Update all non-major dependencies by renovate[bot] · Pull Request #1110 · pixee/codemodder-python

renovate · 2025-12-05T21:11:47Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
flask-wtf (changelog)	`~=1.2.0` → `~=1.3.0`
jsonschema (changelog)	`~=4.25.0` → `~=4.26.0`
libcst (changelog)	`>=1.8,<1.9` → `>=1.9,<1.10`
lxml (source, changelog)	`>=6.0.0,<6.1.0` → `>=6.1.1,<6.2.0`
numpy (changelog)	`~= 2.3.0` → `~=2.5.1`
pyjwt	`~=2.10.0` → `~=2.13.0`
python-json-logger	`~=4.0.0` → `~=4.1.0`
requests (changelog)	`~=2.32.1` → `~=2.34.2`
semgrep (changelog)	`>=1.144,<1.145` → `>=1.172,<1.173`
tomlkit	`~=0.13.0` → `~=0.15.1`
types-defusedxml (changelog)	`==0.7.0.20250822` → `==0.7.0.20260504`
types-wtforms (changelog)	`==3.2.1.20250809` → `==3.2.1.20260518`

Release Notes

python-jsonschema/jsonschema (jsonschema)

`v4.26.0`

Compare Source

=======

Decrease import time by delaying importing of urllib.request (#1416).

Instagram/LibCST (libcst)

`v1.9.0`

Compare Source

Added

Add support for Python 3.15 by @AlexWaygood and @thatch in #1454 and #1456
Add CodemodCommand helpers for adding and removing imports by @frvnkliu in #1432

Fixed

Recognize Python 3.14 parser configurations by @bowiechen in #1452
Allow a trailing comma after **rest in class patterns by @itamaro in #1438

Updated

Document the new CodemodCommand import helpers by @frvnkliu in #1437
Fix the tokenize function's docstring grammar by @galenseilis in #1434
Remove the retired macOS 13 runner from CI by @drinkmorewaterr in #1433

New Contributors

@AlexWaygood made their first contribution in #1454
@bowiechen made their first contribution in #1452
@galenseilis made their first contribution in #1434

Full Changelog: Instagram/LibCST@v1.8.6...v1.9.0

lxml/lxml (lxml)

`v6.1.1`

Compare Source

==================

Bugs fixed

The known link attributes in lxml.html.defs.link_attrs were missing xlink:href,
which can be used for URL bypass attacks in embedded SVG/MathML/etc. content.
GHSA-4jhm-jv67-739f
The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.
The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.

`v6.1.0`

Compare Source

==================

This release fixes a possible external entity injection (XXE) vulnerability in
iterparse() and the ETCompatXMLParser.

Features added

GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes
in lxml.html.defs. This allows lxml_html_clean to pass them through.
Patch by oomsveta.
The default chunk size for reading from file-likes in iterparse() is now configurable
with a new chunk_size argument.

Bugs fixed

LP#2146291: The resolve_entities option was still set to True for
iterparse and ETCompatXMLParser, allowing for external entity injection (XXE)
when using these parsers without setting this option explicitly.
The default was now changed to 'internal' only (as for the normal XML and HTML parsers
since lxml 5.0).
Issue found by Sihao Qiu as CVE-2026-41066.

numpy/numpy (numpy)

`v2.5.1`

Compare Source

`v2.5.0`: (June 21, 2026)

Compare Source

NumPy 2.5.0 Release Notes

Numpy 2.5.0 is a transitional release. It drops support for Python 3.11,
marking the end of distutils, and expires a large number of deprecations made
in the 2.0.x release. It also improves free threading and brings sorting into
compliance with the array-api standard with the addition of descending sorts.
There is also a fair amount of preparation for Python 3.15, which will be
supported starting with the first rc.

This release supports Python versions 3.12-3.14.

Highlights

Distutils has been removed,
Many expired deprecations, see below,
Many new deprecations, see below,
Many static typing improvements.
Improved support for free threading,
Support for descending sorts,

See New Features below for other additions.

Deprecations

numpy.char.chararray is deprecated. Use an ndarray with a string or bytes dtype instead.

(gh-30605)
numpy.take now correctly checks if the result can be cast to the provided
out=out under the same-kind rule. A DeprecationWarning is given now
when this check fails. Previously, take incorrectly checked if out
could be cast to the result (the wrong direction). This deprecation also
affects compress and possibly other functions. (Future versions of NumPy
may tighten the casting check further.)

(gh-30615)
The numpy.char.[as]array functions are deprecated. Use an
numpy.[as]array with a string or bytes dtype instead.

(gh-30802)
Setting the dtype attribute is deprecated because mutating an array is unsafe
if an array is shared, especially by multiple threads. As an alternative,
you can create a view with a new dtype via array.view(dtype=new_dtype).

