Update dependency ray to v2 [SECURITY] #652
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.
This PR contains the following updates:
==1.8.0->==2.43.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2023-6019
A command injection exists in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.
CVE-2023-6020
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
CVE-2023-6021
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
CVE-2025-1979
Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password.
This is only exploitable if:
Logging is enabled;
Redis is using password authentication;
Those logs are accessible to an attacker, who can reach that redis instance.
Note:
It is recommended that anyone who is running in this configuration should update to the latest version of Ray, then rotate their redis password.
Release Notes
ray-project/ray (ray)
v2.43.0Compare Source
Highlights
ray.data.llmandray.serve.llm. See the below notes for more details. These APIs are marked as alpha -- meaning they may change in future releases without a deprecation period.RAY_TRAIN_V2_ENABLED=1environment variable. See the migration guide for more information.uv runthat allows easily specifying Python dependencies for both driver and workers in a consistent way and enables quick iterations for development of Ray applications (#50160, 50462), check out our blog postRay Libraries
Ray Data
🎉 New Features:
Processorabstraction that interoperates with existing Ray Data pipelines. This abstraction can be configured two ways:vLLMEngineProcessorConfig, which configures vLLM to load model replicas for high throughput model inferenceHttpRequestProcessorConfig, which sends HTTP requests to an OpenAI-compatible endpoint for inference.UnionOperator(#50436)💫 Enhancements:
ShufflingBatcherontotry_combine_chunked_columns(#50296)ArrowBlockAccessor,PandasBlockAccessor(#50498)AggregateFnwithAggregateFnV2, cleaning up Aggregation infrastructure (#50585)TaskDurationStatsandon_execution_stepcallback (#50766)🔨 Fixes:
grouped_data.pydocstrings (#50392)test_map_batches_async_generator(#50459)pyarrow.infer_typeon datetime arrays (#50403)📖 Documentation:
Ray Train
🎉 New Features:
RAY_TRAIN_V2_ENABLED=1environment variable. See the migration guide for more information.💫 Enhancements:
ray[train]extra install (#46682)🔨 Fixes:
📖 Documentation:
🏗 Architecture refactoring:
Ray Tune
🔨 Fixes:
📖 Documentation:
🏗 Architecture refactoring:
Ray Serve
🎉 New Features:
VLLMService: A prebuilt deployment that offers a full-featured vLLM engine integration, with support for features such as LoRA multiplexing and multimodal language models.LLMRouter: An out-of-the-box OpenAI compatible model router that can route across multiple LLM deployments.💫 Enhancements:
required_resourcesto REST API (#50058)🔨 Fixes:
RLlib
🎉 New Features:
💫 Enhancements:
eval_env_runner_groupfrom the training steps. (#50057)OfflinePreLearnerdocstring. (#50107)🔨 Fixes:
on_workers/env_runners_recreatedcallback would be called twice. (#50172)default_resource_request: aggregator actors missing in placement group for local Learner. (#50219, #50475)📖 Documentation:
Ray Core and Ray Clusters
Ray Core
💫 Enhancements:
🔨 Fixes:
Ray Clusters
📖 Documentation:
Ray Dashboard
🎉 New Features:
Thanks
Thank you to everyone who contributed to this release! 🥳
@liuxsh9, @justinrmiller, @CheyuWu, @400Ping, @scottsun94, @bveeramani, @bhmiller, @tylerfreckmann, @hefeiyun, @pcmoritz, @matthewdeng, @dentiny, @erictang000, @gvspraveen, @simonsays1980, @aslonnie, @shorbaji, @LeoLiao123, @justinvyu, @israbbani, @zcin, @ruisearch42, @khluu, @kouroshHakha, @sijieamoy, @SergeCroise, @raulchen, @anson627, @bluenote10, @allenyin55, @martinbomio, @rueian, @rynewang, @owenowenisme, @Betula-L, @alexeykudinkin, @crypdick, @jujipotle, @saihaj, @EricWiener, @kevin85421, @MengjinYan, @chris-ray-zhang, @SumanthRH, @chiayi, @comaniac, @angelinalg, @kenchung285, @tanmaychimurkar, @andrewsykim, @MortalHappiness, @sven1977, @richardliaw, @omatthew98, @fscnick, @akyang-anyscale, @cristianjd, @Jay-ju, @spencer-p, @win5923, @wxsms, @stfp, @letaoj, @JDarDagran, @jjyao, @srinathk10, @edoakes, @vincent0426, @dayshah, @davidxia, @DmitriGekhtman, @GeneDer, @HYLcool, @gameofby, @can-anyscale, @ryanaoleary, @eddyxu
v2.42.1Compare Source
Ray Data
🔨 Fixes:
v2.42.0Compare Source
Ray Libraries
Ray Data
🎉 New Features:
💫 Enhancements:
🔨 Fixes:
🗑️ Deprecations:
Ray Train
💫 Enhancements:
Ray Tune
📖 Documentation:
Ray Serve
💫 Enhancements:
🔨 Fixes:
RLlib
💫 Enhancements:
AddTimeDimToBatchAndZeroPadandAddStatesFromEpisodesToBatch) (#49835)🔨 Fixes:
replay-ratio=0(fixes a memory leak). (#49964)📖 Documentation:
