make release-tag: Merge branch 'main' into stable

amontanez24 · amontanez24 · commit 8ecaf435b948 · 2024-04-10T11:36:27.000-05:00
diff --git a/.github/workflows/dependency_checker.yml b/.github/workflows/dependency_checker.yml
@@ -0,0 +1,29 @@
+name: Dependency Checker
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * 1-5'
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Python 3.9
+      uses: actions/setup-python@v5
+      with:
+        python-version: 3.9
+    - name: Install dependencies
+      run: |
+        python -m pip install .[dev]
+        make check-deps OUTPUT_FILEPATH=latest_requirements.txt
+    - name: Create pull request
+      id: cpr
+      uses: peter-evans/create-pull-request@v4
+      with:
+        token: ${{ secrets.GH_ACCESS_TOKEN }}
+        commit-message: Update latest dependencies
+        title: Automated Latest Dependency Updates
+        body: "This is an auto-generated PR with **latest** dependency updates."
+        branch: latest-dependency-update
+        branch-suffix: short-commit-hash
+        base: main
diff --git a/.github/workflows/end_to_end.yml b/.github/workflows/end_to_end.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        python-version: ['3.8', '3.9', '3.10', '3.11']
+        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
     - uses: actions/checkout@v1
diff --git a/.github/workflows/minimum.yml b/.github/workflows/minimum.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        python-version: ['3.8', '3.9', '3.10', '3.11']
+        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
     - uses: actions/checkout@v1
diff --git a/.github/workflows/numerical.yml b/.github/workflows/numerical.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        python-version: ['3.8', '3.9', '3.10', '3.11']
+        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
     - uses: actions/checkout@v1
diff --git a/.github/workflows/readme.yml b/.github/workflows/readme.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        python-version: ['3.8', '3.9', '3.10', '3.11']
+        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
         os: [ubuntu-latest, macos-latest]
     steps:
     - uses: actions/checkout@v1
diff --git a/.github/workflows/static_code_analysis.yml b/.github/workflows/static_code_analysis.yml
@@ -0,0 +1,33 @@
+name: Static Code Analysis
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  code-analysis:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Python 3.10
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.10'
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install bandit==1.7.7
+    - name: Save code analysis
+      run: bandit -r . -x ./tests -f txt -o static_code_analysis.txt --exit-zero
+    - name: Create pull request
+      id: cpr
+      uses: peter-evans/create-pull-request@v4
+      with:
+        token: ${{ secrets.GH_ACCESS_TOKEN }}
+        commit-message: Update static code analysis
+        title: Latest Code Analysis
+        body: "This is an auto-generated PR with the **latest** code analysis results."
+        branch: static-code-analysis
+        branch-suffix: short-commit-hash
+        base: main
diff --git a/.github/workflows/tutorials.yml b/.github/workflows/tutorials.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ['3.8', '3.9', '3.10', '3.11']
+        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
     steps:
     - uses: actions/checkout@v1
     - name: Set up Python ${{ matrix.python-version }}
diff --git a/.github/workflows/unit.yml b/.github/workflows/unit.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        python-version: ['3.8', '3.9', '3.10', '3.11']
+        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
     - uses: actions/checkout@v1
diff --git a/HISTORY.md b/HISTORY.md
@@ -1,5 +1,19 @@
 # History
 
+## v0.11.0 - 2024-04-10
+
+This release adds support for Python 3.12!
+
+### Bugs Fixed
+
+* Fix minimum version workflow when pointing to github branch - Issue [#392](https://github.com/sdv-dev/Copulas/issues/392) by @R-Palazzo
+
+### Maintenance
+
+* Support Python 3.12 - Issue [#372](https://github.com/sdv-dev/Copulas/issues/372) by @fealho
+* Add dependency checker - Issue [#388](https://github.com/sdv-dev/Copulas/issues/388) by @lajohn4747
+* Add bandit workflow - Issue [#391](https://github.com/sdv-dev/Copulas/issues/391) by @R-Palazzo
+
 ## v0.10.1 - 2024-03-13
 
 This release fixes a bug that occurred when calculating probability density in a gaussian copula.
diff --git a/Makefile b/Makefile
@@ -249,6 +249,11 @@ ifeq ($(CHANGELOG_LINES),0)
 	$(error Please insert the release notes in HISTORY.md before releasing)
 endif
 
+.PHONY: check-deps
+check-deps: # Dependency targets
+	$(eval allow_list='numpy=|pandas=|scipy=|plotly=')
+	pip freeze | grep -v "Copulas.git" | grep -E $(allow_list) | sort > $(OUTPUT_FILEPATH)
+
 .PHONY: check-release
 check-release: check-clean check-candidate check-main check-history ## Check if the release can be made
 	@echo "A new release can be made"
diff --git a/copulas/__init__.py b/copulas/__init__.py
@@ -4,18 +4,18 @@
 
 __author__ = 'DataCebo, Inc.'
 __email__ = 'info@sdv.dev'
-__version__ = '0.10.1'
+__version__ = '0.11.0.dev1'
 
 import contextlib
 import importlib
 import sys
 import warnings
 from copy import deepcopy
+from importlib.metadata import entry_points
 from operator import attrgetter
 
 import numpy as np
 import pandas as pd
-from pkg_resources import iter_entry_points
 
