Experiment tracking, webhooks and monitoring: mlflow>=2.9.0, uncapped (extra [tracking-mlflow], pyproject.toml:101-103) (range-unsound) (TECH-T09-005) #493

Wave 2 · theme D2-7: Next-release technology updates · highest severity Next release · 1 finding(s) · effort not estimated

Summary

pyproject.toml:102 advertises a floor that the resolver can never pick together with ForgeLM's core stack, and the missing cap leaves the extra open to a future 4.0.

Primary finding

TECH-T09-005 — Experiment tracking, webhooks and monitoring: mlflow>=2.9.0, uncapped (extra [tracking-mlflow], pyproject.toml:101-103) (range-unsound)

severity Next release

Item. mlflow>=2.9.0, uncapped (extra [tracking-mlflow], pyproject.toml:101-103) · verdict: range-unsound · urgency: Next release

State in ForgeLM. pyproject.toml:102 declares mlflow>=2.9.0 with no cap. The K-3 extras venv resolves 3.16.1.

State of the ecosystem on 2026-10-01. The latest release is mlflow 3.16.1 (PyPI, 2026-09-16), and no 4.x exists. 2.x backports still appear (2.11.5 on 2026-09-23, 2.13.3 on 2026-09-24). mlflow 2.9.0 requires protobuf<5, numpy<2 and pyarrow<15. 3.2.0 requires pyarrow<22. ForgeLM's core datasets>=4.7.0 requires pyarrow>=21.0.0 (confirmed in the lower venv's metadata), so per xcheck's metadata reading no release from 2.9.0 through 3.1.x can be installed with ForgeLM. transformers v5.18.0 still ships MLflowCallback (integration_utils.py:1286), and both researchers ran it successfully against mlflow 3.16.1. Breaking behaviour arrived inside the 3.x major: from 3.13 a file store raises (see the MLflow-defaults item).

Impact. pyproject.toml:102 advertises a floor that the resolver can never pick together with ForgeLM's core stack, and the missing cap leaves the extra open to a future 4.0.

Recommendation. Change to mlflow>=3.2.0,<4.0.0 (or a higher floor that CI exercises) and run a callback smoke test at both bounds. Fix experiment-tracking.md:52 to name [tracking-mlflow].

Sources.

• PyPI mlflow metadata (latest 3.16.1) (2026-09-16)
• mlflow 2.9.0 metadata (protobuf<5, numpy<2, pyarrow<15) (2023-12-06)
• mlflow 3.2.0 metadata (pyarrow<22) (retrieved 2026-10-01)
• OSV advisories for mlflow (2026-09-10 (newest advisory))
• transformers v5.18.0 integration_utils.py (MLflowCallback) (2026-09-30)

Acceptance criteria

• Each statement is re-checked against the code at fix time.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}