Support Python 3.13

[felixhekhorn]

preliminary feedback from @scarlehoff

fwiw, also eko seems to do fine with the release candidate of numba and numpy 2 (I only had to search and replace np.float_ to np.float64, probably for the full eko to work there will be some more changes)

• eko/src/eko/io/raw.py:65: DeprecationWarning: Python 3.14 will, by default, filter extracted tar archives and reject files or modify their metadata. Use the filter argument to control this behavior ; see also https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter

[scarlehoff]

Regarding that error, not only it's a deprecation warning but can be a serious security issue. At some point in NNPDF one could upload an evil tar theory / fit to the server and break the computer of whoever downloaded it 🙅

[felixhekhorn]

of that risk some random bot made us already aware: 9f0c6cf - but we can now abandon that hack if I understood correctly

[alecandido]

of that risk some random bot made us already aware: 9f0c6cf - but we can now abandon that hack if I understood correctly

Now = when you will drop support for py<3.12.

If you keep following Python's schedule, that means 2027-10.

[scarlehoff]

fwiw this is a relatively cheap workaround to have it working for before <3.12 https://github.com/NNPDF/nnpdf/blob/8327d16719c638ef0fd2eb6af788d9a7836146d3/validphys2/src/validphys/loader.py#L911

(I don't think we need to worry about north korean hackers messing up with eko anyway, I mentioned it more as a curiosity)

[alecandido]

That's exactly why I mentioned py<3.12:

Changed in version 3.12: Added the filter parameter.
https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall

(your URL is pointing to an exception raised by a filter)

            try:
                res_tar.extractall(path=dest_path, filter="data")
            except tarfile.LinkOutsideDestinationError as e:
                if sys.version_info > (3, 11):
                    raise e

[felixhekhorn]

From here https://docs.python.org/3.10/library/tarfile.html#tarfile.TarFile.extractall I understand it is backported to 3.10.12 and we really want filter='data' - there are no links in eko

[felixhekhorn]

can we do something like "3.10.12 <= x < 3.11 || 3.11.4 <= x < 3.12 || 3.12 <= x" ?

[alecandido]

Yeah, I just checked, and it is backported for all versions which supported bugfixes

• Changed in version 3.11.4: Added the filter parameter.
• Changed in version 3.10.12: Added the filter parameter.
• Changed in version 3.9.17: Added the filter parameter.
• Changed in version 3.8.17: Added the filter parameter.

I guess you have two options:

1. conservative, i.e. keep the workaround (until 2027-10), to preserve compatibility even with not updated versions
2. compromise, decide to require Python bugfixes on your end user, and just step in

I believe whatever you choose, there is no motivation for actually imposing it in the version constraint. That feature (reading files) won't work with some Python versions. Thus, when used, it will break.
In principle, without the restriction, this will become a breaking change of EKO (since the dependency resolution may pick the new eko version, and break on an old enough version of Python).
But it will be actually breaking anyhow, since if you manually force the upgrade it will actually break (you'd be just specifying it in a different field than the version itself). I'd just forget about it as a higher-order issue...