Proposal to Update ITK's Minimum macOS Deployment Target to 10.15 (Catalina)

[thewtex]

Rationale

1. Apple’s Deprecation of Older macOS Versions

• macOS 10.15 (Catalina) loses security support on June 30, 2025, creating vulnerabilities for users on older systems¹.
• Current ITK Python builds default to macOS 10.9 (Intel), macOS 10.11 (ARM), which are no longer receiving security updates¹².

2. C++17 and SDK Compatibility

• Full C++17 support (e.g., <filesystem>, <variant>) requires macOS 10.15 or newer³⁴⁵.
• Legacy deployment targets (e.g., 10.9–10.13) force workarounds like <experimental/filesystem>, increasing maintenance complexity³⁶.
• Modern compilers (Xcode 15+) and SDKs increasingly enforce stricter compatibility checks, causing build failures on older targets⁷⁸.

3. Compiler Optimizations

• Newer macOS SDKs enable advanced optimizations (e.g., autovectorization, LTO) that are restricted on older deployment targets.

4. Maintenance Burden

• Third-party projects (e.g., PyTorch) are dropping support for macOS <10.15, creating compatibility gaps⁹⁷⁵.

---

Proposed Changes

1. Update Minimum Deployment Target
   • Set MACOSX_DEPLOYMENT_TARGET to 10.15 for ITK 6.x in Python wheels.
   • Document 10.15 as the new baseline for macOS support.
2. CI/CD Pipeline Updates
   • Update macOS runners with macos-15+ runners⁹⁸ We may need self-hosted runners for Intel support (Proposal for macOS Intel Support deprecation timeline in ITK 6 (Retained in ITK 5) #5326).
3. C++17 Modernization
   • Replace deprecated headers (e.g., <experimental/filesystem>) with standard C++17 equivalents.

---

Impact Mitigation

• LTS Branch: Maintain ITK 5.x with macOS 10.9 support for legacy workflows ⁹¹⁰.

---

Supporting Data

Key Point	Source
macOS 10.15 security EOL: June 2025	12
C++17 <filesystem> requires 10.15	345
Xcode 15+ enforces 10.13+ targets	78

---

Request for Feedback

1. Are there critical use cases requiring macOS <10.15?
2. Concerns about dependency compatibility (e.g., hardware drivers)?

Proposed timeline: Target ITK 6.0 (2025) to align with macOS 10.15’s security EOL.

CC @seanm @blowekamp @hjmjohnson @cookpa @imikejackson @SimonRit @jcfr @jamesobutler

Footnotes

1. https://access.tufts.edu/macos-1015-support-ends-june-30-2025-take-action-now ↩ ↩² ↩³

2. https://discussions.apple.com/thread/255690857 ↩ ↩²

3. https://cibuildwheel.pypa.io/en/stable/cpp_standards/ ↩ ↩² ↩³

4. https://forum.juce.com/t/c-17-minimum-deployment-target/32109 ↩ ↩²

5. https://github.com/nlohmann/json/issues/3156 ↩ ↩² ↩³

6. https://forum.juce.com/t/fix-for-using-c-11-features-with-osx-10-7-deployment-target/25247 ↩

7. https://github.com/apple/swift/issues/68163 ↩ ↩² ↩³

8. https://github.com/sparkle-project/Sparkle/issues/2186 ↩ ↩² ↩³

9. https://github.com/InsightSoftwareConsortium/ITK/issues/5326 ↩ ↩² ↩³

10. https://computercity.com/desktops/mac/how-long-will-intel-macs-be-supported ↩

[seanm]

This is ok for me. I've therefore retired the Rogue22 bot from submitting to CDash. You can unexpect it now.

[dzenanz]

You can unexpect it now

Done.

[imikejackson]

My Opinion, if you are jumping to a new major version of ITK, I would set the minimum MacOS version to 11 or even 12. Considering those MacOS versions are no longer receiving security updates. Take the opportunity when jumping from ITK 5 to ITK 6 to cut the cruft and make it easier on maintenance.

[seanm]

Considering those MacOS versions are no longer receiving security updates.

I think that argument is overblown. Lots of things classified as 'security updates', while they certainly should be fixed, are not so horrible in the real world. Many can be mitigated.

