Mlflow

Latest version: v2.19.0

Safety actively analyzes 687959 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 4 of 18

2.12.1

Not secure
With this release, we're pleased to introduce several major new features that are focused on enhanced GenAI support, Deep Learning workflows involving images, expanded table logging functionality, and general usability enhancements within the UI and external integrations.

Major Features and Improvements:

- **PromptFlow**: Introducing the new PromptFlow flavor, designed to enrich the GenAI landscape within MLflow. This feature simplifies the creation and management of dynamic prompts, enhancing user interaction with AI models and streamlining prompt engineering processes. (11311, 11385 brynn-code)

- **Enhanced Metadata Sharing for Unity Catalog**: MLflow now supports the ability to share metadata (and not model weights) within Databricks Unity Catalog. When logging a model, this functionality enables the automatic duplication of metadata into a dedicated subdirectory, distinct from the model’s actual storage location, allowing for different sharing permissions and access control limits. (11357, 11720 WeichenXu123)

- **Code Paths Unification and Standardization**: We have unified and standardized the `code_paths` parameter across all MLflow flavors to ensure a cohesive and streamlined user experience. This change promotes consistency and reduces complexity in the model deployment lifecycle. (11688, BenWilson2)

- **ChatOpenAI and AzureChatOpenAI Support**: Support for the ChatOpenAI and AzureChatOpenAI interfaces has been integrated into the LangChain flavor, facilitating seamless deployment of conversational AI models. This development opens new doors for building sophisticated and responsive chat applications leveraging cutting-edge language models. (11644, B-Step62)

- **Custom Models in Sentence-Transformers**: The sentence-transformers flavor now supports custom models, allowing for a greater flexibility in deploying tailored NLP solutions. (11635, B-Step62)

- **Image Support for Log Table**: With the addition of image support in `log_table`, MLflow enhances its capabilities in handling rich media. This functionality allows for direct logging and visualization of images within the platform, improving the interpretability and analysis of visual data. (11535, jessechancy)

- **Streaming Support for LangChain**: The newly introduced `predict_stream` API for LangChain models supports streaming outputs, enabling real-time output for chain invocation via pyfunc. This feature is pivotal for applications requiring continuous data processing and instant feedback. (11490, 11580 WeichenXu123)

Security Fixes:

- **Security Patch**: Addressed a critical Local File Read/Path Traversal vulnerability within the Model Registry, ensuring robust protection against unauthorized access and securing user data integrity. (11376, WeichenXu123)


Features:

- [Models] Add the PromptFlow flavor (11311, 11385 brynn-code)
- [Models] Add a new `predict_stream` API for streamable output for Langchain models and the `DatabricksDeploymentClient` (11490, 11580 WeichenXu123)
- [Models] Deprecate and add `code_paths` alias for `code_path` in `pyfunc` to be standardized to other flavor implementations (11688, BenWilson2)
- [Models] Add support for custom models within the `sentence-transformers` flavor (11635, B-Step62)
- [Models] Enable Spark `MapType` support within model signatures when used with Spark udf inference (11265, WeichenXu123)
- [Models] Add support for metadata-only sharing within Unity Catalog through the use of a subdirectory (11357, 11720 WeichenXu123)
- [Models] Add Support for the `ChatOpenAI` and `AzureChatOpenAI` LLM interfaces within the LangChain flavor (11644, B-Step62)
- [Artifacts] Add support for utilizing presigned URLs when uploading and downloading files when using Unity Catalog (11534, artjen)
- [Artifacts] Add a new `Image` object for handling the logging and optimized compression of images (11404, jessechancy)
- [Artifacts] Add time and step-based metadata to the logging of images (11243, jessechancy)
- [Artifacts] Add the ability to log a dataset to Unity Catalog by means of `UCVolumeDatasetSource` (11301, chenmoneygithub)
- [Tracking] Remove the restrictions for logging a table in Delta format to no longer require running within a Databricks environment (11521, chenmoneygithub)
- [Tracking] Add support for logging `mlflow.Image` files within tables (11535, jessechancy)
- [Server-infra] Introduce override configurations for controlling how http retries are handled (11590, BenWilson2)
- [Deployments] Implement `chat` & `chat streaming` for Anthropic within the MLflow deployments server (11195, gabrielfu)

Security fixes:

- [Model Registry] Fix Local File Read/Path Traversal (LFI) bypass vulnerability (11376, WeichenXu123)

