⬆️ Bump lightning from 2.6.1 to 2.6.6 in the pip group across 1 directory

[dependabot]

Bumps the pip group with 1 update in the / directory: lightning.

Updates lightning from 2.6.1 to 2.6.6

Release notes

Sourced from lightning's releases.

Lightning 2.6.6

Changes in 2.6.6

PyTorch Lightning

• Fixed arbitrary code execution in load_from_checkpoint by restricting the _instantiator hyperparameter to an allowlist of trusted instantiators (#21832)

• Fixed arbitrary code execution in load_from_checkpoint by rejecting a checkpoint _class_path that does not resolve to an already imported subclass of the loaded class (#21914)

  Full commit list: 2.6.5 -> 2.6.6

  Contributors

  We thank all folks who submitted issues, features, fixes and doc changes. It's the only way we can collectively make Lightning ⚡ better for everyone, nice job!

  In particular, we would like to thank the authors and co-authors of the pull-requests above:

  @​addyCooks @​bhimrazy

Lightning 2.6.5

Changes in 2.6.5

Lightning Fabric

• Use fs.pipe() for S3/GCS checkpoint uploads in _atomic_save (#21595

Full commit list: 2.6.4 -> 2.6.5

Contributors

New Contributors

... (truncated)

Commits

• 771017e Prepare Patch Release 2.6.6 (#21948)
• be98784 Prepare Patch Release 2.6.5 (#21745)
• 43a4411 Pin PyPI publish action for trusted publishing (#21731)
• c016e62 Cherry-pick publishing changes to release/stable (#21727)
• 458c50a ci: disable litbot checkgroup (#21728)
• 9f074af Prepare Release Note for 2.6.2 Release (#21592)
• 73f593d Remove NeptuneLogger integration from PyTorch Lightning (#21572)
• 1690c21 Update Litlogger Integration to latest version (#21591)
• 6c92678 fix: FSDP mixed precision initializes params in fp32, not bf16/fp16 (#21586)
• a13361d build(deps): update rich requirement from <14.3.0,>=12.3.0 to >=12.3.0,<14.4....
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​lightning@​2.6.1 ⏵ 2.6.6		+16

View full report