# numpy 2.5.3

The fundamental package for scientific computing with Python.

Snapshot of gominimal/pkgs commit `673744d03aea823593e5a5ce18b9526d29f20040` (pushed 2026-10-12T19:03:44.000Z).

## Install

```sh
min add numpy
```

## Direct advisories

| ID | Severity | CVSS | Fix status | Fixed version | Summary |
| --- | --- | --- | --- | --- | --- |
| CVE-2014-1858 | MEDIUM | 5.5 | unknown_fix | 0bb46c1448b0d3f5453d5182a17ea7ac5854ee15 | __init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file. |
| CVE-2014-1859 | MEDIUM | 5.5 | unknown_fix | 0bb46c1448b0d3f5453d5182a17ea7ac5854ee15 | (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file. |

## Transitive advisories

4 advisories inherited through runtime dependencies:

- CVE-2025-15367 (MEDIUM) via python
- CVE-2026-19672 (MEDIUM) via python
- CVE-2026-87910 (MEDIUM) via python
- CVE-2026-77214 (HIGH) via python → expat

## Dependencies

- Build (4): base, cython, pkgconf, meson-python
- Runtime (2): python, openblas

## OpenSSF Scorecard

Aggregate score: 8 / 10. Scored by OpenSSF Scorecard. Repository scored: numpy/numpy. Scanned 2026-10-12.

Result on OpenSSF's viewer: https://scorecard.dev/viewer/?uri=github.com/numpy/numpy

Checks, scored 0-10 as the Scorecard tool reports them (N/A: not applicable or inconclusive):

| Check | Score | Reason |
| --- | --- | --- |
| [Binary-Artifacts](https://minimal.dev/docs/reference/scorecard#check-binary-artifacts) | 10 | No binaries found in the repo |
| [Branch-Protection](https://minimal.dev/docs/reference/scorecard#check-branch-protection) | 3 | Branch protection is not maximal on development and all release branches |
| [CI-Tests](https://minimal.dev/docs/reference/scorecard#check-ci-tests) | 10 | 29 out of 29 merged PRs checked by a CI test -- score normalized to 10 |
| [CII-Best-Practices](https://minimal.dev/docs/reference/scorecard#check-cii-best-practices) | 0 | No effort to earn an OpenSSF best practices badge detected |
| [Code-Review](https://minimal.dev/docs/reference/scorecard#check-code-review) | 10 | All changesets reviewed |
| [Contributors](https://minimal.dev/docs/reference/scorecard#check-contributors) | 10 | Project has 100 contributing companies or organizations |
| [Dangerous-Workflow](https://minimal.dev/docs/reference/scorecard#check-dangerous-workflow) | 10 | No dangerous workflow patterns detected |
| [Dependency-Update-Tool](https://minimal.dev/docs/reference/scorecard#check-dependency-update-tool) | 10 | Update tool detected |
| [Fuzzing](https://minimal.dev/docs/reference/scorecard#check-fuzzing) | 10 | Project is fuzzed |
| [License](https://minimal.dev/docs/reference/scorecard#check-license) | 9 | License file detected |
| [Maintained](https://minimal.dev/docs/reference/scorecard#check-maintained) | 10 | 30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10 |
| [Packaging](https://minimal.dev/docs/reference/scorecard#check-packaging) | N/A | Packaging workflow not detected |
| [Pinned-Dependencies](https://minimal.dev/docs/reference/scorecard#check-pinned-dependencies) | 3 | Dependency not pinned by hash detected -- score normalized to 3 |
| [SAST](https://minimal.dev/docs/reference/scorecard#check-sast) | 9 | SAST tool detected but not run on all commits |
| [Security-Policy](https://minimal.dev/docs/reference/scorecard#check-security-policy) | 9 | Security policy file detected |
| [Signed-Releases](https://minimal.dev/docs/reference/scorecard#check-signed-releases) | 0 | Project has not signed or included provenance with any releases. |
| [Token-Permissions](https://minimal.dev/docs/reference/scorecard#check-token-permissions) | 10 | GitHub workflow tokens follow principle of least privilege |
| [Vulnerabilities](https://minimal.dev/docs/reference/scorecard#check-vulnerabilities) | 10 | 0 existing vulnerabilities detected |

## Links

- Homepage: https://numpy.org
- Package page (HTML): https://minimal.dev/pkgs/numpy
- JSON API (floats latest): https://minimal.dev/api/pkgs/numpy.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/numpy/sbom.json
- Build attestations (JSON): https://minimal.dev/api/pkgs/numpy/attestation.json