Also, Apple doesn't actually fix all "security" bugs except in their very newest OS, so shouldn't ITK support only the very latest macOS then?

Have you ever tried fuzzing ITK's file readers? I have. It's a crash fest. I'd bet real money many of those would be classified as 'security bugs' by companies like Apple.

Many of my customers use air-gapped Macs, not connected to the internet. That mitigates a lot of risk.

I'd be more amenable to this argument if Apple didn't drop hardware support with (nearly) every macOS release. So requiring newest OS is not just a matter of installing software, but of spending thousands of dollars on new hardware.

Take the opportunity when jumping from ITK 5 to ITK 6 to cut the cruft and make it easier on maintenance.

What cruft? I've not seen much evidence of a huge maintenance burden here. Where there's an actual argument like 'using std::filesystem will eliminate thousands of lines of code', ok, that's an argument, but just dropping OSes (or CPU architectures) where ITK currently builds and works, because of hypothetical cruft, is not persuasive.

If bugs occur only on older macOSs, ping me and my coworkers and we will try to fix them.

[jamesobutler]

Many of my customers use air-gapped Macs, not connected to the internet. That mitigates a lot of risk.

@seanm Are you all still providing new to customers 27” iMacs or have you mostly switched to Apple Silicon machines for commercial use? This page still shows what would be an iMac with a hardware spec circa 2020. Re https://www.rogue-research.com/tms/mobile-computer/

So requiring newest OS is not just a matter of installing software, but of spending thousands of dollars on new hardware.

I guess this is a side effect of the Apple tax and choosing to buy an All-in-one which may still have a good screen but is using a decade old CPU. Mac Minis would seemingly not have this problem as a desktop Mac option.

macOS 11 is supported on iMacs going back to 2014 which is quite an old CPU. @seanm would macOS 11 not be a reasonable minimum for ITK 6?

[seanm]

This page still shows what would be an iMac with a hardware spec circa 2020. Re https://www.rogue-research.com/tms/mobile-computer/

Our website is alas quite out of date. :( New customers get new hardware of course.

I guess this is a side effect of the Apple tax

It sure is!

(Microsoft has a similar tax of course. Windows 11 drops a lot of hardware support too, and Windows 10 stops getting security updates in about 4 months. Shall ITK 6 drop Windows 10 support too?)

would macOS 11 not be a reasonable minimum for ITK 6?

Arguing for C++17 support, like std::filesystem, and thus requiring 10.15, is reasonable and based on some concrete reason. What features of macOS 11 does ITK need (that older versions don't have)?

[jamesobutler]

Windows 11 drops a lot of hardware support too, and Windows 10 stops getting security updates in about 4 months. Shall ITK 6 drop Windows 10 support too?

Only Windows 10 SAC releases will no longer be getting free security updates as of October this year. Microsoft is still supporting Windows 10 with security updates to its LTSC releases (Windows 10 Enterprise LTSC 2021 until January 2027 and Windows 10 IoT Enterprise LTSC 2021 until January 2032). Since the LTSC releases are the primary versions for things like medical instrumentation, and Microsoft will still support it, I see reason for ITK to continue to support it.

What features of macOS 11 does ITK need (that older versions don't have)?

Nothing specific to macOS, but not sure why to continue supporting Haswell generation Intel CPUs for ITK and its dependencies. Moving minimum macOS to 11 is an additional step to dropping testing of old CPUs.

[seanm]

Only Windows 10 SAC releases will no longer be getting free security updates as of October this year. Microsoft is still supporting Windows 10 with security updates to its LTSC releases (Windows 10 Enterprise LTSC 2021 until January 2027 and Windows 10 IoT Enterprise LTSC 2021 until January 2032). Since the LTSC releases are the primary versions for things like medical instrumentation, and Microsoft will still support it, I see reason for ITK to continue to support it.

I was of course not really suggesting that Win 10 support should be dropped.

Nothing specific to macOS, but not sure why to continue supporting Haswell generation Intel CPUs for ITK and its dependencies.

Why? Because my customers use them. And because newer hardware does not grow on trees.

Moving minimum macOS to 11 is an additional step to dropping testing of old CPUs.

But that's just it: I don't want to drop support for old CPUs. I am happy to continue testing them. I provide cdash submissions to that end, and we also have human testers (testing the parts of ITK we use.)