Skip to content
This repository has been archived by the owner on Jun 7, 2023. It is now read-only.

Bump mlflow from 1.19.0 to 2.3.1 #201

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github May 1, 2023

Bumps mlflow from 1.19.0 to 2.3.1.

Release notes

Sourced from mlflow's releases.

MLflow 2.3.1 is a patch release containing bug fixes and a security patch for GHSA-83fm-w79m-64r5. If you are using mlflow server or mlflow ui, we recommend upgrading to MLflow 2.3.1 as soon as possible.

Security patches:

  • [Security] Fix critical LFI attack vulnerability by disabling the ability to provide relative paths in registered model sources (#8281, @​BenWilson2)

Bug fixes:

  • [Tracking] Fix an issue causing file and model uploads to hang on Databricks (#8348, @​harupy)
  • [Tracking / Model Registry] Fix an issue causing file and model downloads to hang on Databricks (#8350, @​dbczumar)
  • [Scoring] Fix regression in schema enforcement for model serving when using the inputs format for inference (#8326, @​BenWilson2)
  • [Model Registry] Fix regression in model naming parsing where special characters were not accepted in model names (#8322, @​arpitjasa-db)
  • [Recipes] Fix card rendering with the pandas profiler to handle columns containing all null values (#8263, @​sunishsheth2009)

MLflow 2.3.0 includes several major features and improvements

Features:

Bug fixes:

  • [Models] Fix a bug with tensorflow autologging for models with multiple inputs (#8097, @​jaume-ferrarons)
  • [Recipes] Fix a bug with Pandas 2.0 updates for profiler rendering of datetime types (#7925, @​sunishsheth2009)
  • [Tracking] Prevent exceptions from being raised if a parameter is logged with an existing key whose value is identical to the logged parameter (#8038, @​AdamStelmaszczyk)
  • [Tracking] Fix an issue with deleting experiments in the FileStore backend (#8178, @​mariusschlegel)
  • [Tracking] Fix a UI bug where the "Source Run" field in the Model Version page points to an incorrect set of artifacts (#8156, @​WeichenXu123)
  • [Tracking] Fix a bug wherein renaming a run reverts its current lifecycle status to UNFINISHED (#8154, @​WeichenXu123)
  • [Tracking] Fix a bug where a file URI could be used as a model version source (#8126, @​harupy)
  • [Projects] Fix an issue with MLflow projects that have submodules contained within a project (#8050, @​kota-iizuka)
  • [Examples] Fix lightning hyperparameter tuning examples (#8039, @​BenWilson2)
  • [Server-infra] Fix bug with Cache-Control headers for static server files (#8016, @​jmahlik)

Documentation updates:

... (truncated)

Changelog

Sourced from mlflow's changelog.

2.3.1 (2023-04-27)

MLflow 2.3.1 is a patch release containing the following bug fixes and changes:

Bug fixes:

  • [Security] Fix critical LFI attack vulnerability by disabling the ability to provide relative paths in registered model sources (#8281, @​BenWilson2)
    • If you are using mlflow server or mlflow ui, we recommend upgrading to MLflow 2.3.1 as soon as possible. For more details, see GHSA-xg73-94fp-g449.
  • [Tracking] Fix an issue causing file and model uploads to hang on Databricks (#8348, @​harupy)
  • [Tracking / Model Registry] Fix an issue causing file and model downloads to hang on Databricks (#8350, @​dbczumar)
  • [Scoring] Fix regression in schema enforcement for model serving when using the inputs format for inference (#8326, @​BenWilson2)
  • [Model Registry] Fix regression in model naming parsing where special characters were not accepted in model names (#8322, @​arpitjasa-db)
  • [Recipes] Fix card rendering with the pandas profiler to handle columns containing all null values (#8263, @​sunishsheth2009)

Documentation updates:

Small bug fixes and documentation updates:

#8324, #8325, @​smurching; #8313, @​dipanjank; #8323, @​liangz1; #8331, #8328, #8319, #8316, #8308, #8293, #8289, #8283, #8284, #8285, #8282, #8241, #8270, #8272, #8271, #8268, @​harupy; #8312, #8294, #8295, #8279, #8267, @​BenWilson2; #8290, @​jinzhang21; #8257, @​WeichenXu123; #8307, @​arpitjasa-db

2.3.0 (2023-04-18)

MLflow 2.3.0 includes several major features and improvements

Features:

Bug fixes:

... (truncated)

Commits
  • 95dc319 Make a short sleep to avoid busy waiting (#8354)
  • cb5cc36 Use separate thread pool executors when uploading chunks to avoid deadlock (#...
  • 2b50b88 Revert (#8351)
  • af38edf Handle slashes in _validate_non_local_source_contains_relative_paths (#8338)
  • 9e35947 Remove virtualenv environment if we encounter unexpected error (#8328)
  • 2470fd1 Create a new request session in each process (#8331)
  • b7d8406 Merge branch 'master' into branch-2.3
  • cef03da Fix regression in schema enforcement (#8326)
  • ef7b6ed Update parse model URI to prevent breaking old cases while supporting aliases...
  • 64270e2 Improve UC model registry client error messages when specifying nonexistent s...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label May 1, 2023
@sesheta sesheta added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label May 1, 2023
@sesheta
Copy link

sesheta commented May 1, 2023

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Bumps [mlflow](https://github.com/mlflow/mlflow) from 1.19.0 to 2.3.1.
- [Release notes](https://github.com/mlflow/mlflow/releases)
- [Changelog](https://github.com/mlflow/mlflow/blob/master/CHANGELOG.md)
- [Commits](mlflow/mlflow@v1.19.0...v2.3.1)

---
updated-dependencies:
- dependency-name: mlflow
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/pip/mlflow-2.3.1 branch from 0962a55 to 6d321f8 Compare May 27, 2023 06:24
@op1st-prow
Copy link

op1st-prow bot commented May 27, 2023

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@op1st-prow op1st-prow bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels May 27, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
dependencies Pull requests that update a dependency file size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant