Skip to content

Conversation

@shachafl
Copy link
Collaborator

@shachafl shachafl commented Mar 27, 2025

We have kept support for Python 3.9 beyond its recommended life span although it was dropped by the scientific community in April 2024 (https://numpy.org/neps/nep-0029-deprecation_policy.html).
A critical vulnerability in Dask <= 2024.8.2 forces us to drop Python 3.9 as Dask dropped support for Python 3.9 in version 2024.8.1.
After this change we will still have at least 3 working versions of Python (3.10-12).

Subtasks:

  1. Remove python 3.9 in automatic GitHub Actions tests (.github/workflows/starfish-prod-ci.yml)
  2. Update 4 requirements files
  3. Bump python version to 3.10 in docker/Dockerfile
  4. Update docs (README.rst & docs/source/installation/index.rst)
  5. Update comments in examples/quick_start/plot_quick_start.py
  6. Remove Python 3.9 in packaging files (pyproject.toml)
  7. Make a new release by bumping minor (update CHANGELOG.md)

@shachafl shachafl added this to the Drop support for Python 3.9 milestone Mar 27, 2025
@shachafl shachafl requested review from berl and Copilot March 27, 2025 18:05
@shachafl shachafl self-assigned this Mar 27, 2025
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR drops support for Python 3.9 due to a critical security issue with the Dask dependency and updates various configurations and documentation to reflect the new minimum Python version.

  • Updated Python version requirements in pyproject.toml to 3.10–3.12.
  • Modified GitHub Actions workflows to remove Python 3.9, add macOS support, and adjust test matrices.
  • Updated the quick start example, documentation, and changelog to reflect the change.

Reviewed Changes

Copilot reviewed 4 out of 11 changed files in this pull request and generated no comments.

File Description
pyproject.toml Updated Python version requirements and classifiers to 3.10–3.12.
examples/quick_start/plot_quick_start.py Adjusted the documentation text to recommend Python 3.10+ (3.12 recommended).
CHANGELOG.md Added entries for dropping Python 3.9 and other related version updates.
.github/workflows/starfish-prod-ci.yml Replaced Python 3.9 with Python 3.10 across setup steps and expanded OS support.
Files not reviewed (7)
  • README.rst: Language not supported
  • docker/Dockerfile: Language not supported
  • docs/source/installation/index.rst: Language not supported
  • requirements/REQUIREMENTS-CI.txt: Language not supported
  • requirements/REQUIREMENTS-JUPYTER.txt: Language not supported
  • requirements/REQUIREMENTS-NAPARI-CI.txt: Language not supported
  • starfish/REQUIREMENTS-STRICT.txt: Language not supported

@shachafl
Copy link
Collaborator Author

shachafl commented Mar 30, 2025

The security issue with Dask has been removed in the Github Security section, so no need to drop Python 3.9 yet.

Regarding the test failure on MacOS with new Apple silicon (M1+), it is probably due to slight differences in floating-point arithmetic between different hardware architectures. This could be mitigated by adding a small tolerance when comparing image registration results:

# Adding a tolerance
tolerance = 1e-4

assert np.allclose(
    expected_registered_values,
    registered_image.xarray[2, 2, 0, 40:50, 40:50],
    atol=tolerance
)

Another possible mitigation is changing float32 to float64 as mentioned in: https://stackoverflow.com/questions/71441137/np-float32-floating-point-differences-between-intel-macbook-and-m1
But I haven't tried it, and in any case, it will burden memory usage so might be less desirable.
Also, could be related to numpy update from 1.22.4 to 1.24.4 (less likely) or to 1.26.4 (not sure if tested on M1 the last update).

@shachafl shachafl changed the title Drop Python 3.9 support due to critical security issue with Dask dependency Drop Python 3.9 support due to critical security issue with a dependency May 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants