chore(deps): bump tornado from 6.5.7 to 6.5.8 in /envs/wildfire_env - #1115
chore(deps): bump tornado from 6.5.7 to 6.5.8 in /envs/wildfire_env#1115dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.7 to 6.5.8. - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.7...v6.5.8) --- updated-dependencies: - dependency-name: tornado dependency-version: 6.5.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Routine Dependabot security patch: tornado 6.5.7 → 6.5.8, lock-only in envs/wildfire_env/uv.lock (49 +/− 49, no source changes). tornado is a transitive dependency here (via the ipykernel dev dep → jupyter-client, the Jupyter kernel stack), so a lock-only change with no pyproject / requires-dist edit is correct.
Automated Checks
- Lint —
bash .claude/hooks/lint.shexits 1, but only on ~25 pre-existing unformatted.pyfiles in other envs (opencode_env, pi_env, coding_tools_env, …). None are inwildfire_env, and this PR changes no.pyfiles → not introduced here. (CI's lint job only coverssrc/+tests/;uv.lock/TOML are not linted at all.) - Debug code —
check-debug.shscanssrc/only and reports pre-existingprint()/TODOundersrc/openenv/cli/**→ unrelated to this PR. CLEAN for the changed file.
Verification (lock-bump checklist)
uv lock --check --project envs/wildfire_env→ PASS (Resolved 156 packages); lockfile is consistent withpyproject.toml.- sdist + all 9 wheel hashes match
pypi.org/pypi/tornado/6.5.8/json(yanked: false); artifact URLs stay onfiles.pythonhosted.org. - Constraint OK: wildfire
requires-python >=3.10⊆ tornado>=3.9; tornado has no runtime deps. - Born-clean:
revision = 3and 0 HF-mirror refs on both base and head → no index-flip and no revision bump this time (wildfire was flipped earlier, in #997). - Deploy impact = NONE:
envs/wildfire_env/server/Dockerfileinstalls viapip install -e .(notuv sync --frozen), so this lock is dev-only and never consumed at image build.
Security (positive)
tornado 6.5.8 (Aug 2026) is a security release: it caps form-encoded POST bodies at 1000 args and rejects excessive multipart parts earlier (both CPU/memory DoS mitigations), and extends cookie-attribute character validation to mixed-case set_cookie kwargs (GHSA-wwv5-g3v4-889x, GHSA-8423-8fgw-73vq). In this env tornado is only the Jupyter kernel transport, so direct exposure to those web-server paths is limited, but patching is good hygiene.
Open RFCs Context
000–005 + 008 In Review, 010 Draft. None cover packaging / dependency pinning / the PyPI index → no RFC surface here.
Tier 1: Fixes Required
None. Lock-only bump; uv lock --check passes; hashes verified; constraints satisfied.
Tier 2: Alignment Discussion
Principle conflicts — None identified. A transitive lock bump touches no invariant (Gym API signatures, client-server separation, rewards-in-environment, MCP/WebSocket boundary, container isolation).
RFC conflicts — None identified.
Process (non-blocking):
ALIGNMENT FLAG: Native dependabot/uv/envs/… PR bypasses exclude-paths
- At stake:
.github/dependabot.yml'suvupdater is configureddirectory: "/"withexclude-paths: ["envs/**"], yet this native PR editsenvs/wildfire_env/uv.lock.exclude-pathsis a valid key, but theuvecosystem doesn't currently honor it (platform limitation); the intended lane for env bumps is thecodex/dependabot-envs-*aggregate roll-ups. Nothing to change on this PR — noting the recurring config/behavior gap. - Suggested reviewer: @burtenshaw (authored
.github/dependabot.yml)
FYI (not a flag): the diff also carries benign environment-marker normalization for a few transitive deps (contourpy/ipython/pandas/pexpect/secretstorage) — redundant python_full_version markers dropped inside resolution-marker-scoped blocks. Logically equivalent; resolved versions unchanged; uv lock --check passes.
Summary
- 0 mechanical issues to fix
- 1 non-blocking process note for human review (@burtenshaw)
- 0 RFC conflicts
Verdict: Clean, low-risk security patch. Safe to merge once CI is green.
Sent by Cursor Automation: Pre-review
| { url = "https://files.pythonhosted.org/packages/5c/42/5f0e56c01e8d9d36f4e23f367b85ae6cae0c1ecddd5e6977d8388ad27488/tornado-6.5.7-cp39-abi3-win32.whl", hash = "sha256:f8de3bf12d3efdd0cbe7c8887868198f8a91415e3f29fcf258d9b8eb7b1d9ae4", size = 451047, upload-time = "2026-06-08T17:34:46.784Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/c9/a4/b393076ffb21b469eec5b328a0534cf03a3b90bfc6b1f09507cdd075d938/tornado-6.5.7-cp39-abi3-win_amd64.whl", hash = "sha256:de942f843533a039ef9fa3d9c88c7cd8a7c94553fb5ad0154270989b3d99a2c4", size = 451485, upload-time = "2026-06-08T17:34:48.248Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/71/2e/7b1c769803121b809112cf9a00681c472eae1d80e32d7ec0e0bd61d0d0e1/tornado-6.5.7-cp39-abi3-win_arm64.whl", hash = "sha256:ff934fce95643af5f11efdae618eaa73d469dc588641e5c8d19295a0c65c4796", size = 450506, upload-time = "2026-06-08T17:34:49.702Z" }, | ||
| version = "6.5.8" |
There was a problem hiding this comment.
The bump. tornado is transitive here via the ipykernel dev dep → jupyter-client (Jupyter kernel stack), so a lock-only change with no pyproject/requires-dist edit is correct.
6.5.8 is a security release: form-encoded POST bodies capped at 1000 args + earlier rejection of excessive multipart parts (DoS mitigations), plus mixed-case set_cookie character validation (GHSA-wwv5-g3v4-889x, GHSA-8423-8fgw-73vq). sdist + all 9 wheel hashes match pypi.org/pypi/tornado/6.5.8/json (yanked: false), and uv lock --check passes.
| ] | ||
| dependencies = [ | ||
| { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" }, | ||
| { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" } }, |
There was a problem hiding this comment.
Incidental (benign): the re-lock dropped a redundant python_full_version < '3.11' marker here (and similarly on ipython/pandas/pexpect/secretstorage deps). These entries already sit inside a resolution-markers = ["python_full_version < '3.11'"] block, so the markers were logically redundant. No resolved version changed, and this is not an index-flip or revision bump — both base and head stay at revision = 3 with 0 HF-mirror refs.
1 participant
Bumps tornado from 6.5.7 to 6.5.8.
Changelog
Sourced from tornado's changelog.
... (truncated)
Commits
a55abe3Merge pull request #3704 from bdarnell/security-6.5.8fc79488docs: add additional credit to release notes7b01763Fix test_strip_headers_on_redirect's URL-embedded-credentials casesd72fff8release notes and version bump for 6.5.8b168818auth: Formally deprecated OpenIDMixinda28476web: Also check for semicolons in deprecated mixed-case cookie args8d6363ehttputil: Enforce a new limit on the number of arguments in a requestde85b3fhttputil: Apply multipart max_parts limit earlierDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only patch bump on a transitive dev dependency; no application source or declared dependency changes, though 6.5.8 includes HTTP-related hardening in tornado itself.
Overview
Updates
envs/wildfire_env/uv.lockso the resolved tornado package moves from 6.5.7 to 6.5.8 (new sdist/wheel URLs and hashes). Tornado is still pulled in transitively for dev tooling (e.g. ipykernel / jupyter-client), not as a direct app dependency inpyproject.toml.The same lock refresh also simplifies dependency markers on several existing entries (contourpy, ipython, pandas, pexpect, secretstorage, etc.)—dropping redundant
python_full_versionmarkers on individual deps where the package is already scoped byresolution-markers. One small semantic tweak: ipython 9.13.0 now gatestyping-extensionswithpython_full_version < '3.12'instead of== '3.11.*'.Reviewed by Cursor Bugbot for commit 48bd95b. Bugbot is set up for automated code reviews on this repo. Configure here.