Update dependency ray to v2 [SECURITY] #652
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.
This PR contains the following updates:
==1.8.0
->==2.43.0
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2023-6019
A command injection exists in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.
CVE-2023-6020
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
CVE-2023-6021
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
CVE-2025-1979
Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password.
This is only exploitable if:
Logging is enabled;
Redis is using password authentication;
Those logs are accessible to an attacker, who can reach that redis instance.
Note:
It is recommended that anyone who is running in this configuration should update to the latest version of Ray, then rotate their redis password.
Release Notes
ray-project/ray (ray)
v2.43.0
Compare Source
Highlights
ray.data.llm
andray.serve.llm
. See the below notes for more details. These APIs are marked as alpha -- meaning they may change in future releases without a deprecation period.RAY_TRAIN_V2_ENABLED=1
environment variable. See the migration guide for more information.uv run
that allows easily specifying Python dependencies for both driver and workers in a consistent way and enables quick iterations for development of Ray applications (#50160, 50462), check out our blog postRay Libraries
Ray Data
🎉 New Features:
Processor
abstraction that interoperates with existing Ray Data pipelines. This abstraction can be configured two ways:vLLMEngineProcessorConfig
, which configures vLLM to load model replicas for high throughput model inferenceHttpRequestProcessorConfig
, which sends HTTP requests to an OpenAI-compatible endpoint for inference.UnionOperator
(#50436)💫 Enhancements:
ShufflingBatcher
ontotry_combine_chunked_columns
(#50296)ArrowBlockAccessor
,PandasBlockAccessor
(#50498)AggregateFn
withAggregateFnV2
, cleaning up Aggregation infrastructure (#50585)TaskDurationStats
andon_execution_step
callback (#50766)🔨 Fixes:
grouped_data.py
docstrings (#50392)test_map_batches_async_generator
(#50459)pyarrow.infer_type
on datetime arrays (#50403)📖 Documentation:
Ray Train
🎉 New Features:
RAY_TRAIN_V2_ENABLED=1
environment variable. See the migration guide for more information.💫 Enhancements:
ray[train]
extra install (#46682)🔨 Fixes:
📖 Documentation:
🏗 Architecture refactoring:
Ray Tune
🔨 Fixes:
📖 Documentation:
🏗 Architecture refactoring:
Ray Serve
🎉 New Features:
VLLMService
: A prebuilt deployment that offers a full-featured vLLM engine integration, with support for features such as LoRA multiplexing and multimodal language models.LLMRouter
: An out-of-the-box OpenAI compatible model router that can route across multiple LLM deployments.💫 Enhancements:
required_resources
to REST API (#50058)🔨 Fixes:
RLlib
🎉 New Features:
💫 Enhancements:
eval_env_runner_group
from the training steps. (#50057)OfflinePreLearner
docstring. (#50107)🔨 Fixes:
on_workers/env_runners_recreated
callback would be called twice. (#50172)default_resource_request
: aggregator actors missing in placement group for local Learner. (#50219, #50475)📖 Documentation:
Ray Core and Ray Clusters
Ray Core
💫 Enhancements:
🔨 Fixes:
Ray Clusters
📖 Documentation:
Ray Dashboard
🎉 New Features:
Thanks
Thank you to everyone who contributed to this release! 🥳
@liuxsh9, @justinrmiller, @CheyuWu, @400Ping, @scottsun94, @bveeramani, @bhmiller, @tylerfreckmann, @hefeiyun, @pcmoritz, @matthewdeng, @dentiny, @erictang000, @gvspraveen, @simonsays1980, @aslonnie, @shorbaji, @LeoLiao123, @justinvyu, @israbbani, @zcin, @ruisearch42, @khluu, @kouroshHakha, @sijieamoy, @SergeCroise, @raulchen, @anson627, @bluenote10, @allenyin55, @martinbomio, @rueian, @rynewang, @owenowenisme, @Betula-L, @alexeykudinkin, @crypdick, @jujipotle, @saihaj, @EricWiener, @kevin85421, @MengjinYan, @chris-ray-zhang, @SumanthRH, @chiayi, @comaniac, @angelinalg, @kenchung285, @tanmaychimurkar, @andrewsykim, @MortalHappiness, @sven1977, @richardliaw, @omatthew98, @fscnick, @akyang-anyscale, @cristianjd, @Jay-ju, @spencer-p, @win5923, @wxsms, @stfp, @letaoj, @JDarDagran, @jjyao, @srinathk10, @edoakes, @vincent0426, @dayshah, @davidxia, @DmitriGekhtman, @GeneDer, @HYLcool, @gameofby, @can-anyscale, @ryanaoleary, @eddyxu
v2.42.1
Compare Source
Ray Data
🔨 Fixes:
v2.42.0
Compare Source
Ray Libraries
Ray Data
🎉 New Features:
💫 Enhancements:
🔨 Fixes:
🗑️ Deprecations:
Ray Train
💫 Enhancements:
Ray Tune
📖 Documentation:
Ray Serve
💫 Enhancements:
🔨 Fixes:
RLlib
💫 Enhancements:
AddTimeDimToBatchAndZeroPad
andAddStatesFromEpisodesToBatch
) (#49835)🔨 Fixes:
replay-ratio=0
(fixes a memory leak). (#49964)📖 Documentation:
