Repository navigation
BUG: fix StringDType coerce flag in binary ufunc promotion (#31862) - #31901
Merged
Merged
Conversation
charris
added
00 - Bug
08 - Backport
736-c41-2c1-e464fc974
pushed a commit
to Swiss-Armed-Forces/Loom
that referenced
this pull request
Aug 16, 2026
This MR contains the following updates: | Package | Type | Update | Change | OpenSSF | |---|---|---|---|---| | [numpy](https://github.com/numpy/numpy) ([changelog](https://numpy.org/doc/stable/release)) | dependencies | patch | `2.5.0` → `2.5.2` | [](https://securityscorecards.dev/viewer/?uri=github.com/numpy/numpy) | | [uvicorn](https://github.com/Kludex/uvicorn) ([changelog](https://uvicorn.dev/release-notes)) | dependencies | patch | `0.52.1` → `0.52.3` | [](https://securityscorecards.dev/viewer/?uri=github.com/Kludex/uvicorn) | --- ### Release Notes <details> <summary>numpy/numpy (numpy)</summary> ### [`v2.5.2`](https://github.com/numpy/numpy/releases/tag/v2.5.2): (Aug 9, 2026) [Compare Source](numpy/numpy@v2.5.1...v2.5.2) ### NumPy 2.5.2 Release Notes The NumPy 2.5.2 is a patch release that fixes bugs discovered after the 2.5.1 release. The big news is that it includes wheels for the newly released Python 3.15.0rc1. This release supports Python versions 3.12-3.15 #### C API changes ##### `PyArray_StringDTypeObject` is opaque under the abi3t stable ABI The `PyArray_StringDTypeObject` was accidentally exposed in NumPy 2.5 when targeting the free-threading-compatible stable ABI (`Py_TARGET_ABI3T`). `PyArray_StringDTypeObject` is now an opaque struct: extensions compiled that way cannot access its fields, since the struct layout depends on the size of the object header. Any code that accessed `PyArray_StringDTypeObject` fields in an abi3t build would have crashed, so we are making this API change in a bugfix release. The `NpyString` allocator API remains usable by passing the descriptor object pointer, e.g. `NpyString_acquire_allocator((PyArray_StringDTypeObject *)descr)`. ([gh-31771](numpy/numpy#31771)) #### Contributors A total of 16 people contributed to this release. People with a "+" by their names contributed a patch for the first time. - Abhijeetsingh Meena + - Charalampos Stratakis - Charles Harris - Chris Ninham + - David Woods - Geonho + - Gopu Yeshwanth Reddy + - Iason Krommydas - Ijtihed Kilani - Jelle Zijlstra + - Joren Hammudoglu - Kumar Aditya - Mike Boyle - Nathan Goldbaum - Raghuveer Devulapalli - Sebastian Berg #### Pull requests merged A total of 28 pull requests were merged for this release. - [#​31864](numpy/numpy#31864): MAINT: Prepare 2.5.x for further development - [#​31889](numpy/numpy#31889): TYP: Backport multiple static typing fixes 1. - [#​31900](numpy/numpy#31900): TST: add tests for stable ABI numpy extensions ([#​31822](numpy/numpy#31822)) - [#​31901](numpy/numpy#31901): BUG: fix `StringDType` coerce flag in binary ufunc promotion... - [#​31902](numpy/numpy#31902): BLD: fix meson deprecation warnings ([#​31892](numpy/numpy#31892)) - [#​31921](numpy/numpy#31921): TYP: Backport multiple typing fixes 2. - [#​31947](numpy/numpy#31947): MAINT: Update x86-simd-sort subproject ([`5adb334`](numpy/numpy@5adb334) → [`fa944ef`](numpy/numpy@fa944ef)) ([#​31908](numpy/numpy#31908)) - [#​31949](numpy/numpy#31949): BUG: fix crash on 32 bit systems using abi3t ([#​31771](numpy/numpy#31771)) - [#​31950](numpy/numpy#31950): MNT: remove some obsolete string to bool workarounds ([#​31859](numpy/numpy#31859)) - [#​31952](numpy/numpy#31952): BUG: