Pinned version of Numpy dependency

[BLKSerene]

Hi, Lingua 1.3.3 requires Numpy < 1.25, but the latest version of NumPy is 1.26.0, so I'm wondering whether there are any incompatibilities which require NumPy version to be pinned?

[pemistahl]

NumPy >= 1.25 does not support Python 3.8 anymore but I want my library to support Python 3.8 as long as security updates are provided for it. As soon as Python 3.8 reaches end of life in October 2024, I will drop support for it and update the dependencies accordingly.

[BLKSerene]

Ah, I see. Then for Python 3.9+ users, it should be safe to use the latest NumPy by specifying:

[tool.poetry.dependencies]
numpy = [
    {version = "^1.24.4,<1.25", python = ">=3.8,<3.9"},
    {version = ">=1.24.4", python = ">=3.9,<3.12,!=3.11.0"}
]

in pyproject.toml.

[pemistahl]

Ah, you are right. I have not thought about specifying the dependency like that. I will do it in the next release 1.3.4.

[samypr100]

@pemistahl

Taking it a bit further, since this is basically added maintenance on your part.
You can get away with just specifying numpy = ">=1.24.4" and luckily python >= 3.8 will still be supported on end user systems installing lingua-py thanks to Pip's solver.

The solver will know what to do with python 3.8 since 1.24.4 is valid on python3.8 based on published metadata.
Note: If you had specified >=1.25 then yes python 3.8 would not have been supported when installing this library.

Hence, end result can be

[tool.poetry.dependencies]
python = ">=3.8,<3.13"
numpy = ">=1.24.4"
...

If for your own development you want to keep it locked to 1.24.4, you can simply make sure it stays 1.24.4 on your repo's lock file. Luckily, end-users won't be affected by the content of your lock file. Poetry provides mechanisms to achieve that by using poetry lock --no-update and/or similar commands.

[samypr100]

There's historical evidence in avoiding <, the official packaging guide explains it better than I could https://packaging.python.org/en/latest/discussions/install-requires-vs-requirements/

It is not considered best practice to use install_requires to pin dependencies to specific versions, or to specify sub-dependencies (i.e. dependencies of your dependencies). This is overly-restrictive, and prevents the user from gaining the benefit of dependency upgrades.

Since Poetry uses tool.poetry.dependencies to generate the install_requires equivalent metadata in PKG-INFO, it affects end users in this same way.

Hope this helps, thanks!

[pemistahl]

Thank you @samypr100, that is helpful. I've just updated the dependencies according to your recommendations for release 1.3.4.

[pemistahl]

Hmm...it turns out that NumPy 1.24.4 is not compatible with Python 3.12 anymore. As I don't want to mess about with the lock file myself, I've now decided to go with @BLKSerene's approach of specifying the dependency constraints. It's a bit more complex but it works at least as intended.

[samypr100]

Sounds good, thank you! Agreed, poetry's own solver can be a bit picky in this situation.