Merge branch 'master' into feat/device-stats-filter-keys

deependujha · web-flow · commit 96ce8bf550c0 · 2026-05-22T21:52:20.000+05:30
diff --git a/.github/workflows/_legacy-checkpoints.yml b/.github/workflows/_legacy-checkpoints.yml
@@ -44,6 +44,8 @@ on:
 env:
   LEGACY_FOLDER: "tests/legacy"
   TORCH_URL: "https://download.pytorch.org/whl/cpu/"
+  # Supply-chain guard: skip PyPI releases newer than this. See https://docs.astral.sh/uv/reference/settings/#exclude-newer
+  UV_EXCLUDE_NEWER: "2 days"
 
 defaults:
   run:
@@ -71,12 +73,15 @@ jobs:
           PACKAGE_NAME: pytorch
           FREEZE_REQUIREMENTS: 1
         timeout-minutes: 20
-        run: uv pip install . --extra-index-url="${TORCH_URL}"
+        # `unsafe-best-match` required: PyTorch extra-index mirrors an older fsspec that
+        # conflicts with lightning's version range under UV_EXCLUDE_NEWER.
+        run: uv pip install . --extra-index-url="${TORCH_URL}" --index-strategy unsafe-best-match
         if: inputs.pl_version == ''
 
       - name: Install PL version
         timeout-minutes: 20
-        run: uv pip install "pytorch-lightning==${{ inputs.pl_version }}" --extra-index-url="${TORCH_URL}"
+        # `unsafe-best-match` required: same fsspec/PyTorch-index conflict as above.
+        run: uv pip install "pytorch-lightning==${{ inputs.pl_version }}" --extra-index-url="${TORCH_URL}" --index-strategy unsafe-best-match
         if: inputs.pl_version != ''
 
       - name: Adjust tests -> PL
diff --git a/.github/workflows/call-clear-cache.yml b/.github/workflows/call-clear-cache.yml
@@ -23,7 +23,7 @@ on:
 jobs:
   cron-clear:
     if: github.event_name == 'schedule' || github.event_name == 'pull_request'
-    uses: Lightning-AI/utilities/.github/workflows/cleanup-caches.yml@v0.15.3
+    uses: Lightning-AI/utilities/.github/workflows/cleanup-caches.yml@86fe1b20b4609835ba9e8c8739cd39707ba76868 # v0.15.3
     with:
       scripts-ref: v0.15.2
       dry-run: ${{ github.event_name == 'pull_request' }}
@@ -32,7 +32,7 @@ jobs:
 
   direct-clear:
     if: github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request'
-    uses: Lightning-AI/utilities/.github/workflows/cleanup-caches.yml@v0.15.3
+    uses: Lightning-AI/utilities/.github/workflows/cleanup-caches.yml@86fe1b20b4609835ba9e8c8739cd39707ba76868 # v0.15.3
     with:
       scripts-ref: v0.15.2
       dry-run: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/ci-pkg-install.yml b/.github/workflows/ci-pkg-install.yml
@@ -45,11 +45,16 @@ jobs:
         os: ["ubuntu-22.04", "macOS-14", "windows-2022"]
         pkg-name: ["fabric", "pytorch", "lightning", "notset"]
         python-version: ["3.10", "3.11"]
+    env:
+      # Supply-chain guard: skip PyPI releases newer than this (ISO 8601 duration). See https://pip.pypa.io/en/stable/cli/pip_install/#cmdoption-uploaded-prior-to
+      PIP_UPLOADED_PRIOR_TO: "P2D"
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
+      - name: Upgrade pip (for --uploaded-prior-to, pip >= 26.1)
+        run: python -m pip install --upgrade "pip>=26.1"
       - uses: actions/download-artifact@v8
         with:
           name: dist-packages-${{ github.sha }}
diff --git a/.github/workflows/ci-rtfd.yml b/.github/workflows/ci-rtfd.yml
diff --git a/.github/workflows/ci-tests-fabric.yml b/.github/workflows/ci-tests-fabric.yml
@@ -68,6 +68,8 @@ jobs:
       # TODO: Remove this - Enable running MPS tests on this platform
       DISABLE_MPS: ${{ matrix.os == 'macOS-14' && '1' || '0' }}
       UV_TORCH_BACKEND: "cpu"
+      # Supply-chain guard: skip PyPI releases newer than this. See https://docs.astral.sh/uv/reference/settings/#exclude-newer
+      UV_EXCLUDE_NEWER: "2 days"
     steps:
       - uses: actions/checkout@v6
 