(gh-29244)
Setting the shape attribute is deprecated because mutating an array is
unsafe if an array is shared, especially by multiple threads. As an
alternative, you can create a new view via np.reshape or
np.ndarray.reshape. For example: x = np.arange(15); x = np.reshape(x, (3, 5)).
To ensure no copy is made from the data, one can use np.reshape(..., copy=False).

While setting the shape on an array is discouraged, for cases where it is
difficult to work around, e.g., in __array_finalize__, it is possible
with the private method np.ndarray._set_shape.

(gh-29536)
Using the generic unit in numpy.timedelta64 is deprecated since this
can lead to unexpected behavior such as non-transitive comparison, see
gh-28287 for details. As
an alternative, specify an explicit unit such as 's' (seconds) or 'D'
(days) when constructing numpy.timedelta64. Due to this change, operations
that implicitly rely on the generic unit are also deprecated. For
example:
```
arr = np.array([1, 2, 3], dtype="m8[s]")
```

`1` is implicitly converted to generic timedelta64

  arr + 1

(gh-29619)

Resizing a Numpy array in place is deprecated since mutating an array is
unsafe if an array is shared, especially by multiple threads. As an
alternative, you can create a resized array via np.resize.

(gh-30181)
numpy.fix is deprecated, use numpy.trunc instead. It is faster and
follows the Array API standard. Both functions provide identical
functionality: rounding array elements towards zero.

(gh-30644)
numpy.ma.round_ is deprecated. numpy.ma.round can be used as a
replacement.

(gh-30738)
numpy.typename is deprecated because the names returned by it were
outdated and inconsistent. numpy.dtype.name can be used as a
replacement.

(gh-30774)
Inputs other than integers are deprecated for numpy.triu_indices and
numpy.tril_indices. Non-integer values for the M, k and N
parameters of numpy.tri are deprecated. Non-integer values for the k
parameter of both numpy.tril_indices_from and numpy.triu_indices_from
are deprecated.

(gh-30869)
Deprecations in custom dtype property and __array_finalize__.

Previously arr.view(dtype=new_dtype) called arr.dtype = new_dtype
also for subclasses, i.e., the attribute setting. That path is now
deprecated and refined, meaning that even subclasses that do not see this
DeprecationWarning may wish to update their code.

A subclass that does any dtype specific logic (i.e. verifying the dtype
in __array_finalize__ or has a dtype property) should now:
- Set _set_dtype = None in which case arr.view(dtype=new_dtype)
  will call __array_finalize__ with the new dtype, ensuring that
  any validation __array_finalize__ will run is done.
- Or, for a quick fix, define _set_dtype as a function (calling
  ndarray._set_dtype() to avoid DeprecationWarnings.
  (Future versions might migrate towards the _set_dtype = None path.)
Ideally, follow NumPy's deprecation to prevent dtype mutation by users.
The use of ndarray._set_dtype() may be necessary for some subclass
finalization patterns, but should otherwise be avoided.

(gh-31293)

Expired deprecations

numpy.distutils has been removed

(gh-30340)
Passing None as dtype to np.finfo will now raise a TypeError
(deprecated since 1.25)

(gh-30460)
numpy.cross no longer supports 2-dimensional vectors.
(Deprecated since 2.0)

(gh-30461)
numpy._core.numerictypes.maximum_sctype has been removed.
(deprecated since 2.0)

(gh-30462)
numpy.row_stack has been removed in favor of numpy.vstack.
(deprecated since 2.0)

(gh-30463)
get_array_wrap has been removed.
(deprecated since 2.0)

(gh-30463)
recfromtxt and recfromcsv have been removed from numpy.lib._npyio
in favor of numpy.genfromtxt.
(deprecated since 2.0)

(gh-30467)
The numpy.chararray re-export of numpy.char.chararray has been removed.
(deprecated since 2.0)

(gh-30604)
bincount now raises a TypeError for non-integer inputs.
(deprecated since 2.1)

(gh-30610)
The numpy.lib.math alias for the standard library math module has
been removed.
(deprecated since 1.25)

(gh-30612)
Data type alias 'a' was removed in favor of 'S'.
(deprecated since 2.0)

(gh-30613)
_add_newdoc_ufunc(ufunc, newdoc) has been removed in favor of
ufunc.__doc__ = newdoc.
(deprecated since 2.2)

(gh-30614)

Compatibility notes

`linalg.eig` and `linalg.eigvals` now always return complex arrays

Previously, the return values depended on whether the eigenvalues happen to lie
on the real line (which, for a general, non-symmetric matrix, is not
guaranteed).

