chore(deps): bump gradio from 6.9.0 to 6.15.0 in /envs/qed_math_env#917
chore(deps): bump gradio from 6.9.0 to 6.15.0 in /envs/qed_math_env#917dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [gradio](https://github.com/gradio-app/gradio) from 6.9.0 to 6.15.0. - [Release notes](https://github.com/gradio-app/gradio/releases) - [Changelog](https://github.com/gradio-app/gradio/blob/main/CHANGELOG.md) - [Commits](https://github.com/gradio-app/gradio/compare/gradio@6.9.0...gradio@6.15.0) --- updated-dependencies: - dependency-name: gradio dependency-version: 6.15.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
PR #917 — dependabot chore(deps): bump gradio 6.9.0 → 6.15.0 in /envs/qed_math_env. Lockfile-only diff (1 file, +20/−26): envs/qed_math_env/uv.lock.
Automated Checks
- Lint: PASS (PR scope). This PR changes 0 Python files — only
uv.lock, whichruff/usortdon't touch — so lint doesn't apply to the diff. (uvisn't preinstalled on the review VM; I installed it and ran.claude/hooks/lint.sh. It exit-1's on ~20 pre-existing reformat candidates, all in other envs —chat_env,coding_tools_env,jupyter_env,opencode_env,repl_env,terminus_env,textarena_env,agent_world_model_env— none inqed_math_env, none in this diff.) - Debug code: CLEAN (PR scope).
check-debug.shonly reports pre-existing prints/TODOs undersrc/openenv/…; nothing in the changed file.
Dependency-bump verification
- Transitive → lock-only is correct.
gradiois not a direct dep inenvs/qed_math_env/pyproject.toml(it's pulled transitively via theopenenv-coreweb-UI extra), so dependabot rightly updated only the lock and leftpyproject.tomluntouched. - What changed:
gradio6.9.0→6.15.0,gradio-client2.3.0→2.5.0, +hf-gradio0.4.1 (new transitive dep of gradio 6.15), −aiofiles, −ffmpy(gradio 6.15 no longer needs them). Removals are clean: no dangling references remain in the lock and the env source imports neither. - Hashes verified against live PyPI —
gradio6.15.0 wheelc71bf7ae…/ sdistdce14829…match the lock exactly.gradio6.15.0:requires-python >=3.10(env is>=3.10✓),yanked=false,vulnerabilities: []→ this is not a security fix, just a routine minor bump. - Genuinely clean bump. Unlike the sibling gradio PRs (#899/#900/#901), this env's lock is already 100% on
pypi.org/simple(0 HF-mirror refs) andrevision = 3is unchanged, so there's no index-source flip and no lockfile-revision bump — only the 5 expected package artifacts changed.
Open RFCs Context
Open RFCs — 000/001/002/003/005 (In Review), 004 (rubrics), 010 (Draft) — cover project phases, abstractions, env spec, MCP, harnesses, rubrics/rewards, and echo world-modeling. None govern packaging / dependency management, so a transitive dep bump has no RFC surface.
Tier 1: Fixes Required
None. (The lint/debug hook output above is all pre-existing and outside this diff.)
Tier 2: Alignment Discussion
Principle Conflicts: None identified — a transitive lockfile bump touches no API surface, reward computation, client-server separation, or MCP/WebSocket boundary.
RFC Conflicts: None identified.
Process note (non-blocking) — cc @burtenshaw
This native dependabot/uv/envs/qed_math_env/… PR edits envs/**, even though .github/dependabot.yml's uv updater is scoped directory: "/" with exclude-paths: ["envs/**"] (added in 5f499da9, "stop dependabot in envs" #566). The guard isn't holding for env dep bumps; the intended channel is the aggregate codex/dependabot-envs-* roll-ups. Worth a look, but not a blocker here.
Summary
- 0 mechanical issues to fix (Tier 1)
- 0 alignment points for human review (Tier 2)
- 0 RFC conflicts
- Verdict: clean, low-risk transitive dependency bump; safe to merge once CI is green. One non-blocking dependabot-scoping note for @burtenshaw.
Sent by Cursor Automation: Pre-review
| [[package]] | ||
| name = "gradio" | ||
| version = "6.9.0" | ||
| version = "6.15.0" |
There was a problem hiding this comment.
gradio 6.15.0 verified against live PyPI — sdist dce14829… / wheel c71bf7ae… match this lock exactly; requires-python >=3.10 (env satisfies), yanked=false, vulnerabilities: [] (not a security fix). gradio is transitive here (absent from this env's pyproject.toml), so a lock-only change is correct.
| ] | ||
|
|
||
| [[package]] | ||
| name = "hf-gradio" |
There was a problem hiding this comment.
New transitive dep pulled in by gradio 6.15 (hf-gradio 0.4.1, verified on PyPI). Correspondingly aiofiles and ffmpy were dropped (gradio 6.15 no longer requires them) — confirmed no dangling refs remain and the env source imports neither.
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps gradio from 6.9.0 to 6.15.0.
Release notes
Sourced from gradio's releases.
Changelog
Sourced from gradio's changelog.
... (truncated)
Commits
0528c2cchore: update versions (#13352)6a0b417Stabilize image editor examples test (#13418)51497aedocs: add MiniMax example to ChatInterface providers guide (#13411)9acecd2Warn when gr.Tabs() has non-Tab direct children (#9832) (#13383)6b0c8afMarkdown link fix (#13408)df56862[js-client] close submit iterator on next/close race (#13403)1cbeb4fCi previews cdn (#13410)0fbdc49JS client cdn preview (#13409)14c8870Add UploadButton unit tests (#13336)10f43e0Offload traffic to static workers and use node as the proxy (#13366)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Minor-version UI framework upgrade with upstream security fixes; risk is mainly regression in Gradio web UIs and transitive dependency shifts, mitigated by lock-only change.
Overview
Updates
envs/qed_math_env/uv.lockonly: gradio 6.9.0 → 6.15.0, with gradio-client 2.3.0 → 2.5.0 and a new transitivehf-gradio0.4.1. Gradio’s declared deps dropaiofilesandffmpyfrom the lockfile as part of the new release’s dependency set.This is a routine Dependabot lock refresh for the math env; no application source in the diff. Upstream 6.15.0 includes security-related fixes (e.g. handlebars CVE, Hugging Face Space
/proxy=cookie isolation) and assorted UI/runtime fixes that may affect any Gradio/websurfaces if this env uses them.Reviewed by Cursor Bugbot for commit 7b34d3d. Bugbot is set up for automated code reviews on this repo. Configure here.