chore(deps): bump gradio from 6.12.0 to 6.15.1 in /envs/textarena_env#968
Conversation
Bumps [gradio](https://github.com/gradio-app/gradio) from 6.12.0 to 6.15.1. - [Release notes](https://github.com/gradio-app/gradio/releases) - [Changelog](https://github.com/gradio-app/gradio/blob/main/CHANGELOG.md) - [Commits](https://github.com/gradio-app/gradio/compare/gradio@6.12.0...gradio@6.15.1) --- updated-dependencies: - dependency-name: gradio dependency-version: 6.15.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
dependabot/uv/envs/textarena_env/gradio-6.15.1 — bumps gradio 6.12.0 → 6.15.1 in envs/textarena_env. Clean, well-formed direct-dep bump carrying the recurring HF-mirror→PyPI index-flip side effect. Not blocking.
Automated Checks
- Lint: PASS (for this diff).
bash .claude/hooks/lint.shexits 1, but only on ~20 pre-existing unformattedenvs/**files. This PR changes onlypyproject.toml+uv.lock— neither is linted (ruff/usort touch.pyonly; CI's lint job issrc/+tests/scoped).envs/textarena_env/server/gradio_ui.pyappears in the failing list but is not touched by this PR (pre-existing). - Debug code: CLEAN (for this diff).
check-debug.shscanssrc/only; all hits are pre-existingsrc/files and this PR touches no.py.
Open RFCs Context
No RFC covers dependency management / packaging / the PyPI index source. RFCs 000–005 are In Review and 010 is Draft; none touch this area. No RFC conflicts.
Tier 1: Fixes Required
None. Verified:
uv lock --check --project envs/textarena_env→ PASS (126 packages resolved); lock is internally consistent withpyproject.toml.- Direct-dep floor bump is correct:
gradio>=4.0.0→>=6.15.1inpyproject.tomland the matchingrequires-distin the lock; resolvedgradio 6.15.1satisfies the new floor. - All four artifact hashes match PyPI exactly and are not yanked: gradio 6.15.1 (wheel
f4f5048…, sdist58be31b…), gradio-client 2.5.0 (wheeld43e217…, sdist4cde99b…).requires_python >=3.10for both, satisfied by the env'srequires-python >=3.10. - Minimal footprint: 124 → 124 packages (0 added / removed); only
gradio(6.12.0→6.15.1) andgradio-client(2.4.1→2.5.0) change version, and the only artifact hashes that move are those two (all otherfiles.pythonhosted.orglines are byte-identical).
Tier 2: Alignment Discussion
Principle Conflicts
ALIGNMENT FLAG: Re-lock silently flips index source from the HF mirror to public PyPI
- Principle at stake: PRINCIPLES.md L15 — "Container isolation for reproducibility and security"
- The concern: Beyond the named gradio bump, this re-lock rewrites all 131
source = { registry = "https://pypi.registries.huggingface.tech/" }entries tohttps://pypi.org/simple(0 mirror refs remain) and bumpsrevision = 2→3. Artifact URLs stay onfiles.pythonhosted.organd every non-gradio hash is byte-identical, so it is very likely benign — but it changes the declared provenance/index of every package in this env and widens the cross-env split (some env locks still pin the mirror). Registry choice is a team decision, so flagging rather than fixing. (revision = 3also requires the deploy base image'suvto support revision 3.) - Suggested reviewers: @Darktex, @burtenshaw
RFC Conflicts
None identified.
Notes (non-blocking)
- Process mismatch (cc @burtenshaw):
.github/dependabot.yml'suvupdater setsdirectory: "/"+exclude-paths: ["envs/**"](authored by @burtenshaw), yet this nativedependabot/uv/envs/textarena_env/…PR still editsenvs/textarena_env/**.exclude-pathsis a supported key, so theuvecosystem doesn't appear to honor it here. The aggregatecodex/dependabot-envs-*roll-ups remain the intended path for env locks. - Security posture (positive, with a caveat): old gradio 6.12.0 carried CVE-2026-48545 (fixed 6.15.0) and CVE-2026-10783 (fixed 6.15.1) — both cleared by this bump. However 6.15.1 still carries CVE-2026-49119 (PYSEC-2026-2179), fixed only in 6.16.0, so the
>=6.15.1floor doesn't fully clear gradio; a later bump to>=6.16.0would.
