[dependabot]

Bumps mlflow from 3.16.1 to 3.18.0.

Release notes

Sourced from mlflow's releases.

MLflow 3.18.0 helps you reuse agent expertise, find regressions before shipping, and monitor quality in production.

Major New Features

• Automatic Issue Detection: Turn recurring agent failures into issues you can investigate and fix. The dedicated Issues tab groups related problems and links findings to trace evidence; schedule detection to keep checking new traffic. (#27193, #26751, #26754, #26791, #26919, #26955, #26961, #26967, #27009, #27002, #27003, #27006, #27137, #27181, #27249, @​tanghaoji; #27070, @​B-Step62)
• Skill Registry: Share your team's expertise across agents and projects with a central catalog of reusable skills. Discover existing skills and choose the version or alias to use in each agent. Experimental. (#26736, @​mprahl; #26900, @​bardenr; #27088, @​Rohitkanithi)
• Revamped Evaluation and Trace Comparisons for Finding Regressions: Find the regressions hidden behind aggregate scores before you ship an agent update. The redesigned comparison UI takes you from score changes to the inputs, conversations, and trace steps behind them. An experimental Python API adds statistical comparisons to help distinguish improvements from noise. (#26991, #26733, #26739, #26740, #26770, #26771, #26782, #26783, #26784, #26927, #26799, #26803, #26808, #26868, #26880, #26889, #26896, #27011, #27014, #27015, @​joshuawong-db; #27332, @​filip-urbanski; #26396, @​AbdulAliMamnun)
• Online Evaluation: Catch production quality regressions with custom code-based checks that automatically assess new traces and multi-turn conversations as they arrive. Code-based online evaluation is experimental and requires a self-hosted server configured with job containers. (#26689, #26430, #26684, #26685, #26687, @​kriscon-db)

Breaking Changes

• [Tracking] Filter and sort search_logged_models metrics by the highest step, then latest timestamp, on SQL stores; apply datasets to both filtering and sorting (#27215, @​agtzrubio)
• [Model Registry] Stop adding registered_model_meta to models:/ downloads; custom readers should use the URI or Model Registry (#27173, @​sunilmehta-si)
• [Tracking] Make MCP server version identity case-sensitive on MySQL and SQL Server; correct case-mismatched references before upgrading (#25920, @​LobsterQBA)

Database upgrade: Back up the SQL backend and plan a maintenance window. Stop MLflow servers and other writers, run mlflow db upgrade <database-url> with MLflow 3.18.0, and restart on the new version. The MCP version migration checks MySQL and SQL Server references for exact-case matches and stops before its own schema changes if correction is required. On case-insensitive databases, registry and MCP permissions now use stored resource names. Re-save differently cased grants under the stored spelling. Follow the database upgrade guidance.

Other Assorted Features & Improvements:

• [UI] Choose the target agent first when installing a skill, with agent icons in the selector (#27457, @​B-Step62)
• [Evaluation / Tracing] Remove expired experimental status from UnityCatalog trace locations and Google ADK scorer APIs (#27379, @​mlflow-app)
• [Docs / Evaluation / Gateway] Support Databricks System One models in custom and Guidelines judges (#27345, @​B-Step62)
• [Docs / Models] Refuse model-supplied code with MLFLOW_ALLOW_MODEL_CODE_EXECUTION=false; deprecate MLFLOW_ALLOW_PICKLE_DESERIALIZATION while preserving its pickle-only behavior (#27000, @​joshuawong-db)
• [UI] Add saved custom trace views to review queue focused review (#26913, @​joshuawong-db)
• [Build] Add opt-in CPU and memory autoscaling to the Helm chart (#26888, @​DrTuup)
• [Evaluation / Tracing / UI] Add GenAI journey overview (#26636, @​B-Step62)
• [Docs / Evaluation] Add an experimental quality_criteria parameter to mlflow.genai.evaluate (#26471, @​joshuawong-db)
• [Docs / Evaluation / Prompts / Tracking / UI] Support presigned artifact flows in the UI (#26268, @​NeriCarcasci)
• [Docs / Tracking] Add presigned-only artifact server mode (#25513, @​NeriCarcasci)
• [Evaluation / Tracing] Allow offline session scorers to select a hierarchical session level with session_level (#26443, @​alkispoly-db)
• [Tracing] Allow session_id to be a list in update_current_trace and tracing.context to identify hierarchical sessions (#26413, @​alkispoly-db)
• [Tracing / UI] Add TraceAudio to custom trace views (#26452, @​chris-chieu)
• [Tracing / UI] Show OpenAI Decisions in the v2 trace viewer (#26577, @​B-Step62)
• [Tracing] Trace OpenAI Decisions calls in TypeScript (#26576, @​B-Step62)
• [Docs / Tracing / Tracking] Trace OpenAI Decisions calls in Python (#26575, @​B-Step62)
• [UI] Allow resizing the experiment run Columns selector on desktop (#26313, @​LockedThread)

