=gpu @​dragonbra (#​6567)
• [c++] Add Bagging by Query for Lambdarank @​shiyu1994 (#​6623)

🔨 Breaking

• [R-package] require lgb.Dataset, remove support for passing 'colnames' and 'categorical_feature' for lgb.train() and lgb.cv() @​jameslamb (#​6714)
• [python-package] support sub-classing scikit-learn estimators @​jameslamb (#​6783)
• [python-package] do not copy column-major numpy arrays when creating Dataset from list of arrays @​jmoralez (#​6773)
• [python-package] remove support for passing 'feature_name' and 'categorical_feature' through train() and cv() @​jameslamb (#​6706)
• [python-package] require scikit-learn>=0.24.2, make scikit-learn estimators compatible with scikit-learn>=1.6.0dev @​vnherdeiro (#​6651)
• [ci] Require CMake 3.28 and replace FetchContent_Populate with FetchContent_MakeAvailable @​StrikerRUS (#​6550)

🚀 Efficiency Improvement

• [python-package] do not copy column-major numpy arrays when predicting @​jmoralez (#​6751)
• [python-package] do not copy column-major numpy arrays when creating Dataset @​jmoralez (#​6721)

🐛 Bug Fixes

• [python-package] Separately check whether pyarrow and cffi are installed @​mlondschien (#​6785)
• [c++] Fixed Predictor lifecycle and trees initialization in Contrib mode @​AndreyOrb (#​6778)
• [python-package] Infer feature names from pyarrow.Table @​mlondschien (#​6781)
• [python-package] Fix inconsistency in predict() output shape for 1-tree models @​RektPunk (#​6753)
• [fix] resolve potential attack in linker connection building @​shiyu1994 (#​6752)
• [R-package] Avoid bashisms (non-POSIX code) in R-package/configure @​smoser (#​6746)
• [c++] fix parallel_tree_learner_split_info @​moming39 (#​6738)
• [c++] Fix dump_model() information for root node @​neNasko1 (#​6569)
• [cmake] [R-package] include R-for-macOS vendored libs dir in OpenMP search path (fixes #​6628) @​jameslamb (#​6629)
• [R-package] only warn about early stopping and DART boosting being incompatible if early stopping was requested @​serkor1 (#​6619)
• [cmake] fixes static build for macos with OpenMP enabled (fixes #​6601) @​Mottl (#​6600)

📖 Documentation

• [docs] update installation guide @​StrikerRUS (#​6696)
• [docs] add note about pyodide support @​jameslamb (#​6715)
• [docs] Remove only cpu note due to gpu support for linear trees @​JAroyan (#​6686)
• [docs] fix inaccurate comment for force_col_wise param with CUDA version @​StrikerRUS (#​6695)
• [docs] group logically external projects in README and add some new libraries @​StrikerRUS (#​6691)
• [docs] use consistent naming for R-package and Python-package across the repo @​StrikerRUS (#​6655)
• [docs] add supertree in README @​pplonski (#​6625)
• [docs] unify language and make small improvements in some param descriptions @​StrikerRUS (#​6618)
• [doc] Updates Rust bindings library link in README.md @​Mottl (#​6611)
• [R-package] [docs] update cran-comments for v4.5.0 release @​jameslamb (#​6578)
• [docs] add conda version badge @​StrikerRUS (#​6576)

🧰 Maintenance

• release v4.6.0 @​jameslamb (#​6796)
• [c++] update to fmt 11.1.2, fast_double_parser 0.8.0 @​jameslamb (#​6802)
• [ci] fix valgrind workflow @​jameslamb (#​6816)
• [ci] validate pyproject file by json schema @​StrikerRUS (#​6813)
• [ci] [python-package] update pre-commit hooks to latest versions @​jameslamb (#​6817)
• [ci]: Bump release-drafter/release-drafter from 6.0.0 to 6.1.0 in the ci-dependencies group @​dependabot[bot] (#​6810)
• [ci] fix errors about line length in yaml files (Part 4) @​StrikerRUS (#​6804)
• [ci] remove pandas before testing that LightGBM can be imported without extra deps @​StrikerRUS (#​6801)
• [ci] fix errors about comments indentation in yaml files (Part 3) @​StrikerRUS (#​6794)
• [ci] fix errors about indentation in yaml files (Part 2) @​StrikerRUS (#​6789)
• [ci] [python-package] build macOS x86_64 wheels on macOS 13 (Ventura) @​jameslamb (#​6669)
• [ci] add yaml files linter to pre-commit hook but skip some rules for now (Part 1) @​StrikerRUS (#​6763)
• [ci] lock inactive issues and PRs at different time @​StrikerRUS (#​6764)
• [ci][python-package] add testing for the shape of raw score predictions @​StrikerRUS (#​6765)
• [ci] pin more dependencies in Python 3.8 environment @​jameslamb (#​6771)
• [CUDA] remove src/treelearner/kernels @​shiyu1994 (#​6766)
• [python-package] stop relying on string concatenation / splitting for cv() eval results @​jameslamb (#​6761)
• [ci] Add Release Drafter workflow @​StrikerRUS (#​6754)
• [python-package] Rename cvfolds variable into cvbooster in engine.cv function @​ClaudioSalvatoreArcidiacono (#​6762)
• [python-package] simplify eval result printing @​jameslamb (#​6749)
• [ci] fix linkchecker job @​jameslamb (#​6757)
• [ci] remove Docker volumes during Azure cleanup @​StrikerRUS (#​6760)
• [ci] use Ruff linter instead of isort @​StrikerRUS (#​6755)
• [ci] set upper bound on dask @​jmoralez (#​6742)
• [c++] include wherever uint8_t is used @​jameslamb (#​6736)
• [python-package] simplify scikit-learn 1.6+ tags support @​jameslamb (#​6735)
• [ci] Introduce typos pre-commit hook @​borchero (#​6564)
• [ci] [python-package] [R-package] adapt to scikit-learn check_sample_weight_equivalence changes, stop testing against R 3.6 on Linux @​jameslamb (#​6733)
• [python-package][R-package] adapt to scikit-learn 1.6 testing changes, pin more packages in R 3.6 CI jobs @​jameslamb (#​6718)
• [ci] [R-package] re-enable 'rchk' checks @​jameslamb (#​6713)
• [ci] check PowerShell scripts with PSScriptAnalyzer (part 3) @​StrikerRUS (#​6710)
• [ci] check JavaScript code with biome tool @​StrikerRUS (#​6711)
• [ci] check PowerShell scripts with PSScriptAnalyzer (part 2) @​StrikerRUS (#​6709)
• [ci] check PowerShell scripts with PSScriptAnalyzer (part 1) @​StrikerRUS (#​6704)
• [ci] [R-package] remove code for 'rchk' checks @​jameslamb (#​6545)
• [ci] Fix version matching between RTD pages and R-package pages @​StrikerRUS (#​6673)
• [python-package] remove MSVS solution files from sdist @​jameslamb (#​6698)
• [ci] set MinimumVisualStudioVersion to MSVS 2015 @​StrikerRUS (#​6689)
• [ci] fix build of LightGBM with MSVS GUI @​StrikerRUS (#​6690)
• [cmake] group sanitizer options together @​StrikerRUS (#​6688)
• [ci] add shellcheck, use latest pre-commit hook versions @​jameslamb (#​6685)
• [ci] fix some shellcheck warnings in package-building scripts @​vnherdeiro (#​6641)
• [python-package] deprecate support for H2O 'datatable' @​jameslamb (#​6670)
• [ci] enable OpenMP support in cpp tests @​StrikerRUS (#​6676)
• [python-package] ignore scikit-learn 'check_sample_weight_equivalence' estimator check (fixes #​6678) @​jameslamb (#​6679)
• [ci] fix shellcheck warnings in CI scripts @​vnherdeiro (#​6646)
• [ci] Restore MPI jobs on macOS @​StrikerRUS (#​6664)
• [ci] Update CUDA versions for CI @​StrikerRUS (#​6539)
• [ci] replace uses of 'mamba' with 'conda', use Python 12 for test-python-latest-job @​jameslamb (#​6663)
• [cmake] simplify SWIG config @​StrikerRUS (#​6648)
• [ci] [R-package] re-enable R-devel clang16 job (fixes #​6607) @​jameslamb (#​6642)
• [cmake] remove unused variable @​StrikerRUS (#​6647)
• [ci] [python-package] temporarily stop testing against scikit-learn nightlies, load lib_lightgbm earlier @​jameslamb (#​6654)
• [ci] prevent C API tests from leaving files behind (fixes #​6361) @​jameslamb (#​6637)
• [python-package] limit when num_boost_round warnings are emitted (fixes #​6324) @​jameslamb (#​6579)
• [ci] prevent Python tests from leaving behind files @​vnherdeiro (#​6626)
• fix some shellcheck warnings @​vnherdeiro (#​6621)
• [ci] fix linux runners running out of disk space (fixed #​6635) @​jameslamb (#​6636)
• [python-package] remove setup.cfg @​jameslamb (#​6624)
• [cmake] consolidate set_target_properties() calls @​jameslamb (#​6594)
• [ci] prevent train.binary.bin and lgb_train_data.bin files being left behind after testing @​bili2002 (#​6606)
• [ci] update some linting versions @​jameslamb (#​6598)
• [ci] skip R-devel clang16 job and use gcc-12 for macOS Python jobs @​jameslamb (#​6608)
• [python-package] update to scikit-build-core 0.10 @​jameslamb (#​6597)
• [ci] restore nuget artifact creation @​StrikerRUS (#​6593)
• [R-package] [cmake] simplify CMake-based R builds @​jameslamb (#​6591)
• [cmake] stop using file(GLOB) @​jameslamb (#​6588)
• [ci] prevent categorical.model and model.txt files being left behind after testing @​neNasko1 (#​6590)
• [ci] Always use latest SWIG version in Windows CI job @​StrikerRUS (#​6541)
• [ci] place all CI helpers under the .ci folder and use - instead of _ in their names @​StrikerRUS (#​6581)
• [ci] fix MSVC warning about builds in temp directory @​StrikerRUS (#​6573)
• bump development version to 4.5.0.99 @​jameslamb (#​6575)
• [ci] ask pip to always install local artifact but not download package from PyPI @​StrikerRUS (#​6574)

v4.5.0

Compare Source

Changes

💡 New Features

• [python-package] Add feature_names_in_ attribute for scikit-learn estimators (fixes #​6279) @​nicklamiller (#​6310)
• [R-package]: add num_trees_per_iter, num_trees, and num_iter methods @​mayer79 (#​6500)

🔨 Breaking

• [c++] remove HDFS support (fixes #​6436) @​jameslamb (#​6534)
• [ci] [python-package] run macOS x86_64 tests on macOS 12 (Monterey), stop manually setting macOS wheel tags @​jameslamb (#​6487)

🚀 Efficiency Improvement

• Avoid copy on Refit @​cbourjau (#​6478)

🐛 Bug Fixes

• [python-package] Correctly recognize LGBMClassifier(num_class=2, objective="multiclass") as multiclass classification @​RektPunk (#​6524)
• [cmake] Some improvements to handling of OpenMP on macOS @​barracuda156 (#​6489)
• [python-package] respect 'verbose' setting when using custom objective function (fixes #​6014) @​jameslamb (#​6428)
• cmake: add missing lib_lightgbm_swig.so to lightgbmlib.jar on linux @​shuttie (#​6515)

📖 Documentation

• [docs] update GitHub Actions badges in README @​StrikerRUS (#​6570)
• [docs] Update badge for Link checks workflow @​StrikerRUS (#​6568)
• [python-package] [docs] Expand class docs for Dataset @​Plenitude-ai (#​6558)
• [docs] fix link to multiple OpenMP issue description @​StrikerRUS (#​6562)
• [docs] Add NuGet version badge @​StrikerRUS (#​6549)
• [docs] remove link to Roadmap (fixes #​6556) @​jameslamb (#​6557)
• [docs] remove outdated docs from the repo @​StrikerRUS (#​6552)
• [docs] Add conda downloads badge @​StrikerRUS (#​6546)
• [docs] update and simplify installation docs @​jameslamb (#​6536)
• [doc] fix documentation for quantized training @​shiyu1994 (#​6528)
• [docs] fix FAQ markdown @​StrikerRUS (#​6521)
• [docs] [R-package] update cran-comments.md @​jameslamb (#​6499)
• [docs] remove pmml redirect, simplify some other docs @​jameslamb (#​6490)

