Bump rasterio from 1.3.7 to 1.3.9 in /rastervision_core

[dependabot]

Bumps rasterio from 1.3.7 to 1.3.9.

Release notes

Sourced from rasterio's releases.

1.3.9

Bug fixes

• Lean on numpy for minimum and maximum values of float data types (#2946).
• Replace rasterio.dtypes.in_dtype_range() with the version inside the edit-info command (#2946).
• Deallocate _filepath VSI filesystem plugin callback structs to prevent the memory leak reported in #2932.

Packaging

GDAL 3.6.4 is patched in the PyPI wheels to fix the potential GTiff multithreading deadlock reported in OSGeo/gdal#8470.

1.3.8.post2

There are no code changes in this release. This is only to create new wheels that update curl to version 8.4.0 to address CVE-2023-38545 and CVE-38546.

1.3.8.post1

There are no code changes in this release. This is only to create new wheels that update libwebp to version 1.3.2 to address CVE-2023-4863, and to publish wheels for Python 3.12.

1.3.8

Rasterio 1.3.8 fixes three bugs that can result in segmentation faults due to doubly freed memory and illegal memory access.

Bug fixes

• Rasterio's Python file VSI plugin is now compatible with GDAL VRTs such as the one used for boundless reads of datasets (#2856).
• Crashes when accessing the block shapes of a multidataset HDF5 file are now prevented (#2859).
• Adds a workaround for a GDAL multithreaded compression bug introduced in 3.6.0 (#2851).

Changelog

Sourced from rasterio's changelog.

1.3.9 (2023-10-18)

Bug fixes:

• Lean on numpy for minimum and maximum values of float data types (#2946).
• Replace rasterio.dtypes.in_dtype_range() with the version inside the edit-info command (#2946).
• Deallocate _filepath VSI filesystem plugin callback structs to prevent the memory leak reported in #2932.

Packaging:

GDAL 3.6.4 is patched in the PyPI wheels to fix the potential GTiff multithreading deadlock reported in OSGeo/gdal#8470.

1.3.8.post2 (2023-10-11)

There are no code changes in this release. This is only to create new wheels that update curl to version 8.4.0 to address CVE-2023-38545 and CVE-38546.

1.3.8.post1 (2023-10-09)

There are no code changes in this release. This is only to create new wheels that update libwebp to version 1.3.2 to address CVE-2023-4863, and to publish wheels for Python 3.12.

1.3.8 (2023-06-28)

• Rasterio's Python file VSI plugin is now compatible with GDAL VRTs such as the one used for boundless reads of datasets (#2856).
• Prevent a crash when accessing the block shapes of a multidataset HDF5 file (#2859).
• Add a workaround for a GDAL multithreaded compression bug introduced in 3.6.0 (#2851).

Commits

• 4a592e8 This is 1.3.9
• 6db8f54 update docs usage (#2947)
• 567c97f Lean on numpy for min and max of float data types (#2946)
• e54aaed Deallocate _filepath callback structs (#2944)
• e8837fb Release 1.3.8.post2 (#2939)
• 01d778a Release 1.3.8.post1 (#2923)
• af7ad3e Rel 1.3.8 (#2861)
• 0560836 Improve compatibility of FilePath with GDAL's VSI system (#2856)
• e2dcbce Prevent a crash when accessing block shapes of an HDF5 file (#2859)
• 0ee2b61 Backport 2851 (#2858)
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[AdeelH]

@dependabot rebase

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (67f09a6) 85.23% compared to head (f2363e0) 85.23%.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1970   +/-   ##
=======================================
  Coverage   85.23%   85.23%           
=======================================
  Files         196      196           
  Lines        9908     9908           
=======================================
  Hits         8445     8445           
  Misses       1463     1463           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.