diff --git a/.github/workflows/ci-tests-pytorch.yml b/.github/workflows/ci-tests-pytorch.yml
@@ -73,6 +73,8 @@ jobs:
       # TODO: Remove this - Enable running MPS tests on this platform
       DISABLE_MPS: ${{ matrix.os == 'macOS-14' && '1' || '0' }}
       UV_TORCH_BACKEND: "cpu"
+      # Supply-chain guard: skip PyPI releases newer than this. See https://docs.astral.sh/uv/reference/settings/#exclude-newer
+      UV_EXCLUDE_NEWER: "2 days"
     steps:
       - uses: actions/checkout@v6
 
diff --git a/.github/workflows/cleanup-caches.yml b/.github/workflows/cleanup-caches.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Cleanup
         run: |
diff --git a/.github/workflows/code-checks.yml b/.github/workflows/code-checks.yml
@@ -27,6 +27,9 @@ defaults:
 jobs:
   mypy:
     runs-on: ubuntu-22.04
+    env:
+      # Supply-chain guard: skip PyPI releases newer than this. See https://docs.astral.sh/uv/reference/settings/#exclude-newer
+      UV_EXCLUDE_NEWER: "2 days"
     steps:
       - uses: actions/checkout@v6
 
diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml
@@ -48,6 +48,8 @@ env:
   FREEZE_REQUIREMENTS: "1"
   TORCH_URL: "https://download.pytorch.org/whl/cpu/"
   PYPI_LOCAL_DIR: "pypi_pkgs/"
+  # Supply-chain guard: skip PyPI releases newer than this. See https://docs.astral.sh/uv/reference/settings/#exclude-newer
+  UV_EXCLUDE_NEWER: "2 days"
 
 jobs:
   docs-make:
@@ -103,9 +105,15 @@ jobs:
 
       - name: Install package & dependencies
         timeout-minutes: 20
+        # `unsafe-best-match` lets uv consider all indexes when resolving a package,
+        # not just the first one it's found on. Required here because the PyTorch CPU
+        # extra-index mirrors an older `fsspec` that conflicts with `lightning[all]`'s
+        # version range under `UV_EXCLUDE_NEWER`; without this flag uv refuses to fall
+        # back to PyPI for a newer compatible version.
         run: |
           uv pip install .[all] -U -r requirements/${{ matrix.pkg-name }}/docs.txt \
-            -f ${PYPI_LOCAL_DIR} --extra-index-url="${TORCH_URL}"
+            -f ${PYPI_LOCAL_DIR} --extra-index-url="${TORCH_URL}" \
+            --index-strategy unsafe-best-match
           uv pip list
 
       - name: Install req. for Notebooks/tutorials
@@ -179,7 +187,7 @@ jobs:
       - name: Inject version selector
         working-directory: docs/build
         run: |
-          pip install -q wget
+          uv pip install -q wget
           python -m wget https://raw.githubusercontent.com/Lightning-AI/utilities/main/scripts/inject-selector-script.py
           python inject-selector-script.py html ${{ matrix.pkg-name }}
 
diff --git a/.github/workflows/label-conflicts.yml b/.github/workflows/label-conflicts.yml
diff --git a/.github/workflows/labeler-issue.yml b/.github/workflows/labeler-issue.yml
@@ -19,16 +19,16 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Parse issue form
-        uses: stefanbuck/github-issue-parser@v3
+        uses: stefanbuck/github-issue-parser@cb6e97157cbf851e3a393ff8d57c93a484cc323f # v3.2.5
         id: issue-parser
         with:
           template-path: .github/ISSUE_TEMPLATE/1_bug_report.yaml
 