Bug fixes:

- [Model Registry] Fix a registry configuration error that occurs within Databricks serverless clusters (11719, WeichenXu123)
- [Model Registry] Delete registered model permissions when deleting the underlying models (11601, B-Step62)
- [Model Registry] Disallow `%` in model names to prevent URL mangling within the UI (11474, daniellok-db)
- [Models] Fix an issue where crtically important environment configurations were not being captured as langchain dependencies during model logging (11679, serena-ruan)
- [Models] Patch the `LangChain` loading functions to handle uncorrectable pickle-related exceptions that are thrown when loading a model in certain versions (11582, B-Step62)
- [Models] Fix a regression in the `sklearn` flavor to reintroduce support for custom prediction methods (11577, B-Step62)
- [Models] Fix an inconsistent and unreliable implementation for batch support within the `langchain` flavor (11485, WeichenXu123)
- [Models] Fix loading remote-code-dependent `transformers` models that contain custom code (11412, daniellok-db)
- [Models] Remove the legacy conversion logic within the `transformers` flavor that generates an inconsistent input example display within the MLflow UI (11508, B-Step62)
- [Models] Fix an issue with Keras autologging iteration input handling (11394, WeichenXu123)
- [Models] Fix an issue with `keras` autologging training dataset generator (11383, WeichenXu123)
- [Tracking] Fix an issue where a module would be imported multiple times when logging a langchain model (11553, sunishsheth2009)
- [Tracking] Fix the sampling logic within the `GetSampledHistoryBulkInterval` API to produce more consistent results when displayed within the UI (11475, daniellok-db)
- [Tracking] Fix import issues and properly resolve dependencies of `langchain` and `lanchain_community` within `langchain` models when logging (11450, sunishsheth2009)
- [Tracking] Improve the performance of asynchronous logging (11346, chenmoneygithub)
- [Deployments] Add middle-of-name truncation to excessively long deployment names for Sagemaker image deployment (11523, BenWilson2)

Documentation updates:

- [Docs] Add clarity and consistent documentation for `code_paths` docstrings in API documentation (11675, BenWilson2)
- [Docs] Add documentation guidance for `sentence-transformers` `OpenAI`-compatible API interfaces (11373, es94129)

Small bug fixes and documentation updates:

11723, freemin7; 11722, 11721, 11690, 11717, 11685, 11689, 11607, 11581, 11516, 11511, 11358, serena-ruan; 11718, 11673, 11676, 11680, 11671, 11662, 11659, 11654, 11633, 11628, 11620, 11610, 11605, 11604, 11600, 11603, 11598, 11572, 11576, 11555, 11563, 11539, 11532, 11528, 11525, 11514, 11513, 11509, 11457, 11501, 11500, 11459, 11446, 11443, 11442, 11433, 11430, 11420, 11419, 11416, 11418, 11417, 11415, 11408, 11325, 11327, 11313, harupy; 11707, 11527, 11663, 11529, 11517, 11510, 11489, 11455, 11427, 11389, 11378, 11326, B-Step62; 11715, 11714, 11665, 11626, 11619, 11437, 11429, BenWilson2; 11699, 11692, annzhang-db; 11693, 11533, 11396, 11392, 11386, 11380, 11381, 11343, WeichenXu123; 11696, 11687, 11683, chilir; 11387, 11625, 11574, 11441, 11432, 11428, 11355, 11354, 11351, 11349, 11339, 11338, 11307, daniellok-db; 11653, 11369, 11270, chenmoneygithub; 11666, 11588, jessechancy; 11661, jmjeon94; 11640, tunjan; 11639, minkj1992; 11589, tlm365; 11566, 11410, brynn-code; 11570, lababidi; 11542, 11375, 11345, edwardfeng-db; 11463, taranarmo; 11506, ernestwong-db; 11502, fzyzcjy; 11470, clemenskol; 11452, jkfran; 11413, GuyAglionby; 11438, victorsun123; 11350, liangz1; 11370, sunishsheth2009; 11379, 11304, zhouyou9505; 11321, 11323, 11322, michael-berk; 11333, cdancette; 11228, TomeHirata

2.12.0

Not secure
MLflow 2.12.0 has been yanked from PyPI due to an issue with packaging required JS components. MLflow 2.12.1 is its replacement.

