Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

azureml-mlflow 1.62.0.post5 dependency constraints block required mlflow and cryptography security upgrades

未关闭
  • 哪里不对？
#48,745 12 条评论 1 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@saanikaguptamicrosoft 已经在做这个了。

开始于 2026年8月26日。

评估

这个 Issue 还没有评估数据。

描述

Client customer-reported Machine Learning needs-team-attention question Service Attention
  • Package Name: azureml-mlflow
  • Package Version: 1.62.0.post5
  • Operating System: Linux (Kubernetes workload)
  • Python Version: 3.11

Describe the bug

We use azureml-mlflow for remote MLflow tracking against an Azure Machine Learning Workspace from a Kubernetes workload.

The latest available version, azureml-mlflow 1.62.0.post5, currently introduces dependency constraints that prevent us from applying required security upgrades:

  • mlflow-skinny <= 3.13.0
  • cryptography < 49.0.0

Our security scanning requires:

  • mlflow >= 3.15.0
  • cryptography >= 50.0.0

Because azureml-mlflow is required for our azureml:// MLflow tracking URI, removing the package is not currently an option without changing the Azure ML tracking architecture.

To Reproduce

  1. Create a Python 3.11 environment.
  2. Install or declare azureml-mlflow==1.62.0.post5.
  3. Attempt to resolve the environment with mlflow>=3.15.0.
  4. Attempt to resolve the environment with cryptography>=50.0.0.
  5. The dependency resolver cannot satisfy these requirements together with the constraints introduced by azureml-mlflow.

Expected behavior

There should be a supported version of azureml-mlflow that is compatible with current secure versions of MLflow and its dependencies, or documented guidance for customers who need to remediate these dependency vulnerabilities while continuing to use an Azure Machine Learning Workspace as the remote MLflow tracking backend.

Screenshots

N/A

Additional context

Our application already uses Azure Machine Learning SDK v2 (azure-ai-ml / MLClient) to access the workspace.

MLflow is used for experiment tracking, metrics, parameters, artifacts, and model registry operations against the Azure ML Workspace.

According to the current Azure ML documentation, azureml-mlflow is still required when configuring remote MLflow tracking against an Azure Machine Learning Workspace from compute outside Azure ML.

Could you please confirm:

  1. Whether a new azureml-mlflow release is planned that relaxes these dependency constraints.
  2. Whether there is a currently supported alternative that allows us to keep Azure ML Workspace as the MLflow tracking backend while upgrading MLflow.
  3. What the recommended remediation path is for customers blocked from security upgrades by these constraints.
主要语言
Python
星标
5.6k
派生
3.4k
平均合并
2 天 10 小时
30 天内合并 PR
209

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

Azure/azure-sdk-for-python 的其他 Issue

查看 Azure/azure-sdk-for-python 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。