Increase dependency lower bounds

[mfisher87]

Omit versions of dependencies that can't be installed now that we've upgraded our minimum supported version of Python to 3.12.

[mfisher87]

@neutrinoceros please let me know if you have any opinions on this PR :) Thanks for your help this week!

[neutrinoceros]

If you're already into uv I do have a couple suggestions:

1. configure uv to exclude installing from sdists for some known-heavy dependencies

[tool.uv]
no-build-package = [
    "numpy",
    "scipy",
    ...
]

2. add a job with UV_RESOLUTION=lowest (or the equivalent CLI flags) and check that it actually installs what you declare as lower bounds. If it doesn't, you may need to bump them some more.

Beware however that lowest is sometimes tricky to set up because all it takes to fail is a single transitive dependency to not have any version constraint and an oldest version that

• has no wheel
• doesn't build against current setuptools

You can get around these by tweaking uv's settings (mostly no-build-package and constraint-dependency), and eventually upstreaming them.
On the other hand, you might want to use lowest-direct instead. It's usually easier to set up but also much less stable (as transitive dependencies are silently upgraded but direct ones aren't).

[mfisher87]

1. I personally use and advocate for uv when I'm teaching, but I think other maintainers may not share my infatuation :) I'll explore this! Thanks 🙏

Beware however that lowest is sometimes tricky to set up because all it takes to fail is a single transitive dependency to not have any version constraint and an oldest version that

* has no wheel

* doesn't build against current setuptools

...

On the other hand, you might want to use lowest-direct instead

Yeah, I went through this and lowest-direct is exactly what I did to come to these version numbers :) But that was manual. Agreed it will be valuable to do this test in CI as well, and I don't know of any tools other than uv that can 🤔

[neutrinoceros]

I think other maintainers may not share my infatuation

Setting up uv in CI doesn't imply that other tools cease to work for maintainers ! I've been using uv in CI precisely because of --resolution=lowest` in projects where most other maintainers prefer to keep using pip.

[mfisher87]

Yeah, I get that, but with uv being owned by OpenAI now, there may be concerns that are more ethical in nature than mechanical.

Personally, I'm very very sad that uv is owned by OpenAI but I still think it's the best tool for the job, it's still open source, and it's the easiest to teach/learn, so I still use it. I guess I just feel less joyful about using it now because it's got that OpenAI stank on it.

[neutrinoceros]

Oh I very much get it. The acquisition announcement was devastating. I'm hoping that when (not if) OpenAI shuts it down, make it closed source, or otherwise enshitifies it, we can rally behind a community fork, as the current license allows for it.

[mfisher87]

💯

[mfisher87]

Gonna yolo-merge, I think this is a fairly uncontroversial and safe PR and other maintainers are very busy :)