MAINT: Bump actions/dependency-review-action from 4.6.0 to 4.7.1

.github/workflows/codeql.yml

@@ -47,7 +47,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/init@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -57,7 +57,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/autobuild@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -70,6 +70,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/analyze@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -19,6 +19,6 @@ jobs:
         with:
           persist-credentials: false
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@ce3cf9537a52e8119d91fd484ab5b8a807627bf8 # v4.6.0
+        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1
         with:
           allow-ghsas: GHSA-cx63-2mw6-8hw5

.github/workflows/emscripten.yml

@@ -49,7 +49,7 @@ jobs:
           fetch-tags: true
           persist-credentials: false
 
-      - uses: pypa/cibuildwheel@d04cacbc9866d432033b1d09142936e6a0e2121a  # 2.23.2
+      - uses: pypa/cibuildwheel@faf86a6ed7efa889faf6996aa23820831055001a  # 2.23.3
         env:
           CIBW_PLATFORM: pyodide
 

.github/workflows/macos.yml

@@ -124,7 +124,7 @@ jobs:
         fetch-tags: true
         persist-credentials: false
 
-    - uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04
+    - uses: astral-sh/setup-uv@6b9c6063abd6010835644d4c2e1bef4cf5cd0fca
       with:
         activate-environment: true
         python-version: ${{ matrix.version }}

.github/workflows/scorecards.yml

@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 # v2.1.27
+        uses: github/codeql-action/upload-sarif@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v2.1.27
         with:
           sarif_file: results.sarif

.github/workflows/wheels.yml

@@ -91,11 +91,15 @@ jobs:
           - [macos-14, macosx_arm64, accelerate]  # always use accelerate
           - [windows-2019, win_amd64, ""]
           - [windows-2019, win32, ""]
+          - [windows-11-arm, win_arm64, ""]
         python: ["cp311", "cp312", "cp313", "cp313t", "pp311"]
         exclude:
           # Don't build PyPy 32-bit windows
           - buildplat: [windows-2019, win32, ""]
             python: "pp311"
+          # Don't build PyPy arm64 windows
+          - buildplat: [windows-11-arm, win_arm64, ""]
+            python: "pp311"
           # No PyPy on musllinux images
           - buildplat: [ ubuntu-22.04, musllinux_x86_64, "" ]
             python: "pp311"
@@ -121,6 +125,12 @@ jobs:
         with:
           architecture: 'x86'
 
+      - name: Setup MSVC arm64
+        if: ${{ matrix.buildplat[1] == 'win_arm64' }}
+        uses: bus1/cabuild/action/msdevshell@e22aba57d6e74891d059d66501b6b5aed8123c4d  # v1
+        with:
+          architecture: 'arm64'
+
       - name: pkg-config-for-win
         run: |
           choco install -y --no-progress --stoponfirstfailure --checksum 6004DF17818F5A6DBF19CB335CC92702 pkgconfiglite
@@ -171,7 +181,7 @@ jobs:
           echo "CIBW_BUILD_FRONTEND=pip; args: --no-build-isolation" >> "$GITHUB_ENV"
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@d04cacbc9866d432033b1d09142936e6a0e2121a  # v2.23.2
+        uses: pypa/cibuildwheel@faf86a6ed7efa889faf6996aa23820831055001a  # v2.23.3
         env:
           CIBW_BUILD: ${{ matrix.python }}-${{ matrix.buildplat[1] }}
 
@@ -181,6 +191,7 @@ jobs:
           path: ./wheelhouse/*.whl
 
       - uses: mamba-org/setup-micromamba@0dea6379afdaffa5d528b3d1dabc45da37f443fc
+        if: ${{ matrix.buildplat[1] != 'win_arm64' }} # unsupported platform at the moment
         with:
           # for installation of anaconda-client, required for upload to
           # anaconda.org

.github/workflows/windows.yml

@@ -35,7 +35,7 @@ jobs:
         persist-credentials: false
 
     - name: Setup Python
-      uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04
+      uses: astral-sh/setup-uv@6b9c6063abd6010835644d4c2e1bef4cf5cd0fca
       with:
         activate-environment: true
         python-version: ${{ matrix.compiler-pyversion[1] }}
@@ -96,9 +96,17 @@ jobs:
       run: |
         spin test -- --timeout=600 --durations=10
 
