build(deps): bump keras from 3.8.0 to 3.12.4

[dependabot]

Bumps keras from 3.8.0 to 3.12.4.

Release notes

Sourced from keras's releases.

Keras 3.12.4

Keras 3.12.4 is a security patch release that hardens dataset loading and model file handling against insecure deserialization and decompression-bomb attacks.

Security Fixes

• Restrict unpickling when loading IMDB and Reuters datasets — Replaces np.load(allow_pickle=True) with a restricted unpickler that only permits numpy array reconstruction, preventing arbitrary code execution via crafted .npz files (CWE-502). (#23047) by @​LinZiyuu
• Verify all intermediary H5 groups when navigating H5 files — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal. (#23168) by @​hertschuh
• Reject decompression-bomb members on the .keras asset extraction path — Adds per-member decompression-ratio checks before extracting .keras archives to disk, preventing disk-exhaustion attacks via crafted archives. (#23101) by @​LinZiyuu
• Restrict unpickling when loading CIFAR datasets — Replaces bare cPickle.load in CIFAR-10/100 batch loading with the numpy-only RestrictedUnpickler, blocking arbitrary code execution via pickle gadgets. (#23252) by @​SABITHSAHEB

---

Contributors

Thank you to all the contributors who made this release possible! 🎉

• @​LinZiyuu — Security hardening for IMDB, Reuters, and .keras asset extraction (#23047, #23101)
• @​hertschuh — H5 group verification (#23168)
• @​SABITHSAHEB — CIFAR dataset pickle restriction (#23252)

---

Full Changelog: keras-team/keras@v3.12.3...v3.12.4

v3.12.3

Keras 3.12.3 is a security patch release that hardens model saving, loading, and deserialization against a range of attack vectors.

HDF5 Hardening

• Eject ExternalLink/SoftLink groups in KerasFileEditor (#22899)
  • Prevents HDF5 external/soft links from being exploited to read arbitrary files during model editing.
• Reject ExternalLink/SoftLink on legacy .h5 dispatcher (#22900)
  • Extends HDF5 link rejection to the legacy load_weights path for .h5 files.
• Reject HDF5 shape-bomb datasets (#22975)
  • Blocks HDF5 datasets that declare excessively large shapes to trigger out-of-memory crashes during load_model/load_weights.
• Reject HDF5 virtual datasets in KerasFileEditor (#22976)
  • Prevents virtual dataset references from being used to access external files.

Archive Hardening

• Reject hard-link tar members escaping extraction directory (#22973)
  • Blocks tar hard links whose target resolves outside the extraction root.
• Reject decompression-bomb archive members (#23010)
  • Detects and rejects .keras archive members that declare far more data than is actually stored, preventing memory exhaustion.
• Prevent symlink traversal during extraction (#23015)
  • Resolves paths with realpath to prevent symlink-based directory traversal attacks.
• Reject npz weight bombs (#23016)
  • Validates npz weight members against shape/decompression bombs before allocating memory.
• Validate DiskIOStore asset paths (#23017)

... (truncated)

Commits

• 6c0caa7 Bump version to 3.12.4 (#23356)
• 64ab216 Remove nested container warnings (#23172)
• d338a45 Security Fixes 3.12.3 (#23165)
• 8f987f1 Patch fix 3.12.2 (#22850)
• f704c88 3.12.1 cherry pick changes for patch release. (#22081)
• adbfd13 Add warning to set_backend and more detailed example. (#21787)
• 70598b7 Fix typo in Distiller docstring
• eecd34f Fix: keras.ops.quantile works with tf graph execution (#21782)
• c2bc6cf Suport keras.op.view() to view the same data bitwise at a new dtype (#21763)
• 10b51ce Make confusion metrics compilable. (#21775)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.