centralized helper for output coerce and na\_object in stringdtype... - [#​31953](numpy/numpy#31953): BUG: fix CPU feature env diagnostic buffer overruns ([#​31905](numpy/numpy#31905)) - [#​31954](numpy/numpy#31954): BUG: restore ndarray.conjugate() for legacy user-defined dtypes... - [#​31955](numpy/numpy#31955): TYP: Avoid shadowed dtype annotations - [#​32077](numpy/numpy#32077): MAINT: Update verdored-meson/meson to match main. - [#​32114](numpy/numpy#32114): BUG: fix refcount leak on overlapping copyto with where=False - [#​32115](numpy/numpy#32115): BUG: fix swallowed cast error in fancy indexing assignment ([#​31975](numpy/numpy#31975)) - [#​32116](numpy/numpy#32116): BUG: Fix buffered iterator stride after removing multi-index - [#​32117](numpy/numpy#32117): BUG: fix `np.fromiter` corruption when reusing a `StringDType`... - [#​32119](numpy/numpy#32119): BUG: add a special case for StringDType in np.isdtype ([#​32030](numpy/numpy#32030)) - [#​32121](numpy/numpy#32121): BUG: reference leak in `simd_sequence_from_iterable` ([#​32038](numpy/numpy#32038)) - [#​32122](numpy/numpy#32122): BUG: ensure lock is held when accessing or writing to RNG state... - [#​32123](numpy/numpy#32123): BUG: fully reset cached RNG state for non-MT19937 RNGs ([#​32062](numpy/numpy#32062)) - [#​32135](numpy/numpy#32135): TYP: type capabilities max dimensions - [#​32158](numpy/numpy#32158): BUG: avoid possible stack overflow in arraydescr\_dealloc ([#​32133](numpy/numpy#32133)) - [#​32206](numpy/numpy#32206): MAINT: Update cibuildwheel to v4.2.0 - [#​32214](numpy/numpy#32214): MAINT: Skip limited\_api tests on some platforms. - [#​32220](numpy/numpy#32220): TYP: `isclose` shape-typing fix for 2d array-likes ([#​32205](numpy/numpy#32205)) - [#​32221](numpy/numpy#32221): BUG: avoid segfaults when legacy copyswap slot is not defined... ### [`v2.5.1`](https://github.com/numpy/numpy/releases/tag/v2.5.1): (July 4, 2026) [Compare Source](numpy/numpy@v2.5.0...v2.5.1) ### NumPy 2.5.1 Release Notes The NumPy 2.5.1 is a patch release that fixes bugs discovered after the 2.5.0 release. The most noticeable is the fix is to the numpy datetime cython API which should allow downstream to support NumPy versions older than 2.5. Preparation for Python 3.15 continues along with typing improvements. This release supports Python versions 3.12-3.14 #### Changes - The minimum supported GCC version has been updated from 9.3.0 to 10.3.0 ([gh-31843](numpy/numpy#31843)) #### Contributors A total of 10 people contributed to this release. People with a "+" by their names contributed a patch for the first time. - Adhyan Gupta + - Ankit Ahlawat - Charles Harris - Iason Krommydas - Joren Hammudoglu - Kumar Aditya - Nathan Goldbaum - Sebastian Berg - Ties Jan Hefting + - Vineet Kumar #### Pull requests merged A total of 20 pull requests were merged for this release. - [#​31707](numpy/numpy#31707): MAINT: Prepare 2.5.x for further development - [#​31721](numpy/numpy#31721): CI: fix new `cython-lint` errors ([#​31711](numpy/numpy#31711)) - [#​31723](numpy/numpy#31723): MAINT: Update meson to match main - [#​31729](numpy/numpy#31729): TST: use setup-sde instead of curl to get SDE binaries ([#​31727](numpy/numpy#31727)) - [#​31829](numpy/numpy#31829): BUG: Relax finfo to be easier accessible for all user dtypes... - [#​31831](numpy/numpy#31831): TYP: Fix `flatiter.