-  msvc_32bit_python_no_openblas:
-    name: MSVC, 32-bit Python, no BLAS
-    runs-on: windows-2019
+  msvc_python_no_openblas:
+    name: MSVC, ${{ matrix.architecture }} Python , no BLAS
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: windows-2019
+            architecture: x86
+          - os: windows-11-arm
+            architecture: arm64
     # To enable this job on a fork, comment out:
     if: github.repository == 'numpy/numpy'
     steps:
@@ -109,16 +117,16 @@ jobs:
           fetch-tags: true
           persist-credentials: false
 
-      - name: Setup Python (32-bit)
+      - name: Setup Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.11'
-          architecture: 'x86'
+          architecture: ${{ matrix.architecture }}
 
-      - name: Setup MSVC (32-bit)
+      - name: Setup MSVC
         uses: bus1/cabuild/action/msdevshell@e22aba57d6e74891d059d66501b6b5aed8123c4d  # v1
         with:
-          architecture: 'x86'
+          architecture: ${{ matrix.architecture }}
 
       - name: Build and install
         run: |

benchmarks/benchmarks/__init__.py

@@ -5,7 +5,7 @@
 def show_cpu_features():
     from numpy.lib._utils_impl import _opt_info
     info = _opt_info()
-    info = "NumPy CPU features: " + (info if info else 'nothing enabled')
+    info = "NumPy CPU features: " + (info or 'nothing enabled')
     # ASV wrapping stdout & stderr, so we assume having a tty here
     if 'SHELL' in os.environ and sys.platform != 'win32':
         # to avoid the red color that imposed by ASV

benchmarks/benchmarks/bench_ufunc.py

@@ -342,7 +342,7 @@ def time_ufunc_small_array(self, ufuncname):
         self.f(self.array_5)
 
     def time_ufunc_small_array_inplace(self, ufuncname):
-        self.f(self.array_5, out = self.array_5)
+        self.f(self.array_5, out=self.array_5)
 
     def time_ufunc_small_int_array(self, ufuncname):
         self.f(self.array_int_3)
@@ -432,7 +432,7 @@ def time_divide_scalar2_inplace(self, dtype):
 
 
 class CustomComparison(Benchmark):
-    params = (np.int8,  np.int16,  np.int32,  np.int64, np.uint8, np.uint16,
+    params = (np.int8, np.int16, np.int32, np.int64, np.uint8, np.uint16,
               np.uint32, np.uint64, np.float32, np.float64, np.bool)
     param_names = ['dtype']
 

benchmarks/benchmarks/common.py

@@ -20,14 +20,14 @@
 TYPES1 = [
     'int16', 'float16',
     'int32', 'float32',
-    'int64', 'float64',  'complex64',
+    'int64', 'float64', 'complex64',
     'complex128',
 ]
 
 DLPACK_TYPES = [
     'int16', 'float16',
     'int32', 'float32',
-    'int64', 'float64',  'complex64',
+    'int64', 'float64', 'complex64',
     'complex128', 'bool',
 ]
 

doc/release/upcoming_changes/28769.performance.rst

@@ -0,0 +1,8 @@
+Performance improvements for ``np.float16`` casts
+--------------------------------------------------
+Earlier, floating point casts to and from ``np.float16`` types
+were emulated in software on all platforms.
+
+Now, on ARM devices that support Neon float16 intrinsics (such as
+recent Apple Silicon), the native float16 path is used to achieve
+the best performance.

doc/release/upcoming_changes/28856.improvement.rst

@@ -0,0 +1,5 @@
+* ``np.dtypes.StringDType`` is now a
+  `generic type <https://typing.python.org/en/latest/spec/generics.html>`_ which
+  accepts a type argument for ``na_object`` that defaults to ``typing.Never``.
+  For example, ``StringDType(na_object=None)`` returns a ``StringDType[None]``,
+  and ``StringDType()`` returns a ``StringDType[typing.Never]``.