2.11.3

Not secure
Bug fixes:

- [Security] Address an LFI exploit related to misuse of url parameters (11473, daniellok-db)
- [Databricks] Fix an issue with Databricks Runtime version acquisition when deploying a model using Databricks Docker Container Services (11483, WeichenXu123)
- [Databricks] Correct an issue with credential management within Databricks Model Serving (11468, victorsun123)
- [Models] Fix an issue with chat request validation for LangChain flavor (11478, BenWilson2)
- [Models] Fixes for LangChain models that are logged as code (11494, 11436 sunishsheth2009)

2.11.2

Not secure
MLflow 2.11.2 is a patch release that introduces corrections for the support of custom transformer models, resolves LangChain integration problems, and includes several fixes to enhance stability.

Bug fixes:

- [Security] Address LFI exploit (11376, WeichenXu123)
- [Models] Fix transformers models implementation to allow for custom model and component definitions to be loaded properly (11412, 11428 daniellok-db)
- [Models] Fix the LangChain flavor implementation to support defining an MLflow model as code (11370, sunishsheth2009)
- [Models] Fix LangChain VectorSearch parsing errors (11438, victorsun123)
- [Models] Fix LangChain import issue with the community package (11450, sunishsheth2009)
- [Models] Fix serialization errors with RunnableAssign in the LangChain flavor (11358, serena-ruan)
- [Models] Address import issues with LangChain community for Databricks models (11350, liangz1)
- [Registry] Fix model metadata sharing within Databricks Unity Catalog (11357, 11392 WeichenXu123)

Small bug fixes and documentation updates:

11321, 11323, michael-berk; 11326, 11455, B-Step62; 11333, cdancette; 11373, es94129; 11429, BenWilson2; 11413, GuyAglionby; 11338, 11339, 11355, 11432, 11441, daniellok-db; 11380, 11381, 11383, 11394, WeichenXu123; 11446, harupy;

2.11.1

Not secure
MLflow 2.11.1 is a patch release, containing fixes for some Databricks integrations and other various issues.

Bug fixes:

- [UI] Add git commit hash back to the run page UI (11324, daniellok-db)
- [Databricks Integration] Explicitly import vectorstores and embeddings in databricks_dependencies (11334, daniellok-db)
- [Databricks Integration] Modify DBR version parsing logic (11328, daniellok-db)

Small bug fixes and documentation updates:

11336, 11335, harupy; 11303, B-Step62; 11319, BenWilson2; 11306, daniellok-db

2.11.0

Not secure
With the MLflow 2.11.0 release, we're excited to bring a series of large and impactful features that span both GenAI and Deep Learning use cases.

- The MLflow Tracking UI got an overhaul to better support the review and comparison of training runs for Deep Learning workloads. From grouping to large-scale metric plotting throughout
the iterations of a DL model's training cycle, there are a large number of quality of life improvements to enhance your Deep Learning MLOps workflow.

- Support for the popular [PEFT](https://www.mlflow.org/docs/latest/llms/transformers/guide/index.html#peft-models-in-mlflow-transformers-flavor) library from HuggingFace is now available
in the `mlflow.transformers` flavor. In addition to PEFT support, we've removed the restrictions on Pipeline types
that can be logged to MLflow, as well as the ability to, when developing and testing models, log a transformers pipeline without copying foundational model weights. These
enhancements strive to make the transformers flavor more useful for cutting-edge GenAI models, new pipeline types, and to simplify the development process of prompt engineering, fine-tuning,
and to make iterative development faster and cheaper. Give the updated flavor a try today! (11240, B-Step62)

- We've added support to both [PyTorch](https://www.mlflow.org/docs/latest/python_api/mlflow.pytorch.html#mlflow.pytorch.autolog) and
[TensorFlow](https://www.mlflow.org/docs/latest/python_api/mlflow.tensorflow.html#mlflow.tensorflow.autolog) for automatic model weights checkpointing (including resumption from a
previous state) for the auto logging implementations within both flavors. This highly requested feature allows you to automatically configure long-running Deep Learning training
runs to keep a safe storage of your best epoch, eliminating the risk of a failure late in training from losing the state of the model optimization. (11197, 10935, WeichenXu123)

- We've added a new interface to Pyfunc for GenAI workloads. The new `ChatModel` interface allows for interacting with a deployed GenAI chat model as you would with any other provider.
The simplified interface (no longer requiring conformance to a Pandas DataFrame input type) strives to unify the API interface experience. (10820, daniellok-db)