__next__` return type for `object_` and... - [#​31832](numpy/numpy#31832): BUG: avoid deadlocks using NpyString API ([#​31682](numpy/numpy#31682)) - [#​31833](numpy/numpy#31833): BUG: fix out array leak in reduceat and accumulate when dtype... - [#​31835](numpy/numpy#31835): BUG: fix numpy datetime cython APIs to be compatible with older... - [#​31836](numpy/numpy#31836): TYP: Fix incorrect dtype inference of `asarray([])` ([#​31732](numpy/numpy#31732)) - [#​31837](numpy/numpy#31837): TYP: Fix `np.ma.masked_array` 2.5.0 regression - [#​31838](numpy/numpy#31838): FIX: Refactor error handling in array\_setstate to prevent typecode... - [#​31839](numpy/numpy#31839): TST: xfail multithreaded BLAS test more generously - [#​31840](numpy/numpy#31840): MAINT: Rename subroutine for crackfortran tests - [#​31842](numpy/numpy#31842): BUG: fix leak in reductions when a ufunc override errors or is... - [#​31849](numpy/numpy#31849): BLD: set minimum required gcc version to 10.3 ([#​31843](numpy/numpy#31843)) - [#​31855](numpy/numpy#31855): CI: fix hangs on MacOS ASan CI ([#​31853](numpy/numpy#31853)) - [#​31856](numpy/numpy#31856): BUG: fix several bugs in StringDType operations ([#​31846](numpy/numpy#31846)) - [#​31857](numpy/numpy#31857): BUG: Fix segfault in MT19937 by preventing recursive seed lists... - [#​31858](numpy/numpy#31858): BUG: Fix signed integer overflow in datetime.c ([#​31688](numpy/numpy#31688)) </details> <details> <summary>Kludex/uvicorn (uvicorn)</summary> ### [`v0.52.3`](https://github.com/Kludex/uvicorn/releases/tag/0.52.3): Version 0.52.3 [Compare Source](Kludex/uvicorn@0.52.2...0.52.3) ##### Changed - Update `zttp` to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance ([#​3067](Kludex/uvicorn#3067)) **Full Changelog**: <Kludex/uvicorn@0.52.2...0.52.3> ### [`v0.52.2`](https://github.com/Kludex/uvicorn/releases/tag/0.52.2): Version 0.52.2 [Compare Source](Kludex/uvicorn@0.52.1...0.52.2) ##### Fixed - Update `zttp` to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance ([#​3063](Kludex/uvicorn#3063)) **Full Changelog**: <Kludex/uvicorn@0.52.1...0.52.2> </details> --- - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTEuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjMwLjQiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsInJlbm92YXRlIl19--> See merge request swiss-armed-forces/cyber-command/cea/loom!639 Co-authored-by: Loom MR Pipeline Trigger <group_103951964_bot_9504bb8dead6d4e406ad817a607f24be@noreply.gitlab.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport or #31862.
PR summary
Fixes #31861.
Binary
StringDTypeufuncs resolved outputcoercewithdescr1->coerce && descr1->coerceinstead of combining both operands.That made results order-dependent (e.g.
np.addwithcoerce=Truethencoerce=Falsekeptcoerce=True) and allowed non-string assignment via implicit stringification.This changes the combination to
descr1->coerce && descr2->coerce, matchingcommon_instance/np.promote_types, and adds a small regression test for both operand orders.First time committer introduction
I have been using NumPy for some time now. I hit this while working with
StringDTypeandcoerce, and found two places with similar typo bug. I checked and found that one typo incommon_instancehas been fixed yesterday, so wanted to fix the remaining typo in the binary ufunc path.AI Disclosure
I used Grok to help locate the bug in
binary_resolve_descriptors, draft the regression test, and refine the issue/PR wording. I made and verified the fix with correctness checks, rebuilds and the test suite; final review and PR submission were done by me.