 EPSILON = np.finfo(np.float32).eps
 
@@ -311,7 +311,13 @@ def _get_addon_target(addon_path_name):
 def _find_addons():
     """Find and load all copulas add-ons."""
     group = 'copulas_modules'
-    for entry_point in iter_entry_points(group=group):
+    try:
+        eps = entry_points(group=group)
+    except TypeError:
+        # Load-time selection requires Python >= 3.10 or importlib_metadata >= 3.6
+        eps = entry_points().get(group, [])
+
+    for entry_point in eps:
         try:
             addon = entry_point.load()
         except Exception:  # pylint: disable=broad-exception-caught
diff --git a/latest_requirements.txt b/latest_requirements.txt
@@ -0,0 +1,4 @@
+numpy==1.26.4
+pandas==2.2.1
+plotly==5.20.0
+scipy==1.13.0
diff --git a/pyproject.toml b/pyproject.toml
@@ -12,22 +12,25 @@ classifiers = [
     'Programming Language :: Python :: 3.9',
     'Programming Language :: Python :: 3.10',
     'Programming Language :: Python :: 3.11',
+    'Programming Language :: Python :: 3.12',
     'Topic :: Scientific/Engineering :: Artificial Intelligence',
 ]
 keywords = [ 'copulas' ]
 dynamic = ["version"]
 license = { text = 'BSL-1.1' }
-requires-python = '>=3.8,<3.12'
+requires-python = '>=3.8,<3.13'
 readme = 'README.md'
 dependencies = [
-    "numpy>=1.20.0,<2;python_version<'3.10'",
-    "numpy>=1.23.3,<2;python_version>='3.10'",
+    "numpy>=1.20.0;python_version<'3.10'",
+    "numpy>=1.23.3;python_version>='3.10' and python_version<'3.12'",
+    "numpy>=1.26.0;python_version>='3.12'",
     "pandas>=1.1.3;python_version<'3.10'",
     "pandas>=1.3.4;python_version>='3.10' and python_version<'3.11'",
     "pandas>=1.5.0;python_version>='3.11'",
-    'plotly>=5.10.0,<6',
-    "scipy>=1.5.4,<2;python_version<'3.10'",
-    "scipy>=1.9.2,<2;python_version>='3.10'",
+    'plotly>=5.10.0',
+    "scipy>=1.5.4;python_version<'3.10'",
+    "scipy>=1.9.2;python_version>='3.10' and python_version<'3.12'",
+    "scipy>=1.12.0;python_version>='3.12'",
 ]
 
 [project.urls]
@@ -47,14 +50,15 @@ version = {attr = 'copulas.__version__'}
 [project.optional-dependencies]
 tutorials = [
     'markupsafe<=2.0.1',
-    'scikit-learn>=0.24,<1.2',
+    "scikit-learn>=0.24,<1.2;python_version<'3.10'",
+    "scikit-learn>=0.24,<1.5;python_version>='3.10'",
     'jupyter>=1.0.0,<2',
 ]
 test = [
     'copulas[tutorials]',
     'pytest>=6.2.5,<7',
     'pytest-cov>=2.6.0,<3',
-    'pytest-rerunfailures>=9.0.0,<10',
+    'pytest-rerunfailures>=10.3,<15',
     'rundoc>=0.4.3,<0.5',
     'tomli>=2.0.0,<3',
 ]
@@ -65,13 +69,19 @@ dev = [
     'pip>=9.0.1',
     'build>=1.0.0,<2',
     'bump-my-version>=0.18.3,<1',
-    'watchdog>=0.8.3,<0.11',
+    'watchdog>=1.0.1,<5',
 
     # docs
     'm2r>=0.2.0,<0.3',
     'nbsphinx>=0.5.0,<0.7',
     'Sphinx>=1.7.1,<3',
     'sphinx_rtd_theme>=0.2.4,<0.5',
+    'sphinxcontrib_applehelp<1.0.8',
+    'sphinxcontrib-devhelp<1.0.6',
+    'sphinxcontrib-htmlhelp<2.0.5',
+    'sphinxcontrib_serializinghtml<1.1.10',
+    'sphinxcontrib_qthelp<1.0.7',
+    'alabaster<0.7.13',
 
     # Jinja2>=3 makes the sphinx theme fail
     'Jinja2>=2,<3',
@@ -158,16 +168,16 @@ namespaces = false
     '*.png',
     '*.gif'
 ]
-'tests' = ['*']
 
 [tool.setuptools.exclude-package-data]
 '*' = [
     '* __pycache__',
     '*.py[co]',
+    'static_code_analysis.txt',
 ]
 