- We now support Keras 3. This large overhaul of the Keras library introduced new fundamental changes to how Keras integrates with different DL frameworks, bringing with it
a host of new functionality and interoperability. To learn more, see the [Keras 3.0 Tutorial](https://www.mlflow.org/docs/latest/deep-learning/keras/quickstart/quickstart_keras.html)
to start using the updated model flavor today! (10830, chenmoneygithub)

- [Mistral AI](https://mistral.ai/) has been added as a native [provider](https://www.mlflow.org/docs/latest/llms/deployments/index.html#providers) for the MLflow Deployments Server. You can
now create proxied connections to the Mistral AI services for completions and embeddings with their powerful GenAI models. (11020, thnguyendn)

- We've added compatibility support for the OpenAI 1.x SDK. Whether you're using an OpenAI LLM for model evaluation or calling OpenAI within a LangChain model, you'll now be able to
utilize the 1.x family of the OpenAI SDK without having to point to deprecated legacy APIs. (11123, harupy)

Features:

- [UI] Revamp the MLflow Tracking UI for Deep Learning workflows, offering a more intuitive and efficient user experience (11233, daniellok-db)
- [Data] Introduce the ability to log datasets without loading them into memory, optimizing resource usage and processing time (11172, chenmoneygithub)
- [Models] Introduce logging frequency controls for TensorFlow, aligning it with Keras for consistent performance monitoring (11094, chenmoneygithub)
- [Models] Add PySpark DataFrame support in `mlflow.pyfunc.predict`, enhancing data compatibility and analysis options for batch inference (10939, ernestwong-db)
- [Models] Introduce new CLI commands for updating model requirements, facilitating easier maintenance, validation and updating of models without having to re-log (11061, daniellok-db)
- [Models] Update Embedding API for sentence transformers to ensure compatibility with OpenAI format, broadening model application scopes (11019, lu-wang-dl)
- [Models] Improve input and signature support for text-generation models, optimizing for Chat and Completions tasks (11027, es94129)
- [Models] Enable chat and completions task outputs in the text-generation pipeline, expanding interactive capabilities (10872, es94129)
- [Tracking] Add node id to system metrics for enhanced logging in multi-node setups, improving diagnostics and monitoring (11021, chenmoneygithub)
- [Tracking] Implement `mlflow.config.enable_async_logging` for asynchronous logging, improving log handling and system performance (11138, chenmoneygithub)
- [Evaluate] Enhance model evaluation with endpoint URL support, streamlining performance assessments and integrations (11262, B-Step62)
- [Deployments] Implement chat & chat streaming support for Cohere, enhancing interactive model deployment capabilities (10976, gabrielfu)
- [Deployments] Enable Cohere streaming support, allowing real-time interaction functionalities for the MLflow Deployments server with the Cohere provider (10856, gabrielfu)
- [Docker / Scoring] Optimize Docker images for model serving, ensuring more efficient deployment and scalability (10954, B-Step62)
- [Scoring] Support completions (`prompt`) and embeddings (`input`) format inputs in the scoring server, increasing model interaction flexibility (10958, es94129)

Bug Fixes:

- [Model Registry] Correct the oversight of not utilizing the default credential file in model registry setups (11261, B-Step62)
- [Model Registry] Address the visibility issue of aliases in the model versions table within the registered model detail page (11223, smurching)
- [Models] Ensure `load_context()` is called when enforcing `ChatModel` outputs so that all required external references are included in the model object instance (11150, daniellok-db)
- [Models] Rectify the keras output dtype in signature mismatches, ensuring data consistency and accuracy (11230, chenmoneygithub)
- [Models] Resolve spark model loading failures, enhancing model reliability and accessibility (11227, WeichenXu123)
- [Models] Eliminate false warnings for missing signatures in Databricks, improving the user experience and model validation processes (11181, B-Step62)
- [Models] Implement a timeout for signature/requirement inference during Transformer model logging, optimizing the logging process and avoiding delays (11037, B-Step62)
- [Models] Address the missing dtype issue for transformer pipelines, ensuring data integrity and model accuracy (10979, B-Step62)
- [Models] Correct non-idempotent predictions due to in-place updates to model-config, stabilizing model outputs (11014, B-Step62)
- [Models] Fix an issue where specifying `torch.dtype` as a string was not being applied correctly to the underlying transformers model (11297, 11295, harupy)
- [Tracking] Fix `mlflow.evaluate` `col_mapping` bug for non-LLM/custom metrics, ensuring accurate evaluation and metric calculation (11156, sunishsheth2009)
- [Tracking] Resolve the `TensorInfo` TypeError exception message issue, ensuring clarity and accuracy in error reporting for users (10953, leecs0503)
- [Tracking] Enhance `RestException` objects to be picklable, improving their usability in distributed computing scenarios where serialization is essential (10936, WeichenXu123)
- [Tracking] Address the handling of unrecognized response error codes, ensuring robust error processing and improved user feedback in edge cases (10918, chenmoneygithub)
- [Spark] Update hardcoded `io.delta:delta-spark_2.12:3.0.0` dependency to the correct scala version, aligning dependencies with project requirements (11149, WeichenXu123)
- [Server-infra] Adapt to newer versions of python by avoiding `importlib.metadata.entry_points().get`, enhancing compatibility and stability (10752, raphaelauv)
- [Server-infra / Tracking] Introduce an environment variable to disable mlflow configuring logging on import, improving configurability and user control (11137, jmahlik)
- [Auth] Enhance auth validation for `mlflow.login()`, streamlining the authentication process and improving security (11039, chenmoneygithub)

