[dependabot]

Bumps ray from 2.55.1 to 2.59.0.

Release notes

Sourced from ray's releases.

Ray-2.59.0

Highlights

• Ray Data LLM & Ray Serve LLM are GA/Stable: the LLM APIs graduate to general availability this release (#65194), alongside an upgrade to vLLM 0.27.0 (#65351).
• Ray Data external shuffle (shuffle_v2): the new shuffle backend gains an external, disk-backed mode — a new external shuffle runtime library and task/operator set (#64828, #65144), planner integration (#65499), and Join & Aggregation support on external shuffle (#65897). The strategy was renamed from hash_shuffle_v2 to shuffle_v2 (#65411) and the compression setting from hash_shuffle_compression to shuffle_compression (#65590).
• Token authentication: Ray now turns on token authentication by default for local clusters. ray.init() without an address enables authentication and generates a token at ~/.ray/auth_token when none exists. ray start --head enables authentication when a token is already available, and otherwise warns that it started an unauthenticated cluster. Remote and multi-node clusters are unchanged in this release. Set RAY_AUTH_MODE=disabled to opt out (#64755).
• Security hardening: the dashboard redacts runtime_env values (which routinely carry credentials) in browser-facing endpoints (#65226), and read_hudi gained an unpickling guard preventing remote code execution (#65780).
• Ray Core at scale: removed the GCS resource-view reset that caused placement-group retry storms on large clusters (#65271), hardened the worker-lease protocol (at most one CancelWorkerLease per pending lease, lease-id tombstones — #65613, #65420), and batched local object frees (#65000, #64037).
• New Data sources: native ORC file reading (#64600), multi-path read_lance (#64560), and fps/resize parameters for read_videos (#64120).

Ray Data

🎉 New Features

• Add support for reading ORC files (#64600)
• Introduce external disk shuffle: runtime library, tasks and operators, planner integration, and Join & Aggregations on external shuffle (#64828, #65144, #65499, #65897)
• Support reading multiple paths in read_lance (#64560)
• Add fps and resize parameters to read_videos() (#64120)
• Add max_concurrent_calls_per_actor to ActorPoolStrategy (#65534)
• Introduce reporting for task USS distribution metrics (#65666)

💫 Enhancements

• Iceberg: deduplicate read-task state, better decoded-size estimation, and bounded read-task memory (#64811, #65042, #64813)
• Count materialized data as downstream capacity, and return external consumer bytes for downstream-capacity backpressure (#66226, #65474)
• Disable throttling for Union and Mix operators (#65242)
• Pin the fused map function for shuffle tasks (#65480)
• Chunk DataFrame emission in WebDatasetDatasource._read_stream and detect non-contiguous keys in read_webdataset (#65394, #63407)
• Expose read-task resource args in read_webdataset (#65623)
• Auto-detect AzureFileSystem for Blob HTTPS URLs in download() (#63648)
• Groundwork for footer-based Parquet reads: footer types and online bin packer, FooterReader actor pool, and ListFiles pushdown state derived from the ReadFiles scanner (#65210, #65273, #65214)
• Groundwork for Data fault tolerance (1/n): add a linear application-layer lineage tracker (#65519)

🔨 Fixes

• Add an unpickling guard to prevent RCE when reading Hudi (#65780)
• Fix Iceberg Dataset.count() returning wrong row counts (#65175)
• Fix LeRobot delta windows for multidimensional features (#65165)
• OpTask._cancel never passed force=True (#65389)
• Fix an incorrect timeout value in the autoscaler shutdown warning (#65317)
• Correct the physical-to-logical operator mapping type (#61790)
• Don't register out-of-scope callbacks on blocks passed through from input to output (#66369)
• Fix crash in preprocessors due to stale metadata in Arrow-backed Pandas dataframes (#66578)

📖 Documentation

• Style and accuracy passes on the shuffle, join/save, and OOM-prevention pages (#65374, #65372, #65525, #65509)
• Clarify num_workers in the PyTorch docs and iter_torch_batches collate_fn usage (#65311, #64535)
• Deprecations: ray_remote_args for read APIs (#65501) and for Dataset transformations (#65228); min_rows_per_file with partitioned Parquet writes (#63368)

... (truncated)

Commits

• dd83c3a [cherry-pick][2.59.0][Data] Fix preprocessors crashing on Arrow-backed pandas...
• 3a22cdb [cherry-pick][2.59.0][Fix][Core/Auth] Pass auth token to image_uri containers...
• 94236f2 [cherry-pick][2.59.0][core][kuberay] Support configurable Kubernetes API auth...
• f9cc8c0 [cherry-pick][2.59.0][Data] Don't register out-of-scope callbacks on blocks p...
• 633947e [cherry-pick][2.59.0][Docs] Prevent dismissed announcement banners from flash...
• 05d558d [cherry-pick][2.59.0][Data] Count Materialized Data as Downstream Capacity (#...
• f273845 [cherry-pick][2.59.0][Feat][Core/Auth] Enable token authentication for local ...
• bfe9b7a [cherry-pick][2.59.0][ci][deps] Downgrade protobuf to 5.27.5 without the unre...
• e15d289 [cherry-pick][2.59.0][Java] Update httpcore5 to 5.4.3 (#66081) (#66130)
• 150bc9b [cherry-pick][2.59.0][ci] Pin the uv installer version in release and CI imag...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.