pypi / mlflow-skinny
mlflow-skinny
What changed in mlflow-skinny 2 to 3, from its official release notes, upgrade guides and advisories. Also covers mlflow. Sources checked 2026-10-18.
25 breaking19 security1 deprecations123 new APIs and options2 performance36 behavior and defaults9 tooling52 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initmlflow-skinny 3263 changes
Breaking changes 25
SQL-backed servers require a coordinated schema upgrade with all writers stopped; run this command before restarting replicas on the new version.
This key must be set for basic-auth when starting the server.
The server now fails fast when
MLFLOW_FLASK_SERVER_SECRET_KEYis unset for basic authentication.The default basic-auth admin password shipped in this file was removed, so deployments no longer receive that default credential.
Chat Completion spans now remain open during streaming.
Model loading now honors the execution providers declared for ONNX.
Disables credentialed CORS when wildcard origins are configured.
The setting acts as a floor rather than an override under the unified role-based access control model.
The deprecated option is removed;
mlflow models servealways uses the built-in scoring server.MemAlign is now the default optimizer; existing alignment workflows may produce different judges unless an optimizer is passed explicitly.
Set this environment variable to keep using a file-based tracking or model registry store, which otherwise raises an error by default.
Legacy per-resource permission tables, REST endpoints, and client methods are removed and replaced by role-based APIs; code using the old APIs must migrate.
Async trace logging is enabled by default for OSS MLflow.
Guardrails run on passthrough endpoints, and response_format is skipped for non-chat payloads.
A size limit is added for trace attachments.
Removes this environment variable; configurations relying on it must be updated.
The default budget refresh interval changes from 60 to 600 seconds.
The TypeScript SDK packages were renamed to scoped npm packages; update package dependencies and imports.
Registered Model names can no longer contain
/or:.The default trace location table_prefix in set_experiment is now the experiment ID.
The unused parameters message is logged at DEBUG instead of WARNING.
CASCADE is added to experiment_id foreign keys in logged_model tables.
Authorization is enforced on AJAX proxy artifact APIs.
SQLite is now the default backend for the MLflow Tracking server, changing the server's default tracking-store choice.
Returns protobuf instead of JSON from the traces endpoint.
Security 19
Control access to contained resource types, including runs, traces, and versions, with wildcard grants and explicit DENY.
The pickle-deserialization guard is also applied to the
mlflow.paddleflavor.The web UI is served to non-admins under fail-closed authorization.
The presigned download route now enforces artifact authorization when basic authentication is enabled.
The setup command can enable the MLflow Assistant in one prompt, with API keys stored securely in Gateway LLM Connections.
Adds a deserialization guard to the mlflow.statsmodels flavor.
Fixes a DNS-rebinding SSRF bypass in webhook delivery.
Adds a guard for PickleEvaluationArtifact deserialization.
Fixes an authorization vulnerability in the trace API.
Guardrails can be set on gateway endpoints to prevent unsafe or non-compliant model inputs and outputs.
Hardens the disabled-pickle safety control, including for the pyfunc flavor, to prevent unsafe pickle deserialization.
Adds a flag to prevent local file inclusion in the API gateway when resolving API keys from files.
Webhook URLs are validated to fix an SSRF vulnerability.
Unsafe pickle and cloudpickle model serialization formats are deprecated in favor of safer serialization options.
Adds PyTorch serialization via
torch.export.saveand theskopsformat, while deprecating unsafe pickle and cloudpickle formats.Prevents command injection via malicious model artifacts.
Fixes an artifact path traversal vector.
Fixes a SQL injection vulnerability in Unity Catalog function execution.
Prevents symlink path traversal in the local artifact store.
Deprecations 1
The pyfunc serving backend option enable_mlserver is deprecated.
New APIs and options 121
Adds an API for managing review queues on Databricks.
Direct TypeSafe judges can use a custom base URL.
Opt-in daily summaries reduce SQL analytics query overhead for large trace datasets, with raw-query fallback.
LazySpan objects support
copy.deepcopyandpickle.Administrators can disable the AI Gateway with this environment variable.
TypeScript tracing and OpenCode now support this environment variable.
Adds a TypeSafe AI tracing integration.
Adds a fluent API for restoring experiments.
Adds a fluent API for restoring runs.
Adds first-class span description support to the span API.
Adds first-class span description support to the tracing decorator.
Evaluation-dataset search supports
name IN (...)filters.Adds
order_bysupport tosearch_prompts()across client, fluent, and GenAI APIs.Span objects support
copy.deepcopyandpickle.Trace objects support
copy.deepcopyandpickle, and expose atrace_idproperty.Custom trace views can render TraceImage values.