Summary
- 0 mechanical issues to fix
- 1 alignment point for human review (index-source flip)
- 0 RFC conflicts to discuss
Sent by Cursor Automation: Pre-review
| "nltk>=3.9.3", | ||
| # For custom Gradio tab (server/gradio_ui.py) when ENABLE_WEB_INTERFACE=true | ||
| "gradio>=4.0.0", | ||
| "gradio>=6.15.1", |
There was a problem hiding this comment.
Direct-dep floor bump is correct — gradio is a real dependency here (server/gradio_ui.py, the ENABLE_WEB_INTERFACE tab). dependabot also synced the matching requires-dist in uv.lock (line 1655), and the resolved gradio 6.15.1 satisfies >=6.15.1; uv lock --check passes (126 pkgs).
Raising the floor from >=4.0.0 is well justified on security grounds: it clears CVE-2026-48545 (fixed 6.15.0) and CVE-2026-10783 (fixed 6.15.1). Non-blocking FYI: 6.15.1 still carries CVE-2026-49119 (fixed only in 6.16.0), so this floor isn't fully clean — a later bump to >=6.16.0 would close it.
| @@ -1,5 +1,5 @@ | |||
| version = 1 | |||
| revision = 2 | |||
| revision = 3 | |||
There was a problem hiding this comment.
Tier 2 (reproducibility, PRINCIPLES.md L15): this re-lock also flips every package's index from the HF mirror (pypi.registries.huggingface.tech) to public PyPI (pypi.org/simple) — 131 → 0 mirror refs — and bumps revision 2→3. Artifact URLs stay on files.pythonhosted.org and all non-gradio hashes are unchanged, so likely benign, but it silently changes declared provenance for the whole env and widens the cross-env split. Registry choice is a team call → flagging, not fixing. revision = 3 also requires the deploy base image's uv to support it. cc @Darktex @burtenshaw
| name = "gradio" | ||
| version = "6.12.0" | ||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | ||
| version = "6.15.1" |
There was a problem hiding this comment.
gradio 6.12.0 → 6.15.1 verified against PyPI: wheel f4f5048… (20,093,799 B), sdist 58be31b… (36,429,761 B); not yanked; requires_python >=3.10. gradio-client moves 2.4.1 → 2.5.0 in lockstep (its pinned companion; wheel d43e217…, sdist 4cde99b…). Package footprint is minimal — 124→124 pkgs, 0 added/removed, only these two change version.
|
Aggregated into #921 ( |
1 participant
Bumps gradio from 6.12.0 to 6.15.1.
Changelog
Sourced from gradio's changelog.
... (truncated)
Commits
e3a20f8chore: update versions (#13419)14ccbf1Ssr node port (#13424)270c12afix(dataframe): handle empty and 1d auto datatype values (#13391)c889673test: regression coverage for from_config proxy_url SSRF guard (GHSA-jmh7-g25...1c609afFix audio cache keys to include metadata (#13394)0528c2cchore: update versions (#13352)6a0b417Stabilize image editor examples test (#13418)51497aedocs: add MiniMax example to ChatInterface providers guide (#13411)9acecd2Warn when gr.Tabs() has non-Tab direct children (#9832) (#13383)6b0c8afMarkdown link fix (#13408)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Dependency-only change but bumps a large UI stack used when the web interface is enabled; verify Gradio tabs locally after lock refresh, especially if you rely on HF’s private PyPI mirror elsewhere.
Overview
Raises the Gradio floor in
envs/textarena_envfrom>=4.0.0to>=6.15.1and refreshesuv.lockso the resolved stack is Gradio 6.15.1 (from 6.12.0) and gradio-client 2.5.0 (from 2.4.1).The lockfile also switches package
sourceregistries from the Hugging Face PyPI mirror topypi.org/simpleacross the environment’s dependency tree—no Python source changes, only packaging pins.This matters for the optional
ENABLE_WEB_INTERFACEpath (server/gradio_ui.py/ OpenEnvgradio_buildertab). The 6.12→6.15 line includes security and proxy/SSR fixes (e.g.Blocks.from_configproxy URL guard, cookie isolation on/proxy=requests, handlebars CVE) plus minor UI/runtime fixes.Reviewed by Cursor Bugbot for commit 8c96574. Bugbot is set up for automated code reviews on this repo. Configure here.