# What changed in pytorch-lightning

> 10 changes in pytorch-lightning 2 from its official release notes, upgrade guides and advisories: 4 breaking, 1 security. Each one cited. Sources checked 2026-10-28. HTML: https://unstale.sh/pypi/pytorch-lightning/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## pytorch-lightning 2

### Breaking changes

- Rejects a checkpoint _class_path unless it resolves to an already imported subclass of the loaded class, preventing arbitrary code execution. (2.6.6) — [release notes](https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.6)
- Restricts the _instantiator hyperparameter to an allowlist of trusted instantiators to prevent arbitrary code execution. (2.6.6) — [release notes](https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.6)
- The minimum supported LitLogger version was raised to 2026-03-17. (2.6.4) — [release notes](https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.4)
- Support for the Neptune logger was removed because the integration would otherwise be broken after Neptune sunset its public service. (2.6.4) — [release notes](https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.4)

### Security

- PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to (2.6.6) — [security advisory](https://github.com/advisories/GHSA-QQMF-GPG7-G8GW)

### Fixes and other changes

- With bf16-mixed and 16-mixed, model parameters are now initialized in fp32 instead of half precision. (2.6.4) — [release notes](https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.4)
- The device_mesh type hint now accepts a 2-element tuple via the CLI. (2.6.4) — [release notes](https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.4)
- Fixed model size display formatting. (2.6.4) — [release notes](https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.4)
- Duration aggregation now uses math.fsum to improve floating-point precision. (2.6.4) — [release notes](https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.4)
- No longer raises ValueError when limit_val_batches=0 and the interval exceeds the number of training batches. (2.6.4) — [release notes](https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.4)