pypi / pytorch-lightning
pytorch-lightning
What changed in pytorch-lightning 2, from its official release notes, upgrade guides and advisories. Also covers lightning. Sources checked 2026-10-28.
4 breaking1 security5 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initpytorch-lightning 210 changes
Breaking changes 4
Rejects a checkpoint _class_path unless it resolves to an already imported subclass of the loaded class, preventing arbitrary code execution.
Restricts the _instantiator hyperparameter to an allowlist of trusted instantiators to prevent arbitrary code execution.
The minimum supported LitLogger version was raised to 2026-03-17.
Support for the Neptune logger was removed because the integration would otherwise be broken after Neptune sunset its public service.
Security 1
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to
Fixes and other changes 5
With bf16-mixed and 16-mixed, model parameters are now initialized in fp32 instead of half precision.
The device_mesh type hint now accepts a 2-element tuple via the CLI.
Fixed model size display formatting.
Duration aggregation now uses math.fsum to improve floating-point precision.
No longer raises ValueError when limit_val_batches=0 and the interval exceeds the number of training batches.