TypeSafe Gateway endpoints can use a custom API base.
Built-in scorers and custom judges can use TypeSafe models with typed Boolean or categorical feedback.
Adds autologging support for the TypeSafe SDK.
The scorer decorator accepts a timeout option.
Unity Catalog traces support span links.
Logged model artifacts now support artifact_path.
The make_judge API exposes generate_rationale_first so developers can configure this judge behavior.
Evaluation datasets support immutable versions, allowing developers to work with versioned evaluation data.
Adds a primitive for combining scorer results.
A new tool fetches trace-span image attachments as base64 data URLs for multimodal LLM judge evaluation.
A centralized catalog lets developers register, version, and share MCP servers through the UI, REST API, or Python.
Trace filters can now filter assessments by numeric values.
The AI Gateway supports budget policies configured per endpoint.
Autologging support is added for Pydantic AI 2.x.
Autologging support is added for Pydantic AI 2.x.
Adds the SAP AI Core Orchestration v2 provider, including support for extra headers.
The TypeScript SDK adds trace search support.
Save named Runs table views, including columns, layout, filters, and sort, and share them by URL.
Adds
EvaluationResult.passedto report whether an@mlflow.testassertion passed.Adds
EvaluationResult.reasonto report the reason for an@mlflow.testassertion result.Adds a Google ADK LLM judge scorer named
Hallucination.Adds an environment variable for configuring the default model used by GenAI judges.
Adds support for selecting a UC trace location for Claude Code and Codex tracing.
Adds
MLFLOW_WORKSPACEsupport to the OSS auth provider.Adds an exporter for handing traces off to the WAL daemon.
Adds
PIIDetectionas a rule-based built-in scorer.Adds
RegexMatchas a rule-based built-in scorer.Adds a Google ADK LLM judge scorer named
ResponseEvaluation.Adds
ResponseLengthas a rule-based built-in scorer.Supports common content fields in RETRIEVER chunks.
Adds
run_idsupport for trace APIs.Adds a Google ADK LLM judge scorer named
Safety.Adds
x-mlflow-run-idsupport to OTLP trace ingestion.Adds a Link entity for OpenTelemetry Span Links.
Adds support for adding OpenTelemetry Span Links to a live span.
Adds an environment variable to bypass pip validation in air-gapped environments.
Unified per-user permission APIs provide grant, revoke, get, and list operations.
Adds an API for automated agent stress-testing.
The V4 retry policy for
mlflow.get_traceis now configurable.Spans support Python-logging-style severity levels, and the trace UI can filter out lower-level noise.
Application Default Credentials is available as an authentication mode for the Vertex AI gateway.
The base_model_path parameter lets you save a PEFT adapter-only artifact with a local base model reference.
Tracing support is added for Codex, Gemini, and Qwen coding agent platforms.
A Guardrail base class and JudgeGuardrail implementation are added.
A URI style for trace attachments is supported, enabling rich rendering of PDFs, audio, and images in the UI.
DeepEval scorers accept model_kwargs for controlling LLM parameters.
Multimodal content can be stored in tracing spans as artifact attachments instead of inline binary data.
The AI Gateway supports a configurable provider allow/deny list.
Third-party scorers can be registered in OSS MLflow, with a server-side check for custom scorer registration.
Adds a public pipeline API for discovering issues in traces.
Adds native gateway providers for Vertex AI, Databricks, Ollama, and xAI, and adds Converse API support to the Bedrock provider.
Built-in scorers now support inference_params.
Adds proxy URL support for make_judge.
Enables translation of traces exported via OTLP to follow OpenTelemetry GenAI semantic conventions while preserving GenAI-specific metadata.
Adds OTEL-based autologging for tracing integrations including Langfuse and Arize/Phoenix.
Adds an API for injecting metadata and tags into tracing without creating wrapper spans.
Adds Polars dataset support to autologging.
Adds IS NULL and IS NOT NULL support for tags and params when searching runs.
Adds a trace_location parameter to create_experiment and set_experiment.
Adds a parameter for controlling UV extras during model dependency inference.
Adds a parameter for controlling UV dependency groups during model dependency inference.
Makes the conversation simulator public and easily subclassable.
Adds an API for deleting dataset records.
Adds the
--experiment-nameoption tomlflow experiments get.Gateway endpoints gain usage analytics, and trace ingestion links gateway calls back to experiments.
Evaluate existing conversations with session-level scorers and simulate conversations to test new agent versions.
MLflow Tracking Server supports organizing experiments, models, and prompts into workspaces within a single server.
Adds a per-decorator parameter to
@mlflow.tracefor overriding the sampling ratio.Adds an SDK for searching sessions and retrieving complete sessions.
