chore(deps): bump gradio from 6.12.0 to 6.15.1 in /envs/sumo_rl_env#967
Conversation
Bumps [gradio](https://github.com/gradio-app/gradio) from 6.12.0 to 6.15.1. - [Release notes](https://github.com/gradio-app/gradio/releases) - [Changelog](https://github.com/gradio-app/gradio/blob/main/CHANGELOG.md) - [Commits](https://github.com/gradio-app/gradio/compare/gradio@6.12.0...gradio@6.15.1) --- updated-dependencies: - dependency-name: gradio dependency-version: 6.15.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
PR #967 — chore(deps): bump gradio from 6.12.0 to 6.15.1 in /envs/sumo_rl_env (native dependabot, branch dependabot/uv/envs/sumo_rl_env/gradio-6.15.1).
Automated Checks
- Lint: PASS (for this PR's scope).
lint.shexits non-zero only on ~20 pre-existing unformatted files in other envs (agent_world_model_env,chat_env,coding_tools_env,jupyter_env,opencode_env,repl_env,terminus_env,textarena_env) — none issumo_rl_env, and this PR only touchesuv.lock(TOML, not linted by ruff/usort). - Debug code: CLEAN (for this PR's scope).
check-debug.shscanssrc/only; all hits are pre-existing (cli/commands/build.py,cli/__main__.py,cli/commands/serve.py,containers/test_local_docker_provider.py). The diff is lockfile-only.
Open RFCs Context
000/001/002/003/005 In Review, 010 Draft, 004 no Status header. None governs Python packaging, dependency-version management, or the PyPI index source (RFC 002's "Dependency Management" is Docker-Compose sim/prod orchestration). No RFC conflict for a dependency lock bump.
Change summary (verified)
Transitive bump — sumo_rl_env/pyproject.toml pins no gradio (only openenv>=0.2.2; gradio arrives via the optional core web UI), so a lock-only change with no pyproject edit is correct. Package delta is minimal and clean (124 → 124 packages, 0 added/removed):
gradio6.12.0 → 6.15.1gradio-client2.4.1 → 2.5.0 (lockstep — gradio 6.15.1 pinsgradio-client==2.5.0)
Verified: version + sdist + wheel updated for both; hashes match live PyPI; requires_python >=3.10 (env is >=3.10); not yanked; uv lock --check --project envs/sumo_rl_env passes. hf-gradio already present and aiofiles/ffmpy already dropped at base (the 6.9→6.12 reshuffle predates this PR).
Security — net positive: 6.12.0 → 6.15.1 clears GHSA-6655-8ph2-63j3 (fixed exactly in 6.15.1) plus GHSA-7hp7-4p35-3cx2 and PYSEC-2026-2178 (both fixed in 6.15.0).
FYI (non-blocking): 6.15.1 still carries CVE-2026-49119 (FileExplorer preprocess() path traversal), fixed only in 6.16.0 — a follow-up bump to >=6.16.0 would clear it. Low risk here since gradio is only the optional debug web UI.
Tier 1: Fixes Required
None.
Tier 2: Alignment Discussion
Principle Conflicts
ALIGNMENT FLAG: Index-source flip from the internal HF mirror to public PyPI
- Principle at stake: Reproducibility / provenance (PRINCIPLES.md — "Container isolation for reproducibility and security", L15)
- The concern: Alongside the gradio bump, dependabot rewrote the
sourceregistry of all 143 entries frompypi.registries.huggingface.tech→pypi.org/simpleand moved the lockrevision = 2 → 3. Artifact URLs stay onfiles.pythonhosted.orgwith unchanged hashes, so this is likely benign, but it silently changes declared provenance and widens the cross-env split between mirror- and PyPI-sourced locks. Registry choice is a team decision, so flagging rather than fixing (hand-reverting a dependabot lock isn't appropriate). - Suggested reviewer: @Darktex, @burtenshaw
RFC Conflicts
None identified.
Process note (non-blocking, cc @burtenshaw)
.github/dependabot.yml's uv updater declares directory: "/" + exclude-paths: ["envs/**"], yet this native dependabot/uv/envs/sumo_rl_env/… PR still edits envs/sumo_rl_env/uv.lock. The exclude-paths key isn't being honored for the uv ecosystem (root pyproject.toml has no [tool.uv.workspace]). The codex/dependabot-envs-* aggregate roll-ups are the intended path for env locks. Not a code issue — a config/process observation.
Summary
- 0 mechanical issues to fix
- 1 alignment point for human review (index-source flip → @Darktex / @burtenshaw), plus 1 dependabot-config process note (@burtenshaw)
- 0 RFC conflicts
Sent by Cursor Automation: Pre-review
| @@ -1,5 +1,5 @@ | |||
| version = 1 | |||
| revision = 2 | |||
| revision = 3 | |||
There was a problem hiding this comment.
Tier 2 (reproducibility) — index-source flip + lock revision bump. Beyond the gradio bump, this PR rewrote the source registry of all 143 packages from pypi.registries.huggingface.tech → pypi.org/simple and moved revision = 2 → 3 (accounts for the 150/150 line churn). Artifact URLs stay on files.pythonhosted.org with unchanged hashes, so it's likely benign, but it changes declared provenance vs the internal mirror. Registry choice is a team call — flagging, not fixing. cc @Darktex @burtenshaw
| name = "gradio" | ||
| version = "6.12.0" | ||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | ||
| version = "6.15.1" |
There was a problem hiding this comment.
gradio is transitive here (no pin in pyproject.toml; pulled via the optional core web UI), so a lock-only bump is correct. Verified live on PyPI: requires_python >=3.10, not yanked, sdist/wheel hashes match this lock. Security net-positive — clears GHSA-6655-8ph2-63j3 (fixed in 6.15.1) plus GHSA-7hp7-4p35-3cx2 / PYSEC-2026-2178 (fixed 6.15.0). FYI: 6.15.1 still carries CVE-2026-49119 (FileExplorer path traversal, fixed only in 6.16.0) — a later bump to >=6.16.0 would clear it.
| name = "gradio-client" | ||
| version = "2.4.1" | ||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | ||
| version = "2.5.0" |
There was a problem hiding this comment.
gradio-client moves in lockstep because gradio 6.15.1 requires gradio-client==2.5.0. Verified on PyPI: requires_python >=3.10, no known vulns, sdist/wheel hashes match the lock. uv lock --check --project envs/sumo_rl_env passes (internally consistent).
|
Aggregated into #921 ( |
1 participant
Bumps gradio from 6.12.0 to 6.15.1.
Changelog
Sourced from gradio's changelog.
... (truncated)
Commits
e3a20f8chore: update versions (#13419)14ccbf1Ssr node port (#13424)270c12afix(dataframe): handle empty and 1d auto datatype values (#13391)c889673test: regression coverage for from_config proxy_url SSRF guard (GHSA-jmh7-g25...1c609afFix audio cache keys to include metadata (#13394)0528c2cchore: update versions (#13352)6a0b417Stabilize image editor examples test (#13418)51497aedocs: add MiniMax example to ChatInterface providers guide (#13411)9acecd2Warn when gr.Tabs() has non-Tab direct children (#9832) (#13383)6b0c8afMarkdown link fix (#13408)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only dependency refresh with no runtime code changes; main review surface is verifying installs still resolve and that Gradio UI behavior via
openenvis acceptable on the new minor versions.Overview
Updates
envs/sumo_rl_env/uv.lockonly: lock revision 2 → 3, and re-resolves the environment so every locked package now points athttps://pypi.org/simpleinstead of the Hugging Face PyPI mirror.The substantive version bumps tied to this Dependabot PR are
gradio6.12.0 → 6.15.1 and its companiongradio-client2.4.1 → 2.5.0 (pulled in viaopenenv). No application or env source files change—only pinned artifacts and registry metadata in the lockfile.Reviewed by Cursor Bugbot for commit db4c74a. Bugbot is set up for automated code reviews on this repo. Configure here.