training_step(). (#49976)TargetNetAPI) (#49825)Ray Core and Ray Clusters
Ray Core
💫 Enhancements:
🔨 Fixes:
Ray Clusters
🔨 Fixes:
Thanks
Thank you to everyone who contributed to this release! 🥳
@wingkitlee0, @saihaj, @win5923, @justinvyu, @kevin85421, @edoakes, @cristianjd, @rynewang, @richardliaw, @LeoLiao123, @alexeykudinkin, @simonsays1980, @aslonnie, @ruisearch42, @pcmoritz, @fscnick, @bveeramani, @mattip, @till-m, @tswast, @ujjawal-khare, @wadhah101, @nikitavemuri, @akshay-anyscale, @srinathk10, @zcin, @dayshah, @dentiny, @LydiaXwQ, @matthewdeng, @JoshKarpel, @MortalHappiness, @sven1977, @omatthew98
v2.41.0Compare Source
Highlights
Ray Libraries
Ray Data
🎉 New Features:
partition_colsinwrite_parquet(#49411)💫 Enhancements:
ValueErrorwhen the data sort key isNone(#48969)hudiversion to 0.2.0 (#48875)webdataset: expand JSON objects into individual samples (#48673)ExecutionCallbackinterface (#49205)select_columnsandrename_columnsuse Project operator (#49393)🔨 Fixes:
map_groups(#48907)read_sql(#48923)webdataset: flatten return args (#48674)numpy > 2.0.0behaviour in_create_possibly_ragged_ndarray(#48064)DataContextsealing for multiple datasets. (#49096)to_tfforListtypes (#49139)on_write_completes(#49251)groupbyhang when value containsnp.nan(#49420)file_extensionsdoesn't work with compound extensions (#49244)Ray Train
🎉 New Features:
💫 Enhancements:
🏗 Architecture refactoring:
get_network_paramsimplementation (#49019)Ray Tune
🎉 New Features:
optuna_searchto allow users to configure optuna storage (#48547)🏗 Architecture refactoring:
Ray Serve
💫 Enhancements:
pickle.dumpsfor faster serialization fromproxytoreplica(#49539)🔨 Fixes:
ray.init()is called multiple times with differentruntime_envs(#49074)🗑️ Deprecations:
RAY_SERVE_RUN_SYNC_IN_THREADPOOL=1. (#48897)RLlib
🎉 New Features:
💫 Enhancements:
EpisodeReplayBuffer. (#48116)SampleBatchdata and fully compressed observations. (#48699)OfflineData. (#49015)AggregatorActorsper Learner. (#49284)tuned_examples). (#49068)📖 Documentation:
RLModulepage. (#49387)package_refpage for algo configs. (#49464)🔨 Fixes:
on_episode_createdcallback to SingleAgentEnvRunner. (#49487)train_batch_size_per_learnerproblems. (#49715)🏗 Architecture refactoring:
Default[algo]RLModuleclasses (#49366, #49368)ormsgpack(#49489)🗑️ Deprecations:
Ray Core and Ray Clusters
Ray Core
💫 Enhancements:
task_name,task_function_nameandactor_namein Structured Logging (#48703)nsight.nvtxprofiling (#49392)🔨 Fixes:
WORKER_OBJECT_EVICTIONwhen the object is out of scope or manually freed (#47990).whlfile (#48560)Ray Clusters
💫 Enhancements:
📖 Documentation:
DaemonSetand Grafana Loki to "Persist KubeRay Operator Logs" (#48725)Dashboard
💫 Enhancements:
RAY_PROMETHEUS_HEADERSenv for carrying additional headers to Prometheus (#49353)RAY_PROMETHEUS_HEADERSenv for carrying additional headers to Prometheus (#49700)🏗 Architecture refactoring:
memraydependency from default to observability (#47763)StateHead's methods into free functions. (#49388)Thanks
@raulchen, @alanwguo, @omatthew98, @xingyu-long, @tlinkin, @yantzu, @alexeykudinkin, @andrewsykim, @win5923, @csy1204, @dayshah, @richardliaw, @stephanie-wang, @gueraf, @rueian, @davidxia, @fscnick, @wingkitlee0, @KPostOffice, @GeneDer, @MengjinYan, @simonsays1980, @pcmoritz, @petern48, @kashiwachen, @pfldy2850, @zcin, @scottjlee, @Akhil-CM, @Jay-ju, @JoshKarpel, @edoakes, @ruisearch42, @gorloffslava, @jimmyxie-figma, @bthananjeyan, @sven1977, @bnorick, @jeffreyjeffreywang, @ravi-dalal, @matthewdeng, @angelinalg, @ivanthewebber, @rkooo567, @srinathk10, @maresb, @gvspraveen, @akyang-anyscale, @mimiliaogo, @bveeramani, @ryanaoleary, @kevin85421, @richardsliu, @hartikainen, @coltwood93, @mattip, @Superskyyy, @justinvyu, @hongpeng-guo, @ArturNiederfahrenhorst, @jecsand838, @Bye-legumes, @hcc429, @WeichenXu123, @martinbomio, @HollowMan6, @MortalHappiness, @dentiny, @zhe-thoughts, @anyadontfly, @smanolloff, @richo-anyscale, @khluu, @xushiyan, @rynewang, @japneet-anyscale, @jjyao, @sumanthratna, @saihaj, @aslonnie
Many thanks to all those who contributed to this release!
v2.40.0Compare Source
Ray Libraries
Ray Data
🎉 New Features:
💫 Enhancements:
🔨 Fixes:
🗑️ Deprecations:
Ray Train
🔨 Fixes:
📖 Documentation:
Ray Tune
🔨 Fixes:
clear_checkpointfunction during Trial restoration error handling. (#48532)Ray Serve
🎉 New Features:
💫 Enhancements:
🔨 Fixes:
RLlib
💫 Enhancements:
🔨 Fixes:
📖 Documentation:
🏗 Architecture refactoring:
rllib_contribfrom repo. (#48565)Ray Core and Ray Clusters
Ray Core
🎉 New Features:
💫 Enhancements:
🔨 Fixes:
Ray Clusters
🔨 Fixes:
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.