 [tool.bumpversion]
-current_version = "0.10.1"
+current_version = "0.11.0.dev1"
 commit = true
 tag = true
 parse = '(?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(\.(?P<release>[a-z]+)(?P<candidate>\d+))?'
diff --git a/static_code_analysis.txt b/static_code_analysis.txt
@@ -0,0 +1,113 @@
+Run started:2024-04-10 07:28:27.016244
+
+Test results:
+>> Issue: [B403:blacklist] Consider possible security implications associated with pickle module.
+   Severity: Low   Confidence: High
+   CWE: CWE-502 (https://cwe.mitre.org/data/definitions/502.html)
+   More Info: https://bandit.readthedocs.io/en/1.7.7/blacklists/blacklist_imports.html#b403-import-pickle
+   Location: ./copulas/multivariate/base.py:3:0
+2	
+3	import pickle
+4	
+
+--------------------------------------------------
+>> Issue: [B301:blacklist] Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
+   Severity: Medium   Confidence: High
+   CWE: CWE-502 (https://cwe.mitre.org/data/definitions/502.html)
+   More Info: https://bandit.readthedocs.io/en/1.7.7/blacklists/blacklist_calls.html#b301-pickle
+   Location: ./copulas/multivariate/base.py:177:19
+176	        with open(path, 'rb') as pickle_file:
+177	            return pickle.load(pickle_file)
+178	
+
+--------------------------------------------------
+>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
+   Severity: Low   Confidence: High
+   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
+   More Info: https://bandit.readthedocs.io/en/1.7.7/plugins/b101_assert_used.html
+   Location: ./copulas/optimize/__init__.py:26:4
+25	    """
+26	    assert (f(xmin) <= 0.0).all()
+27	    assert (f(xmax) >= 0.0).all()
+
+--------------------------------------------------
+>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
+   Severity: Low   Confidence: High
+   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
+   More Info: https://bandit.readthedocs.io/en/1.7.7/plugins/b101_assert_used.html
+   Location: ./copulas/optimize/__init__.py:27:4
+26	    assert (f(xmin) <= 0.0).all()
+27	    assert (f(xmax) >= 0.0).all()
+28	
+
+--------------------------------------------------
+>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
+   Severity: Low   Confidence: High
+   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
+   More Info: https://bandit.readthedocs.io/en/1.7.7/plugins/b101_assert_used.html
+   Location: ./copulas/optimize/__init__.py:71:4
+70	    shape = np.shape(fa)
+71	    assert shape == np.shape(fb)
+72	
+
+--------------------------------------------------
+>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
+   Severity: Low   Confidence: High
+   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
+   More Info: https://bandit.readthedocs.io/en/1.7.7/plugins/b101_assert_used.html
+   Location: ./copulas/optimize/__init__.py:77:4
+76	    # Make sure we are bracketing a root in each case
+77	    assert (np.sign(fa) * np.sign(fb) <= 0).all()
+78	    t = 0.5
+
+--------------------------------------------------
+>> Issue: [B403:blacklist] Consider possible security implications associated with pickle module.
+   Severity: Low   Confidence: High
+   CWE: CWE-502 (https://cwe.mitre.org/data/definitions/502.html)
+   More Info: https://bandit.readthedocs.io/en/1.7.7/blacklists/blacklist_imports.html#b403-import-pickle
+   Location: ./copulas/univariate/base.py:3:0
+2	
+3	import pickle
+4	from abc import ABC
+
+--------------------------------------------------
+>> Issue: [B301:blacklist] Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
+   Severity: Medium   Confidence: High
+   CWE: CWE-502 (https://cwe.mitre.org/data/definitions/502.html)
+   More Info: https://bandit.readthedocs.io/en/1.7.7/blacklists/blacklist_calls.html#b301-pickle
+   Location: ./copulas/univariate/base.py:477:19
+476	        with open(path, 'rb') as pickle_file:
+477	            return pickle.load(pickle_file)
+478	
+
+--------------------------------------------------
+>> Issue: [B110:try_except_pass] Try, Except, Pass detected.
+   Severity: Low   Confidence: High
+   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
+   More Info: https://bandit.readthedocs.io/en/1.7.7/plugins/b110_try_except_pass.html
+   Location: ./copulas/univariate/selection.py:32:8
+31	                best_model = model
+32	        except Exception:
+33	            # Distribution not supported
+34	            pass
+35	
+
+--------------------------------------------------
+
+Code scanned:
+	Total lines of code: 3973
+	Total lines skipped (#nosec): 0
+	Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0
+
+Run metrics:
+	Total issues (by severity):
+		Undefined: 0
+		Low: 7
+		Medium: 2
+		High: 0
+	Total issues (by confidence):
+		Undefined: 0
+		Low: 0
+		Medium: 0
+		High: 9
+Files skipped (0):
diff --git a/tasks.py b/tasks.py
diff --git a/tests/test_tasks.py b/tests/test_tasks.py
diff --git a/tests/unit/bivariate/test_base.py b/tests/unit/bivariate/test_base.py
diff --git a/tests/unit/multivariate/test_gaussian.py b/tests/unit/multivariate/test_gaussian.py
diff --git a/tests/unit/test___init__.py b/tests/unit/test___init__.py
diff --git a/tox.ini b/tox.ini
diff --git a/tutorials/04_Syntehtic_Data_for_Machine_Learning.ipynb b/tutorials/04_Syntehtic_Data_for_Machine_Learning.ipynb
