Update dependency mlflow to v3.11.1 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
mlflow	3.3.2 → 3.11.1

---

MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation

CVE-2025-14279 / GHSA-pgqp-8h46-6x4j

More information

Details

MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST endpoints. An attacker can query, update, and delete experiments via the affected endpoints, leading to potential data exfiltration, destruction, or manipulation. The issue is resolved in version 3.5.0.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-14279
• https://github.com/mlflow/mlflow/commit/b0ffd289e9b0d0cc32c9e3a9b9f3843ae83dbec3
• https://huntr.com/bounties/ef478f72-2e4f-44dc-8055-fc06bef03108
• https://github.com/mlflow/mlflow/pull/17910
• https://github.com/advisories/GHSA-pgqp-8h46-6x4j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

mlflow Creates of Temporary File in Directory with Insecure Permissions

CVE-2025-10279 / GHSA-4x5p-f36r-mxxr

More information

Details

In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the /tmp directory to exploit a race condition and overwrite .py files in the virtual environment, leading to arbitrary code execution. The issue is resolved in version 3.4.0.

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-10279
• https://github.com/mlflow/mlflow/commit/1d7c8d4cf0a67d407499a8a4ffac387ea4f8194a
• https://huntr.com/bounties/01d3b81e-13d1-43aa-b91a-443aec68bdc8
• https://github.com/advisories/GHSA-4x5p-f36r-mxxr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MLflow has a command injection in mlflow/sagemaker/init.py

CVE-2025-14287 / GHSA-xch3-2f9x-wh9f

More information

Details

A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/__init__.py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using os.system(). This allows attackers to execute arbitrary commands by supplying malicious input through the --container parameter of the CLI. The issue affects environments where MLflow is used, including development setups, CI/CD pipelines, and cloud deployments.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-14287
• https://huntr.com/bounties/229cd526-41aa-4819-b6f0-e2d0371c89e3
• https://github.com/mlflow/mlflow/pull/19277
• https://github.com/mlflow/mlflow/commit/8b8792a7034fb33a14b0b31cabcaa9b912d3485f
• https://github.com/mlflow/mlflow/releases/tag/v3.8.0rc0
• https://github.com/advisories/GHSA-xch3-2f9x-wh9f

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MLflow Use of Default Password Authentication Bypass Vulnerability

CVE-2026-2635 / GHSA-gq3w-7jj3-x7gr

More information

Details

This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-2635
• https://github.com/mlflow/mlflow/pull/19260
• https://www.zerodayinitiative.com/advisories/ZDI-26-111
• https://github.com/mlflow/mlflow/commit/5bf2ec2bd4222a18d78631183ac7f6b752afe8a4
• https://github.com/mlflow/mlflow/releases/tag/v3.8.0rc0
• https://github.com/advisories/GHSA-gq3w-7jj3-x7gr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability

CVE-2026-2033 / GHSA-q2r8-vmq7-fpx2

More information

Details

MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of artifact file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-2033
• https://github.com/mlflow/mlflow/pull/19260
• https://www.zerodayinitiative.com/advisories/ZDI-26-105
• https://github.com/mlflow/mlflow/commit/5bf2ec2bd4222a18d78631183ac7f6b752afe8a4
• https://github.com/mlflow/mlflow/releases/tag/v3.8.0rc0
• https://github.com/advisories/GHSA-q2r8-vmq7-fpx2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Arbitrary file write via tar traversal in mlflow

CVE-2025-15031 / GHSA-fhff-qmm8-h2fp

More information

Details

A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of tarfile.extractall without path validation enables crafted tar.gz files containing .. or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, as it can lead to arbitrary file overwrites and potential remote code execution.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-15031
• https://huntr.com/bounties/09856f77-f968-446f-a930-657d126efe4e
• https://github.com/mlflow/mlflow/commit/3bf6d81ac4d38654c8ff012dbd0c3e9f17e7e346
• https://github.com/mlflow/mlflow/blob/fe4d9be330426904283401f1d2ed914238b6fc37/mlflow/pyfunc/dbconnect_artifact_cache.py#L140
• https://github.com/advisories/GHSA-fhff-qmm8-h2fp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MLFlow path traversal vulnerability

CVE-2025-15036 / GHSA-vhcx-3pq2-4fvc

More information

Details

A path traversal vulnerability exists in the extract_archive_to_dir function within the mlflow/pyfunc/dbconnect_artifact_cache.py file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An attacker with control over the tar.gz file can exploit this issue to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox directory in multi-tenant or shared cluster environments.

Severity

• CVSS Score: 9.6 / 10 (Critical)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-15036
• https://github.com/mlflow/mlflow/commit/3bf6d81ac4d38654c8ff012dbd0c3e9f17e7e346
• https://huntr.com/bounties/36c314cf-fd6e-4fb0-b9b0-1b47bcdf0eb0
• https://github.com/advisories/GHSA-vhcx-3pq2-4fvc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MLflow Command Injection vulnerability

CVE-2025-15379 / GHSA-r23q-823p-vmf7

More information

Details

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the _install_model_dependencies_to_env() function. When deploying a model with env_manager=LOCAL, MLflow reads dependency specifications from the model artifact's python_env.yaml file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.1.

Severity

• CVSS Score: 10.0 / 10 (Critical)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-15379
• https://github.com/mlflow/mlflow/commit/361b6f620adf98385c6721e384fb5ef9a30bb05e
• https://huntr.com/bounties/dc9c1c20-7879-4050-87df-4d095fe5ca75
• https://github.com/mlflow/mlflow/commit/a22ce7157f646bdce4c95106fc38ccc9ca289205
• https://github.com/advisories/GHSA-r23q-823p-vmf7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint

CVE-2026-33866 / GHSA-46r5-x6jq-v8g6

More information

Details

MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access.

This issue affects MLflow version through 3.10.1

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-33866
• https://github.com/mlflow/mlflow/pull/21708
• https://cert.pl/en/posts/2026/04/CVE-2026-33865
• https://github.com/mlflow/mlflow/commit/005b959cacda05d1423356cfcbd9ebeda8ff96a7
• https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors
• https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-94.yaml
• https://github.com/advisories/GHSA-46r5-x6jq-v8g6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface

CVE-2026-33865 / GHSA-fh64-r2vc-xvhr

More information

Details

MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.

This issue affects MLflow version through 3.10.1

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-33865
• https://github.com/mlflow/mlflow/pull/21435
• https://cert.pl/en/posts/2026/04/CVE-2026-33865
• https://github.com/mlflow/mlflow/commit/aca4dd0ec88a12f7655155c224371280e9b45dda
• https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors
• https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-93.yaml
• https://github.com/advisories/GHSA-fh64-r2vc-xvhr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability

CVE-2026-2393 / GHSA-65h7-c7c4-mghx

More information

Details

A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The _create_webhook() function in mlflow/server/handlers.py accepts a user-controlled url parameter without validation, and the _send_webhook_request() function in mlflow/webhooks/delivery.py sends HTTP POST requests to this attacker-controlled URL. This allows an authenticated attacker to force the MLflow backend to send HTTP requests to internal services, cloud metadata endpoints, or arbitrary external servers. The lack of input sanitization, URL scheme filtering, or allowlist validation on the webhook URL enables exploitation, potentially leading to cloud credential theft, internal network access, and data exfiltration.

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-2393
• https://github.com/mlflow/mlflow/commit/64aa0ab7207f9c649b59ba1a5f40d82196817389
• https://huntr.com/bounties/04ef100d-06b5-4a70-95b1-b7be23aa8150
• https://github.com/advisories/GHSA-65h7-c7c4-mghx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

CVE-2026-2614 / GHSA-42h5-h8qh-vv9v

More information

Details

A vulnerability in the _create_model_version() handler of mlflow/server/handlers.py in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a CreateModelVersion request includes the tag mlflow.prompt.is_prompt, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The get_model_version_artifact_handler() function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-2614
• https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a
• https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6
• https://github.com/advisories/GHSA-42h5-h8qh-vv9v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Mlflow: Command Injection when serving models with enable_mlserver=True

CVE-2026-0596 / GHSA-rvhj-8chj-8v3c

More information

Details

A command injection vulnerability exists in Mlflow when serving a model with enable_mlserver=True. The model_uri is embedded directly into a shell command executed via bash -c without proper sanitization. If the model_uri contains shell metacharacters, such as $() or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation if a higher-privileged service serves models from a directory writable by lower-privileged users.

Severity

• CVSS Score: 9.6 / 10 (Critical)
• Vector String: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-0596
• https://huntr.com/bounties/2e905add-f9f5-4309-a3db-b17de5981285
• https://github.com/mlflow/mlflow/pull/19738
• https://github.com/mlflow/mlflow/commit/202fac4c83ccc8544c087c142b80196d0e60695c
• https://github.com/advisories/GHSA-rvhj-8chj-8v3c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MLflow: unauthenticated access to certain FastAPI routes

CVE-2026-2652 / GHSA-75cm-x2w3-8mgf

More information

Details

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (--app-name basic-auth) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on /gateway/ routes, leaving other routes such as the Job API (/ajax-api/3.0/jobs/*) and the OpenTelemetry trace ingestion API (/v1/traces) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the _find_fastapi_validator() function fails to handle non-/gateway/ paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-2652
• https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa
• https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756
• https://github.com/advisories/GHSA-75cm-x2w3-8mgf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MLFlow Creates a Temporary File With Insecure Permissions

CVE-2026-4137 / GHSA-f2m9-wcf4-cwwx

More information

Details

In mlflow/mlflow versions prior to 3.11.0, the get_or_create_nfs_tmp_dir() function in mlflow/utils/file_utils.py creates temporary directories with world-writable permissions (0o777), and the _create_model_downloading_tmp_dir() function in mlflow/pyfunc/__init__.py creates directories with group-writable permissions (0o770). These insecure permissions allow local attackers to tamper with model artifacts, such as cloudpickle-serialized Python objects, and achieve arbitrary code execution when the tampered artifacts are deserialized via cloudpickle.load(). This vulnerability is particularly critical in environments with shared NFS mounts, such as Databricks, where NFS is enabled by default. The issue is a continuation of the vulnerability class addressed in CVE-2025-10279, which was only partially fixed.

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4137
• https://github.com/mlflow/mlflow/commit/1dcbb0c2fbd1f446c328830e601ca13a28219b8a
• https://huntr.com/bounties/648dc30b-76c7-4433-86b8-f43d926fd8d6
• https://github.com/advisories/GHSA-4x5p-f36r-mxxr
• https://github.com/advisories/GHSA-f2m9-wcf4-cwwx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks

CVE-2026-2734 / GHSA-w5xq-c4pf-ghq7

More information

Details

In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registered models, regardless of their permission level. The issue arises due to the absence of SearchModelVersions in the BEFORE_REQUEST_VALIDATORS and AFTER_REQUEST_HANDLERS for the REST API, and its omission from GraphQLAuthorizationMiddleware.PROTECTED_FIELDS for GraphQL. This vulnerability can expose sensitive information such as model names, version descriptions, source URIs, tags, and other metadata, potentially revealing proprietary or confidential details in multi-tenant environments. The issue is resolved in version 3.10.0.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-2734
• https://github.com/mlflow/mlflow/commit/6989066af33fdcb03588fd71a1a67f8fc5ef12c9
• https://huntr.com/bounties/d632f783-b2c7-4a3b-af5e-1d693e841c08
• https://github.com/advisories/GHSA-w5xq-c4pf-ghq7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mlflow/mlflow (mlflow)

v3.11.1

MLflow 3.11.1 includes several major features and improvements.

Major New Features:

• 🔍 Automatic Issue Identification: Automatically identify quality issues in your agent with AI! Use the new "Detect Issues" button in the traces table to analyze selected traces and surface potential problems across categories like correctness, safety, and performance. Issues are linked directly to traces for easy investigation and debugging. Docs (#​21431, #​21204, #​21165, #​21163, #​21161, @​smoorjani, @​serena-ruan)
• 💰 Gateway Budget Alerts & Limits: Control your AI Gateway spending with configurable budget policies! Set spending limits by time window (daily, weekly, or monthly), receive alerts before hitting limits, and prevent runaway costs with automatic request blocking. The new budget management UI lets you track spending, configure webhooks for notifications, and monitor violations across all your gateway endpoints. Docs (#​21116, #​21534, #​21569, #​21473, #​21108, @​TomeHirata, @​copilot-swe-agent)
• 📊 Trace Graph View: Visualize complex trace hierarchies with an interactive graph view! Navigate multi-level trace structures, understand parent-child relationships at a glance, and debug complex systems more effectively with a visual representation of your trace topology. Docs (#​20607, @​joelrobin18)
• 🌐 Native OpenTelemetry GenAI Convention Support: MLflow now natively supports the OpenTelemetry GenAI Semantic Conventions for trace export! When exporting traces via OTLP with MLFLOW_ENABLE_OTEL_GENAI_SEMCONV enabled, MLflow automatically translates them to follow the OTel GenAI semantic conventions, enabling seamless integration with OTel-compatible observability platforms while preserving GenAI-specific metadata. Docs (#​21494, #​21495, @​B-Step62)
• 🔧 OpenCode Tracing Integration: Debug smarter with OpenCode CLI integration! Track and analyze code execution flows directly from your development workflow, making it easier to identify performance bottlenecks and trace issues back to specific code paths. Docs (#​20133, @​joelrobin18)
• ⚡ Native UV Support for Model Dependencies: Automatic dependency inference now supports UV! MLflow automatically detects UV projects and captures exact, locked dependencies from your lockfile when logging models, ensuring reproducible environments. Docs (#​20344, #​20935, @​debu-sinha)
• 🔒 Pickle-Free Model Serialization: Enhance security with pickle-free model formats! MLflow now supports safer model serialization using torch.export and skops formats, with improved controls when MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False. Comprehensive documentation guides you through migrating existing models to pickle-free formats for production deployments. Docs (#​21404, #​21188, #​20774, @​WeichenXu123)

Breaking Changes:

• ⚠️ TypeScript SDK Package Renaming: The MLflow TypeScript SDK packages have been renamed to use npm organization scoping. If you're using the TypeScript SDK, update your package.json dependencies and import statements: mlflow-tracing → @mlflow/core, mlflow-openai → @mlflow/openai, mlflow-anthropic → @mlflow/anthropic, mlflow-gemini → @mlflow/gemini. All packages are now at version 0.2.0. (#​20792, @​B-Step62)
• Remove MLFLOW_ENABLE_INCREMENTAL_SPAN_EXPORT environment variable (#​22182, @​PattaraS)
• Remove litellm and gepa from genai extras (#​22059, @​TomeHirata)
• Block / and : in Registered Model names (#​21458, @​Bhuvan-08)

Features:

