python v3.10.7

[regro-cf-autotick-bot]

It is very likely that the current package version for this feedstock is out of date.

Checklist before merging this PR:

• Dependencies have been updated if changed: see upstream
• Tests have passed
• Updated license if changed and license_file is packaged

Information about this PR:

1. Feel free to push to the bot's branch to update this PR if needed.
2. The bot will almost always only open one PR per version.
3. The bot will stop issuing PRs if more than 3 version bump PRs generated by the bot are open. If you don't want to package a particular version please close the PR.
4. If you want these PRs to be merged automatically, make an issue with @conda-forge-admin,please add bot automerge in the title and merge the resulting PR. This command will add our bot automerge feature to your feedstock.
5. If this PR was opened in error or needs to be updated please add the bot-rerun label to this PR. The bot will close this PR and schedule another one. If you do not have permissions to add this label, you can use the phrase @conda-forge-admin, please rerun bot in a PR comment to have the conda-forge-admin add it for you.

Pending Dependency Version Updates

Here is a list of all the pending dependency version updates for this repo. Please double check all dependencies before merging.

Name	Upstream Version	Current Version
python	3.10.7

Dependency Analysis

Please note that this analysis is highly experimental. The aim here is to make maintenance easier by inspecting the package's dependencies. Importantly this analysis does not support optional dependencies, please double check those before making changes. If you do not want hinting of this kind ever please add bot: inspection: false to your conda-forge.yml. If you encounter issues with this feature please ping the bot team conda-forge/bot.

Analysis by source code inspection shows a discrepancy between it and the the package's stated requirements in the meta.yaml.

Packages found by source code inspection but not in the meta.yaml:

• dateparser
• billiard
• reindent
• spectrum
• docutils
• pygments
• pyobjc-framework-cocoa
• sphinx

_{This PR was created by the regro-cf-autotick-bot. The regro-cf-autotick-bot is a service to automatically track the dependency graph, migrate packages, and propose package version updates for conda-forge. Feel free to drop us a line if there are any issues! This PR was generated by https://github.com/regro/autotick-bot/actions/runs/2995286395, please use this URL for debugging.}

[conda-forge-linter]

Hi! This is the friendly automated conda-forge-linting service.

I just wanted to let you know that I linted all conda-recipes in your PR (recipe) and found it was in an excellent condition.

[wshanks]

Is there a reason not to merge this? Since 3.10.7 addresses a CVE, I think it would be good to make it available on conda-forge. I am not sure about the C++ compiler change, but otherwise it looks like a straightforward update.

[xhochy]

@isuruf Can you leave a comment here why this is in draft? Looks good to me otherwise.

[isuruf]

There are lots of issues with that release/CVE. It breaks a few software in a patch release. See https://discuss.python.org/t/int-str-conversions-broken-in-latest-python-bugfix-releases/18889

[wshanks]

Hmm, that is an interesting discussion, but what is the outlook? It seems like the core developers are standing by the decision and not reverting it. So is the decision here to delay the new release to give other projects more time to adapt? Since conda-forge skews more heavily toward data science, that makes some sense.

[isuruf]

It seems like the core developers are standing by the decision and not reverting it

Not really. See https://discuss.python.org/t/int-str-conversions-broken-in-latest-python-bugfix-releases/18889/93

I'm just going to wait to see how the discussion pans out.

[wshanks]

Not really. See https://discuss.python.org/t/int-str-conversions-broken-in-latest-python-bugfix-releases/18889/93

I'm just going to wait to see how the discussion pans out.

Okay, I should have written more specifically "the steering council and security response team are standing by the decision..." instead of "core developers" 🙂 In any case, it will be interesting to follow the discussion. It sounds like it is not impossible a more efficient algorithm could be added.

[ngam]

@isuruf thanks for halting this

That thread looks like something from the Julia discourse page now lol

[h-vetinari]

I came to this feedstock to open an issue about this, but saw that this discussion is already happening. Glad to see I'm not alone in considering this quite egregious breakage, made worse by the sort of circling the wagons that declares this decision beyond discussion.

Since it seems like it'll take a while for these things to work themselves through, I don't think we should necessarily stop publishing patch version updates -- though I would lend my support to an effort that reverts or adapts this "fix" in our branches, if that's a decision that conda-forge/core wants to take. This would need fairly broad support though, because it's likely going to be confrontational (judging from the interactions in that thread), and substantial enough that it would IMO need something like a blogpost & announcement on the python discourse.