doc/release/upcoming_changes/28884.deprecation.rst

@@ -0,0 +1,28 @@
+``numpy.typing.NBitBase`` deprecation
+-------------------------------------
+The ``numpy.typing.NBitBase`` type has been deprecated and will be removed in a future version.
+
+This type was previously intended to be used as a generic upper bound for type-parameters, for example:
+
+.. code-block:: python
+
+    import numpy as np
+    import numpy.typing as npt
+
+    def f[NT: npt.NBitBase](x: np.complexfloating[NT]) -> np.floating[NT]: ...
+
+But in NumPy 2.2.0, ``float64`` and ``complex128`` were changed to concrete subtypes, causing static type-checkers to reject ``x: np.float64 = f(np.complex128(42j))``.
+
+So instead, the better approach is to use ``typing.overload``:
+
+.. code-block:: python
+
+    import numpy as np
+    from typing import overload
+
+    @overload
+    def f(x: np.complex64) -> np.float32: ...
+    @overload
+    def f(x: np.complex128) -> np.float64: ...
+    @overload
+    def f(x: np.clongdouble) -> np.longdouble: ...

doc/source/building/cross_compilation.rst

@@ -2,10 +2,10 @@ Cross compilation
 =================
 
 Cross compilation is a complex topic, we only add some hopefully helpful hints
-here (for now). As of May 2023, cross-compilation based on ``crossenv`` is
-known to work, as used (for example) in conda-forge. Cross-compilation without
-``crossenv`` requires some manual overrides. You instruct these overrides by
-passing options to ``meson setup`` via `meson-python`_.
+here (for now). As of May 2025, cross-compilation with a Meson cross file as
+well as cross-compilation based on ``crossenv`` are known to work. Conda-forge
+uses the latter method. Cross-compilation without ``crossenv`` requires passing
+build options to ``meson setup`` via `meson-python`_.
 
 .. _meson-python: https://meson-python.readthedocs.io/en/latest/how-to-guides/meson-args.html
 
@@ -33,9 +33,18 @@ your *cross file*:
     [properties]
     longdouble_format = 'IEEE_DOUBLE_LE'
 
+For an example of a cross file needed to cross-compile NumPy, see
+`numpy#288861 <https://github.com/numpy/numpy/issues/28861#issuecomment-2844257091>`__.
+Putting that together, invoking a cross build with such a cross file, looks like:
+
+.. code:: bash
+
+   $ python -m build --wheel -Csetup-args="--cross-file=aarch64-myos-cross-file.txt"
+
 For more details and the current status around cross compilation, see:
 
 - The state of cross compilation in Python:
   `pypackaging-native key issue page <https://pypackaging-native.github.io/key-issues/cross_compilation/>`__
+- The `set of NumPy issues with the "Cross compilation" label <https://github.com/numpy/numpy/issues?q=state%3Aclosed%20label%3A%2238%20-%20Cross%20compilation%22>`__
 - Tracking issue for SciPy cross-compilation needs and issues:
   `scipy#14812 <https://github.com/scipy/scipy/issues/14812>`__

doc/source/building/index.rst

@@ -52,7 +52,7 @@ your system.
     * BLAS and LAPACK libraries. `OpenBLAS <https://github.com/OpenMathLib/OpenBLAS/>`__
       is the NumPy default; other variants include Apple Accelerate,
       `MKL <https://software.intel.com/en-us/intel-mkl>`__,
-      `ATLAS <http://math-atlas.sourceforge.net/>`__ and
+      `ATLAS <https://math-atlas.sourceforge.net/>`__ and
       `Netlib <https://www.netlib.org/lapack/index.html>`__ (or "Reference")
       BLAS and LAPACK.
 

doc/source/building/introspecting_a_build.rst

@@ -19,4 +19,4 @@ These things are all available after the configure stage of the build (i.e.,
 information, rather than running the build and reading the full build log.
 
 For more details on this topic, see the
-`SciPy doc page on build introspection <http://scipy.github.io/devdocs/building/introspecting_a_build.html>`__.
+`SciPy doc page on build introspection <https://scipy.github.io/devdocs/building/introspecting_a_build.html>`__.

doc/source/f2py/code/setup_example.py

@@ -1,16 +1,16 @@
 from numpy.distutils.core import Extension
 
-ext1 = Extension(name = 'scalar',
-                 sources = ['scalar.f'])
-ext2 = Extension(name = 'fib2',
-                 sources = ['fib2.pyf', 'fib1.f'])
+ext1 = Extension(name='scalar',
+                 sources=['scalar.f'])
+ext2 = Extension(name='fib2',
+                 sources=['fib2.pyf', 'fib1.f'])
 
 if __name__ == "__main__":
     from numpy.distutils.core import setup
-    setup(name = 'f2py_example',
-          description = "F2PY Users Guide examples",
-          author = "Pearu Peterson",
-          author_email = "[email protected]",
-          ext_modules = [ext1, ext2]
+    setup(name='f2py_example',
+          description="F2PY Users Guide examples",
+          author="Pearu Peterson",
+          author_email="[email protected]",
+          ext_modules=[ext1, ext2]
           )
 # End of setup_example.py

doc/source/f2py/f2py.getting-started.rst

@@ -308,4 +308,4 @@ the previous case::
   >>> print(fib3.fib(8))
   [  0.   1.   1.   2.   3.   5.   8.  13.]
 
-.. _`system dependencies panel`: http://scipy.github.io/devdocs/building/index.html#system-level-dependencies
+.. _`system dependencies panel`: https://scipy.github.io/devdocs/building/index.html#system-level-dependencies

doc/source/f2py/windows/index.rst

@@ -217,4 +217,4 @@ path using a hash. This needs to be added to the ``PATH`` variable.
 .. _are outdated: https://github.com/conda-forge/conda-forge.github.io/issues/1044
 .. _now deprecated: https://github.com/numpy/numpy/pull/20875
 .. _LLVM Flang: https://releases.llvm.org/11.0.0/tools/flang/docs/ReleaseNotes.html
-.. _SciPy's documentation: http://scipy.github.io/devdocs/building/index.html#system-level-dependencies
+.. _SciPy's documentation: https://scipy.github.io/devdocs/building/index.html#system-level-dependencies

doc/source/reference/simd/gen_features.py

@@ -2,6 +2,7 @@
 Generate CPU features tables from CCompilerOpt
 """
 from os import path
+
 from numpy.distutils.ccompiler_opt import CCompilerOpt
 
 class FakeCCompilerOpt(CCompilerOpt):

doc/source/user/basics.dispatch.rst

@@ -7,8 +7,8 @@ Writing custom array containers
 Numpy's dispatch mechanism, introduced in numpy version v1.16 is the
 recommended approach for writing custom N-dimensional array containers that are
 compatible with the numpy API and provide custom implementations of numpy
-functionality. Applications include `dask <http://dask.pydata.org>`_ arrays, an
-N-dimensional array distributed across multiple nodes, and `cupy
+functionality. Applications include `dask <https://docs.dask.org/en/stable/>`_
+arrays, an N-dimensional array distributed across multiple nodes, and `cupy
 <https://docs-cupy.chainer.org/en/stable/>`_ arrays, an N-dimensional array on
 a GPU.
 

doc/source/user/c-info.python-as-glue.rst

@@ -144,7 +144,7 @@ written C-code.
 Cython
 ======
 
-`Cython <http://cython.org>`_ is a compiler for a Python dialect that adds
+`Cython <https://cython.org>`_ is a compiler for a Python dialect that adds
 (optional) static typing for speed, and allows mixing C or C++ code
 into your modules. It produces C or C++ extensions that can be compiled
 and imported in Python code.

doc/source/user/numpy-for-matlab-users.rst

@@ -810,7 +810,7 @@ Links
 =====
 
 Another somewhat outdated MATLAB/NumPy cross-reference can be found at
-http://mathesaurus.sf.net/
+https://mathesaurus.sf.net/
 
 An extensive list of tools for scientific work with Python can be
 found in the `topical software page <https://projects.scipy.org/topical-software.html>`__.