Skip to content

security(deps): bump the inference-dependencies group in /evaluation with 2 updates#401

Merged
WilliamBerryiii merged 1 commit into
mainfrom
dependabot/pip/evaluation/inference-dependencies-77b2d92f18
Apr 7, 2026
Merged

security(deps): bump the inference-dependencies group in /evaluation with 2 updates#401
WilliamBerryiii merged 1 commit into
mainfrom
dependabot/pip/evaluation/inference-dependencies-77b2d92f18

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 7, 2026

Bumps the inference-dependencies group in /evaluation with 2 updates: marshmallow and mlflow.

Updates marshmallow from 4.2.3 to 4.3.0

Changelog

Sourced from marshmallow's changelog.

4.3.0 (2026-04-03)

Features:

  • Add pre_load and post_load parameters to marshmallow.fields.Field for field-level pre- and post-processing (:issue:2787).
  • Typing: improvements to marshmallow.validate (:pr:2940).

4.2.4 (2026-04-02)

Bug fixes:

  • marshmallow.validate.URL and marshmallow.validate.Email accept Internationalized Domain Names (IDNs) (:issue:2821, :issue:2936). marshmallow.validate.Email also correctly rejects IDN domains with leading/trailing hyphens. Thanks :user:touhidurrr for the report.
  • Typing: Fix typing of nested in marshmallow.fields.Nested (:pr:2935).
Commits

Updates mlflow from 3.10.1 to 3.11.1

Release notes

Sourced from mlflow's releases.

v3.11.0rc1

Stripped third-party dependencies from evaluation and AI Gateway features, replacing external provider routing with built-in implementations.

v3.11.0rc0

We're excited to announce MLflow 3.11.0rc0, which includes several notable updates:

Major New Features:

  • 🔍 Automatic Issue Identification: Automatically identify quality issues in your agent with AI! Use the new "Detect Issues" button in the traces table to analyze selected traces and surface potential problems across categories like correctness, safety, and performance. Issues are linked directly to traces for easy investigation and debugging. (#21431, #21204, #21165, #21163, #21161, @​smoorjani, @​serena-ruan)
  • 💰 Gateway Budget Alerts & Limits: Control your AI Gateway spending with configurable budget policies! Set spending limits by time window (daily, weekly, or monthly), receive alerts before hitting limits, and prevent runaway costs with automatic request blocking. The new budget management UI lets you track spending, configure webhooks for notifications, and monitor violations across all your gateway endpoints. (#21116, #21534, #21569, #21473, #21108, @​TomeHirata, @​copilot-swe-agent)
  • 📊 Trace Graph View: Visualize complex trace hierarchies with an interactive graph view! Navigate multi-level trace structures, understand parent-child relationships at a glance, and debug complex systems more effectively with a visual representation of your trace topology. (#20607, @​joelrobin18)
  • 🌐 Native OpenTelemetry GenAI Convention Support: MLflow now natively supports the OpenTelemetry GenAI Semantic Conventions for trace export! When exporting traces via OTLP with MLFLOW_ENABLE_OTEL_GENAI_SEMCONV enabled, MLflow automatically translates them to follow the OTel GenAI semantic conventions, enabling seamless integration with OTel-compatible observability platforms while preserving GenAI-specific metadata. (#21494, #21495, @​B-Step62)
  • 🔧 Opencode Tracing Integration: Debug smarter with Opencode CLI integration! Track and analyze code execution flows directly from your development workflow, making it easier to identify performance bottlenecks and trace issues back to specific code paths. (#20133, @​joelrobin18)
  • ⚡ UV Package Manager Support: Automatic dependency inference now supports UV! MLflow automatically detects UV projects and captures exact, locked dependencies from your lockfile when logging models, ensuring reproducible environments. (#20344, #20935, @​debu-sinha)
  • 🔒 Pickle-Free Model Serialization: Enhance security with pickle-free model formats! MLflow now supports safer model serialization using torch.export and skops formats, with improved controls when MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False. Comprehensive documentation guides you through migrating existing models to pickle-free formats for production deployments. (#21404, #21188, #20774, @​WeichenXu123)

Breaking Changes:

  • ⚠️ TypeScript SDK Package Renaming: The MLflow TypeScript SDK packages have been renamed to use npm organization scoping. If you're using the TypeScript SDK, update your package.json dependencies and import statements: mlflow-tracing → @mlflow/core, mlflow-openai → @mlflow/openai, mlflow-anthropic → @mlflow/anthropic, mlflow-gemini → @mlflow/gemini. All packages are now at version 0.2.0. (#20792, @​B-Step62)

Stay tuned for the full release, which will be packed with even more features and bugfixes.

To try out this release candidate, please run:

pip install mlflow==3.11.0rc0

Changelog

Sourced from mlflow's changelog.

CHANGELOG

3.11.0 (2026-04-07)

MLflow 3.11.0 includes several major features and improvements.