This change makes consistent what was a value-dependent result. To retain the
previous behavior, do:

w = eigvals(a)
if np.any(w.imag == 0):  # this is what NumPy used to do
    w = w.real

If your matrix is symmetrix/hermitian, use eigh and eigvalsh instead of
eig and eigvals. These are guaranteed to return real values. A common
case is covariance matrices, which are symmetric and positive definite by
construction.

(gh-30411)

MSVC support

NumPy now requires minimum MSVC 19.35 toolchain version on Windows platforms.
This corresponds to Visual Studio 2022 version 17.5 Preview 2 or newer.

(gh-30489)

Cython support

NumPy's Cython headers (accessed via cimport numpy) now require Cython 3.0
or newer to build. If you try to compile a project that depends on NumPy's
Cython headers using Cython 0.29 or older, you will see a message like this:

Error compiling Cython file:
------------------------------------------------------------
...

versions.

See init.cython-30.pxd for the real Cython header


#

DEF err = int('Build aborted: the NumPy Cython headers require Cython 3.0.0 or newer.')
  ------------------------------------------------------------

  /path/to/site-packages/numpy/__init__.pxd:11:13: Error in compile-time expression:
  ValueError: invalid literal for int() with base 10: 
  'Build aborted: the NumPy Cython headers require Cython 3.0.0 or newer.'

Note that the invalid integer is not a bug in NumPy - we are intentionally
generating this error to avoid triggering a more obscure error later in the
build when an older Cython version tries to use a Cython feature that was not
available in the old Cython version.

(gh-30770)

`numpy.where` no longer truncates Python integers

Previously, if the x or y argument of numpy.where was a Python
integer that was out of range of the output type, it would be silently
truncated. Now, an OverflowError will be raised instead.

This change also applies to the underlying C API function PyArray_Where.

(gh-30803)

Default memory allocator change

NumPy now uses PyMem_RawMalloc and PyMem_RawFree as the default memory
allocator, instead of system's malloc and free directly.

(gh-30846)

`from_dlpack` raises `BufferError` instead of `RuntimeError`

np.from_dlpack now raises BufferError instead of RuntimeError when
the incoming DLPack tensor has an unsupported device, dtype, or exceeds the
maximum number of dimensions. This aligns with the DLPack and Array API
specifications, which recommend BufferError for data that cannot be
imported.

(gh-30937)

Corrections to the BTPE binomial sampler

Two independent errors in the Stirling series of the acceptance/rejection step
of the BTPE algorithm used by numpy.random.Generator.binomial have been
corrected:

The third and fourth error terms were added rather than subtracted. This sign
error was inherited from section 5.3 of the original 1988 paper by
Kachitvichyanukul & Schmeiser, which incorrectly adds all four terms.
The leading coefficient had a digit-swap typo (13680 instead of
13860) that was introduced in the initial implementation.

As a result, Generator.binomial and Generator.multinomial, which uses
binomial internally, may now return different samples for the same seed.

The legacy numpy.random.RandomState.binomial and
numpy.random.RandomState.multinomial are not affected: they preserve the
original (incorrect) behavior, so existing streams remain reproducible.

(gh-31238)

`datetime64`/`timedelta64` arithmetic raises on overflow

Addition, subtraction, and integer multiplication of datetime64 and
timedelta64 values now raise OverflowError when the result would
overflow int64 or land on the NaT sentinel value. Previously these
operations silently wrapped, often producing a value that was indistinguishable
from NaT. This matches the overflow checking already performed by
unit-conversion casts.

(gh-31378)

C API changes

It is now possible to register "real" and "imag" ArrayMethods via
PyUFunc_AddLoopsFromSpecs. These will be used for imag and real
and should normally set *view_offset in their resolve_descriptors
function to allow the array attributes to return views.

(gh-30984)
New PyDataType_TYPE, PyDataType_KIND, PyDataType_BYTEORDER and
PyDataType_TYPEOBJ accessor macros to the C API. Together with the other
accessor macros added for the NumPy 2.0 transition, these allow accessing the
fields of PyArray_Descr structs without any direct field accesses.

(gh-30994)
NumPy now supports the stable ABI for free-threaded Python as described in
803{.interpreted-text role="pep"}.

(gh-31091)
PyArray_DescrFromScalar now returns the full dtype descriptor for scalars
of user-defined parametric data types, including any dtype parameters.
Parameters were previously silently discarded, which could cause incorrect
results in operations like astype on scalar objects. Internally, the
function now delegates to discover_descr_from_pyobject, which handles
parametric dtypes correctly.

(gh-31067)

New Features

It is now possible to register user-dtypes for dlpack export and import
via numpy.dtypes.register_dlpack_dtype. This functionality is meant to
be used with care by user-dtype authors.

(gh-31256)

Pixi package definitions

Pixi package definitions have been added for different kinds
of from-source builds of NumPy. These can be used in
downstream Pixi workspaces via the pixi-build feature.

Definitions for both default and AddressSanitizer-instrumented
(asan) builds are available in the source code under the
pixi-packages/ directory.

linux-64 and osx-arm64 platforms are supported.

(gh-30381)

`numpy.ndarray` now supports structural pattern matching

numpy.ndarray and its subclasses now have the Py_TPFLAGS_SEQUENCE flag
set, enabling structural pattern matching (PEP 634) with match/case
statements. This also enables Cython to optimize integer indexing operations.
See `arrays.ndarray.pattern-matching{.interpreted-text role="ref"}` for details.

(gh-30653)

Added N-D evaluation functions to the polynomial package

New functions polyvalnd, chebvalnd, legvalnd, hermvalnd,
hermevalnd, and lagvalnd have been added to evaluate polynomials
in arbitrary dimensions, analogous to the existing 2D and 3D evaluators.

(gh-30857)

New "descending" keyword argument for `numpy.sort` and `numpy.argsort`

Users can now pass the descending=True keyword argument to numpy.sort
and numpy.argsort to sort and argsort arrays in descending order. NaN
values, if present, are sorted to the end of the array in both ascending and
descending sorts. This feature is available for all built-in dtypes except
void, object, and generic. Note that SIMD optimizations for sorting
are currently not available for descending sorts, so performance may be slower.

(gh-31345)

Improvements

For f2py, the behaviour of intent(inplace) has improved. Previously,
if an input array did not have the right dtype or order, the input array was
modified in-place, changing its dtype and replacing its data by a corrected
copy. Now, instead, the corrected copy is kept a separate array, which, after
being passed and presumably modified by the fortran routine, is copied back to
the input routine. The above means one no longer has the risk that
pre-existing views or slices of the input array start pointing to unallocated
memory (at the price of increased overhead for the write-back copy at the end
of the call).

A potential problem would be that one might get very different results if one,
e.g., previously passed in an integer array where a double array was expected:
the writeback to integer would likely give wrong results. To avoid such
situations, intent(inplace) will now only allow arrays that have equivalent
type to that used in the fortran routine, i.e., dtype.kind is the same. For
instance, a routine expecting double would be able to receive float, but would
raise on integer input.

(gh-29929)

`f2py` modules now show allocatable arrays in `dir()`

Allocatable module variables wrapped by f2py now appear in dir()
output, matching their accessibility by name.

(gh-30965)

`StringDType` comparisons now correctly handle embedded NULL bytes.

(gh-31662)

Performance improvements and changes

Improved performance of `numpy.searchsorted`

The C++ binary search implementation used by numpy.searchsorted now has a
much better performance when searching for multiple keys. The new
implementation batches binary search steps across all keys to leverage cache
locality and out-of-order execution. Benchmarks show the new implementation can
be up to 20 times faster for hundreds of thousands keys while single-key
performance remains comparable to previous versions.

(gh-30517)

Improved scaling of ufuncs on free-threading

NumPy's ufuncs now scale significantly better on free-threading builds
of CPython due to the following optimizations:

Lock-free dispatch table: The ufuncs dispatch table is now implemented as
a lock-free concurrent hash map, allowing multiple threads to call ufuncs
without contention.
Immortal shared objects: Certain shared objects, such as global memory
handlers, have been made immortal. This effectively reduces reference
counting contention across threads.
Optimized memory allocation: NumPy now utilizes PyMem_RawMalloc and
PyMem_RawFree for memory allocation. On Python 3.15 and newer, this
leverages mimalloc and significantly reduces memory allocation overhead
in multi-threaded workloads.

(gh-30846)

Faster reductions on small/medium contiguous arrays

numpy.sum, numpy.prod, numpy.any, numpy.all, and other
reductions with an identity value now use a fast path when the input is a
contiguous, aligned, non-object array and the reduction covers all axes
(axis=None) with no special arguments. Typical speedup is ~1.3x on small
arrays; numpy.any / numpy.all on contiguous boolean arrays can see
speedup up to 1.9x.

(gh-31274)

Typing improvements and changes

`numpy.linalg` typing improvements and preliminary shape-typing support

Input and output dtypes for numpy.linalg functions are now more precise.
Several of these functions also gain preliminary shape-typing support while
remaining backward compatible. For example, the return type of
numpy.linalg.matmul now depends on the shape-type of its inputs, or fall
back to the backward-compatible return type if the shape-types are unknown at
type-checking time. Because of limitations in Python's type system and current
type-checkers, shape-typing cannot cover every situation and is often only
implemented for the most common lower-rank cases.

(gh-30480)

`numpy.ma` typing annotations

The numpy.ma module is now fully covered by typing annotations. This
includes annotations for masked arrays, masks, and various functions and
methods. With this, NumPy has achieved 100% typing coverage across all its
submodules.

(gh-30566)

Shape-typing support for many functions and methods

Many functions and methods now have shape-aware return type annotations.
Type-checkers can now infer the number of dimensions of the returned array
through common operations. For example, np.linspace(0, 1) is now typed as a
1-d float64 array, and np.sum(x, keepdims=True) has the same number of
dimensions as x.

This covers numpy.linalg functions, array creation functions (like
asarray, from{buffer,string,file,iter,regex}), range functions
(linspace, logspace, geomspace), aggregation functions and methods
(sum, mean, std, var, min, max, all, any,
etc.), sorting (sort, argsort, argpartition), cumulative operations
(cumsum, cumprod, etc.), set operations (unique_values,
intersect1d, union1d, etc.), and various other functions including
nonzero, transpose, diagonal, atleast_{1,2,3}d, clip,
round, inner, bincount, and fft.fftfreq. Several of these also
gained more precise return dtype annotations as part of this work.

Shape-typing is still a work-in-progress, so coverage is not yet complete.
Because of limitations in Python's type system and current type-checkers,
shape-typing is often only implemented for the most common lower-rank cases.

(gh-31172)

`numpy.fft` typing improvements and preliminary shape-typing support

The numpy.fft functions now support non-float64/complex128 dtypes
and gain preliminary shape-typing support. For example, the return type of
numpy.fft.fft now depends on the shape-type of its inputs, falling back to
the backward-compatible return type when the shape-types are unknown at
type-checking time.

(gh-31226)

Changes

Structured array copies now use `memcpy` for contiguous dtypes

Copying structured arrays with identical dtypes now uses memcpy instead of
field-by-field transfer when the dtype has a contiguous layout (no gaps between
fields). A new NPY_NOT_TRIVIALLY_COPYABLE dtype flag is set on structured
dtypes that have gaps in their memory layout, such as those created with
explicit offsets or via multi-field indexing. Only these dtypes continue to
use the slower field-by-field copy.

This means that padding bytes in contiguous structured dtypes (e.g. those
created without explicit offsets) may now be copied as part of the
memcpy, whereas previously they were left untouched. Code that relies on
padding bytes being preserved during structured array copies may be affected.

(gh-29270)

`numpy.ctypeslib.as_ctypes` now does not support scalar types

The function numpy.ctypeslib.as_ctypes has been updated to only accept
numpy.ndarray. Passing a scalar type (e.g., numpy.int32(5)) will now
raise a TypeError. This change was made to avoid the issue
gh-30354 and to enforce the
readonly nature of scalar types in NumPy. The previous behavior relied on
undocumented implicit temporary arrays and was not well-defined. Users who
need to convert scalar types to ctypes should first convert them to an array
(e.g., numpy.asarray) before passing them to numpy.ctypeslib.as_ctypes.

(gh-30538)

`__array_interface__` changes on scalars

Scalars now export the __array_interface__ directly rather than including
an array copy as a __ref entry. This means that scalars are now exported as
read-only while they previously exported as writeable. The path via __ref
was undocumented and not consistently used even within NumPy itself.

(gh-30538)

`meshgrid` now always returns a tuple

np.meshgrid previously used to return a list when sparse was true and
copy was false. Now, it always returns a tuple regardless of the
arguments.

(gh-30707)

`numpy.triu_indices` now accepts `unsigned integers`

numpy.triu_indices previously used to error in some cases when unsigned integers
were given as arguments. Now, it accepts them in all cases.

(gh-30869)

`object` dtype in `.real` and `.imag` and related functions

The array attributes .real and .imag now behave differently for object
arrays and return getattr(element, "real", element) or getattr(element, "imag", 0)
elementwise. Additionally, the return for both is now read-only to avoid possible
in-place changes having no effect.

This change also affects np.isreal() which uses arr.imag.

Previously, .imag always returned 0 while .real returned the
original array unmodified. The new behavior now returnes the correct values
for complex Python objects but may also lead to surprises for example if
element.real() is a method and not a property.

(gh-30984)

NumPy's internal memory allocations now use `PyMem_RawMalloc`

NumPy's internal memory allocations now use PyMem_RawMalloc instead of
malloc and can be tracked by tracemalloc.

(gh-31503)

`v2.4.6`

Compare Source

`v2.4.5`: (May 15, 2026)

Compare Source

NumPy 2.4.5 Release Notes

NumPy 2.4.5 is a patch release that fixes bugs discovered after the 2.4.4
release, has some typing improvements, and maintains infrastructure.

This release supports Python versions 3.11-3.14

Contributors

A total of 17 people contributed to this release. People with a "+" by their
names contributed a patch for the first time.