Bug fixes:

• [UI] Center issue-detection run-history status icons and labels with the other columns (#27449, @​B-Step62)
• [UI] Match Traces toolbar icons and the Traces/Sessions switcher to the current visual style (#27451, @​B-Step62)
• [UI] Update the Sessions empty state to point to the current Traces/Sessions switcher (#27450, @​B-Step62)
• [UI] Show a skill-folder URL in the registration example (#27455, @​B-Step62)
• [UI] Clarify single-skill registration and provide a tip for importing multiple skills (#27458, @​B-Step62)
• [Tracking] Apply dataset authorization to the same experiment IDs parsed by the request handlers (#27441, @​kriscon-db)
• [UI] Scope users/list to the requested workspace (#27270, @​a-gajam)
• [Gateway] Take the final input and cache token counts from Anthropic message_delta (#26908, @​pcbeingused333)
• [Tracking] Create server-info CapacityLimiter lazily to support anyio < 4.2 (#27405, @​mlflow-app)
• [Tracing] Upload attachments of spans in remote (distributed) traces (#27272, @​vincedc)
• [Tracking] Validate storage account names in wasbs:// URIs (#27396, @​kriscon-db)

... (truncated)

Changelog

Sourced from mlflow's changelog.

3.18.0 (2026-11-02)

MLflow 3.18.0 helps you reuse agent expertise, find regressions before shipping, and monitor quality in production.

Major New Features

• Automatic Issue Detection: Turn recurring agent failures into issues you can investigate and fix. The dedicated Issues tab groups related problems and links findings to trace evidence; schedule detection to keep checking new traffic. (#27193, #26751, #26754, #26791, #26919, #26955, #26961, #26967, #27009, #27002, #27003, #27006, #27137, #27181, #27249, @​tanghaoji; #27070, @​B-Step62)
• Skill Registry: Share your team's expertise across agents and projects with a central catalog of reusable skills. Discover existing skills and choose the version or alias to use in each agent. Experimental. (#26736, @​mprahl; #26900, @​bardenr; #27088, @​Rohitkanithi)
• Revamped Evaluation and Trace Comparisons for Finding Regressions: Find the regressions hidden behind aggregate scores before you ship an agent update. The redesigned comparison UI takes you from score changes to the inputs, conversations, and trace steps behind them. An experimental Python API adds statistical comparisons to help distinguish improvements from noise. (#26991, #26733, #26739, #26740, #26770, #26771, #26782, #26783, #26784, #26927, #26799, #26803, #26808, #26868, #26880, #26889, #26896, #27011, #27014, #27015, @​joshuawong-db; #27332, @​filip-urbanski; #26396, @​AbdulAliMamnun)
• Online Evaluation: Catch production quality regressions with custom code-based checks that automatically assess new traces and multi-turn conversations as they arrive. Code-based online evaluation is experimental and requires a self-hosted server configured with job containers. (#26689, #26430, #26684, #26685, #26687, @​kriscon-db)

Breaking Changes

• [Tracking] Filter and sort search_logged_models metrics by the highest step, then latest timestamp, on SQL stores; apply datasets to both filtering and sorting (#27215, @​agtzrubio)
• [Model Registry] Stop adding registered_model_meta to models:/ downloads; custom readers should use the URI or Model Registry (#27173, @​sunilmehta-si)
• [Tracking] Make MCP server version identity case-sensitive on MySQL and SQL Server; correct case-mismatched references before upgrading (#25920, @​LobsterQBA)

Database upgrade: Back up the SQL backend and plan a maintenance window. Stop MLflow servers and other writers, run mlflow db upgrade <database-url> with MLflow 3.18.0, and restart on the new version. The MCP version migration checks MySQL and SQL Server references for exact-case matches and stops before its own schema changes if correction is required. On case-insensitive databases, registry and MCP permissions now use stored resource names. Re-save differently cased grants under the stored spelling. Follow the database upgrade guidance.

Other Assorted Features & Improvements:

• [Evaluation / Tracing] Remove expired experimental status from UnityCatalog trace locations and Google ADK scorer APIs (#27379, @​mlflow-app)
• [Docs / Evaluation / Gateway] Support Databricks System One models in custom and Guidelines judges (#27345, @​B-Step62)
• [Docs / Models] Refuse model-supplied code with MLFLOW_ALLOW_MODEL_CODE_EXECUTION=false; deprecate MLFLOW_ALLOW_PICKLE_DESERIALIZATION while preserving its pickle-only behavior (#27000, @​joshuawong-db)
• [UI] Add saved custom trace views to review queue focused review (#26913, @​joshuawong-db)
• [Build] Add opt-in CPU and memory autoscaling to the Helm chart (#26888, @​DrTuup)
• [Evaluation / Tracing / UI] Add GenAI journey overview (#26636, @​B-Step62)
• [Docs / Evaluation] Add an experimental quality_criteria parameter to mlflow.genai.evaluate (#26471, @​joshuawong-db)
• [Docs / Evaluation / Prompts / Tracking / UI] Support presigned artifact flows in the UI (#26268, @​NeriCarcasci)
• [Docs / Tracking] Add presigned-only artifact server mode (#25513, @​NeriCarcasci)
• [Evaluation / Tracing] Allow offline session scorers to select a hierarchical session level with session_level (#26443, @​alkispoly-db)
• [Tracing] Allow session_id to be a list in update_current_trace and tracing.context to identify hierarchical sessions (#26413, @​alkispoly-db)
• [Tracing / UI] Add TraceAudio to custom trace views (#26452, @​chris-chieu)
• [Tracing / UI] Show OpenAI Decisions in the v2 trace viewer (#26577, @​B-Step62)
• [Tracing] Trace OpenAI Decisions calls in TypeScript (#26576, @​B-Step62)
• [Docs / Tracing / Tracking] Trace OpenAI Decisions calls in Python (#26575, @​B-Step62)
• [UI] Allow resizing the experiment run Columns selector on desktop (#26313, @​LockedThread)

Bug fixes:

• [UI] Scope users/list to the requested workspace (#27270, @​a-gajam)
• [Gateway] Take the final input and cache token counts from Anthropic message_delta (#26908, @​pcbeingused333)
• [Tracking] Create server-info CapacityLimiter lazily to support anyio < 4.2 (#27405, @​mlflow-app)
• [Tracing] Upload attachments of spans in remote (distributed) traces (#27272, @​vincedc)
• [Tracking] Validate storage account names in wasbs:// URIs (#27396, @​kriscon-db)
• [Docs / Tracking] Match IP-shaped allowed-host patterns only against IP addresses (#27384, @​kriscon-db)
• [Docs / Model Registry / Prompts] Reject registered model/prompt rename onto a name where users already have direct grants (#27380, @​kriscon-db)
• [Gateway] Route guardrail sanitization calls to the server's own address (#27383, @​kriscon-db)
• [Model Registry / Prompts] Require the stored name spelling for admin registered model, prompt, and MCP server deletes (#27378, @​kriscon-db)
• [Tracing] Skip LLM cost on AGENT spans at store time and record Strands cache tokens (#27371, @​mlflow-app)

... (truncated)

Commits

• ba41106 Read experiment_ids like the handlers do in the basic-auth dataset validato...
• f23c241 Clarify single-skill registration guidance (#27458)
• c70d275 Prioritize the skill install target and show agent icons (#27457)
• 59edd96 Use a skill subfolder URL in the registration placeholder (#27455)
• 1e21893 [UI] Update Sessions empty state to match the trace view switcher (#27450)
• 2970b3e [UI] Use gray icons in the Traces toolbar (#27451)
• b9f2eca [UI] Align status cells in issue detection run history (#27449)
• 73f25fd Bump version to 3.18.0 (#27428)
• db79c37 Scope users/list to the requested workspace (#27270)
• 4d267d5 Require placeholder bearer authentication for telemetry proxy (#27421)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 008ed14b-6ef6-4463-bbf2-3c0637f9bfba

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn