MNT DNPY_NO_DEPRECATED_API=NPY_1_22_API_VERSION and security fixes (scikit-learn#31984)

lorentzenchr · web-flow · commit 866fef153ab4 · 2025-08-22T10:24:07.000+05:00
diff --git a/sklearn/meson.build b/sklearn/meson.build
@@ -100,7 +100,7 @@ inc_np = include_directories(incdir_numpy)
 # Don't use the deprecated NumPy C API. Define this to a fixed version instead of
 # NPY_API_VERSION in order not to break compilation for released SciPy versions
 # when NumPy introduces a new deprecation.
-numpy_no_deprecated_api = ['-DNPY_NO_DEPRECATED_API=NPY_1_9_API_VERSION']
+numpy_no_deprecated_api = ['-DNPY_NO_DEPRECATED_API=NPY_1_22_API_VERSION']
 np_dep = declare_dependency(include_directories: inc_np, compile_args: numpy_no_deprecated_api)
 
 openmp_dep = dependency('OpenMP', language: 'c', required: false)
diff --git a/sklearn/metrics/_dist_metrics.pyx.tp b/sklearn/metrics/_dist_metrics.pyx.tp
@@ -846,7 +846,7 @@ cdef class DistanceMetric{{name_suffix}}(DistanceMetric):
 
             intp_t i1, i2
             intp_t x1_start, x1_end
-            {{INPUT_DTYPE_t}} * x2_data
+            const {{INPUT_DTYPE_t}} * x2_data
 
         with nogil:
             # Use the exact same adaptation for CSR than in SparseDenseDatasetsPair
@@ -910,7 +910,7 @@ cdef class DistanceMetric{{name_suffix}}(DistanceMetric):
             {{INPUT_DTYPE_t}}[:, ::1] Darr = np.empty((n_X, n_Y), dtype={{INPUT_DTYPE}}, order='C')
 
             intp_t i1, i2
-            {{INPUT_DTYPE_t}} * x1_data
+            const {{INPUT_DTYPE_t}} * x1_data
 
             intp_t x2_start, x2_end
 
diff --git a/sklearn/neighbors/_ball_tree.pyx.tp b/sklearn/neighbors/_ball_tree.pyx.tp
@@ -98,7 +98,7 @@ cdef int init_node{{name_suffix}}(
     cdef float64_t radius
     cdef const {{INPUT_DTYPE_t}} *this_pt
 
-    cdef intp_t* idx_array = &tree.idx_array[0]
+    cdef const intp_t* idx_array = &tree.idx_array[0]
     cdef const {{INPUT_DTYPE_t}}* data = &tree.data[0, 0]
     cdef {{INPUT_DTYPE_t}}* centroid = &tree.node_bounds[0, i_node, 0]
 
diff --git a/sklearn/svm/src/liblinear/linear.cpp b/sklearn/svm/src/liblinear/linear.cpp
@@ -73,7 +73,7 @@ static void info(const char *fmt,...)
 	char buf[BUFSIZ];
 	va_list ap;
 	va_start(ap,fmt);
-	vsprintf(buf,fmt,ap);
+	vsnprintf(buf,sizeof buf,fmt,ap);
 	va_end(ap);
 	(*liblinear_print_string)(buf);
 }
diff --git a/sklearn/svm/src/liblinear/tron.cpp b/sklearn/svm/src/liblinear/tron.cpp
@@ -23,7 +23,7 @@ void TRON::info(const char *fmt,...)
 	char buf[BUFSIZ];
 	va_list ap;
 	va_start(ap,fmt);
-	vsprintf(buf,fmt,ap);
+	vsnprintf(buf,sizeof buf,fmt,ap);
 	va_end(ap);
 	(*tron_print_string)(buf);
 }
diff --git a/sklearn/svm/src/libsvm/svm.cpp b/sklearn/svm/src/libsvm/svm.cpp
@@ -117,7 +117,7 @@ static void info(const char *fmt,...)
 	char buf[BUFSIZ];
 	va_list ap;
 	va_start(ap,fmt);
-	vsprintf(buf,fmt,ap);
+	vsnprintf(buf,sizeof buf,fmt,ap);
 	va_end(ap);
 	(*svm_print_string)(buf);
 }

Original file line number	Diff line number	Diff line change
`@@ -73,7 +73,7 @@ static void info(const char *fmt,...)`
`73`	`73`	`char buf[BUFSIZ];`
`74`	`74`	`va_list ap;`
`75`	`75`	`va_start(ap,fmt);`
`76`		`- vsprintf(buf,fmt,ap);`
	`76`	`+ vsnprintf(buf,sizeof buf,fmt,ap);`
`77`	`77`	`va_end(ap);`
`78`	`78`	`(*liblinear_print_string)(buf);`
`79`	`79`	`}`
Original file line number	Diff line number	Diff line change
`@@ -23,7 +23,7 @@ void TRON::info(const char *fmt,...)`
`23`	`23`	`char buf[BUFSIZ];`
`24`	`24`	`va_list ap;`
`25`	`25`	`va_start(ap,fmt);`
`26`		`- vsprintf(buf,fmt,ap);`
	`26`	`+ vsnprintf(buf,sizeof buf,fmt,ap);`
`27`	`27`	`va_end(ap);`
`28`	`28`	`(*tron_print_string)(buf);`
`29`	`29`	`}`
Original file line number	Diff line number	Diff line change
`@@ -117,7 +117,7 @@ static void info(const char *fmt,...)`
`117`	`117`	`char buf[BUFSIZ];`
`118`	`118`	`va_list ap;`
`119`	`119`	`va_start(ap,fmt);`
`120`		`- vsprintf(buf,fmt,ap);`
	`120`	`+ vsnprintf(buf,sizeof buf,fmt,ap);`
`121`	`121`	`va_end(ap);`
`122`	`122`	`(*svm_print_string)(buf);`
`123`	`123`	`}`