Update pinned numpy version

[WardBrian]

Submission Checklist

• Run unit tests
• Declare copyright holder and open-source license: see below

Summary

After #511 we can require a more recent version of numpy

Copyright and Licensing

Please list the copyright holder for the work you are submitting (this will be you or your assignee, such as a university or company):
Simons Foundation

By submitting this pull request, the copyright holder is agreeing to license the submitted work under the following licenses:

• Code: BSD 3-clause (https://opensource.org/licenses/BSD-3-Clause)

[codecov-commenter]

Codecov Report

Merging #529 (d8b9542) into develop (dc9d1ef) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff            @@
##           develop     #529   +/-   ##
========================================
  Coverage    79.13%   79.13%           
========================================
  Files           45       45           
  Lines         9441     9441           
========================================
  Hits          7471     7471           
  Misses        1970     1970           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update dc9d1ef...d8b9542. Read the comment docs.

[mitzimorris]

great!

[AugustKarlstedt]

does cmdstanpy absolutely require numpy>=1.21? this change makes it difficult in production environments with other dependencies that depend on older numpy versions. if we don't absolutely need >=1.21 and can get by with a less strict numpy version that would be ideal

[WardBrian]

I believe numpy recommended updating for security issues found in <1.19, but the corresponding CVE seems to have since been marked as disputed. I am not sure if we are using any of the numpy.typing features which were new in that version

[WardBrian]

@AugustKarlstedt - I don't believe we currently have any code incompatibilities with earlier numpy versions, if other dependencies force you to override the version in our setup. We will likely update our type signatures to use numpy.typing at some point soon, at which point at least 1.20 will be required as a hard minimum.

[AugustKarlstedt]

Got it, thanks for the update @WardBrian. For now I have pinned cmdstanpy to 1.0.0 to work around this and give other packages some time to up their numpy version requirements.