Skip to content

security: bump mlflow to 3.15.1 - #2298

Merged
kajalj22 merged 6 commits into
mainfrom
bump-mlflow-3.15.1
Aug 4, 2026
Merged

security: bump mlflow to 3.15.1#2298
kajalj22 merged 6 commits into
mainfrom
bump-mlflow-3.15.1

Conversation

@kajalj22

@kajalj22 kajalj22 commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Bumps `mlflow`, `mlflow-skinny`, and `mlflow-tracing` from `3.14.0` to `3.15.1`
  • Pins `stirrup==0.1.12` to block the coincidentally-released 0.2.0 which broke `ChatCompletionsClient` (unrelated to the mlflow bump, but fixed here to unblock CI)
  • Updates `uv.lock` accordingly

Test plan

  • CI green

Signed-off-by: Kajal Jain <kajalj@nvidia.com>
@kajalj22
kajalj22 requested a review from a team as a code owner August 4, 2026 05:55
@kajalj22 kajalj22 added the r0.5.0 Auto-cherrypick to release branch. Apply before merge; cherrypick happens after merge. label Aug 4, 2026
@copy-pr-bot

copy-pr-bot Bot commented Aug 4, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

balasaajay
balasaajay previously approved these changes Aug 4, 2026
…0.2.0 API

stirrup 0.2.0 split the old max_tokens (context window) into two
parameters: max_tokens (generation limit) and context_window_tokens
(context capacity, now required). Pass context_window_tokens explicitly
through the subclass __init__ and read it from self._context_window_tokens
in generate() instead of self._max_tokens.

Signed-off-by: Kajal Jain <kajalj@nvidia.com>
stirrup 0.2.0 validates max_tokens <= context_window_tokens; the default
max_tokens is 64k so test values must be at least that large.

Signed-off-by: Kajal Jain <kajalj@nvidia.com>
The stirrup >=0.1.12 requirement resolved to 0.2.0 independently of the
mlflow version bump. That breakage pre-dates this PR and needs its own fix.

Signed-off-by: Kajal Jain <kajalj@nvidia.com>
stirrup 0.2.0 (published 2026-08-04T00:12 UTC) added a required
context_window_tokens kwarg to ChatCompletionsClient.__init__(),
breaking the stirrup_agent server tests.

Signed-off-by: Kajal Jain <kajalj@nvidia.com>
Taking main's stirrup>=0.1.12,<0.2 range cap over our ==0.1.12 pin
(main's version was merged independently and is more flexible).

Signed-off-by: Kajal Jain <kajalj@nvidia.com>
@kajalj22
kajalj22 enabled auto-merge (squash) August 4, 2026 14:44
@kajalj22
kajalj22 merged commit ae1aea9 into main Aug 4, 2026
16 checks passed
@kajalj22
kajalj22 deleted the bump-mlflow-3.15.1 branch August 4, 2026 16:04
kajalj22 added a commit that referenced this pull request Aug 5, 2026
beep boop [🤖]: Hi @kajalj22 👋,

    we've cherry picked #2298 into  for you! 🚀

    Please review and approve this cherry pick by your convenience!

Signed-off-by: Kajal Jain <kajalj@nvidia.com>
Signed-off-by: NeMo Bot <nemo-bot@nvidia.com>
Co-authored-by: kajalj22 <kajalj@nvidia.com>
OlegSudakov pushed a commit to OlegSudakov/Gym that referenced this pull request Aug 7, 2026
## Summary
- Bumps \`mlflow\`, \`mlflow-skinny\`, and \`mlflow-tracing\` from
\`3.14.0\` to \`3.15.1\`
- Pins \`stirrup==0.1.12\` to block the coincidentally-released 0.2.0
which broke \`ChatCompletionsClient\` (unrelated to the mlflow bump, but
fixed here to unblock CI)
- Updates \`uv.lock\` accordingly

## Test plan
- [ ] CI green

---------

Signed-off-by: Kajal Jain <kajalj@nvidia.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

r0.5.0 Auto-cherrypick to release branch. Apply before merge; cherrypick happens after merge.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants