pyamber license check fails: cloudpickle has no LICENSE-binary bullet #8296

What happened?

build / pyamber (ubuntu-latest, 3.12) fails repo-wide at the step Check installed Python packages against per-module LICENSE-binary files. A new transitive dependency is in the environment with no bullet in amber/LICENSE-binary-python:

NEW Python packages not claimed by LICENSE-binary:
  + cloudpickle==3.1.2  (license: BSD License) → add to amber/LICENSE-binary-python

That single line is the failure. The long ~ DRIFT (transitive, informational) list in the same log is not — PR runs pass --ignore-transitive-version, and the nightly exact-match check on main refreshes those.

Where it came from. joblib stopped vendoring cloudpickle and started declaring it, per PyPI metadata:

The chain is scikit-learn (amber/operator-requirements.txt) → joblib → cloudpickle. Nothing in this repository changed; joblib 1.6.0 was published and the unpinned transitive resolve picked it up.

Time-based, not PR-based. Open PRs built before the release are green and ones built after are red:

regex also moved to 2026.8.31 in that window, which dates the batch.

Collateral. The check runs only on the 3.12 matrix entry (skipped on 3.11 and 3.13), and fail-fast then cancels 3.13's Test with pytest. A run therefore shows three reds for one cause; only the 3.12 license step is real.

How to reproduce?

Any PR whose CI runs after joblib 1.6.0 hit PyPI on 2026-08-31:

pip install -r amber/requirements.txt -r amber/operator-requirements.txt
pip-licenses --format=csv --ignore-packages pip-licenses prettytable wcwidth > /tmp/pip-licenses.csv
./bin/licensing/check_binary_deps.py --ignore-transitive-version python /tmp/pip-licenses.csv

Version/Branch

1.3.0-incubating-SNAPSHOT (main)