Update mlflow requirement from >=3.7 to >=3.16.1

[dependabot]

Updates the requirements on mlflow to permit the latest version.

Release notes

Sourced from mlflow's releases.

MLflow 3.16.1 is a patch release that includes bug fixes and documentation updates.

Breaking changes:

• [Docs / Tracking] Remove the default basic-auth admin password shipped in basic_auth.ini (GHSA-gq3w-7jj3-x7gr) (#25751, @​tanghaoji)

Features:

• [Evaluation] Add a timeout option to the @scorer decorator (#25720, @​smoorjani)
• [Evaluation] Propagate scorer version to assessment metadata (#25570, @​B-Step62)
• [Tracing] Support span links for Unity Catalog traces (#25597, @​B-Step62)

Bug fixes:

• [Tracing] Resolve Unity Catalog trace locations in Databricks Model Serving without local-store validation (#25884, @​james-fletcher-db)
• [Model Registry] Fix S3 multipart upload encryption arguments (#25772, @​james-fletcher-db)
• [Tracking / UI] basic-auth: serve the web UI to non-admins under fail-closed authorization (#25672, @​mkBGD)

Changelog

Sourced from mlflow's changelog.

3.16.1 (2026-09-15)

MLflow 3.16.1 is a patch release that includes bug fixes and documentation updates.

Breaking changes:

• [Docs / Tracking] Remove the default basic-auth admin password shipped in basic_auth.ini (GHSA-gq3w-7jj3-x7gr) (#25751, @​tanghaoji)

Features:

• [Evaluation] Add a timeout option to the @scorer decorator (#25720, @​smoorjani)
• [Evaluation] Propagate scorer version to assessment metadata (#25570, @​B-Step62)
• [Tracing] Support span links for Unity Catalog traces (#25597, @​B-Step62)

Bug fixes:

• [Tracing] Resolve Unity Catalog trace locations in Databricks Model Serving without local-store validation (#25884, @​james-fletcher-db)
• [Model Registry] Fix S3 multipart upload encryption arguments (#25772, @​james-fletcher-db)
• [Tracking / UI] basic-auth: serve the web UI to non-admins under fail-closed authorization (#25672, @​mkBGD)

3.15.2 (2026-08-25)

MLflow 3.15.2 is a patch release that includes several major features and improvements.

Features:

• [Evaluation] Support immutable evaluation dataset versions (#24845, @​danielseong1)
• [Evaluation] Add scorer_ensemble primitive for combining scorer results (#24749, @​alkispoly-db)

Bug fixes:

• [Evaluation] Preserve base judge invocation flow in MemAlign aligned judges (#24883, @​veronicalyu320)
• [Tracking] Pre-import databricks.sdk in Databricks to avoid telemetry deadlock (#24841, @​aaronteo-db)
• [Build / Tracking] Align runs.status constraint metadata (#24890, @​joshuawong-db)

3.15.1 (2026-08-03)

MLflow 3.15.1 is a patch release that includes bug fixes and documentation updates.

Bug fixes:

• [Model Registry] Skip env_pack on ARM client images (#24762) (#24835, @​qyc)
• [Scoring / Tracking] Harden version parsing against missing/non-PEP440 versions on Databricks Serverless (+ lint rule) (#24799) (#24813, @​PattaraS)

Documentation updates:

• [Docs] Clarify scorer versioning documentation (#24769) (#24805, @​nihalmenon)

3.15.0 (2026-07-31)

... (truncated)

Commits

• 32792af Update 3.16.1 changelog for #25884 (#25919)
• 2d8856f [3.16] Resolve UC trace location in model serving without local-store validat...
• ca721f4 [3.16] Update bundled mlflow/assistant/skills to latest upstream (#25918)
• ff9e48b Update CHANGELOG for 3.16.1 (#25872)
• b7ab3d1 Replace MinIO with RustFS in mlflow_artifacts example (#25808)
• d2bd515 Adapt admin bootstrap tests for branch-3.16
• 3730ed8 Fix S3 multipart upload encryption arguments (#25772)
• 93c11e1 Remove the default basic-auth admin password shipped in basic_auth.ini (GHS...
• 25240dd basic-auth: serve the web UI to non-admins under fail-closed authorization (#...
• 5c36ecb Add a timeout option to the @scorer decorator (#25720)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.24%. Comparing base (a07e617) to head (348e26e).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1064   +/-   ##
=======================================
  Coverage   70.24%   70.24%           
=======================================
  Files          91       91           
  Lines        9000     9000           
=======================================
  Hits         6322     6322           
  Misses       2678     2678           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.