Release 1.2.1

.circleci/config.yml

@@ -37,27 +37,6 @@ jobs:
           root: doc/_build/html
           paths: .
 
-  linux-arm64:
-    machine:
-      image: ubuntu-2004:202101-01
-    resource_class: arm.medium
-    environment:
-      - OMP_NUM_THREADS: 2
-      - OPENBLAS_NUM_THREADS: 2
-      - CONDA_ENV_NAME: testenv
-      - LOCK_FILE: build_tools/circle/py39_conda_forge_linux-aarch64_conda.lock
-    steps:
-      - checkout
-      - run: ./build_tools/circle/checkout_merge_commit.sh
-      - restore_cache:
-          key: linux-arm64-{{ .Branch }}
-      - run: ./build_tools/circle/build_test_arm.sh
-      - save_cache:
-          key: linux-arm64-{{ .Branch }}
-          paths:
-            - ~/.cache/ccache
-            - ~/.cache/pip
-            - ~/scikit_learn_data
   deploy:
     docker:
       - image: cimg/python:3.8.12
@@ -75,6 +54,17 @@ jobs:
               bash build_tools/circle/push_doc.sh doc/_build/html/stable
             fi
 
+  # This noop job is required for the pipeline to exist, so that the
+  # documentation related jobs can be triggered.
+  noop:
+    docker:
+      - image: cimg/python:3.8.12
+    steps:
+    - run: |
+        echo "This is no-op job for the pipeline to exist, so that it triggers "
+        echo "Circle CI jobs pushing the artifacts of the documentation built "
+        echo "via GitHub actions."
+
 workflows:
   version: 2
 
@@ -90,10 +80,10 @@ workflows:
           requires:
             - doc
 
-  linux-arm64:
+  noop:
     when:
       equal: [ "none", << pipeline.parameters.GITHUB_RUN_URL >> ]
     # Prevent double execution of this job: on push
     # by default and when triggered by the workflow
     jobs:
-      - linux-arm64
+      - noop

.cirrus.star

@@ -0,0 +1,35 @@
+# This script uses starlark for configuring when a cirrus CI job runs:
+# https://cirrus-ci.org/guide/programming-tasks/
+
+load("cirrus", "env", "fs", "http")
+
+def main(ctx):
+    # Only run for scikit-learn/scikit-learn. For debugging on a fork, you can
+    # comment out the following condition.
+    if env.get("CIRRUS_REPO_FULL_NAME") != "scikit-learn/scikit-learn":
+        return []
+
+    arm_wheel_yaml = "build_tools/cirrus/arm_wheel.yml"
+    arm_tests_yaml = "build_tools/cirrus/arm_tests.yml"
+
+    # Nightly jobs always run
+    if env.get("CIRRUS_CRON", "") == "nightly":
+        return fs.read(arm_wheel_yaml)
+
+    # Get commit message for event. We can not use `git` here because there is
+    # no command line access in starlark. Thus we need to query the GitHub API
+    # for the commit message. Note that `CIRRUS_CHANGE_MESSAGE` can not be used
+    # because it is set to the PR's title and not the latest commit message.
+    SHA = env.get("CIRRUS_CHANGE_IN_REPO")
+    REPO = env.get("CIRRUS_REPO_FULL_NAME")
+    url = "https://api.github.com/repos/" + REPO + "/git/commits/" + SHA
+    response = http.get(url).json()
+    commit_msg = response["message"]
+
+    if "[skip ci]" in commit_msg:
+        return []
+
+    if "[cd build]" in commit_msg or "[cd build cirrus]" in commit_msg:
+        return fs.read(arm_wheel_yaml)
+
+    return fs.read(arm_tests_yaml)

.github/workflows/artifact-redirector.yml

@@ -1,7 +1,10 @@
+name: CircleCI artifacts redirector
 on: [status]
 jobs:
   circleci_artifacts_redirector_job:
     runs-on: ubuntu-latest
+    # For testing this action on a fork, remove the "github.repository =="" condition.
+    if: "github.repository == 'scikit-learn/scikit-learn' && github.event.context == 'ci/circleci: doc'"
     name: Run CircleCI artifacts redirector
     steps:
       - name: GitHub Action step

.github/workflows/trigger-hosting.yml

@@ -21,6 +21,14 @@ jobs:
       - name: Trigger hosting jobs
         run: bash build_tools/github/trigger_hosting.sh
         env:
+          # Note: the CIRCLE_CI_TOKEN needs to be a user token instead of a
+          # project-wide token created using:
+          #
+          # https://support.circleci.com/hc/en-us/articles/360050351292-How-to-Trigger-a-Workflow-via-CircleCI-API-v2
+          #
+          # At the time of writing, secrets.CIRCLE_CI_TOKEN is valued with a
+          # token created using the ogrisel circleci account using:
+          # https://app.circleci.com/settings/user/tokens
           CIRCLE_CI_TOKEN: ${{ secrets.CIRCLE_CI_TOKEN }}
           EVENT: ${{ github.event.workflow_run.event }}
           RUN_ID: ${{ github.event.workflow_run.id }}

.github/workflows/wheels.yml

@@ -142,11 +142,12 @@ jobs:
           CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: bash build_tools/github/repair_windows_wheels.sh {wheel} {dest_dir}
           CIBW_BEFORE_TEST_WINDOWS: bash build_tools/github/build_minimal_windows_image.sh ${{ matrix.python }}
           CIBW_TEST_REQUIRES: pytest pandas threadpoolctl
-          CIBW_TEST_COMMAND: bash {project}/build_tools/github/test_wheels.sh
+          CIBW_TEST_COMMAND: bash {project}/build_tools/wheels/test_wheels.sh
           CIBW_TEST_COMMAND_WINDOWS: bash {project}/build_tools/github/test_windows_wheels.sh ${{ matrix.python }}
           CIBW_BUILD_VERBOSITY: 1
+          CONDA_HOME: /usr/local/miniconda
 
-        run: bash build_tools/github/build_wheels.sh
+        run: bash build_tools/wheels/build_wheels.sh
 
       - name: Store artifacts
         uses: actions/upload-artifact@v3

MANIFEST.in

@@ -22,6 +22,7 @@ recursive-exclude maint_tools *
 recursive-exclude benchmarks *
 recursive-exclude .binder *
 recursive-exclude .circleci *
+exclude .cirrus.star
 exclude .codecov.yml
 exclude .git-blame-ignore-revs
 exclude .mailmap

azure-pipelines.yml

@@ -66,7 +66,6 @@ jobs:
         LOCK_FILE: './build_tools/azure/pylatest_pip_scipy_dev_linux-64_conda.lock'
         CHECK_WARNINGS: 'true'
         CHECK_PYTEST_SOFT_DEPENDENCY: 'true'
-        TEST_DOCSTRINGS: 'true'
         # Tests that require large downloads over the networks are skipped in CI.
         # Here we make sure, that they are still run on a regular basis.
         SKLEARN_SKIP_NETWORK_TESTS: '0'
@@ -146,7 +145,12 @@ jobs:
         SKLEARN_TESTS_GLOBAL_RANDOM_SEED: '42'  # default global random seed
 
 # Check compilation with Ubuntu 22.04 LTS (Jammy Jellyfish) and scipy from conda-forge
-- template: build_tools/azure/posix.yml
+# By default the CI is sequential, where `Ubuntu_Jammy_Jellyfish` runs first and
+# the others jobs are run only if `Ubuntu_Jammy_Jellyfish` succeeds.
+# When "[azure parallel]" is in the commit message, `Ubuntu_Jammy_Jellyfish` will
+# run in parallel with the rest of the jobs. On Azure, the job's name will be
+# `Ubuntu_Jammy_Jellyfish_Parallel`.
+- template: build_tools/azure/posix-all-parallel.yml
   parameters:
     name: Ubuntu_Jammy_Jellyfish
     vmImage: ubuntu-22.04
@@ -156,6 +160,7 @@ jobs:
         succeeded(),
         not(contains(dependencies['git_commit']['outputs']['commit.message'], '[ci skip]'))
       )
+    commitMessage: dependencies['git_commit']['outputs']['commit.message']
     matrix:
       py38_conda_forge_openblas_ubuntu_2204:
         DISTRIB: 'conda'
@@ -167,10 +172,10 @@ jobs:
   parameters:
     name: Linux
     vmImage: ubuntu-20.04
-    dependsOn: [linting, git_commit]
+    dependsOn: [linting, git_commit, Ubuntu_Jammy_Jellyfish]
     condition: |
       and(
-        succeeded(),
+        in(dependencies['Ubuntu_Jammy_Jellyfish']['result'], 'Succeeded', 'Skipped'),
         not(contains(dependencies['git_commit']['outputs']['commit.message'], '[ci skip]'))
       )
     matrix:
@@ -195,18 +200,17 @@ jobs:
         DISTRIB: 'conda-pip-latest'
         LOCK_FILE: './build_tools/azure/pylatest_pip_openblas_pandas_linux-64_conda.lock'
         CHECK_PYTEST_SOFT_DEPENDENCY: 'true'
-        TEST_DOCSTRINGS: 'true'
         CHECK_WARNINGS: 'true'
         SKLEARN_TESTS_GLOBAL_RANDOM_SEED: '3'  # non-default seed
 
