Talip7/scikit-learn-issues-multilabel huggingface dataset:
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
To clarify the reasoning behind applying NEP 29 strictly:

> When a project releases a new major or minor version, we recommend that they support at least all minor versions of Python introduced and released in the prior 42 months from the anticipated release date with a minimum of 2 minor versions of Python, and all minor versions of NumPy released in the prior 24 months from the anticipated release date with a minimum of 3 minor versions of NumPy.

If we release in 2022-11, 24 months prior is 2020-11.

Here are the main runtime dependencies projects history:

- https://pypi.org/project/numpy/#history
- https://pypi.org/project/scipy/#history

So that would indeed mean Python 3.8, numpy 1.19 and scipy 1.5.

We can be a bit more conservative and support numpy 1.18 and scipy 1.4. I assume it wouldn't add too much maintenance overhead.

I think we should align the other dependencies to their latest release around mid 2020 (or late 2019 if we want to be on the conservative side).

Maybe @lorentzenchr had more specific needs in mind w.r.t. the scipy version but I cannot find the discussions.

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
I plan to bump min dependencies as follow:
```
python 3.8 -> 3.8          # do not bump <- NEP 29
numpy 1.17.3 -> 1.17.3     # oldest_supported_numpy, might change by november : to follow up
scipy 1.3.2 -> 1.4.1       # for https://github.com/scikit-learn/scikit-learn/issues/23699
joblib = 1.0.0 -> 1.0.1    # latest minor release for this major release
pytest 5.0.1 -> 5.3.1      # 3 years old
matplotlib 3.1.2 -> 3.1.3  # latest minor release for this major release
```

As discussed irl with @ogrisel, the plan for dependencies that are not python/numpy/scipy is to support up to 3 years old major versions, but keeping the latest minor version for them.

@scikit-learn/core-devs are you ok with this plan ? Do you need leter versions for some of these packages to be able to use more recent features ?

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
> are you ok with this plan ? Do you need leter versions for some of these packages to be able to use more recent features ?

I cannot think of something that is blocker except the release of Cython 3.

On a side-note (you probably already have seen): [SPEC 0](https://scientific-python.org/specs/spec-0000/) aims at specifying minimum supported versions in the ecosystem. There is [a thread in Scientific Python's forum](https://discuss.scientific-python.org/t/spec-0-minimum-supported-versions/33) to discuss this SPEC.

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
I'm okay with the proposed version bumps in https://github.com/scikit-learn/scikit-learn/issues/24401#issuecomment-1253914428.

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
Works for me. Thanks!!

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
For joblib, we are getting a security alert: https://github.com/scikit-learn/scikit-learn/security/dependabot/2 which is related to https://github.com/joblib/joblib/issues/1128#issuecomment-1258420240.

Should we make our min joblib version `1.2` or try to get `joblib` to backport the fix in https://github.com/joblib/joblib/pull/1321 to a `1.1.1` ?

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
https://github.com/scikit-learn/scikit-learn/issues/24401#issuecomment-1253914428 also works for me.
> Maybe @lorentzenchr had more specific needs in mind

I've no special requirements. https://github.com/scikit-learn/scikit-learn/pull/24145 would benefit from scipy 1.10, but that has to wait.

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
How was that alert created? Somebody must have been watching that issue?

Security concerns seem to be becoming more of a mainstream kind of thing these days. It might make sense to backport that change in joblib. I'm not sure if we want to depend on joblib>=1.2 here, not sure how dependencies of other libraries on joblib are set.

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
> How was that alert created? Somebody must have been watching that issue?

I think so. Someone was watching it and created [CVE-2022-21797](https://nvd.nist.gov/vuln/detail/CVE-2022-21797). According to the CVE's metadata, the source was [Snyk](https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033).

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
I worry that between the 1.1 release of joblib and the 1.2, we have removed the deprecated "cachedir" argument https://github.com/joblib/joblib/commit/aab402dcacb38a73404baf50e296c4cc0528d7a1 (it was deprecated for years, but apparently some people were still using it). Hence bumping the requirement could force people to upgrade joblib, which might break code...

The joblib team should consider making a 1.1.1 release, I guess.

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
So I know from a close source that the joblib team is considering making a 1.1.1 release :smile: 
It should happen in a relatively short time. Once released I'll update our dependencies.

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
The 1.1.1 release is online. We can bump up the dependencies.

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
joblib bump is done in `main`.

Labels: RFC, Packaging
RFC bump up dependencies for 1.2

This is an issue to discuss what will be the min versions of our dependencies for the 1.2 release, targeted in november.

Here's the list of our current min versions
```
   current min version  |  latest version
                        |
      python = 3.8      |  3.11 (by then)
                        |
 (pypy) numpy = 1.19.2  |  1.23.2
        numpy = 1.17.3  |  1.23.2
        scipy = 1.3.2   |  1.9.1
       joblib = 1.0.0   |  1.1.0
threadpoolctl = 2.0.0   |  3.1.0
       cython = 0.29.24 |  0.29.32
                        |
       pytest = 5.0.1   |  7.1.3
   matplotlib = 3.1.2   |  3.5.3
 scikit-image = 0.16.2  |  0.19.3
       pandas = 1.0.5   |  1.4.4
      seaborn = 0.9.0   |  0.12.0
```

Following [NEP 29](https://numpy.org/neps/nep-0029-deprecation_policy.html), we should keep support for python 3.8 for this release, and drop support for numpy 1.19.

Looking at the ``fixes`` module, we could benefit from
- threadpoolctl 3.0+ released on october 2021.
- scipy 1.4+, released on december 2019, (related to https://github.com/scikit-learn/scikit-learn/issues/23699)

Please share other needs here

COMMENT:
So I opened #24650 but it turns out that we might not want to bump the min version of scipy (version installed on ubuntu 20.04 is 1.3.3, more details in the PR description). In the end there are only a couple of minor bumps so I'm not sure if it's worth but the PR is there so why not.

Labels: RFC, Packaging