Documentation Updates:

- [Docs] Introduce a comprehensive notebook demonstrating the use of ChatModel with Transformers and Pyfunc, providing users with practical insights and guidelines for leveraging these models (11239, daniellok-db)
- [Tracking / Docs] Stabilize the dataset logging APIs, removing the experimental status (11229, dbczumar)
- [Docs] Revise and update the documentation on authentication database configuration, offering clearer instructions and better support for setting up secure authentication mechanisms (11176, gabrielfu)
- [Docs] Publish a new guide and tutorial for MLflow data logging and `log_input`, enriching the documentation with actionable advice and examples for effective data handling (10956, BenWilson2)
- [Docs] Upgrade the documentation visuals by replacing low-resolution and poorly dithered GIFs with high-quality HTML5 videos, significantly enhancing the learning experience (11051, BenWilson2)
- [Docs / Examples] Correct the compatibility matrix for OpenAI in MLflow Deployments Server documentation, providing users with accurate integration details and supporting smoother deployments (11015, BenWilson2)

Small bug fixes and documentation updates:

11284, 11096, 11285, 11245, 11254, 11252, 11250, 11249, 11234, 11248, 11242, 11244, 11236, 11208, 11220, 11222, 11221, 11219, 11218, 11210, 11209, 11207, 11196, 11194, 11177, 11205, 11183, 11192, 11179, 11178, 11175, 11174, 11166, 11162, 11151, 11168, 11167, 11153, 11158, 11143, 11141, 11119, 11123, 11124, 11117, 11121, 11078, 11097, 11079, 11095, 11082, 11071, 11076, 11070, 11072, 11073, 11069, 11058, 11034, 11046, 10951, 11055, 11045, 11035, 11044, 11043, 11031, 11030, 11023, 10932, 10986, 10949, 10943, 10928, 10929, 10925, 10924, 10911, harupy; 11289, BenWilson2; 11290, 11145, 11125, 11098, 11053, 11006, 11001, 11011, 11007, 10985, 10944, 11231, daniellok-db; 11276, 11280, 11275, 11263, 11247, 11257, 11258, 11256, 11224, 11211, 11182, 11059, 11056, 11048, 11008, 10923, serena-ruan; 11129, 11086, victorsun123; 11292, 11004, 11204, 11148, 11165, 11146, 11115, 11099, 11092, 11029, 10983, B-Step62; 11189, 11191, 11022, 11160, 11110, 11088, 11042, 10879, 10832, 10831, 10888, 10908, michael-berk; 10627, 11217, 11200, 10969, liangz1; 11215, 11173, 11000, 10931, edwardfeng-db; 11188, 10711, TomeHirata; 11186, xhochy; 10916, annzhang-db; 11131, 11010, 11060, WeichenXu123; 11063, 10981, 10889, 11269, chenmoneygithub; 11054, 10921, smurching; 11018, mingyangge-db; 10989, minkj1992; 10796, kriscon-db; 10984, eltociear; 10982, holzman; 10972, bmuskalla; 10959, prithvikannan; 10941, mahesh-venkatachalam; 10915, Cokral; 10904, dannyfriar; 11134, WP-LKL; 11287, serkef;

Page 4 of 18

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.