 - template: build_tools/azure/posix-docker.yml
   parameters:
     name: Linux_Docker
     vmImage: ubuntu-20.04
-    dependsOn: [linting, git_commit]
+    dependsOn: [linting, git_commit, Ubuntu_Jammy_Jellyfish]
     condition: |
       and(
-        succeeded(),
+        in(dependencies['Ubuntu_Jammy_Jellyfish']['result'], 'Succeeded', 'Skipped'),
         not(contains(dependencies['git_commit']['outputs']['commit.message'], '[ci skip]'))
       )
     matrix:
@@ -222,10 +226,10 @@ jobs:
   parameters:
     name: macOS
     vmImage: macOS-11
-    dependsOn: [linting, git_commit]
+    dependsOn: [linting, git_commit, Ubuntu_Jammy_Jellyfish]
     condition: |
       and(
-        succeeded(),
+        in(dependencies['Ubuntu_Jammy_Jellyfish']['result'], 'Succeeded', 'Skipped'),
         not(contains(dependencies['git_commit']['outputs']['commit.message'], '[ci skip]'))
       )
     matrix:
@@ -244,10 +248,10 @@ jobs:
   parameters:
     name: Windows
     vmImage: windows-latest
-    dependsOn: [linting, git_commit]
+    dependsOn: [linting, git_commit, Ubuntu_Jammy_Jellyfish]
     condition: |
       and(
-        succeeded(),
+        in(dependencies['Ubuntu_Jammy_Jellyfish']['result'], 'Succeeded', 'Skipped'),
         not(contains(dependencies['git_commit']['outputs']['commit.message'], '[ci skip]'))
       )
     matrix:

benchmarks/bench_saga.py

@@ -7,8 +7,7 @@
 import time
 import os
 
-from joblib import Parallel
-from sklearn.utils.fixes import delayed
+from sklearn.utils.parallel import delayed, Parallel
 import matplotlib.pyplot as plt
 import numpy as np
 

build_tools/azure/debian_atlas_32bit_lock.txt

@@ -1,28 +1,26 @@
 #
-# This file is autogenerated by pip-compile with python 3.9
-# To update, run:
+# This file is autogenerated by pip-compile with Python 3.9
+# by the following command:
 #
 #    pip-compile --output-file=build_tools/azure/debian_atlas_32bit_lock.txt build_tools/azure/debian_atlas_32bit_requirements.txt
 #
-attrs==22.1.0
+attrs==22.2.0
     # via pytest
-cython==0.29.32
+cython==0.29.33
     # via -r build_tools/azure/debian_atlas_32bit_requirements.txt
 joblib==1.1.1
     # via -r build_tools/azure/debian_atlas_32bit_requirements.txt
 more-itertools==9.0.0
     # via pytest
-packaging==21.3
+packaging==23.0
     # via pytest
 pluggy==0.13.1
     # via pytest
 py==1.11.0
     # via pytest
-pyparsing==3.0.9
-    # via packaging
 pytest==5.3.1
     # via -r build_tools/azure/debian_atlas_32bit_requirements.txt
 threadpoolctl==2.2.0
     # via -r build_tools/azure/debian_atlas_32bit_requirements.txt
-wcwidth==0.2.5
+wcwidth==0.2.6
     # via pytest

build_tools/azure/get_commit_message.py

@@ -19,6 +19,19 @@ def get_commit_message():
     else:
         commit_message = build_source_version_message
 
+    # Sanitize the commit message to avoid introducing a vulnerability: a PR
+    # submitter could include the "##vso" special marker in their commit
+    # message to attempt to obfuscate the injection of arbitrary commands in
+    # the Azure pipeline.
+    #
+    # This can be a problem if the PR reviewers do not pay close enough
+    # attention to the full commit message prior to clicking the merge button
+    # and as a result make the inject code run in a protected branch with
+    # elevated access to CI secrets. On a protected branch, Azure
+    # already sanitizes `BUILD_SOURCEVERSIONMESSAGE`, but the message
+    # will still be sanitized here out of precaution.
+    commit_message = commit_message.replace("##vso", "..vso")
+
     return commit_message
 
 

build_tools/azure/install.sh

@@ -29,7 +29,6 @@ setup_ccache() {
 
 pre_python_environment_install() {
     if [[ "$DISTRIB" == "ubuntu" ]]; then
-        sudo add-apt-repository --remove ppa:ubuntu-toolchain-r/test
         sudo apt-get update
         sudo apt-get install python3-scipy python3-matplotlib \
              libatlas3-base libatlas-base-dev python3-virtualenv ccache
@@ -84,11 +83,11 @@ python_environment_install_and_activate() {
         echo "Installing development dependency wheels"
         dev_anaconda_url=https://pypi.anaconda.org/scipy-wheels-nightly/simple
         pip install --pre --upgrade --timeout=60 --extra-index $dev_anaconda_url numpy pandas scipy
-        echo "Installing Cython from PyPI enabling pre-releases"
-        pip install --pre cython
-        echo "Installing joblib master"
+        echo "Installing Cython from latest sources"
+        pip install https://github.com/cython/cython/archive/master.zip
+        echo "Installing joblib from latest sources"
         pip install https://github.com/joblib/joblib/archive/master.zip
-        echo "Installing pillow master"
+        echo "Installing pillow from latest sources"
         pip install https://github.com/python-pillow/Pillow/archive/main.zip
     fi
 }
@@ -105,6 +104,12 @@ scikit_learn_install() {
         # Without openmp, we use the system clang. Here we use /usr/bin/ar
         # instead because llvm-ar errors
         export AR=/usr/bin/ar
+        # Make sure omp.h is not present in the conda environment, so that
+        # using an unprotected "cimport openmp" will make this build fail. At
+        # the time of writing (2023-01-13), on OSX, blas (mkl or openblas)
+        # brings in openmp so that you end up having the omp.h include inside
+        # the conda environment.
+        find $CONDA_PREFIX -name omp.h -delete -print
     fi
 
     if [[ "$UNAMESTR" == "Linux" ]]; then

build_tools/azure/linting.sh

@@ -34,10 +34,15 @@ then
     exit 1
 fi
 
-joblib_import="$(git grep -l -A 10 -E "joblib import.+delayed" -- "*.py" ":!sklearn/utils/_joblib.py" ":!sklearn/utils/fixes.py")"
-
-if [ ! -z "$joblib_import" ]; then
-    echo "Use from sklearn.utils.fixes import delayed instead of joblib delayed. The following files contains imports to joblib.delayed:"
-    echo "$joblib_import"
+joblib_delayed_import="$(git grep -l -A 10 -E "joblib import.+delayed" -- "*.py" ":!sklearn/utils/_joblib.py" ":!sklearn/utils/parallel.py")"
+if [ ! -z "$joblib_delayed_import" ]; then
+    echo "Use from sklearn.utils.parallel import delayed instead of joblib delayed. The following files contains imports to joblib.delayed:"
+    echo "$joblib_delayed_import"
+    exit 1
+fi
+joblib_Parallel_import="$(git grep -l -A 10 -E "joblib import.+Parallel" -- "*.py" ":!sklearn/utils/_joblib.py" ":!sklearn/utils/parallel.py")"
+if [ ! -z "$joblib_Parallel_import" ]; then
+    echo "Use from sklearn.utils.parallel import Parallel instead of joblib Parallel. The following files contains imports to joblib.Parallel:"
+    echo "$joblib_Parallel_import"
     exit 1
 fi