The workspace header can be used with AI Gateway endpoints, with workspace fallback behavior.
Introduces conversation simulation in
mlflow.genai, integrates it withmlflow.genai.evaluate, and supports datasets.Adds support for conversational datasets with persona, goal, and context.
Adds a scorer for conversational guidelines.
Adds a scorer for evaluating text quality.
Adds an optimizer for judge instruction optimization.
Adds an API for Databricks SGC checkpointing with MLflow.
Trace metadata filtering now supports
IS NULLandIS NOT NULLcomparators.Adds a run context for tracking local Jupyter notebooks as the source.
Adds a built-in scorer for knowledge retention.
Adds an API for logging binary streams as artifacts.
Adds an optimizer that learns general guidelines from past feedback and retrieves relevant examples at runtime to improve judge evaluations.
Adds APIs for propagating trace context across services and processes, enabling end-to-end request tracing.
Adds a trace metrics backend.
A built-in scorer evaluates multi-turn conversation histories for hate speech, harassment, violence, and other safety concerns.
A built-in scorer evaluates tool call efficiency in multi-turn agent interactions, detecting redundant calls, missed batching opportunities, and poor tool selections.
Tracking adds support for a default passphrase.
Use DeepEval and RAGAS evaluation metrics as MLflow scorers, including answer relevancy, faithfulness, and hallucination detection.
GraphQL routes now support authentication.
The Traces UI displays spans from in-progress traces with auto-polling for real-time debugging and monitoring of long-running LLM applications.
LLM judges support inference parameters.
Adds a linked prompts filter to the trace search tab.
Set this existing environment variable to true to disable UI telemetry on a self-managed server.
The experiment search command adds a
--max-resultsoption.This environment variable limits concurrent scorer execution.
Prompts can include model configuration, associating specific model settings with prompt templates for more reproducible LLM workflows.
Tracing adds support for Pydantic AI streams.
Dataset search is enabled in Databricks managed MLflow.
Adds a description field to all built-in scorers.
Adds the missing trace-tag deletion API.
Supports structured outputs, enabling more precise and programmatically consumable evaluation results.
Adds the
--builtin/-bflag to list built-in scorers.Adds authentication support for scorers.
Adds environment variable fallback for resuming SGC runs.
Adds support for resuming SGC runs from Databricks Jobs.
Adds auto-tracing support for the VoltAgent AI agent framework.
Performance 2
Span logging uses bulk upsert to eliminate per-span ORM overhead.
Multi-turn session evaluation is parallelized.
Behavior and default changes 36
make_judge() supports the Decision API, allowing developers to use it with that API.
Loads the latest Databricks scorers from the scheduled-scorers REST config so feedback records the scorer version.
Aggregate logged-model evaluation metrics are associated with the managed dataset that produced them.
OTLP ingestion metrics are exposed for Prometheus.
Filters accept lowercase
like,ilike, andinoperators.Scorer version is propagated to assessment metadata.
Haystack 3.x is now supported by autologging.
Explicit set_outputs() calls inside the decorator are now honored.
Prompt optimization now supports chat-type prompts.
Pandas 3.x is now supported.
MLflow skips env_pack on ARM client images.
Large artifact transfers can bypass the tracking server and transfer directly to cloud storage, with automatic fallback to proxied transfer.
Maps
gen_ai.conversation.idto an MLflow trace session.The OpenAI provider configuration now honors the
OPENAI_BASE_URLenvironment variable.A workspace USE grant is sufficient to create experiments and registered models.
The caller is recorded in gateway traces using request headers.
Trace ingestion supports JSON OTLP encoding.
The SQL warehouse is automatically started before V4/V5 MLflow tracing calls.
Adds built-in skops trusted types for LightGBM models to support pickle-free model loading.
Automatic dependency inference detects UV projects and captures locked dependencies when logging models.
Dismissal of the default passphrase security banner is persisted to localStorage.
The scoring server input for pyfunc accepts parquet content types.
Supports
get_dataset(name=...)in OSS environments.MLflow extracts model information from LLM spans and calculates costs for trace views.
Prompt registry prompts can now use Jinja2 templates.
Adds support for metaprompting when optimizing prompts.
Adds support for using
mlflow.genai.to_predict_fnwith app invocation endpoints.The
PyFuncOutputtype alias now includesdictforResponsesAgent,ChatAgent, andChatModel.Set this existing environment variable to true to disable UI telemetry on a self-managed server.
Async functions passed to
predict_fnare automatically wrapped.MLflow collects anonymized data about UI interactions. Server administrators can disable it with either environment variable; other users can opt out in the UI Settings tab.
