-
Notifications
You must be signed in to change notification settings - Fork 70
Drop Python 3.9 support due to critical security issue with a dependency #2061
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR drops support for Python 3.9 due to a critical security issue with the Dask dependency and updates various configurations and documentation to reflect the new minimum Python version.
- Updated Python version requirements in pyproject.toml to 3.10–3.12.
- Modified GitHub Actions workflows to remove Python 3.9, add macOS support, and adjust test matrices.
- Updated the quick start example, documentation, and changelog to reflect the change.
Reviewed Changes
Copilot reviewed 4 out of 11 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| pyproject.toml | Updated Python version requirements and classifiers to 3.10–3.12. |
| examples/quick_start/plot_quick_start.py | Adjusted the documentation text to recommend Python 3.10+ (3.12 recommended). |
| CHANGELOG.md | Added entries for dropping Python 3.9 and other related version updates. |
| .github/workflows/starfish-prod-ci.yml | Replaced Python 3.9 with Python 3.10 across setup steps and expanded OS support. |
Files not reviewed (7)
- README.rst: Language not supported
- docker/Dockerfile: Language not supported
- docs/source/installation/index.rst: Language not supported
- requirements/REQUIREMENTS-CI.txt: Language not supported
- requirements/REQUIREMENTS-JUPYTER.txt: Language not supported
- requirements/REQUIREMENTS-NAPARI-CI.txt: Language not supported
- starfish/REQUIREMENTS-STRICT.txt: Language not supported
adding single quotes to python-version in starfish-prod-ci.yml
|
The security issue with Dask has been removed in the Github Security section, so no need to drop Python 3.9 yet. Regarding the test failure on MacOS with new Apple silicon (M1+), it is probably due to slight differences in floating-point arithmetic between different hardware architectures. This could be mitigated by adding a small tolerance when comparing image registration results: Another possible mitigation is changing float32 to float64 as mentioned in: https://stackoverflow.com/questions/71441137/np-float32-floating-point-differences-between-intel-macbook-and-m1 |
We have kept support for Python 3.9 beyond its recommended life span although it was dropped by the scientific community in April 2024 (https://numpy.org/neps/nep-0029-deprecation_policy.html).
A critical vulnerability in Dask <= 2024.8.2 forces us to drop Python 3.9 as Dask dropped support for Python 3.9 in version 2024.8.1.
After this change we will still have at least 3 working versions of Python (3.10-12).
Subtasks: