build(deps): bump ai.djl:bom from 0.36.0 to 0.38.0

[dependabot]

Bumps ai.djl:bom from 0.36.0 to 0.38.0.

Release notes

Sourced from ai.djl:bom's releases.

DJL v0.38.0 Release

What's Changed

• Use 64-bit arithmetic for tensor buffer size calculations by @​ethnzhng in deepjavalibrary/djl#3876
• Increase build version to 0.38.0 by @​xyang16 in deepjavalibrary/djl#3879
• [ci] Upgrade actions version by @​xyang16 in deepjavalibrary/djl#3880
• [ci] Fix native library build pipeline by @​xyang16 in deepjavalibrary/djl#3881

Full Changelog: deepjavalibrary/djl@v0.37.0...v0.38.0

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

• Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
• Bumped log4j to 2.26.0 (#3877)
• onnxruntime: allow sub-managers after NDManager.cap() (#3870)
• Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior	Default	To restore
Compile bundled .java sources at model load	off	DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading	off	DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

• A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
• Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits

• 41ff6b2 Remove -SNAPSHOT for release v0.38.0
• 502671e Increase DJL version to 0.38.0
• c838756 [ci] Fix native library build pipeline (#3881)
• ffd4719 [ci] Upgrade actions version (#3880)
• 46787b3 Increase build version to 0.38.0 (#3879)
• dee55bf Use 64-bit arithmetic for tensor buffer size calculations (#3876)
• 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
• 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
• e263d0d [docs] fix typo benifit -> benefit (#3874)
• 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
• Additional commits viewable in compare view

[github-actions]

Submodule Changes

[c-dilks]

approved by @skuditha