• [Evaluation] Allow MetaPromptOptimizer to work without litellm (#​22233, @​TomeHirata)
• [Tracking] Update Databricks API calls to use new gRPC APIs instead of py4j APIs (#​22205, @​WeichenXu123)
• [Build] Add aiohttp as a core dependency of mlflow (#​22189, @​TomeHirata)
• [Evaluation] Extend _get_provider_instance with groq, deepseek, xai, openrouter, ollama, databricks, vertex_ai (#​22148, @​kriscon-db)
• [UI] Move native providers to non-LiteLLM in gateway UI (#​22203, @​TomeHirata)
• [Tracing / Tracking] Add trace_location parameter to create_experiment (#​22075, @​dbrx-euirim)
• [Gateway] Complete Bedrock provider with Converse API support (#​21999, @​TomeHirata)
• [Gateway] Add native Vertex AI gateway provider (#​21998, @​TomeHirata)
• [Gateway] Add native Databricks gateway provider (#​21997, @​TomeHirata)
• [Gateway] Add native Ollama gateway provider (#​21995, @​TomeHirata)
• [Gateway] Add native xAI (Grok) gateway provider (#​21993, @​TomeHirata)
• [Tracing] Use bulk upsert in log_spans() to eliminate per-span ORM overhead (#​21954, @​harupy)
• [Tracing] Add builtin cost_per_token to remove litellm dependency for cost tracking (#​22046, @​TomeHirata)
• [Evaluation] Remove LiteLLM hard dependency from the discovery pipeline and judge adapters (#​21739, @​harupy)
• [Evaluation] Add pipelined predict-score execution for mlflow.genai.evaluate (#​20940, @​alkispoly-db)
• [Tracing / Tracking] Default trace location table_prefix to experiment ID in set_experiment (#​21815, @​danielseong1)
• [Tracking] Add default uvicorn log config with timestamps (#​21838, @​harupy)
• [Tracing / UI] Add Session ID filter to GenAI traces table filter dropdown (#​21794, @​daniellok-db)
• [Evaluation / UI] Add Default Credential Chain auth mode for Bedrock/SageMaker in AI Gateway (#​21061, @​timsolovev)
• [UI] Add multi metric bar chart support (#​21258, @​RenzoMXD)
• [Tracking] Add TCP keepalive to HTTP sessions to detect stale connections and reduce timeout hangs (#​21514, @​mobaniha)
• [Evaluation] Add proxy URL support for make_judge (#​21185, @​yukimori)
• [UI] Improve run group filter to use grouping criteria instead of run IDs (#​21072, @​daniellok-db)
• [UI] Add tool selector to Tool Calls charts and fix dark mode/sizing (#​20865, @​B-Step62)
• [UI] Graph View Traces + OpenAI (#​20607, @​joelrobin18)
• [UI] Show run description in chart tooltip (#​21580, @​KaushalVachhani)
• [Evaluation / Tracing / UI] Add bulk judge execution from traces table toolbar with status feedback (#​21270, @​PattaraS)
• [Gateway] Add Redis-backed BudgetTracker for distributed gateway deployments (#​21504, @​TomeHirata)
• [Tracing / Tracking] Add trace location param to set_experiment (#​21385, @​danielseong1)
• [Build / Tracking] Add azure extra for Azure Blob Storage support in full Docker image (#​21582, @​harupy)
• [UI] Add budget violation indicator to gateway budget list page (#​21569, @​copilot-swe-agent)
• [Evaluation] [5/5] Add discover_issues() pipeline and public API (#​21431, @​smoorjani)
• [UI] Add Structured Output (JSON Schema) Support to the MLflow Prompts UI (#​21394, @​kennyvoo)
• [Tracing] Auto-inject tracing context headers in autologging (#​21490, @​TomeHirata)
• [UI] Add budget alert webhooks UI and fix budgets table borders (#​21534, @​TomeHirata)
• [Model Registry / Prompts / UI] Add webhooks management UI to settings page (#​21483, @​TomeHirata)
• [Tracing] Opencode CLI (#​20133, @​joelrobin18)
• [Models] Add uv_groups and uv_extras params for uv dependency group control (#​20935, @​debu-sinha)
• [Tracing] Add GenAI Semantic Convention translator for OTLP trace export (#​21494, @​B-Step62)
• [Tracking] Add polars dataset support to autologging (#​21507, @​harupy)
• [Tracing] Add mlflow.tracing.context() API for injecting metadata/tags without wrapper spans (#​21318, @​B-Step62)
• [UI] Add budget dates and current spending for gateway budgets (#​21473, @​TomeHirata)
• [Tracing / UI] Improve DSPy trace chat view readability (#​21296, @​B-Step62)
• [UI] Add Kubernetes request auth provider plugin (#​21176, @​HumairAK)
• [Tracking] Add IS NULL/IS NOT NULL support for tags and params in search_runs (#​21283, @​TomeHirata)
• [Tracing / UI] Display clickable gateway trace link in trace explorer (#​21316, @​TomeHirata)
• [UI] Add session selection support with checkbox, actions, and row alignment (#​21324, @​B-Step62)
• [Models] Add UV package manager support for automatic dependency inference (#​20344, @​debu-sinha)
• [Evaluation / UI] Add feature flag to control evaluation runs issues panel visibility (#​21406, @​serena-ruan)
• [Tracing / UI] Add cached tokens display to Token Usage chart (#​21295, @​TomeHirata)
• [UI] Add budget policies management UI for AI Gateway (#​21116, @​TomeHirata)
• [UI] Allow multiple judge selection in Run judge on trace modal (#​21322, @​B-Step62)
• [Docs / Tracking] Add admin-only authorization to webhook CRUD operations (#​21271, @​TomeHirata)
• [Evaluation / Tracking] Add SqlIssue database table for storing experiment issues (#​21165, @​serena-ruan)
• [Model Registry / Prompts] Support search_prompt_versions in OSS SQLAlchemy store (#​21315, @​TomeHirata)
• [Evaluation / Tracing / UI] Add issue detection button to traces table toolbar with feature flag (#​21204, @​serena-ruan)
• [Docs / Tracing / UI] Add inline audio player for input_audio content parts in trace UI (#​21302, @​TomeHirata)
• [Evaluation / Tracing] Add IssueReference assessment type to store issue links with traces (#​21163, @​serena-ruan)
• [Evaluation / Tracing] Add issue management protos with create, update, get, and search APIs (#​21161, @​serena-ruan)
• [UI] Add IS NULL/IS NOT NULL operators for trace tags in search UI (#​21280, @​TomeHirata)
• [Docs / Tracing] Add IS NULL/IS NOT NULL support for trace tags in search_traces (#​21277, @​TomeHirata)
• [Tracing] Add steer message tracing support for Claude Code (#​21265, @​harupy)
• [Models / Tracking] Add support for transformers 5.x (#​20728, @​KUrushi)
• [Gateway] Add WEEKS to BudgetDurationUnit enum (#​21196, @​copilot-swe-agent)
• [UI] Add try-it page on Gateway usage example modal (#​21077, @​PattaraS)
• [Docs / Tracing / Tracking] Add mlflow.otel.autolog() for OTEL-based tracing integrations (Langfuse, Arize/Phoenix) (#​20954, @​alkispoly-db)
• [Gateway] Add SQL schema and SQLAlchemy CRUD for gateway budget policies (#​21108, @​TomeHirata)
• [UI] Add global gateway logs tab to usage page (#​21126, @​TomeHirata)
• [Tracking] [MLflow Demo] Add server availability handling checks (#​20349, @​BenWilson2)
• [Tracking] [MLflow Demo] Add scorers demo (#​20287, @​BenWilson2)
• [Docs / Tracking] Add Backblaze B2 artifact repository (b2://) (#​20731, @​jeronimodeleon)
• [Docs / Tracking] Add support for multipart download with presigned URLs for S3 compatible object storages (#​20352, @​etirelli)
• [Tracing] MCP server expansion (#​19830, @​joelrobin18)
• [Tracing / UI] Include response body in HTTP error messages with 1000 character limit (#​20794, @​copilot-swe-agent)

Bug fixes:

• [Gateway] Fix DatabricksProvider to use OpenAI-compatible endpoint URLs (#​22393, @​TomeHirata)
• [Evaluation] Fix: use EvalResult.scorer_stats for multi-turn scorer stat aggregation (#​22364, @​copilot-swe-agent)
• [Scoring / Tracing] Revert "Register InferenceTableSpanProcessor alongside DatabricksUCTableSpanProcessor in model serving (#​22332)" (#​22362, @​smurching)
• [Scoring / Tracing] Warn when UCSchemaLocation destination is set in Databricks model serving (trace: null) (#​22332, @​smurching)
• [Tracing / UI] Support tool_reference content blocks in Anthropic Chat UI parser (#​22331, @​B-Step62)
• [Tracing] Fix online scoring failure when trace spans are stored in artifact repo (#​20784, @​Mr-Neutr0n)
• [UI] Fix adding a tag with empty value silently failing without user feedback in the Experiments table (#​22320, @​WeichenXu123)
• [Docs / Models] Bump minimum uv version requirement from 0.5.0 to 0.6.10 (#​22313, @​copilot-swe-agent)
• [Scoring] Fix: exclude Serverless from use_dbconnect_artifact path in spark_udf (#​22300, @​franciffu723)
• [UI] Fix assistant crash on unknown CLI message types (#​21928, @​SuperSonnix71)
• [Tracing / Tracking] Fix mlflow-skinny: guard numpy-dependent imports in mlflow.types (#​22211, @​Suraj-kumar00)
• [Tracing / UI] Fix dropdown showing wrong selection state before endpoints load in issue detection modal (#​22236, @​serena-ruan)
• [Tracing] Normalize get_provider_name() to align with model_prices_and_context_window.json (#​22223, @​TomeHirata)
• [Tracking / UI] Fix log_image with slash-containing keys: replace # with ~ as path separator (#​22172, @​copilot-swe-agent)
• [Evaluation] Fix discovery pipeline _call_llm_via_gateway to handle gateway:/ URIs (#​22153, @​TomeHirata)
• [UI] Auto-dismiss and fade-out judge run notifications in trace UI (#​22137, @​copilot-swe-agent)
• [Evaluation / Tracking] Add polars version guard in polars_dataset.py to fix import failure with polars<1 (#​22085, @​TomeHirata)
• [Tracking] Fix huey_consumer.py path resolution when venv bin dir is not on PATH (#​22126, @​copilot-swe-agent)
• [UI] Fix sidebar navigation highlighting for run detail pages (#​20860, @​daniellok-db)
• [Tracing] Lowercase model_provider in `calculate_cost_by_model_

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.