training_step()
. (#49976)TargetNetAPI
) (#49825)Ray Core and Ray Clusters
Ray Core
💫 Enhancements:
🔨 Fixes:
Ray Clusters
🔨 Fixes:
Thanks
Thank you to everyone who contributed to this release! 🥳
@wingkitlee0, @saihaj, @win5923, @justinvyu, @kevin85421, @edoakes, @cristianjd, @rynewang, @richardliaw, @LeoLiao123, @alexeykudinkin, @simonsays1980, @aslonnie, @ruisearch42, @pcmoritz, @fscnick, @bveeramani, @mattip, @till-m, @tswast, @ujjawal-khare, @wadhah101, @nikitavemuri, @akshay-anyscale, @srinathk10, @zcin, @dayshah, @dentiny, @LydiaXwQ, @matthewdeng, @JoshKarpel, @MortalHappiness, @sven1977, @omatthew98
v2.41.0
Compare Source
Highlights
Ray Libraries
Ray Data
🎉 New Features:
partition_cols
inwrite_parquet
(#49411)💫 Enhancements:
ValueError
when the data sort key isNone
(#48969)hudi
version to 0.2.0 (#48875)webdataset
: expand JSON objects into individual samples (#48673)ExecutionCallback
interface (#49205)select_columns
andrename_columns
use Project operator (#49393)🔨 Fixes:
map_groups
(#48907)read_sql
(#48923)webdataset
: flatten return args (#48674)numpy > 2.0.0
behaviour in_create_possibly_ragged_ndarray
(#48064)DataContext
sealing for multiple datasets. (#49096)to_tf
forList
types (#49139)on_write_completes
(#49251)groupby
hang when value containsnp.nan
(#49420)file_extensions
doesn't work with compound extensions (#49244)Ray Train
🎉 New Features:
💫 Enhancements:
🏗 Architecture refactoring:
get_network_params
implementation (#49019)Ray Tune
🎉 New Features:
optuna_search
to allow users to configure optuna storage (#48547)🏗 Architecture refactoring:
Ray Serve
💫 Enhancements:
pickle.dumps
for faster serialization fromproxy
toreplica
(#49539)🔨 Fixes:
ray.init()
is called multiple times with differentruntime_envs
(#49074)🗑️ Deprecations:
RAY_SERVE_RUN_SYNC_IN_THREADPOOL=1
. (#48897)RLlib
🎉 New Features:
💫 Enhancements:
EpisodeReplayBuffer
. (#48116)SampleBatch
data and fully compressed observations. (#48699)OfflineData
. (#49015)AggregatorActors
per Learner. (#49284)tuned_examples
). (#49068)📖 Documentation:
RLModule
page. (#49387)package_ref
page for algo configs. (#49464)🔨 Fixes:
on_episode_created
callback to SingleAgentEnvRunner. (#49487)train_batch_size_per_learner
problems. (#49715)🏗 Architecture refactoring:
Default[algo]RLModule
classes (#49366, #49368)ormsgpack
(#49489)🗑️ Deprecations:
Ray Core and Ray Clusters
Ray Core
💫 Enhancements:
task_name
,task_function_name
andactor_name
in Structured Logging (#48703)nsight.nvtx
profiling (#49392)🔨 Fixes:
WORKER_OBJECT_EVICTION
when the object is out of scope or manually freed (#47990).whl
file (#48560)Ray Clusters
💫 Enhancements:
📖 Documentation:
DaemonSet
and Grafana Loki to "Persist KubeRay Operator Logs" (#48725)Dashboard
💫 Enhancements:
RAY_PROMETHEUS_HEADERS
env for carrying additional headers to Prometheus (#49353)RAY_PROMETHEUS_HEADERS
env for carrying additional headers to Prometheus (#49700)🏗 Architecture refactoring:
memray
dependency from default to observability (#47763)StateHead
's methods into free functions. (#49388)Thanks
@raulchen, @alanwguo, @omatthew98, @xingyu-long, @tlinkin, @yantzu, @alexeykudinkin, @andrewsykim, @win5923, @csy1204, @dayshah, @richardliaw, @stephanie-wang, @gueraf, @rueian, @davidxia, @fscnick, @wingkitlee0, @KPostOffice, @GeneDer, @MengjinYan, @simonsays1980, @pcmoritz, @petern48, @kashiwachen, @pfldy2850, @zcin, @scottjlee, @Akhil-CM, @Jay-ju, @JoshKarpel, @edoakes, @ruisearch42, @gorloffslava, @jimmyxie-figma, @bthananjeyan, @sven1977, @bnorick, @jeffreyjeffreywang, @ravi-dalal, @matthewdeng, @angelinalg, @ivanthewebber, @rkooo567, @srinathk10, @maresb, @gvspraveen, @akyang-anyscale, @mimiliaogo, @bveeramani, @ryanaoleary, @kevin85421, @richardsliu, @hartikainen, @coltwood93, @mattip, @Superskyyy, @justinvyu, @hongpeng-guo, @ArturNiederfahrenhorst, @jecsand838, @Bye-legumes, @hcc429, @WeichenXu123, @martinbomio, @HollowMan6, @MortalHappiness, @dentiny, @zhe-thoughts, @anyadontfly, @smanolloff, @richo-anyscale, @khluu, @xushiyan, @rynewang, @japneet-anyscale, @jjyao, @sumanthratna, @saihaj, @aslonnie
Many thanks to all those who contributed to this release!
v2.40.0
Compare Source
Ray Libraries
Ray Data
🎉 New Features:
💫 Enhancements:
🔨 Fixes:
🗑️ Deprecations:
Ray Train
🔨 Fixes:
📖 Documentation:
Ray Tune
🔨 Fixes:
clear_checkpoint
function during Trial restoration error handling. (#48532)Ray Serve
🎉 New Features:
💫 Enhancements:
🔨 Fixes:
RLlib
💫 Enhancements:
🔨 Fixes:
📖 Documentation:
🏗 Architecture refactoring:
rllib_contrib
from repo. (#48565)Ray Core and Ray Clusters
Ray Core
🎉 New Features:
💫 Enhancements:
🔨 Fixes:
Ray Clusters
🔨 Fixes:
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.