Adds validation for correctness judge expectation fields.
Supports multi-turn conversations with DataFrame and list inputs, enabling evaluation of conversational AI applications.
Accepts gzip and deflate Content-Encoding for OTLP traces requests.
Removes experimental flags from scorers, changing how scorers are used or configured.
Parent directories are created for SQLite database files, so their directories need not already exist.
Tooling 9
A shell-based setup wizard is available to help configure MLflow Tracing.
Adds a one-command workflow to install MLflow, set up tracing, and provide coding agents with MLflow skills; setup supports the Databricks backend.
Adds CLI commands to view and list MLflow skills.
Adds a pytest marker and assertion framework for GenAI regression tests, which can be gated in CI and reviewed in the UI.
A command is added to move resources between workspaces.
Adds a CLI command to list datasets.
Adds a CLI command to launch the MLflow demo.
Adds a command to migrate a file store.
Adds a command to get an experiment.
Fixes and other changes 50
Fixes how Claude Code OTel traces render in the MLflow UI.
Multipart artifact downloads now honor this setting.
The setting is honored when downloading multipart artifacts.
Whitespace around
--trace-idsentries is stripped.Whitespace around
--order-byentries is stripped.The server-info endpoint remains responsive when the shared WSGI thread pool is exhausted.
Trace text search now finds non-ASCII span content.
Encryption arguments for S3 multipart uploads are fixed.
Trace locations in Databricks Model Serving are resolved without local-store validation.
A deadlock during async trace queue flush is prevented.
Basic authentication no longer overrides Kubernetes authentication in the Python SDK.
Pre-imports databricks.sdk in Databricks to avoid a telemetry deadlock.
Preserves the base judge invocation flow in MemAlign aligned judges.
Version parsing handles missing or non-PEP440 versions on Databricks Serverless.
Multipart artifact uploads now honor the S3 TLS-ignore setting.
Preserves dataset expectations and tags when
scorers=[].Fixes empty results when
max_resultsis omitted.Fixes running the database upgrade command on a fresh database.
Preserves OTel resource attributes during OTLP trace ingestion.
Guards numpy-dependent imports in mlflow.types to prevent import failures when using mlflow-skinny.
Fixes skops serialization format detection in the pyfunc loader.
Adds support for transformers 5.x and fixes compatibility with removed pipeline classes in transformers 5.3.0.
Charts aggregate Additional runs under the Unassigned group in group mode.
Artifact downloads work when workspaces are enabled.
Artifact listing via query parameter no longer returns 403 Forbidden when default_permission is NO_PERMISSIONS.
The visibility toggle button in chart tooltips works.
The function no longer skips skill content injections.
Gateway experiments are filtered from the experiment list using a server-side query, avoiding inconsistent page sizes.
Spurious warnings for gateway endpoints with fallback_config but no FALLBACK models are logged at debug level.
The View full dashboard link in the Gateway usage tab works when workspaces are enabled.
A try-it page is available from the Gateway usage example modal.
Single artifact downloads through HttpArtifactRepository are fixed.
The instruction textarea in the judge builder is fixed.
Optional parameters with UNSET defaults receive None, and Click UNSET defaults are handled correctly.
Copying a Unity Catalog model across workspaces is fixed.
The All time selector is cleared when switching to the overview tab.
The Traces view in the Prompts tab can be scrolled.
Retrieval context is extracted correctly when span outputs are stored as strings.
Running a judge no longer fails with litellm.InternalServerError: Invalid response object.
Trace export no longer encounters a NOT NULL constraint on assessments.trace_id.
Fixes temperature and JSON issues when using
ConversationSimulatoron managed deployments.Fixes loss of type signatures when using the
@trace_disableddecorator.Fixes a blank UI page on plain HTTP by replacing crypto.randomUUID with the uuid library.
Fixes prompt registration with model_config on Databricks.
The SQLAlchemy store is no longer registered when the sqlalchemy library is not installed.
Adds the required
anthropic_versionfield to fix the Bedrock Anthropic adapter.Fixes the judge incorrectly using the scorer description as the assessment value.
Fixes OTLP endpoint path handling to follow the OpenTelemetry specification.
Fixes trace-based scorer evaluation by using the agentic judge adapter.
Fixes propagation of the tracking URI.
mlflow-skinny 24 changes
New APIs and options 2
Introduces an environment variable to validate the source parameter of /model-versions/create requests.
Adds opt-in routing of Unity Catalog model registry artifact uploads and downloads through the Databricks SDK Files API.
Fixes and other changes 2
Fixes loading models from Unity Catalog Volumes paths.
Fixes Spark UDF behavior on Databricks multi driver clusters.