🧰 Maintenance

• release v4.5.0 @​jameslamb (#​6538)
• [ci] modify CodeQL settings @​jameslamb (#​6563)
• [ci] revert clang-18 LD_LIBRARY_PATH workaround @​jameslamb (#​6559)
• [ci] [R-package] help linker find libstdc++.so.1 in clang18 job (fixes #​6553) @​jameslamb (#​6554)
• [ci] update codeowners @​jameslamb (#​6542)
• [ci] [R-package] use --no-xattrs when re-tarring CRAN-style package @​jameslamb (#​6540)
• [ci] [R-package] add CI jobs covering more CRAN "additional checks", fix R_NO_REMAP warnings (fixes #​6369) @​jameslamb (#​6523)
• [ci] [R-package] add arm64 macOS R-package CI job (fixes #​6481) @​jameslamb (#​6494)
• [ci] restore aarch64 linux builds (fixes #​6509) @​jameslamb (#​6527)
• [test][python] fix pandas DeprecationWarning about is_sparse function @​StrikerRUS (#​6532)
• fix cpp casting errors "Comparison of narrow type with wide type in loop condition" @​StrikerRUS (#​6533)
• [python-package] avoid overwriting dependencies via 'build-python.sh install' @​jameslamb (#​6526)
• [tests][python] fix nan in pandas bool column @​StrikerRUS (#​6530)
• Remove template parameters from copy constructor @​hgminh95 (#​6514)
• [ci] prevent lgb.model and lgb.pkl files being left behind after testing @​nicklamiller (#​6518)
• [ci] [R-package] run 'R CMD check' as a foreground task @​jameslamb (#​6508)
• [CMake] Use CMAKE_MSVC_RUNTIME_LIBRARY to apply /MT @​hcho3 (#​6484)
• [ci] resolve shellcheck errors in .ci/check_python_dists.sh @​Kunal-Singh-Dadhwal (#​6503)
• [ci] skip aarch64 linux job @​jameslamb (#​6517)
• [R-package] Use Rf_-prefixed versions of protect/unprotect @​david-cortes (#​6502)
• [ci] reduce repetition of BUILD_DIRECTORY in CI scripts @​jameslamb (#​6497)
• [ci] remove OpenMP / MKL workaround in CI jobs @​jameslamb (#​6496)
• [ci] [docs] fix link-checks job @​jameslamb (#​6495)
• [python-package] Change build settings to set strict-config to false @​Jorricks (#​6493)
• [ci] remove unnecessary package installations in CI @​jameslamb (#​6488)
• chore: update dataset_loader.cpp @​eltociear (#​6483)
• bump development version to 4.4.0.99 @​jameslamb (#​6485)

v4.4.0

Compare Source

Changes

💡 New Features

• [ci] [python-package] add arm64 macOS wheels @​jameslamb (#​6391)
• [python-package] Add support for NumPy 2.0, test against nightly versions of dependencies (fixes #​6454) @​jameslamb (#​6467)
• [R-package] expose start_iteration to dump/save/lgb.model.dt.tree @​mayer79 (#​6398)
• [python-package] Allow to pass early stopping min delta in params @​borchero (#​6274)
• [python-package] Allow to pass Arrow table with boolean columns to dataset @​borchero (#​6353)
• [c++][fix] Support Quantized Training with Categorical Features on CPU @​shiyu1994 (#​6301)

🔨 Breaking

• [python-package] remove uses of deprecated NumPy random number generation APIs, require 'numpy>=1.17.0' @​jameslamb (#​6468)
• [python-package] drop Python 3.6 support, add Python 3.12 @​jameslamb (#​6459)
• [cmake] [c++] use .dylib extension unconditionally on macOS @​jameslamb (#​6418)
• ENH more stable gradient of CrossEntropy @​lorentzenchr (#​6327)
• [R-package] Rename slice() to lgb.slice.Dataset() @​david-cortes (#​6293)

🚀 Efficiency Improvement

• [R-package] Use ALTREP system to return C++-allocated arrays @​david-cortes (#​6213)
• [R-package] Speed-up lgb.importance() @​mayer79 (#​6364)
• Fix single row prediction performance in a multi-threaded environment @​Ten0 (#​6024)

🐛 Bug Fixes

• [R-package] ensure use of interaction_constraints does not lead to features being ignored @​mayer79 (#​6377)
• [R-package] skip integer categorical feature check when building dataset subset (fixes #​6412) @​jmoralez (#​6442)
• [cmake] always target Windows SDK v10.x when using Visual Studio generators (fixes #​6448) @​jameslamb (#​6451)
• upgrade CMake in dockerfile-cli (fixes #​6420) @​narumiruna (#​6426)
• remove unnecessary omp single that cause deadlock (fixes #​6273) @​morokosi (#​6394)
• [python-package] allow use of early_stopping_round<=0 to turn off early stopping (fixes #​6401) @​ddelzell (#​6406)
• [c++] Fix memory leak in Arrow table implementation @​borchero (#​6314)
• Fix calculation of number of bins in FindGroup @​CVPaul (#​6019)

📖 Documentation

• [docs] ensure pkgdown site index accurately reflects R-package public API (fixes #​6444) @​jameslamb (#​6445)
• [docs] document how to use a custom objective function via the C API @​parsiad (#​6396)
• [docs] [ci] encourage use of cmake --build @​jameslamb (#​6368)
• [docs] remove language about CUDA version being experimental (fixes #​6340) @​jameslamb (#​6371)

