build: cap the spaCy stack on Python 3.9 so the privacy extras install from wheels

constraints/ci.txt

@@ -135,7 +135,11 @@ backrefs==7.0 ; python_full_version >= '3.10'
     # via mkdocs-material
 blinker==1.9.0 ; python_full_version < '3.10'
     # via flask
-blis==1.3.3
+blis==1.2.0 ; python_full_version < '3.10'
+    # via
+    #   freshdata-cleaner
+    #   thinc
+blis==1.3.3 ; python_full_version >= '3.10'
     # via thinc
 build==1.4.4 ; python_full_version < '3.10'
     # via freshdata-cleaner
@@ -583,6 +587,8 @@ kafka-python==3.0.8
     # via freshdata-cleaner
 keyring==25.7.0 ; platform_machine != 'ppc64le' and platform_machine != 's390x'
     # via twine
+langcodes==3.5.1 ; python_full_version < '3.10'
+    # via spacy
 lazy-object-proxy==1.12.0
     # via apache-airflow-core
 leather==0.4.1
@@ -1240,8 +1246,10 @@ sniffio==1.3.1 ; python_full_version >= '3.10'
     # via greenback
 snowplow-tracker==1.1.0
     # via dbt-core
-spacy==3.8.11 ; python_full_version < '3.10'
-    # via presidio-analyzer
+spacy==3.8.7 ; python_full_version < '3.10'
+    # via
+    #   freshdata-cleaner
+    #   presidio-analyzer
 spacy==3.8.14 ; python_full_version >= '3.10'
     # via presidio-analyzer
 spacy-legacy==3.0.12
@@ -1330,8 +1338,10 @@ termcolor==3.3.0 ; python_full_version >= '3.10'
     #   cleanlab
 text-unidecode==1.3
     # via python-slugify
-thinc==8.3.9 ; python_full_version < '3.10'
-    # via spacy
+thinc==8.3.4 ; python_full_version < '3.10'
+    # via
+    #   freshdata-cleaner
+    #   spacy
 thinc==8.3.13 ; python_full_version >= '3.10'
     # via spacy
 threadpoolctl==3.6.0
@@ -1376,16 +1386,15 @@ typer==0.23.2 ; python_full_version < '3.10'
     #   fastapi-cli
     #   fastapi-cloud-cli
     #   huggingface-hub
+    #   spacy
     #   typer-slim
 typer==0.26.8 ; python_full_version >= '3.10'
     # via
     #   fastapi-cli
     #   spacy
     #   weasel
 typer-slim==0.23.2 ; python_full_version < '3.10'
-    # via
-    #   spacy
-    #   weasel
+    # via weasel
 typing-extensions==4.16.0
     # via
     #   a2wsgi

pyproject.toml

@@ -146,6 +146,10 @@ all = [
     "presidio-analyzer>=2.2",
     "presidio-anonymizer>=2.2",
     "pyffx>=0.3.0",
+    # Python 3.9 wheel caps for the privacy stack; see the `privacy` extra.
+    "spacy<3.8.8; python_version<'3.10'",
+    "thinc<8.3.5; python_version<'3.10'",
+    "blis<1.2.1; python_version<'3.10'",
     "itables>=1.6",
     "plotly>=5.0",
     "great-tables>=0.9",
@@ -159,10 +163,18 @@ excel = [
 ]
 # Stronger PII detection (NER) + cryptographic format-preserving encryption.
 # The base regex/context detector and surrogate FPE need none of these.
+# On Python 3.9 the presidio -> spacy -> thinc -> blis chain must stop at the
+# last releases that ship cp39 wheels (spacy 3.8.7, thinc 8.3.4, blis 1.2.0).
+# Newer ones still declare Requires-Python >=3.9 but publish only an sdist for
+# 3.9, and spacy >=3.8.13 cannot even build there (it needs thinc>=8.3.12, which
+# is Python >=3.10). Keep these caps in sync with the `all` extra.
 privacy = [
     "presidio-analyzer>=2.2",
     "presidio-anonymizer>=2.2",
     "pyffx>=0.3.0",
+    "spacy<3.8.8; python_version<'3.10'",
+    "thinc<8.3.5; python_version<'3.10'",
+    "blis<1.2.1; python_version<'3.10'",
 ]
 # DuckDB-backed probabilistic entity resolution at scale. The pandas fallback
 # backend needs none of these.

tests/test_packaging.py

@@ -41,6 +41,23 @@ def test_readme_and_docs_install_commands_match_distribution_name():
         assert not bad, f"{doc} installs the unpublishable name: {bad}"
 
 
+# On Python 3.9, pip otherwise picks spacy/thinc/blis releases that publish no
+# cp39 wheels, falls back to their sdists and fails (spacy 3.8.16 needs
+# thinc>=8.3.12, which is Python >=3.10 only). Issue #278.
+PY39_PRIVACY_CAPS = {
+    "spacy<3.8.8; python_version<'3.10'",
+    "thinc<8.3.5; python_version<'3.10'",
+    "blis<1.2.1; python_version<'3.10'",
+}
+
+
+def test_privacy_extras_cap_spacy_stack_on_python39():
+    extras = _project_metadata()["optional-dependencies"]
+    for name in ("privacy", "all"):
+        missing = PY39_PRIVACY_CAPS - set(extras[name])
+        assert not missing, f"[{name}] lacks the Python 3.9 wheel caps: {sorted(missing)}"
+
+
 def test_source_install_hints_match_distribution_name():
     offenders = []
     for path in (REPO / "src" / "freshdata").rglob("*.py"):