[wshanks]

I agree about not blocking patch releases. In my case, I don't work with large integers and I don't work with web services, so the security patch does not affect me directly. However, it does affect me indirectly because I like to use conda at work and, because of the CVE, 3.10.6 is flagged as insecure. While I could try to argue the CVE is irrelevant, I took the easier route of uploading the build artifacts from this PR to my own conda channel and installing 3.10.7 that way. Other people could be in the same position where it is hard to convey the nuance of the situation to a security team and it just looks like conda-forge is blocking security updates (possibly putting more pressure on people to install Python from a different channel).

I don't know how big of integers people work with. Maybe the length limit on integers could be set to a higher default value here?

[ngam]

@isuruf there is a new release; what are your thoughts now? It looks like the ship has defo sailed ahead on this one...

@h-vetinari what is your recommendation here?

copying @conda-forge/core for visibility

[jakirkham]

xref: #587

[h-vetinari]

@h-vetinari what is your recommendation here?

Thanks for asking but it's not up to me. I tried to bring the topic up in a core meeting ~3 weeks ago, but that meeting ran out of time and we didn't get to it. A week ago I couldn't join the core meeting, I don't know if it was discussed.

I think it needs a broader alignment within core, because the choices are all bad and controversial whichever way one slices it.

[mbargull]

Personally, I don't find upstream's decision, process of decision making, and the handling afterwards really defensible due to several reasons that have already been voiced. I would disable the limit with a simple/maintainable patch for the patch releases (i.e., <3.11).
However, I'm leaving this as a "neutral" comment since it's not important enough for me to put in effort arguing for that.

---

That said, we seem to have reached a clear majority. When do we proceed with this and get the patch releases out? I suppose tomorrow, i.e., after the usual 7 days.

[beckermr]

We need to consult our voting rules and ensure this vote has passed according to the rules. I will leave that task to @jaimergp since he called the vote.

[isuruf]

We don't have quorum yet. We need 13 votes, but we have only 11 yet (9 yes, 1 no, 1 abstain).

After the vote (assuming no patches) we need to figure out more things.

1. Do we do (A) or (B) ?
2. Do we follow anaconda and make an announcement for two weeks before deploying?

If we had 2 more votes, then we can decide on these at tomorrow's meeting.

[jaimergp]

Let's kindly ping the team again for awareness :) @conda-forge/core, see message here: #579 (comment)

[jaimergp]

We have reached quorum! I'll add this to today's meeting notes.

[chenghlee]

Anaconda's position on releasing Python 3.10.7, 3.9.14, 3.8.14, and 3.7.14:

Anaconda will release packages for Python 3.10.7, 3.9.14, 3.8.14, and 3.7.14 on or after 2022-11-10. These releases contain upstream fixes for CVE-2020-10735, which are known to break existing releases of packages like SymPy and Sage in certain circumstances. Anaconda has decided to release the upstream fixes as is, and users who encounter ValueError: Exceeds the limit (4300) for integer string conversion errors are encouraged to consult the upstream CPython documentation on “Integer string conversion length limitation” for possible workarounds.

[jaimergp]

@conda-forge/python - this is scheduled for release on Nov 11th or later, but if there are any items to review here, we can start now. Thanks!

[jakirkham]

Should we re-render or restart CI to make sure the status here is fresh? (same question for other python update PRs)

[bollwyvl]

Timezones and all that, but as of writing, it looks like anaconda has not yet shipped either of:

• https://anaconda.org/anaconda/python/files?version=3.10.7
• https://anaconda.org/anaconda/python/files?version=3.10.8

[mbargull]

Timezones and all that, but as of writing, it looks like anaconda has not yet shipped either of:

Yes, and we'll move forward with this shortly, but all in its due time.

Anaconda will release packages for Python 3.10.7, 3.9.14, 3.8.14, and 3.7.14 on or after 2022-11-10.

@conda-forge/python - this is scheduled for release on Nov 11th or later, but if there are any items to review here, we can start now. Thanks!

If one needs a more concrete time frame: I expect it to happen this month. 😼

[mbargull]

@conda-forge-admin, please rerender

[jakirkham]

FWIW it looks like Anaconda shipped these (in particular here's 3.10.8).

Though recognize we are doing .conda today. So may not want to lump these together.

That said, what are people's thoughts on doing this soonish? Maybe tomorrow or early next week? Depending on how .conda roll out goes of course

[mbargull]

@conda-forge-admin, please rerender

[mbargull]

That said, what are people's thoughts on doing this soonish? Maybe tomorrow or early next week? Depending on how .conda roll out goes of course

Yes :).
The .conda rollout went well and I just wanted to wait until after the weekend so people can react to changes if needed.
So, here we are! Let's merge once the CI passed.

[jakirkham]

Thanks Marcel! 🙏