conda-forge core meeting 2025-10-29

Add new agenda items under the Your __new__() agenda items heading

• Zoom link
• What time is the meeting in my time zone
• Previous meetings

Attendees

Name	Initials	GitHub ID	Affiliation
Cheng H. Lee	CHL	chenghlee	Anaconda/cf
Jaime Rodríguez-Guerra	JRG	jaimergp	Quansight/cf
Mark Allen	MHA	markhallen	GitHub/Dependabot
Sylvain Corlay	SC	QuantStack
Rob Aiken	RA	robaiken	Github/Dependabot
Daniel Ching	DJC	carterbox	NVIDIA/cf

X people total

Standing items

• [ ]

From previous meeting(s)

• [ ]

Active votes

• [ ]

Your new() agenda items

• CHL/MHA/RA: GitHub/Dependabot team
  • (MHA) Have a plan to version updates using dependabot, independent of vulnerability feed
    • Queries the conda API for package versions
  • How to gather & provide CVE/vulnerability data for conda-forge packages?
    • (RA) Get information from GH Advisory database; do have support for Python security advisories
    • (RA) Unsure of how to add new ecosystem to advisory database
    • (MHA) Dependabot running within GHA runner; not feasible because of large download size
    • Could we consider tapping into the PyPI data feed and find matches in conda-forge?
    • (JRG) Add upstream PURLs into recipes; current name mapping is heuristic and subject to error
    • (JRG) complexities: not all versions available; multi-output packages; package renames (need to annotate which versions we switched)
    • (SC) Been looking into integrating conda-forge into repology.
    • XREF: https://conda-forge.org/community/minutes/2025-06-11/
    • (JRG) Need to be careful about burdening volunteer maintainers
  • (CHL) Will invite the GitHub/Dependabot team to Zulip; create GitHub issue
• JRG: zlib -> zlib-ng migration: https://github.com/conda-forge/zlib-ng-feedstock/issues/10
  • CPython 3.14 upstream ships zlibg-ng for Windows, with compatiblity mode; Pillow, various Linux distros switched to zlib-ng
  • Currently not building compat mode on c-f because it would create conflicts with existing zlib
  • (DJC) Continue to support non-compat mode and ask maintainers to explicitly enable zlib-ng
  • Could make compat-mode a zlib variant, using blas as a reference model
  • (CHL) Does zlib-ng support dynamic dispatch for vector instructions? If not, could break on older systems.
• DJC: Tegra support (demanded in robotics)
  • CTK 12.9 packages for Tegra sm87,sm101 devices are now live
  • Third-party packages may start building for Tegra
  • arm-variant not required for CUDA 13 (newer devices are SBSA), but we're not ready yet.
    • Once CUDA 12 is dropped, arm-variant can be retired. (No other packages are known to use arm-variant.)
• DJC: nvidia-virtual-packages
  • A conda virtual package plugin which detects the minimum CUDA architecture available on the system
  • Source: https://github.com/NVIDIA/nvidia-virtual-packages
  • RFC: https://github.com/conda-forge/conda-forge.github.io/issues/2623
  • Motivation: Deep learning packages often have minimum supported CUDA archs which don't align with the CTK
    • https://github.com/conda-forge/cudnn-feedstock/issues/124
    • https://github.com/conda-forge/flash-attn-feedstock/blob/b6e3742a7343268a33a285c593753fd49b46d268/recipe/meta.yaml#L23
  • Motivation: Would be possible to break large binaries into smaller variants along CUDA arch
  • CHL: Apply for conda incubator
  • CHL: CUDA virtual packages should all live in the same place; though we can decide later exactly where.
  • JRG: There is a draft CEP about standard names for virtual packages
  • How to address bootstrap problem
    • conda-forge and Anaconda could just make conda depend on this/these plugins
    • pixi doesn't have a plug-in system, but could integrate virtual packages directly into pixi
• CHL: continued support for Windows 10?
  • Regular security support ended on 14-Oct-2025
  • Took a quick look for main and conda-forge download data; as of 15-Oct, 25%-ish of downloads from conda ... Windows/* user agents are still on Window 10. Roughly matches what Firefox reports
  • Will open an issue on conda-forge.github.io to further discuss
• WV: Huge refactor of the cache output in rattler-build. More versatile, experiments with the staging output idea.

Pushed to next meeting

• [ ]

CFEPs

• [ ]