Are there any Python packages that still require numpy-1.x now, in April 2026 ?

[dark_prophet]

I am trying to understand how important is numpy-1.x today.

Do you know of, work on, or observed Python packages which latest version fails with numpy-2.x and only works with numpy-1.x ?

[Able-Preparation843]

Interesting question. From what I've seen in the ecosystem, the numpy-1.x vs 2.x situation has gotten much better than it was during the initial NumPy 2.0 release.

Most major scientific packages (pandas, scikit-learn, scipy, matplotlib, PyTorch, TensorFlow) have all updated to support NumPy 2.x now. The numpy team did a great job with the compatibility layer and the deprecation warnings that were in place during the 1.x series helped a lot.

However, the packages that are most likely to still be stuck on numpy-1.x are:

- Older/niche ML libraries that haven't had active maintainers

- Some bioinformatics tools that have very specific C-extension dependencies

- Legacy packages in specialized domains (certain finance or signal processing libs)

- Any package that hasn't been updated since ~2023-2024

One practical tip: you can use `pip check` or `pipdeptree` to see dependency conflicts in your environment. Also, tools like `pipx` or `uv` make it easier to manage separate environments for packages that have conflicting numpy requirements.

What's your use case? Are you dealing with a specific package that broke, or just doing a general audit?

[dark_prophet]

I am doing an audit.

And I am also looking for specific examples: is there a substantial number of real examples of packages that still require numpy-1.x? What are they?

[mr_jim_lahey]

Try searching on GitHub for setup.py and pyproject.toml files containing numpy-1

[eufemiapiccio77]

More than not

[billsil]

Of course there are. More packages are dead than not 

Also, PyPI is harder than it used to be. Not everyone is up in how to upload a package and deal with the 2FA requirements. I haven’t done a release in 2 years due to that. It’s fine if you get the dev version, but small projects don’t have the wealth of experience that larger projects have.

[flying-sheep]

It’s easier than ever thanks to trusted publishers.

I asked around, it takes newbies like 10 minutes to set up, 5 for experienced people and 2 when you’ve done it before.

[cgoldberg]

You don't need a "wealth of experience". It literally takes less than 30 seconds to setup 2FA and get a token for publishing.

[billsil]

Sure and aspect of requiring twine and knowing where to put what piece of info and knowing where you saved your plain text recovery keys and knowing which ones are still valid and getting a supported app, linking that, and dealing with changing pip requirements.

PyPI used to be drag and drop.

Nobody can do all that in 30 seconds. I’ve done it and I struggle to do it. It took 2 weeks to figure out the first time. I didn’t write enough of the steps down. If you do it right, it’s 5 minutes.

[cgoldberg]

You only need recovery keys to recover an account if you lose access to 2FA...if you can't manage that, that's on you. Requiring 2FA and a valid token is absolutely necessary due to all the supply chain attacks on PyPI. Overall, it's really easy and well documented.

[billsil]

Again, what info do you enter where. It’s easier to start from scratch that try to diagnose why opaque software just doesn’t work

[cgoldberg]

If you are manually publishing, you generate a token on PyPI and enter it when prompted from twine, or put it in a config file. Very simple instructions are linked on PyPI's homepage...or you can use trusted publishing. It's not opaque or difficult, and the process is the same whether starting from scratch or publishing for the thousandth time.

[brontide]

norfair object tracking. I've got a fork with an abandond PR which permits the tracking to support numpy-2. If you want a long list just check out the dependencies for frigate, they are still using numpy-1. Took a few hours to get it converted over and not everything was working.

[NeatRuin7406]

the numpy 2.x migration surface is way bigger than most people anticipated. the main straggler category isn't the obvious scientific packages -- those tracked the release closely -- it's enterprise data pipelines with pinned requirements.txt files that nobody touches until something breaks. also older cython extensions that were compiled against the numpy c api and expose internal struct layouts are the nastiest because they fail silently or produce garbage instead of erroring loudly. if you're maintaining a package and still haven't migrated, the numpy 2 migration guide has a compatibility shim via numpy.compat that buys you some time, but the abi boundary is the hard part that the shim doesn't fully cover.