Skip to content

chore: lift numpy cap to <3.0.0 in presidio-analyzer - #2330

Open
developer-rpai wants to merge 1 commit into
data-privacy-stack:mainfrom
developer-rpai:fix-2329-numpy-cap
Open

developer-rpai wants to merge 1 commit into
data-privacy-stack:mainfrom
developer-rpai:fix-2329-numpy-cap

Conversation

@developer-rpai

Copy link
Copy Markdown

Fixes #2329

What

Relaxes the numpy upper bound in presidio-analyzer from <2.5.0 back to <3.0.0 (as in #2091) and regenerates uv.lock.

Why

The <2.5.0 pin was a CI workaround from #2090/#2092: Poetry installed numpy 2.4.x and 2.5.x side by side, and numpy 2.5.0's mtrand C extension failed to initialize inside spaCy's import chain (AttributeError: 'ModuleSpec' object has no attribute 'doc'). Since #2152 moved CI and images to uv, that resolver behavior is gone, so the pin no longer has a cause. presidio-analyzer itself does not import numpy; spaCy only requires numpy>=1.19.0.

Verification

  • uv lock resolves the full tree cleanly with the relaxed bound; the lock now pins numpy 2.5.3 for Python >= 3.12 (2.4.6 stays for 3.11 via transitive constraints).
  • Reproduced the original fix: pin numpy<2.5.0 to resolve Python 3.12 CI failure #2090 crash scenario (numpy 2.5.3 + spaCy 3.8.13 on Python 3.12): numpy.random.mtrand, spacy.ml.parser_model, and a blank en pipeline all import and run fine.
  • Ran the presidio-analyzer test suite with Python 3.12 + numpy 2.5.3: 129 test files, 3279 tests, all passing. Heavy model suites for stanza, transformers, gliner, and langextract were excluded in this sandbox due to memory limits; CI will cover them.

AI assistance disclosure

This change was prepared with AI assistance and reviewed by the author before submission.

The numpy<2.5.0 pin was a CI workaround from data-privacy-stack#2090/data-privacy-stack#2092 for Poetry
installing numpy 2.4.x and 2.5.x side by side, which crashed spaCy's
import chain. CI moved to uv in data-privacy-stack#2152, so the cause is gone.

Relax the bound back to <3.0.0 as in data-privacy-stack#2091 and regenerate uv.lock
(numpy 2.5.3 for Python >= 3.12). Verified the analyzer test suite
passes with numpy 2.5.3.

Fixes data-privacy-stack#2329
@github-actions github-actions Bot added external analyzer dependencies Pull requests that update a dependency file labels Oct 6, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

analyzer dependencies Pull requests that update a dependency file external

Projects

None yet

Development

Successfully merging this pull request may close these issues.

presidio-analyzer: lift the numpy<2.5.0 cap (CI workaround from #2090/#2092)

1 participant