aglinxinyuan commented on PR #6231: URL: https://github.com/apache/texera/pull/6231#issuecomment-4922710470
Closing this — bumping to 2.2.6 (or now up to 2.4.6, since #6270 dropped Python 3.10 and moved the floor to 3.11) fixes no CVE: every numpy advisory on record is 1.x-era, the most recent patched in 1.22, and nothing affects numpy 2.x. So this is a non-urgent version bump on a dtype-sensitive library. Per the discussion here, we’ll handle numpy case by case — CVEs take priority, and when one does land we’ll take the lowest fixed version that fits our Python floor (currently ≤2.4.6), preferring a backported patch release over a minor/major jump. No reason to move numpy for its own sake right now. Thanks @Yicong-Huang! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
