chore(deps): drop Python 3.9 + numpy 1.x (fixes GHSA-6w46-j5rx-g56g) - #62
Merged
Merged
Conversation
pytest's fix for CVE-2025-71176 (GHSA-6w46-j5rx-g56g, vulnerable tmpdir handling) requires Python >=3.10, and Python 3.9 reached end-of-life in October 2025. Raise the ordvec-python floor to Python 3.10 and numpy 2.0 (abi3-py310), regenerate the hash-pinned requirements at 3.10 (pytest 9.0.3 throughout), move the CI floor leg 3.9 to 3.10, and drop the Dependabot numpy-floor ignore so numpy is managed normally. 3.9 runtime support is dropped (requires-python>=3.10); no users affected (PyPI publish is held). Core Rust crate unaffected. Signed-off-by: Nelson Spence <nelson@projectnavi.ai>
Nelson Spence (Fieldnote-Echo)
requested a review
from Navi Bot (project-navi-bot)
as a code owner
May 25, 2026 21:07
Copilot started reviewing on behalf of
Nelson Spence (Fieldnote-Echo)
May 25, 2026 21:07
View session
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request raises the minimum supported Python version for the ordvec-python bindings to Python 3.10 and the minimum numpy version to 2.0. It updates the PyO3 configuration to target abi3-py310, cleans up Dependabot configurations, and updates development dependencies (including upgrading pytest to 9.0.3 to address CVE-2025-71176). There are no review comments, so no additional feedback is provided.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
There was a problem hiding this comment.
Pull request overview
Updates the ordvec-python binding package’s supported runtime/toolchain floor to remediate the referenced pytest tmpdir vulnerability by moving to a patched pytest release line (which requires dropping Python 3.9), and aligns declared numpy support with what CI/tooling actually targets.
Changes:
- Raised Python floor to
>=3.10and updated wheel ABI target fromabi3-py39→abi3-py310. - Raised the Python binding’s runtime dependency floor to
numpy>=2.0and regenerated hash-pinned dev/test requirements (pytest 9.0.3). - Updated CI/release workflows, Dependabot config, and docs/changelog to reflect the new support policy.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
ordvec-python/requirements-dev.txt |
Regenerated universal, hash-pinned dev/test dependency lock for Python 3.10+ (pytest 9.0.3, numpy 2.x). |
ordvec-python/README.md |
Updated stated wheel support to CPython 3.10+ (abi3). |
ordvec-python/pyproject.toml |
Dropped Python 3.9 support and raised runtime numpy floor to >=2.0. |
ordvec-python/Cargo.toml |
Switched PyO3 ABI3 feature from abi3-py39 to abi3-py310. |
CHANGELOG.md |
Documented the Python floor changes and the security remediation. |
.github/workflows/release-python.yml |
Updated release workflow comments/labels to reflect abi3-py310 / CPython 3.10+. |
.github/workflows/python.yml |
Updated CI matrix floor leg from Python 3.9 to 3.10 and clarified abi3 coverage. |
.github/dependabot.yml |
Removed the numpy-floor ignore so Dependabot manages numpy normally. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Nelson Spence (Fieldnote-Echo)
force-pushed
the
chore/drop-py39-numpy1
branch
from
May 25, 2026 21:18
604a71c to
e9d2fc0
Compare
project-navi-bot
approved these changes
May 25, 2026
Nelson Spence (Fieldnote-Echo)
requested a review
from Navi Bot (project-navi-bot)
May 25, 2026 21:20
project-navi-bot
previously approved these changes
May 25, 2026
…comment Re-applies the two Copilot Autofix review suggestions as a signed-off commit (the GitHub-UI originals lacked a DCO sign-off). numpy floor matches the CI-tested minor (2.2.6) without patch-pinning; the requirements-dev.txt header now shows the full pip --require-hashes install command. Signed-off-by: Nelson Spence <nelson@projectnavi.ai>
Nelson Spence (Fieldnote-Echo)
force-pushed
the
chore/drop-py39-numpy1
branch
from
May 25, 2026 21:26
e9d2fc0 to
b2e94d2
Compare
Navi Bot (project-navi-bot)
self-requested a review
May 25, 2026 21:26
project-navi-bot
approved these changes
May 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Remediates GHSA-6w46-j5rx-g56g / CVE-2025-71176 (pytest vulnerable tmpdir handling) by raising the
ordvec-pythonfloor to Python 3.10 and numpy 2.0, and removes the Dependabot numpy-floorignore.Why this shape (not a plain pytest bump)
pytest's fix (9.0.3) dropped Python 3.9, so there is no patched pytest for 3.9 — 8.4.2 was the newest that ran there. Combined with Python 3.9 being EOL since October 2025, the honest fix is to stop claiming/testing 3.9 rather than ship a wheel for a version we can no longer test with a patched toolchain.
Two related honesty cleanups rode along:
numpy>=1.20but only ever tested numpy 2.x (the 3.9 leg tested numpy 2.0.2, never 1.x) — an unverified claim. Floor raised tonumpy>=2.0to match what's actually exercised.ignorethat pinned the old numpy floor is removed, so numpy is now managed normally.Changes
pyproject.toml:requires-python = ">=3.10", drop the 3.9 classifier,numpy>=2.0.Cargo.toml: pyo3abi3-py39→abi3-py310.requirements-dev.txt: regenerated at--python-version 3.10→ pytest 9.0.3 throughout, numpy 2.x, no<3.10closure.python.yml: CI floor leg3.9→3.10.release-python.yml: abi3 wheel comments →abi3-py310/ CPython 3.10+.dependabot.yml: drop the numpy-floorignore.README.md,CHANGELOG.md: updated.Notes
requires-python>=3.10); no users affected — PyPI publish is held, so there are none yet.abi3-py310(--locked),cargo fmt+clippy -D warningsclean. Full maturin + pytest runs in CI on the new 3.10 matrix.numpy>=2.0, but the lowest version the matrix actually exercises is2.2.6(the py3.10 universal resolve). Say the word and I'll add a dedicatednumpy==2.0.*floor leg so the literal 2.0 floor is pinned in CI.