PyTorch Lightning
Project record
Maintained by Lightning AI197
PyTorch Lightning is an open-source Python framework that structures PyTorch training code and handles engineering tasks such as multi-GPU and multi-node distributed training and mixed precision. The same repository contains Lightning Fabric, a lighter layer for scaling custom PyTorch training loops, and both ship in the lightning package. It was open-sourced in 2019 and is maintained by Lightning AI.19
- Repository: Repository (external site: github.com)
- Documentation: Documentation (installation) (external site: lightning.ai)
- License: LICENSE (external site: github.com)
- Release notes: Releases (external site: github.com)
Availability and license
Public materials checklist
| Item | Status | Notes and evidence |
|---|---|---|
| Source codeIs the source code publicly readable? | Public | 1 |
| DocumentationIs user documentation published? | Public | Documentation is hosted on lightning.ai; the stable docs were for version 2.6.6 at review.5 |
| InstallationAre installation instructions or packages publicly available? | Public | Installable with pip (python -m pip install lightning), from conda-forge, or from source archives on GitHub.5 |
| Supported platformsAre supported operating systems or hardware documented? | Public | The README's continuous-integration table covers Linux, macOS, and Windows, and it documents running on CPUs, CUDA or MPS GPUs, and TPUs.1 |
| Release statusAre versioned releases published? | Public | Versioned releases are published on GitHub and PyPI; the latest at review was 2.6.6, released on September 10, 2026.34 |
What it is useful for
Training and fine-tuning PyTorch models on CPUs, GPUs (CUDA or Apple MPS), or TPUs, from a single device to multiple nodes, without rewriting the model code.1
Run and use notes
- Security: versions 2.6.2 and 2.6.3 uploaded to PyPI on April 30, 2026 were published by an attacker using stolen PyPI credentials and ran a credential-stealing payload on import (CVE-2026-44484). Lightning AI says the GitHub source was not affected, the two versions were quarantined and retired, and anyone who imported them should rotate exposed credentials; later releases start at 2.6.4.783
Organization context
U.S. eligibility
Eligible · basis: U.S.-governed project
The project is hosted in Lightning AI's GitHub organization, and Lightning AI describes itself as the creator of PyTorch Lightning and handled the project's April 2026 security advisory and PyPI publishing. Lightning AI's documented entities are U.S.-based: an SEC Form D filed in January 2026 by Lightning AI, Inc. (Delaware) gives a San Francisco principal place of business, and the website privacy policy gives a New York address for Grid.ai, Inc. doing business as Lightning AI. The project's governance page gives final decisions to a single project lead and release decisions to its maintainers; this assessment rests on the maintaining company, not on individuals.19711106
Sources
This listing is not an endorsement, a safety assessment, or a federal approval.