[MNT] Bump numpy version to >=1.21.0, <1.22

[lmmentel]

Reference Issues/PRs

• Fixes [ENH] Upgrading to numpy 1.20 #1794 (& duplicate Relax "numpy==1.19.3" dependency  #1914)
• Fixes StatsModels and Numpy to have a >= version instead of == version #1787

What does this implement/fix? Explain your changes.

Bumping numpy to >=1.21.0,<1.22

Does your contribution introduce a new dependency? If yes, which one?

What should a reviewer concentrate their feedback on?

Any other comments?

PR checklist

For all contributions

• I've added myself to the list of contributors.
• Optionally, I've updated sktime's CODEOWNERS to receive notifications about future changes to these files.
• I've added unit tests and made sure they pass locally.

For new estimators

• I've added the estimator to the online documentation.
• I've updated the existing example notebooks or provided a new one to showcase how my estimator works.

[lmmentel]

Looks like nothing broke after bumping numpy 🙂 🚀

[fkiraly]

Great!

Quick Q, why does nothing break? Because we discontinued support for python 3.6 (which in turn influences the upper pandas bound)?

[lmmentel]

Quick Q, why does nothing break? Because we discontinued support for python 3.6 (which in turn influences the upper pandas bound)?

This is not an easy question to answer, but recent changes in #1620 made it easy to introduce this change also dropping 3.6 released some of the constraints on package versions.

[fkiraly]

So, here's another question, @lmmentel: why a lower bound of 01.21.0? This does not include the old version, and may break things for users.
Would it be problematic to have this at 1.19.3 (the old version)?

[lmmentel]

I bumped it since I got a dependabot alert about my other package that there are vulnerabilities in numpy the recommended action is to bump it at least to 1.21, I can decrease the lower bound if you are afraid of users not being able to use sktime. BTW this will only affect people installing sktime 0.10.0 onward so I don't think it's an issue.

[fkiraly]

I bumped it since I got a dependabot alert about my other package

This violates the "Thou shalt have no other packages before sktime" clause in the sktime code of conduct ... or am I confusing this with another literature source? :-)

[ilkersigirci]

Is there any specific reason not to include numpy version 1.22 ?

[fkiraly]

@ilkersigirci, since this is a general Q, answering it here: #2037