Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(predict-diabetes): update dependency mlflow to v2.9.2 #13243

Merged
merged 1 commit into from
Dec 14, 2023

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 14, 2023

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
mlflow (source) 2.9.1 -> 2.9.2 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

mlflow/mlflow (mlflow)

v2.9.2

Compare Source

MLflow 2.9.2 is a patch release, containing several critical security fixes and configuration updates to support extremely large model artifacts.

Features:

  • [Deployments] Add the mlflow.deployments.openai API to simplify direct access to OpenAI services through the deployments API (#​10473, @​prithvikannan)
  • [Server-infra] Add a new environment variable that permits disabling http redirects within the Tracking Server for enhanced security in publicly accessible tracking server deployments (#​10673, @​daniellok-db)
  • [Artifacts] Add environment variable configurations for both Multi-part upload and Multi-part download that permits modifying the per-chunk size to support extremely large model artifacts (#​10648, @​harupy)

Security fixes:

  • [Server-infra] Disable the ability to inject malicious code via manipulated YAML files by forcing YAML rendering to be performed in a secure Sandboxed mode (#​10676, @​BenWilson2, #​10640, @​harupy)
  • [Artifacts] Prevent path traversal attacks when querying artifact URI locations by disallowing .. path traversal queries (#​10653, @​B-Step62)
  • [Data] Prevent a mechanism for conducting a malicious file traversal attack on Windows when using tracking APIs that interface with HTTPDatasetSource (#​10647, @​BenWilson2)
  • [Artifacts] Prevent a potential path traversal attack vector via encoded url traversal paths by decoding paths prior to evaluation (#​10650, @​B-Step62)
  • [Artifacts] Prevent the ability to conduct path traversal attacks by enforcing the use of sanitized paths with the tracking server (#​10666, @​harupy)
  • [Artifacts] Prevent path traversal attacks when using an FTP server as a backend store by enforcing base path declarations prior to accessing user-supplied paths (#​10657, @​harupy)

Documentation updates:

Small bug fixes and documentation updates:

#​10677, #​10636, @​serena-ruan; #​10652, #​10649, #​10641, @​harupy; #​10643, #​10632, @​BenWilson2


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot requested a review from hongbo-miao as a code owner December 14, 2023 18:24
Copy link

sonarcloud bot commented Dec 14, 2023

Quality Gate Passed Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

@mergify mergify bot merged commit 5685aa9 into main Dec 14, 2023
79 checks passed
@mergify mergify bot deleted the renovate/predict-diabetes-mlflow-2.x branch December 14, 2023 18:27
Copy link

🎉 This PR is included in version 1.98.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants