build(deps): bump mlflow from 3.16.0 to 3.16.1

[dependabot]

Bumps mlflow from 3.16.0 to 3.16.1.

Release notes

Sourced from mlflow's releases.

MLflow 3.16.1 is a patch release that includes bug fixes and documentation updates.

Breaking changes:

• [Docs / Tracking] Remove the default basic-auth admin password shipped in basic_auth.ini (GHSA-gq3w-7jj3-x7gr) (#25751, @​tanghaoji)

Features:

• [Evaluation] Add a timeout option to the @scorer decorator (#25720, @​smoorjani)
• [Evaluation] Propagate scorer version to assessment metadata (#25570, @​B-Step62)
• [Tracing] Support span links for Unity Catalog traces (#25597, @​B-Step62)

Bug fixes:

• [Tracing] Resolve Unity Catalog trace locations in Databricks Model Serving without local-store validation (#25884, @​james-fletcher-db)
• [Model Registry] Fix S3 multipart upload encryption arguments (#25772, @​james-fletcher-db)
• [Tracking / UI] basic-auth: serve the web UI to non-admins under fail-closed authorization (#25672, @​mkBGD)

Changelog

Sourced from mlflow's changelog.

3.16.1 (2026-09-15)

MLflow 3.16.1 is a patch release that includes bug fixes and documentation updates.

Breaking changes:

• [Docs / Tracking] Remove the default basic-auth admin password shipped in basic_auth.ini (GHSA-gq3w-7jj3-x7gr) (#25751, @​tanghaoji)

Features:

• [Evaluation] Add a timeout option to the @scorer decorator (#25720, @​smoorjani)
• [Evaluation] Propagate scorer version to assessment metadata (#25570, @​B-Step62)
• [Tracing] Support span links for Unity Catalog traces (#25597, @​B-Step62)

Bug fixes:

• [Tracing] Resolve Unity Catalog trace locations in Databricks Model Serving without local-store validation (#25884, @​james-fletcher-db)
• [Model Registry] Fix S3 multipart upload encryption arguments (#25772, @​james-fletcher-db)
• [Tracking / UI] basic-auth: serve the web UI to non-admins under fail-closed authorization (#25672, @​mkBGD)

3.15.2 (2026-08-25)

MLflow 3.15.2 is a patch release that includes several major features and improvements.

Features:

• [Evaluation] Support immutable evaluation dataset versions (#24845, @​danielseong1)
• [Evaluation] Add scorer_ensemble primitive for combining scorer results (#24749, @​alkispoly-db)

Bug fixes:

• [Evaluation] Preserve base judge invocation flow in MemAlign aligned judges (#24883, @​veronicalyu320)
• [Tracking] Pre-import databricks.sdk in Databricks to avoid telemetry deadlock (#24841, @​aaronteo-db)
• [Build / Tracking] Align runs.status constraint metadata (#24890, @​joshuawong-db)

3.15.1 (2026-08-03)

MLflow 3.15.1 is a patch release that includes bug fixes and documentation updates.

Bug fixes:

• [Model Registry] Skip env_pack on ARM client images (#24762) (#24835, @​qyc)
• [Scoring / Tracking] Harden version parsing against missing/non-PEP440 versions on Databricks Serverless (+ lint rule) (#24799) (#24813, @​PattaraS)

Documentation updates:

• [Docs] Clarify scorer versioning documentation (#24769) (#24805, @​nihalmenon)

3.15.0 (2026-07-31)

... (truncated)

Commits

• 32792af Update 3.16.1 changelog for #25884 (#25919)
• 2d8856f [3.16] Resolve UC trace location in model serving without local-store validat...
• ca721f4 [3.16] Update bundled mlflow/assistant/skills to latest upstream (#25918)
• ff9e48b Update CHANGELOG for 3.16.1 (#25872)
• b7ab3d1 Replace MinIO with RustFS in mlflow_artifacts example (#25808)
• d2bd515 Adapt admin bootstrap tests for branch-3.16
• 3730ed8 Fix S3 multipart upload encryption arguments (#25772)
• 93c11e1 Remove the default basic-auth admin password shipped in basic_auth.ini (GHS...
• 25240dd basic-auth: serve the web UI to non-admins under fail-closed authorization (#...
• 5c36ecb Add a timeout option to the @scorer decorator (#25720)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 305a6022-91d7-4de0-bf00-637fdeb39b43

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}