🧰 Maintenance

• release v4.4.0 @​jameslamb (#​6439)
• [python-package] add a few type hints in LGBMModel.fit() @​jameslamb (#​6470)
• [python-package] clarify max_depth warning and limit when it is emitted @​jameslamb (#​6402)
• [ci] upgrade linters to latest version @​jameslamb (#​6472)
• [ci] [R-package] add new linters from {lintr} 3.1.1 @​jameslamb (#​6471)
• [python-package] make LGBMDeprecationWarning inherit from FutureWarning @​jameslamb (#​6447)
• [ci] further simplify CI configurations @​jameslamb (#​6463)
• [ci] fix CUDA 11.8 builds (fixes #​6466) @​jameslamb (#​6465)
• [ci] simplify CI configurations, parallelize compilation, test CUDA on Ubuntu 22.04 @​jameslamb (#​6458)
• [ci]: Bump actions/checkout from 1 to 4 in the ci-dependencies group @​dependabot (#​6453)
• [cmake] switch to FindCUDAToolkit @​characat0 (#​6457)
• [R-package] [python-package] deprecate Dataset arguments to cv() and train() @​jameslamb (#​6446)
• [ci] Add dependabot configuration @​borchero (#​6449)
• [python-package] upgrade to scikit-build-core 0.9.3 @​jameslamb (#​6263)
• deprecate HDFS support @​jameslamb (#​6443)
• [c++] remove uses of '..' in headers @​jameslamb (#​6409)
• [R-package] always name the shared library 'lightgbm', not 'lib_lightgbm' @​jameslamb (#​6432)
• [R-package] [ci] Manually install 'Matrix' (fixes #​6433) @​jameslamb (#​6434)
• [ci] Skip Arrow tests on AppVeyor, use Intel macOS runners, upgrade to XCode 14.3 on macOS jobs, disable MacOS MPI jobs @​borchero (#​6425)
• [ci] raise floors on CI dependencies @​jameslamb (#​6375)
• [ci] make shell scripts stricter @​jameslamb (#​6266)
• [python-package] prevent build-python.sh from modifying already-installed dependencies @​jameslamb (#​6403)
• [ci] reduce hard-coding of host architecture @​jameslamb (#​6395)
• [c++] remove unused variable 'need_connect_cnt' @​jameslamb (#​6410)
• [ci] clean source directory at the beginning of every Azure DevOps build @​jameslamb (#​6416)
• [ci] Fix Azure Pipeline Agents @​shiyu1994 (#​6407)
• [ci] [R-package] re-enable r-sanitizers jobs (fixes #​6367) @​jameslamb (#​6374)
• [ci] prevent trailing whitespace, ensure files end with newline @​jameslamb (#​6373)
• [ci] [docs] update some docs and CI dependencies @​jameslamb (#​6346)
• [ci] [python-package] remove unused flake8 configuration @​jameslamb (#​6372)
• [ci] put ceiling on graphviz in Python 3.7 jobs @​jameslamb (#​6370)
• [ci] Fix R 3.6 tests, dask tests, compatibility with dask>=2024.3.1 @​borchero (#​6357)
• [ci] [python-package] check for untyped definitions with mypy @​jameslamb (#​6339)
• [ci] ignore ruff-format changes in git blame (fixes #​6304) @​jameslamb (#​6345)
• [c++] remove unnecessary include in CLI @​jameslamb (#​6342)
• [ci] [python-package] enable ruff-format on all Python code @​jameslamb (#​6336)
• [python-package] remove unused type alias @​jameslamb (#​6341)
• [ci] [python-package] enforce 'pylint' checks (fixes #​4308) @​jameslamb (#​6334)
• [ci] [python-package] enable ruff-format on tests and examples @​jameslamb (#​6317)
• [python-package] fix mypy error about pyarrow data @​jameslamb (#​6333)
• [ci] remove unnecessary workarounds in R-package macOS jobs @​jameslamb (#​6331)
• [ci] remove workflow_dispatch from no-response configuration @​jameslamb (#​6330)
• [ci] fix no-response permissions @​jameslamb (#​6323)
• [ci] enable ruff-format on some files, add pre-commit config @​jameslamb (#​6308)
• [ci] ensure shell script exit codes are in range 0-255 @​jameslamb (#​6305)
• [ci] fix installation of clang-18 (fixes #​6306) @​jameslamb (#​6307)
• [ci] [R-package] pin to older setup-pandoc for R 3.6 jobs (fixes #​6298) @​jameslamb (#​6299)
• bump development version to 4.3.0.99 @​jameslamb (#​6287)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.