       - name: Set labels based on severity field
-        uses: redhat-plumbers-in-action/advanced-issue-labeler@v3
+        uses: redhat-plumbers-in-action/advanced-issue-labeler@b80ae64e3e156e9c111b075bfa04b295d54e8e2e # v3.2.4
         with:
           issue-form: ${{ steps.issue-parser.outputs.jsonString }}
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/labeler-pr.yml b/.github/workflows/labeler-pr.yml
diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml
@@ -21,12 +21,16 @@ jobs:
     runs-on: ubuntu-22.04
     env:
       PKG_NAME: "lightning"
+      # Supply-chain guard: skip PyPI releases newer than this (ISO 8601 duration). See https://pip.pypa.io/en/stable/cli/pip_install/#cmdoption-uploaded-prior-to
+      PIP_UPLOADED_PRIOR_TO: "P2D"
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: "3.10"
 
+      - name: Upgrade pip (for --uploaded-prior-to, pip >= 26.1)
+        run: python -m pip install --upgrade "pip>=26.1"
       - name: Convert actual version to nightly
         run: |
           pip install -q -r .actions/requirements.txt
diff --git a/.github/workflows/release-pkg.yml b/.github/workflows/release-pkg.yml
@@ -153,7 +153,8 @@ jobs:
           python -c "print('pkg=' + '${{ matrix.name }}'.lower())" >> $GITHUB_OUTPUT
 
       - name: Publish distribution 📦 to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.5.1
+        # pypa/gh-action-pypi-publish v1.13.0
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e
         with:
           packages_dir: dist/${{ steps.folder.outputs.pkg }}
           verbose: true
diff --git a/src/lightning/fabric/CHANGELOG.md b/src/lightning/fabric/CHANGELOG.md
@@ -22,14 +22,15 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 -
 
---
+---
+
+## [2.6.4] - 2026-05-20
 
-## [2.6.2] - 2026-03-19
+> Versions 2.6.2 and 2.6.3 were skipped due to a supply chain security compromise. See [#21691](https://github.com/Lightning-AI/pytorch-lightning/issues/21691) for details.
 
 ### Fixed
 
 - Fixed FSDP mixed precision (`bf16-mixed`, `16-mixed`) initializing model parameters in half precision instead of fp32 ([#21586](https://github.com/Lightning-AI/pytorch-lightning/pull/21586))
-
 - Fixed `device_mesh` type hint in `FSDPStrategy` to accept a 2-element tuple via the CLI ([#21581](https://github.com/Lightning-AI/pytorch-lightning/pull/21581))
 
 ---
diff --git a/src/lightning/pytorch/CHANGELOG.md b/src/lightning/pytorch/CHANGELOG.md
@@ -28,30 +28,26 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 ---
 
-## [2.6.2] - 2026-03-19
+## [2.6.4] - 2026-05-20
 
+> Versions 2.6.2 and 2.6.3 were skipped due to a supply chain security compromise. See [#21691](https://github.com/Lightning-AI/pytorch-lightning/issues/21691) for details.
 
 ### Removed
 
 - Removed support for Neptune logger ([#21572](https://github.com/Lightning-AI/pytorch-lightning/pull/21572))
 
-
 ### Changed
 
 - Raise minimum `LitLogger` version to `2026-03-17` ([#21591](https://github.com/Lightning-AI/pytorch-lightning/pull/21591))
 
-
 ### Fixed
 
 - Fixed `val_check_interval` raising `ValueError` when `limit_val_batches=0` and interval exceeds training batches ([#21560](https://github.com/Lightning-AI/pytorch-lightning/pull/21560))
-
 - Fixed pkg-resources deprecation issue ([#21538](https://github.com/Lightning-AI/pytorch-lightning/pull/21538))
-
 - Fixed FSDP mixed precision (`bf16-mixed`, `16-mixed`) initializing model parameters in half precision instead of fp32 ([#21586](https://github.com/Lightning-AI/pytorch-lightning/pull/21586))
-
 - Fixed `device_mesh` type hint in `FSDPStrategy` to accept a 2-element tuple via the CLI ([#21581](https://github.com/Lightning-AI/pytorch-lightning/pull/21581))
-
-- Fixed ``RichModelSummary`` model size display formatting ([#21467](https://github.com/Lightning-AI/pytorch-lightning/pull/21467))
+- Fixed `RichModelSummary` model size display formatting ([#21467](https://github.com/Lightning-AI/pytorch-lightning/pull/21467))
+- Fixed floating-point precision in `SimpleProfiler` duration aggregation by using `math.fsum` ([#21525](https://github.com/Lightning-AI/pytorch-lightning/pull/21525))
 
 ---
 
