sagemaker-train should depend on mlflow-skinny, following sagemaker-mlflow 0.5.0
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- Half a day
- Newbie friendliness
- 72/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- aws, python
- Domain
- build-system, machine-learning
Research direction
Inspect the dependency metadata for sagemaker-train and sagemaker-serve, then compare it with the sagemaker-mlflow 0.5.0 pattern described in the issue. Verify that mlflow-skinny is the base requirement, full mlflow is available through an optional extra, and dependency resolution no longer imposes the reported cryptography cap.
Written by the indexing model from the issue text.
Description
Describe the feature you'd like
sagemaker-train (and sagemaker-serve) declare an unconditional dependency on the full mlflow distribution:
sagemaker-train 1.18.0: mlflow<4.0.0,>=3.0.0
The training integration uses MLflow purely as a tracking client (logging runs and metrics to a configured tracking server), which mlflow-skinny implements completely. The full distribution additionally drags in the tracking server stack and its dependency constraints.
sagemaker-mlflow already made exactly this change in 0.5.0: mlflow-skinny>=2.8 as the base requirement, with full mlflow relegated to an optional full extra. Applying the same pattern to sagemaker-train and sagemaker-serve would make the SDK family consistent.
Why it matters
Full mlflow currently caps cryptography<50. Snyk advisories SNYK-PYTHON-CRYPTOGRAPHY-18516620/21/22 (two high severity) are fixed only in cryptography 50.0.0, so any project consuming sagemaker-train transitively cannot reach the fixed version and must either waive the findings or remove sagemaker-train. Since the mlflow usage is client-only, the cap buys nothing for these packages.
Suggested change
Mirror sagemaker-mlflow 0.5.0: depend on mlflow-skinny, offer full mlflow behind an extra for anyone who genuinely needs the server components.
- Dominant language
- Python
- Stars
- 2.3k
- Forks
- 1.3k
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 42
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from aws/sagemaker-python-sdk
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
aws/sagemaker-python-sdk#6278 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
aws/sagemaker-python-sdk#6253 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 93/100
aws/sagemaker-python-sdk#6232 ·
-
component: model monitor type: bug
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
aws/sagemaker-python-sdk#6206 ·
-
component: model builder type: bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
aws/sagemaker-python-sdk#6199 ·
All issues in aws/sagemaker-python-sdk
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100