tensorflow: Docs do not mention discontinuation of support for Python 3.7 in TF 2.11.1

2.11.1 contains a critical security update (CVE-2023-25668) that would be nice to have with the same versions of Python which are compatible with 2.11 (i.e., Python 3.7). Can you please distribute 2.11.1 with Python 3.7 support?

@sushreebarsa I have a same issue like @alcysec. As you mentioned, the documentation from Tensorflow, PyPi(link) clearly mentions TF 2.11.1 supports python 3.7. But I can’t install using pip. (I’m using an official image python:3.7.13-slim. ) The reason might be the @camattin’s mention above.

It looks like python 3.7 was removed from some of the automations back in December here. Perhaps this is release to the reason we’re not seeing 2.11.1 artifacts for python 3.7?

FWIW, I was able to compile 2.11.1 with python 3.7 and successfully install the built wheel. This is without thorough testing, though, so I cannot say it’s 100% functional.

Hi @sushreebarsa I wonder if it’s intentional to discontinue support for Python 3.7? Is there a technical problem preventing 2.11.1 patch been built on Python 3.7? (we need this patch to deploy on Python 3.7, so want to find a resolution)

@sushreebarsa we expect that there would be a build for python 3.7 for TF 2.11.1 especially given the number of vulnerabilities that are resolved in that release. Can you please provide with a tentative timeline on when this will be resolved?

Hi,

Thanks for reporting the issue, The usual practice in Tensorflow to support any Python version is, during the time of release if that Python version is within the support life cycle as defined here https://devguide.python.org/versions/. As per the above link, during the patch release of 2.11.1 Python 3.7 was at end-of-life .

This is false.

1. 2.11.1 was released on 3/20: https://github.com/tensorflow/tensorflow/releases/tag/v2.11.1
2. The CVE was published 3/24: https://github.com/advisories/GHSA-gw97-ff7c-9v96
3. This issue was reported to you on 3/30.
4. Python 3.7 became EoL on 6/27 (as per your own link).

Folks were left vulnerable for three months while this issue went unacknowledged until Python 3.7 became EoL and that was used as an excuse not to fix it. Fair enough, but no need to retcon when the timeline is public.

@YONGARYZ Reopening the issue as per the request. Thank you!

Hey @sushreebarsa. The issue is that the tensorflow-cpu version 2.11.1 for Python 3.7 isn’t available on PyPi, which might give the impression that support for 3.7 has been discontinued.

$ docker run --platform=linux/amd64 --entrypoint /bin/bash python:3.7-slim -c "pip install tensorflow-cpu==2.11.1"
ERROR: Could not find a version that satisfies the requirement tensorflow-cpu==2.11.1 (from versions: 1.15.0, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.8.0, 2.8.1, 2.8.2, 2.8.3, 2.8.4, 2.9.0rc0, 2.9.0rc1, 2.9.0rc2, 2.9.0, 2.9.1, 2.9.2, 2.9.3, 2.10.0rc0, 2.10.0rc1, 2.10.0rc2, 2.10.0rc3, 2.10.0, 2.10.1, 2.11.0rc0, 2.11.0rc1, 2.11.0rc2, 2.11.0)
ERROR: No matching distribution found for tensorflow-cpu==2.11.1