Ray 2.59.1, 2.60.0: Pinned certifi After eMudhra CA Compromise

Ray 2.59.1: Pinned certifi and pip After the eMudhra CA Compromise #

The Ray 2.59.1 release notes, published 2026-11-04, explain why updating the operating system alone is not enough: pip uses its own bundled CA store.

pip trusts its own vendored certifi bundle in addition to the system store, so updating OS ca-certificates alone doesn't protect pip.

Ray 2.59.1 release notes

For Docker images, Ray 2.59.1 moves pip to 26.2.2 on every Python version, certifi to 2026.10.19 in conda and site-packages, and uv to 0.13.4. The virtualenv used for runtime_env virtualenvs moves to 21.14.12, which bundles pip 26.2.2 and also moves packaging to 26.3, typing-extensions to 4.16.0, distlib to 0.4.3 and python-discovery to 1.6.1. The same release sets a certifi>=2026.10.19 floor in Ray's security requirements. Ray 2.60.0 lists the same certifi, pip, uv and virtualenv pins under its Wheels and Images section.

The Windows and macOS wheel builds receive pip 26.2.2 and uv 0.13.4. The notes state that the shipped wheels don't vendor a CA bundle and are unaffected. This suggests that an environment is covered when it is built from Ray's images or from its runtime_env virtualenvs, while a wheel installed into an unrelated environment depends on that environment's own pip and certifi.

Ray 2.60.0: Pickled-Object Columns Rejected by External Arrow Readers #

Ray 2.60.0 lists this under Security: Ray Data now rejects pickled-object columns in every reader that deserializes Arrow data from external input. The notes name the LeRobot, Databricks, Iceberg, Hugging Face, ClickHouse, BigQuery and Delta Sharing readers, and cite pull requests #66042 and #65769. The release describes the change as closing a remote code execution path.

Pipelines that read from any of these sources are the ones in scope. The change is in the reader, so the check belongs in your own read code: find the readers you call and see whether the data they receive contains pickled-object columns. This suggests that such a pipeline will now fail when the reader meets those columns, rather than deserializing them. The Ray 2.60.0 release notes give no CVE identifier for this path.

aiohttp 3.14.4 Fixes CVE-2026-111064 and CVE-2026-111066 in Ray Builds #

Ray 2.59.1 moves aiohttp from 3.14.3 to 3.14.4 and yarl from 1.23.0 to 1.25.1 in the bundled runtime_env agent dependencies, in ray[default] and in the images. The same change covers GHSA-2g87-pp6c-29x5, and the notes cite CVE-2026-111064 and CVE-2026-111066 as the fixed flaws.

CVE-2026-111064 is a weakness (CWE-770) in which aiohttp prior to 3.14.4 has no keepalive timeout during the initial part of a request. An attacker can keep an idle connection open before sending request data, which consumes server connection capacity. CISA's SSVC assessment dated 2026-10-28 rates exploitation as none.

CVE-2026-111066 covers aiohttp from 2.0.0 until 3.14.4 (CWE-400, CWE-770). Multipart request processing can keep an unbounded number of file descriptors open, and an unauthenticated attacker can exhaust them when a handler uses Request.post(). CISA's SSVC assessment dated 2026-10-20 rates exploitation as none. Both CVE records carry a CVSS 4.0 score of 8.2 (HIGH) from GitHub_M; the Ray notes give no severity of their own. The Ray notes do not say which Ray endpoints accept client requests through aiohttp, so exposure depends on each deployment's configuration.

Also in this release #

• Ray 2.60.0, Ray Data: shuffle v2 is the default for joins and aggregations (changed default); Parquet read tasks are sized from footer row-group metadata.
• Ray 2.60.0, Ray Data: the backlog-aware actor-pool autoscaler is the default; RAY_DATA_ACTOR_AUTOSCALER=DEFAULT restores the old one.
• Ray 2.60.0, Ray Data new features: Dataset.write_orc(), unnest(), write_parquet(min_bytes_per_file), write_delta schema_mode, and Lance subset appends.
• Ray 2.60.0, Ray Serve: max_surge_percent starts replacement replicas before stopping old ones; the default of 0 keeps stop-then-start.
• Ray 2.60.0, Ray Serve: a rolling update whose new replicas keep failing stops at DEPLOY_FAILED; RAY_SERVE_STOP_FAILED_ROLLING_UPDATES=0 opts out.
• Ray 2.60.0, Ray Serve (breaking): root_path follows the ASGI spec, and requests that still include the root_path prefix now return 404.
• Ray 2.60.0, Ray Serve: columnar autoscaling metrics are the default; RAY_SERVE_COLUMNAR_AUTOSCALING_METRICS=0 reverts them.
• Ray 2.60.0, Ray Serve: synchronous deployment methods run in a thread pool; RAY_SERVE_RUN_SYNC_IN_THREADPOOL=0 restores the old behavior.
• Ray 2.60.0, Ray Serve: autoscaling metrics are always aggregated at the controller, and RAY_SERVE_AGGREGATE_METRICS_AT_CONTROLLER is removed.
• Ray 2.60.0, Build: Ray 2.60.0 is the last release that will publish Python 3.10 (-py310) images.
• Ray 2.59.1, Ray Serve: ingress request router deployments no longer keep proxies on the nodes they run on, so those nodes can scale down.
• Ray 2.59.1, Ray Data: pandas metadata on Arrow blocks is kept readable, and unparseable dtype names are written as object.

The Ray 2.60.0 release notes hold the complete list.

Upgrading Ray Images, Wheels and Environments Against the CA and aiohttp Fixes #

1. Rebuild Docker images and runtime_env virtualenvs from Ray 2.59.1 or 2.60.0, because the pins are in those artifacts and not in the OS CA store.
2. Confirm that pip 26.2.2 and certifi 2026.10.19 are present in each image and environment you build, using the commands in the next section.
3. Move aiohttp to 3.14.4 in every environment that installs ray[default] or uses the runtime_env agent dependencies.
4. Before running Ray 2.60.0 Ray Data pipelines, search your read code for the LeRobot, Databricks, Iceberg, Hugging Face, ClickHouse, BigQuery and Delta Sharing readers, and check whether their input carries pickled-object columns.
5. Before moving a Serve application to 2.60.0, strip the root_path prefix at your ingress or unset root_path, because requests that still include it now return 404.

Checking Ray, pip, certifi and aiohttp Versions in Your Environments #

Run these commands inside the environment that runs your Ray code. The expected values are the ones the release notes list: pip 26.2.2, certifi 2026.10.19, aiohttp 3.14.4, and virtualenv 21.14.12 for runtime_env virtualenvs.

ray --version
pip --version
pip show certifi aiohttp virtualenv

To check a Ray image before deploying it, run pip inside the image. Replace <image> with the image name you use:

docker run --rm <image> pip --version