Aleksei Nikiforov
Anarion Zuo +
Ankit Ahlawat
Breno Favaretto +
Charles Harris
Igor Krivenko +
Ijtihed Kilani +
Joren Hammudoglu
Maarten Baert +
Matti Picus
Nathan Goldbaum
Praneeth Kodumagulla +
Ralf Gommers
RoomWithOutRoof +
Sebastian Berg
Warren Weckesser
div +

Pull requests merged

A total of 28 pull requests were merged for this release.

#31093: MAINT: Prepare 2.4.x for further development
#31182: TYP: fix np.shape assignability issue for python lists (#31171)
#31197: ENH: Return rank 0 for empty matrices in matrix_rank (#30422)
#31198: CI/BUG: add native jobs for s390x, fix bug in pack_inner...
#31199: BUG: f2py map complex_long_double to NPY_CLONGDOUBLE
#31205: MAINT: f2py: Stop setting re._MAXCACHE to 50.
#31206: BUG: fix heap buffer overflow in timedelta to string casts
#31207: MAINT: Rename ppc64le and s390x workflow (#31121)
#31208: BUG: Fix matvec/vecmat in-place aliasing (out=input produces...
#31209: TYP: tile: accept numpy scalars and arrays as second argument...
#31211: DEP: Undo deprecation for np.dtype() signature used by old pickles...
#31212: REV: Manual revert of float16 svml use (#31178)
#31222: TYP: ix_ fix for boolean and non-1d input (#31218)
#31329: BUG: incorrect temp elision for new-style (NEP 43) user-defined...
#31330: TYP: fix sliding_window_view axis parameter typing
#31335: BUG: Prevent deadlock due to downstream importing NumPy in dlopen...
#31336: BUG: Fix segfault in nditer.multi_index when __getitem__ raises...
#31338: TYP: Fix ruff lint error
#31357: BUG: fix memory leak in np.zeros when fill-zero loop raises (#31320)
#31358: BUG: np.einsum() fails with a 0-dimensional out argument and...
#31379: BUG: Fix signed overflow issue in npy_gcd for INT_MIN on s390x...
#31383: CI: remove Cirrus CI FreeBSD job (#31380)
#31390: BUILD: newer MKL uses so.3
#31391: BLD/MAINT: improve support for Intel LLVM compilers
#31401: BUG: Avoid UB in safe[add,sub,mul] helpers (#31396)
#31402: BUG: exclude __pycache__ directories from wheels (#31397)
#31404: TYP: _NestedSequence type parameter default to work around...
#31426: TYP: Fix DTypeLike runtime type-checker support (#31425)

`v2.4.4`: 2.4.4 (Mar 29, 2026)

Compare Source

NumPy 2.4.4 Release Notes

The NumPy 2.4.4 is a patch release that fixes bugs discovered after the 2.4.3
release. It should finally close issue #30816, the OpenBLAS threading problem
on ARM.

This release supports Python versions 3.11-3.14

Contributors

A total of 8 people contributed to this release. People with a "+" by their
names contributed a patch for the first time.

Charles Harris
Daniel Haag +
Denis Prokopenko +
Harshith J +
Koki Watanabe
Marten van Kerkwijk
Matti Picus
Nathan Goldbaum

Pull requests merged

A total of 7 pull requests were merged for this release.

#30978: MAINT: Prepare 2.4.x for further development
#31049: BUG: Add test to reproduce problem described in #30816 (#30818)
#31052: BUG: fix FNV-1a 64-bit selection by using NPY_SIZEOF_UINTP (#31035)
#31053: BUG: avoid warning on ufunc with where=True and no output
#31058: DOC: document caveats of ndarray.resize on 3.14 and newer
#31079: TST: fix POWER VSX feature mapping (#30801)
#31084: MAINT: numpy.i: Replace deprecated sprintf with snprintf...

NumPy 2.4.1 Release Notes

The NumPy 2.4.1 is a patch release that fixes bugs discoved after the
2.4.0 release. In particular, the typo SeedlessSequence is preserved to
enable wheels using the random Cython API and built against NumPy < 2.4.0
to run without errors.

This release supports Python versions 3.11-3.14

Contributors

A total of 9 people contributed to this release. People with a "+" by their
names contributed a patch for the first time.

Alexander Shadchin
Bill Tompkins +
Charles Harris
Joren Hammudoglu
Marten van Kerkwijk
Nathan Goldbaum
Raghuveer Devulapalli
Ralf Gommers
Sebastian Berg

Pull requests merged

A total of 15 pull requests were merged for this release.

#30490: MAINT: Prepare 2.4.x for further development
#30503: DOC: numpy.select: fix default parameter docstring...
#30504: REV: Revert part of #30164 (#30500)
#30506: TYP: numpy.select: allow passing array-like default...
#30507: MNT: use if constexpr for compile-time branch selection
#30513: BUG: Fix leak in flat assignment iterator
#30516: BUG: fix heap overflow in fixed-width string multiply (#30511)
#30523: BUG: Ensure summed weights returned by np.average always are...
#30527: TYP: Fix return type of histogram2d
#30594: MAINT: avoid passing ints to random functions that take double...
#30595: BLD: Avoiding conflict with pygit2 for static build
#30596: MAINT: Fix msvccompiler missing error on FreeBSD
#30608: BLD: update vendored Meson to 1.9.2
#30620: ENH: use more fine-grained critical sections in array coercion...
#30623: BUG: Undo result type change of quantile/percentile but keep...

`v2.4.0`: 2.4.0 (Dec 20, 2025)

Compare Source

NumPy 2.4.0 Release Notes

The NumPy 2.4.0 release continues the work to improve free threaded Python
support, user dtypes implementation, and annotations. There are many expired
deprecations and bug fixes as well.

This release supports Python versions 3.11-3.14

Highlights

Apart from annotations and same_value kwarg, the 2.4 highlights are mostly
of interest to downstream developers. They should help in implementing new user
dtypes.

Many annotation improvements. In particular, runtime signature introspection.
New casting kwarg 'same_value' for casting by value.
New PyUFunc_AddLoopsFromSpec function that can be used to add user sort
loops using the ArrayMethod API.
New __numpy_dtype__ protocol.

Deprecations

Setting the `strides` attribute is deprecated

Setting the strides attribute is now deprecated since mutating
an array is unsafe if an array is shared, especially by multiple
threads. As an alternative, you can create a new view (no copy) via:

np.lib.stride_tricks.strided_window_view if applicable,
np.lib.stride_tricks.as_strided for the general case,
or the np.ndarray constructor (buffer is the original array) for a
light-weight version.

(gh-28925)

Positional `out` argument to `np.maximum`, `np.minimum` is deprecated

Passing the output array out positionally to numpy.maximum and
numpy.minimum is deprecated. For example, np.maximum(a, b, c) will emit
a deprecation warning, since c is treated as the output buffer rather than
a third input.

Always pass the output with the keyword form, e.g. np.maximum(a, b, out=c).
This makes intent clear and simplifies type annotations.

(gh-29052)

`align=` must be passed as boolean to `np.dtype()`

When creating a new dtype a VisibleDeprecationWarning will be given if
align= is not a boolean. This is mainly to prevent accidentally passing a
subarray align flag where it has no effect, such as np.dtype("f8", 3)
instead of np.dtype(("f8", 3)). We strongly suggest to always pass
align= as a keyword argument.

(gh-29301)

Assertion and warning control utilities are deprecated

np.testing.assert_warns and np.testing.suppress_warnings are
deprecated. Use warnings.catch_warnings, warnings.filterwarnings,
pytest.warns, or pytest.filterwarnings instead.

(gh-29550)

`np.fix` is pending deprecation

The numpy.fix function will be deprecated in a future release. It is
recommended to use numpy.trunc instead, as it provides the same
functionality of truncating decimal values to their integer parts. Static type
checkers might already report a warning for the use of numpy.fix.

(gh-30168)

in-place modification of `ndarray.shape` is pending deprecation

Setting the ndarray.shape attribute directly will be deprecated in a future
release. Instead of modifying the shape in place, it is recommended to use the
numpy.reshape function. Static type checkers might already report a
warning for assignments to ndarray.shape.

(gh-30282)

Deprecation of `numpy.lib.user_array.container`

The numpy.lib.user_array.container class is deprecated and will be removed
in a future version.

(gh-30284)

Expired deprecations

Removed deprecated `MachAr` runtime discovery mechanism.

(gh-29836)

Raise `TypeError` on attempt to convert array with `ndim > 0` to scalar

Conversion of an array with ndim > 0 to a scalar was deprecated in NumPy
1.25. Now, attempting to do so raises TypeError. Ensure you extract a
single element from your array before performing this operation.

(gh-29841)

Removed numpy.linalg.linalg and numpy.fft.helper

The following were deprecated in NumPy 2.0 and have been moved to private
modules:

numpy.linalg.linalg
Use numpy.linalg instead.
numpy.fft.helper
Use numpy.fft instead.

(gh-29909)

Removed `interpolation` parameter from quantile and percentile functions

The interpolation parameter was deprecated in NumPy 1.22.0 and has been
removed from the following functions:

numpy.percentile
numpy.nanpercentile
numpy.quantile
numpy.nanquantile

Use the method parameter instead.

(gh-29973)

Removed `numpy.in1d`

numpy.in1d has been deprecated since NumPy 2.0 and is now removed in favor of numpy.isin.

(gh-29978)

Removed `numpy.ndindex.ndincr()`

The ndindex.ndincr() method has been deprecated since NumPy 1.20 and is now
removed; use next(ndindex) instead.

(gh-29980)

Removed `fix_imports` parameter from `numpy.save`

The fix_imports parameter was deprecated in NumPy 2.1.0 and is now removed.
This flag has been ignored since NumPy 1.17 and was only needed to support
loading files in Python 2 that were written in Python 3.

(gh-29984)

Removal of four undocumented `ndarray.ctypes` methods

Four undocumented methods of the ndarray.ctypes object have been removed:

_ctypes.get_data() (use _ctypes.data instead)
_ctypes.get_shape() (use _ctypes.shape instead)
_ctypes.get_strides() (use _ctypes.strides instead)
_ctypes.get_as_parameter() (use _ctypes._as_parameter_ instead)

These methods have been deprecated since NumPy 1.21.

(gh-29986)

Removed `newshape` parameter from `numpy.reshape`

The newshape parameter was deprecated in NumPy 2.1.0 and has been
removed from numpy.reshape. Pass it positionally or use shape=
on newer NumPy versions.

(gh-29994)

Removal of deprecated functions and arguments

The following long-deprecated APIs have been removed:

numpy.trapz --- deprecated since NumPy 2.0 (2023-08-18). Use numpy.trapezoid or
scipy.integrate functions instead.
disp function --- deprecated from 2.0 release and no longer functional. Use
your own printing function instead.
bias and ddof arguments in numpy.corrcoef --- these had no effect
since NumPy 1.10.

(gh-29997)

Removed `delimitor` parameter from `numpy.ma.mrecords.fromtextfile()`

The delimitor parameter was deprecated in NumPy 1.22.0 and has been
removed from numpy.ma.mrecords.fromtextfile(). Use delimiter instead.

(gh-30021)

`numpy.array2string` and `numpy.sum` deprecations finalized

The following long-deprecated APIs have been removed or converted to errors:

The style parameter has been removed from numpy.array2string.
This argument had no effect since Numpy 1.14.0. Any arguments following
it, such as formatter have now been made keyword-only.
Calling np.sum(generator) directly on a generator object now raises a
TypeError. This behavior was deprecated in NumPy 1.15.0. Use
np.sum(np.fromiter(generator)) or the python sum builtin instead.

(gh-30068)

Compatibility notes

NumPy's C extension modules have begun to use multi-phase initialisation, as
defined by PEP 489. As part of this, a new explicit check has been added that
each such module is only imported once per Python process. This comes with
the side-effect that deleting numpy from sys.modules and re-importing
it will now fail with an ImportError. This has always been unsafe, with
unexpected side-effects, though did not previously raise an error.

(gh-29030)
numpy.round now always returns a copy. Previously, it returned a view
for integer inputs for decimals >= 0 and a copy in all other cases.
This change brings round in line with ceil, floor and trunc.

(gh-29137)
Type-checkers will no longer accept calls to numpy.arange with
start as a keyword argument. This was done for compatibility with
the Array API standard. At runtime it is still possible to use
numpy.arange with start as a keyword argument.

(gh-30147)
The Macro NPY_ALIGNMENT_REQUIRED has been removed The macro was defined in
the npy_cpu.h file, so might be regarded as semi public. As it turns out,
with modern compilers and hardware it is almost always the case that
alignment is required, so numpy no longer uses the macro. It is unlikely
anyone uses it, but you might want to compile with the -Wundef flag or
equivalent to be sure.

(gh-29094)

C API changes

The NPY_SORTKIND enum has been enhanced with new variables

This is of interest if you are using PyArray_Sort or PyArray_ArgSort.
We have changed the semantics of the old names in the NPY_SORTKIND enum and
added new ones. The changes are backward compatible, and no recompilation is
needed. The new names of interest are:

NPY_SORT_DEFAULT -- default sort (same value as NPY_QUICKSORT)
NPY_SORT_STABLE -- the sort must be stable (same value as NPY_MERGESORT)
NPY_SORT_DESCENDING -- the sort must be descending

The semantic change is that NPY_HEAPSORT is mapped to NPY_QUICKSORT when used.
Note that NPY_SORT_DESCENDING is not yet implemented.

(gh-29642)

New `NPY_DT_get_constant` slot for DType constant retrieval

A new slot NPY_DT_get_constant has been added to the DType API, allowing
dtype implementations to provide constant values such as machine limits and
special values. The slot function has the signature:

int get_constant(PyArray_Descr *descr, int constant_id, void *ptr)

It returns 1 on success, 0 if the constant is not available, or -1 on error.
The function is always called with the GIL held and may write to unaligned memory.

Integer constants (marked with the 1 << 16 bit) return npy_intp values,
while floating-point constants return values of the dtype's native type.

Implementing this can be used by use

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

sonarqubecloud · 2026-05-10T21:08:09Z