Major New Features:

  • 🔍 Automatic Issue Identification: Automatically identify quality issues in your agent with AI! Use the new "Detect Issues" button in the traces table to analyze selected traces and surface potential problems across categories like correctness, safety, and performance. Issues are linked directly to traces for easy investigation and debugging. Docs (#21431, #21204, #21165, #21163, #21161, @​smoorjani, @​serena-ruan)
  • 💰 Gateway Budget Alerts & Limits: Control your AI Gateway spending with configurable budget policies! Set spending limits by time window (daily, weekly, or monthly), receive alerts before hitting limits, and prevent runaway costs with automatic request blocking. The new budget management UI lets you track spending, configure webhooks for notifications, and monitor violations across all your gateway endpoints. Docs (#21116, #21534, #21569, #21473, #21108, @​TomeHirata, @​copilot-swe-agent)
  • 📊 Trace Graph View: Visualize complex trace hierarchies with an interactive graph view! Navigate multi-level trace structures, understand parent-child relationships at a glance, and debug complex systems more effectively with a visual representation of your trace topology. Docs (#20607, @​joelrobin18)
  • 🌐 Native OpenTelemetry GenAI Convention Support: MLflow now natively supports the OpenTelemetry GenAI Semantic Conventions for trace export! When exporting traces via OTLP with MLFLOW_ENABLE_OTEL_GENAI_SEMCONV enabled, MLflow automatically translates them to follow the OTel GenAI semantic conventions, enabling seamless integration with OTel-compatible observability platforms while preserving GenAI-specific metadata. Docs (#21494, #21495, @​B-Step62)
  • 🔧 OpenCode Tracing Integration: Debug smarter with OpenCode CLI integration! Track and analyze code execution flows directly from your development workflow, making it easier to identify performance bottlenecks and trace issues back to specific code paths. Docs (#20133, @​joelrobin18)
  • ⚡ Native UV Support for Model Dependencies: Automatic dependency inference now supports UV! MLflow automatically detects UV projects and captures exact, locked dependencies from your lockfile when logging models, ensuring reproducible environments. Docs (#20344, #20935, @​debu-sinha)
  • 🔒 Pickle-Free Model Serialization: Enhance security with pickle-free model formats! MLflow now supports safer model serialization using torch.export and skops formats, with improved controls when MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False. Comprehensive documentation guides you through migrating existing models to pickle-free formats for production deployments. Docs (#21404, #21188, #20774, @​WeichenXu123)

Breaking Changes:

  • ⚠️ TypeScript SDK Package Renaming: The MLflow TypeScript SDK packages have been renamed to use npm organization scoping. If you're using the TypeScript SDK, update your package.json dependencies and import statements: mlflow-tracing → @mlflow/core, mlflow-openai → @mlflow/openai, mlflow-anthropic → @mlflow/anthropic, mlflow-gemini → @mlflow/gemini. All packages are now at version 0.2.0. (#20792, @​B-Step62)
  • Remove MLFLOW_ENABLE_INCREMENTAL_SPAN_EXPORT environment variable (#22182, @​PattaraS)
  • Remove litellm and gepa from genai extras (#22059, @​TomeHirata)
  • Block / and : in Registered Model names (#21458, @​Bhuvan-08)

Features:

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the inference-dependencies group
ff52163 
Bumps the inference-dependencies group in /evaluation with 2 updates: [marshmallow](https://github.com/marshmallow-code/marshmallow) and [mlflow](https://github.com/mlflow/mlflow).


Updates `marshmallow` from 4.2.3 to 4.3.0
- [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst)
- [Commits](marshmallow-code/marshmallow@4.2.3...4.3.0)

Updates `mlflow` from 3.10.1 to 3.11.1
- [Release notes](https://github.com/mlflow/mlflow/releases)
- [Changelog](https://github.com/mlflow/mlflow/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mlflow/mlflow/commits)

---
updated-dependencies:
- dependency-name: marshmallow
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: inference-dependencies
- dependency-name: mlflow
  dependency-version: 3.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: inference-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency version updates python Pull requests that update python code labels Apr 7, 2026
@github-actions github-actions Bot changed the title chore(deps): bump the inference-dependencies group in /evaluation with 2 updates security(deps): bump the inference-dependencies group in /evaluation with 2 updates Apr 7, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 7, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA ff52163.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

evaluation/pyproject.toml

PackageVersionLicenseIssue Type
marshmallow4.3.0NullUnknown License
mlflow3.11.1NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
pip/marshmallow 4.3.0 UnknownUnknown
pip/mlflow 3.11.1 UnknownUnknown

Scanned Files

  • evaluation/pyproject.toml

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 7, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.48%. Comparing base (0c29148) to head (ff52163).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #401   +/-   ##
=======================================
  Coverage   50.48%   50.48%           
=======================================
  Files         267      267           
  Lines       18188    18188           
  Branches     1903     1903           
=======================================
  Hits         9182     9182           
  Misses       8716     8716           
  Partials      290      290
Flag Coverage Δ *Carryforward flag
pester 81.21% <ø> (ø)
pytest 6.89% <ø> (ø) Carriedforward from 0c29148
pytest-dataviewer 61.97% <ø> (ø)
vitest 50.72% <ø> (ø)

*This pull request uses carry forward flags. Click here to find out more.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@WilliamBerryiii WilliamBerryiii merged commit c88d253 into main Apr 7, 2026
30 checks passed
@WilliamBerryiii WilliamBerryiii deleted the dependabot/pip/evaluation/inference-dependencies-77b2d92f18 branch April 7, 2026 17:53
@physical-ai-toolchain-release physical-ai-toolchain-release Bot mentioned this pull request Apr 7, 2026
Merged
WilliamBerryiii pushed a commit that referenced this pull request Apr 8, 2026
@physical-ai-toolchain-release @github-actions
chore(main): release 0.6.0 (#364)
701ee5d 
🤖 I have created a release *beep* *boop*
---


##
[0.6.0](v0.5.0...v0.6.0)
(2026-04-08)


### ✨ Features

* **build:** add terraform-docs generation pipeline
([#378](#378))
([78e90d0](78e90d0))
* **infrastructure:** enable optional AML diagnostic logs
([#400](#400))
([58dd8db](58dd8db))
* **scripts:** consolidate scripts library paths and enhance dataviewer
([#383](#383))
([176d9c9](176d9c9))


### 🐛 Bug Fixes

* **build:** remediate CVEs, enforce equality pinning, repair Dependabot
config
([#391](#391))
([0c29148](0c29148))
* **infrastructure:** add Storage File Data Privileged Contributor role
for ML identity
([#380](#380))
([378f7ed](378f7ed))
* **infrastructure:** replace hardcoded NAT Gateway availability zones
with variable
([#356](#356))
([a1397bd](a1397bd))
* **infrastructure:** resolve TFLint violations and enable hard-fail
([#376](#376))
([dfb55cd](dfb55cd))
* **scripts:** add dot-source guard to Invoke-MsDateFreshnessCheck.ps1
([#397](#397))
([f6f22c3](f6f22c3))
* **training:** validate AzureML and OSMO RL submissions end to end
([#372](#372))
([49904d3](49904d3))


### 📚 Documentation

* **infrastructure:** add terraform-docs tooling and improve developer
experience
([#365](#365))
([a0fb03a](a0fb03a))
* **reference:** centralize workflow template docs and convert workflow
READMEs to pointer index
([#379](#379))
([68097e4](68097e4))


### 🔧 Miscellaneous

* **deps-dev:** bump the npm_and_yarn group across 1 directory with 2
updates
([#374](#374))
([d848c8b](d848c8b))
* **deps-dev:** bump vite from 6.4.1 to 6.4.2 in
/data-management/viewer/frontend in the npm_and_yarn group across 1
directory
([#395](#395))
([6ec7f19](6ec7f19))
* **deps:** bump the github-actions group across 1 directory with 7
updates
([#370](#370))
([4d1b951](4d1b951))
* **deps:** bump the uv group across 2 directories with 1 update
([#373](#373))
([ba66ed9](ba66ed9))


### 🔒 Security

* **deps-dev:** bump brace-expansion from 1.1.12 to 1.1.13 in
/docs/docusaurus in the npm_and_yarn group across 1 directory
([#389](#389))
([27129d9](27129d9))
* **deps-dev:** bump the npm_and_yarn group across 2 directories with 2
updates
([#363](#363))
([aeae624](aeae624))
* **deps-dev:** bump the python-dependencies group with 5 updates
([#403](#403))
([bb85560](bb85560))
* **deps:** bump cryptography from 46.0.5 to 46.0.6 in /training/rl
([#367](#367))
([a82dd68](a82dd68))
* **deps:** bump the inference-dependencies group in /evaluation with 2
updates
([#401](#401))
([c88d253](c88d253))
* **deps:** bump the pip group across 4 directories with 2 updates
([#411](#411))
([1230fe0](1230fe0))
* **deps:** bump the training-dependencies group across 1 directory with
67 updates
([#375](#375))
([8e05172](8e05172))
* **deps:** bump the uv group across 2 directories with 1 update
([#382](#382))
([b6c7aea](b6c7aea))
* **deps:** update marshmallow requirement from &lt;4.3.0,&gt;=3.5 to
&gt;=3.5,&lt;4.4.0 in /evaluation in the inference-dependencies group
([#393](#393))
([599c7eb](599c7eb))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: physical-ai-toolchain-release[bot] <267194360+physical-ai-toolchain-release[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@WilliamBerryiii WilliamBerryiii WilliamBerryiii approved these changes

Assignees

No one assigned

Labels

dependencies Dependency version updates python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@codecov-commenter @WilliamBerryiii