Skip to main content

Moving to Visual Studio 2022 as default windows compiler

Microsoft's Visual Studio (VS) 2019 compiler has reached its end of life over a year ago. In the meantime, several projects have moved on and fail to compile with VS2019.

We are planning to update our default compilers on windows to the (fully compatible) successor VS2022 in one week from now.

This will not affect you as a general user of conda-forge packages on windows; the only potential impact is that if you are compiling locally with VS2019 against artefacts produced by conda-forge, you might be required to upgrade.

For more details see https://github.com/conda-forge/conda-forge.github.io/issues/2138.

Dropping CUDA 11.8 as a default CUDA version

CUDA 11.8 is the last holdover from the old days before conda-forge switched to the new and shiny CUDA 12+ infrastructure, where the CUDA toolchain is provided as native conda-packages, rather than a blob in an image.

For CUDA-enabled feedstocks, we've been building both 11.8 and 12.6 by default for a while now, but many feedstocks (notably pytorch, tensorflow, onnx, jax etc.) have dropped CUDA 11.8 for many months already.

Due to various constraints (details below), we are dropping CUDA 11.8 as a default version in our global pinning on June 5th. It will still be possible to opt into building CUDA 11.8 on a per-feedstock basis where this is necessary or beneficial.

Upcoming closure of NumPy 2.0 migration

NumPy 2.0 was a big change (the first major version in 15 years). For more than a year, we have been migrating feedstocks from NumPy 1.x to NumPy 2.x, and while not every affected feedstock has been done, we are planning to conclude the migration in one week. Note that NumPy 2 support is required for feedstocks that intend to support Python 3.13 and above.

For feedstocks that are not compatible with v2.x yet, this means you will have to add

numpy:
- 1.26 # or 1.25

to your recipe/conda_build_config.yaml, and then rerender. Pins below 1.25 are not possible if your feedstock supports Python 3.12, as NumPy 1.25 was the first version with support for that Python version (and it will not be possible going forward to pin different NumPy versions for different Python versions).

Updating our Ubuntu base for Miniforge Docker images (20.04 → 24.04)

The base image for our Ubuntu Dockerfiles has been upgraded from Ubuntu 20.04 (focal) to Ubuntu 24.04 (noble) in PR #145. This change ensures continued support and access to newer packages and system libraries.

Downstream users building on top of the Ubuntu variant of our containers should verify compatibility with the updated environment.

Thanks to @rpanai for the contribution and to the reviewers for their input.

Security Incident with Package Uploads (CVE-2025-31484)

Yesterday, conda-forge was notified of a security incident reporting that the anaconda.org upload token for the conda-forge channel had been accidentally leaked between on or about 2025-02-10 to 2025-04-01. Our investigation resulted in the temporary artifact upload shutdown you observed yesterday (2025-04-01). The results of our analysis show that, as best as can reasonably be determined, the token was not used by any 3rd party to upload malicious artifacts.

More details in the corresponding blog post.

Updating our default docker images

TL;DR: We have made some updates to our Docker images and build time GLIBC selection.

  1. We've updated our default docker images to be based on alma9
  2. It is now easier to override c_stdlib_version (especially for CUDA-enabled feedstocks), though our baseline of 2.17 hasn't changed.
  3. Where necessary, you can more easily switch images by setting os_version: ... (see below).
  4. We've consolidated our image names to follow a consistent pattern:
linux-anvil-{x86_64,aarch64,ppc64le}:{cos7,alma8,alma9}

In general, it won't be necessary in the vast majority of cases to override the docker-image, but if you need to do so, you can add the following to conda-forge.yml

os_version:             # just to demo different values;
linux_64: cos7 # whenever possible, please use
linux_aarch64: alma8 # homogeneous distro versions
linux_ppc64le: alma9 # across platforms

Migration to Unique Feedstock Tokens per Provider

We will be slowly migrating conda-forge to use unique feedstock tokens per provider. The feedstock token is used to allow maintainers to copy packages from our staging area to the main conda-forge channel. This change will improve our security posture and help us limit the impact of any leaked tokens. During this migration we will also be using newly implemented feedstock token expiration times to avoid race conditions between token changes and running builds.

New time available for conda-forge core meetings

The core team has decided to change the time when core meetings happen to accommodate more attendees across different timezones. It will still happen every two Wednesdays, but starting next Wednesday, November 13th 2024, it will alternate between 17:00-18:00 UTC and 14:00-15:00 UTC.

For clarity, these are the next dates:

  • November 13th, 2024 at 17:00 UTC
  • November 27th, 2024 at 14:00 UTC
  • December 11th, 2024 at 17:00 UTC
  • December 25th, 2024 at 14:00 UTC
  • January 8th, 2025, at 17:00 UTC
  • ... and so on.

A new calendar is now available in the Community > Meetings section to help find the dates.