chore(deps): bump gradio from 6.14.0 to 6.15.1 in /envs/openspiel_env#970
chore(deps): bump gradio from 6.14.0 to 6.15.1 in /envs/openspiel_env#970dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [gradio](https://github.com/gradio-app/gradio) from 6.14.0 to 6.15.1. - [Release notes](https://github.com/gradio-app/gradio/releases) - [Changelog](https://github.com/gradio-app/gradio/blob/main/CHANGELOG.md) - [Commits](https://github.com/gradio-app/gradio/compare/gradio@6.14.0...gradio@6.15.1) --- updated-dependencies: - dependency-name: gradio dependency-version: 6.15.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Automated two-tier review of this Dependabot bump: gradio 6.14.0 → 6.15.1 in envs/openspiel_env (transitive dependency, lock-file only).
Automated Checks
- Lint (
.claude/hooks/lint.sh): exits non-zero, but not due to this PR. All ~20 reformat candidates are pre-existing.pyfiles in other envs (chat_env,opencode_env,coding_tools_env,jupyter_env,repl_env,terminus_env,textarena_env,agent_world_model_env). This PR changes onlyenvs/openspiel_env/uv.lock, and.lock/TOML files aren't linted at all — no lint issue is attributable to this change. - Debug code (
.claude/hooks/check-debug.sh): CLEAN for this PR. Hook findings are all pre-existingprint/TODO insrc/; this PR touches nosrc/files. - Lockfile consistency:
uv lock --check --project envs/openspiel_envPASSED (121 packages resolved). - Hash/version verification (PyPI, 2026-07-15): sdist
58be31…5851(size 36429761) and wheelf4f504…f39f(size 20093799) both match the lock exactly;requires_python >=3.10(env requires>=3.10); not yanked.
Footprint (verified — born-clean, no side effects)
- Package delta: 119 → 119 packages, 0 added / 0 removed; only
gradioversion-changed. gradio-clientalready2.5.0at base and head (gradio 6.15.1 pinsgradio-client==2.5.0) — no companion change.- No index-source flip (0
registries.huggingface.tech, 126pypi.org/simpleat both base and head). - No lock
revisionbump (revision = 3at both ends). - No
requires-distre-sync — gradio is transitive (openspiel_env/pyproject.tomlpins onlyopenenv>=0.2.2; gradio arrives via openenv core'sgradio>=4.0.0, which6.15.1satisfies), so lock-only is correct and nopyproject.tomledit is expected.
Security (net positive)
gradio 6.14.0 carried three advisories; 6.15.1 clears two:
- CVE-2026-48545 / GHSA-7hp7-4p35-3cx2 — fixed in 6.15.0 ✅ cleared
- CVE-2026-10783 — fixed in 6.15.1 ✅ cleared
- CVE-2026-49119 (path traversal in
FileExplorer.preprocess()) —⚠️ still present, fixed only in 6.16.0. Low risk here: gradio is the optional debug web UI (off unlessENABLE_WEB_INTERFACE=true) and openspiel_env doesn't expose aFileExplorer. A follow-up bump to>=6.16.0would clear it fleet-wide (cc @burtenshaw).
Consistent with the just-merged sibling bumps #967 (sumo_rl_env) and #968 (textarena_env), which also moved gradio to 6.15.1.
Open RFCs Context
000–003 & 005 In Review, 010 Draft, 004 (no status header). None govern packaging / dependency management / PyPI, so there is no RFC surface for a dependency bump.
Tier 1: Fixes Required
None. No mechanical issues are introduced by this PR.
Tier 2: Alignment Discussion
Principle Conflicts: None identified. A transitive lock-only bump touches no API surface (Gym reset/step/state), MCP boundary, reward computation, client-server separation, or Pydantic wire types.
RFC Conflicts: None identified.
Process note (informational, non-blocking):
ALIGNMENT FLAG: Native Dependabot uv PR targets an excluded path
- Config at stake:
.github/dependabot.yml— theuvupdater isdirectory: "/"withexclude-paths: ["envs/**"] - The concern:
exclude-pathsshould prevent nativedependabot/uv/envs/**PRs, yet this PR (dependabot/uv/envs/openspiel_env/gradio-6.15.1) modifiesenvs/openspiel_env/uv.lock. Theuvecosystem doesn't appear to honorexclude-paths(the aggregatecodex/dependabot-envs-*roll-ups are the intended path for env-lock bumps). Worth confirming the intended flow so env-lock updates aren't split across two mechanisms. This is a repo-config observation, not a defect in this PR's diff. - Suggested reviewer: @burtenshaw (authored
.github/dependabot.yml, incl. theexclude-pathsscoping)
Summary
- 0 mechanical issues to fix (Tier 1)
- 1 alignment point for human review (Tier 2 — Dependabot process note, non-blocking)
- 0 RFC conflicts
The change is correct, minimal, internally consistent, and a net security improvement. No code changes required.
Sent by Cursor Automation: Pre-review
| [[package]] | ||
| name = "gradio" | ||
| version = "6.14.0" | ||
| version = "6.15.1" |
There was a problem hiding this comment.
Transitive bump: openspiel_env/pyproject.toml pins only openenv>=0.2.2, and gradio arrives via openenv core's gradio>=4.0.0 (which 6.15.1 satisfies) — so lock-only is correct and no pyproject.toml floor edit is expected.
Verified this is a born-clean, single-package delta: 119 → 119 packages (0 added/removed), gradio-client already 2.5.0, no index-source flip, no revision bump. uv lock --check --project envs/openspiel_env passes.
Security net-positive: clears CVE-2026-48545 (fixed 6.15.0) and CVE-2026-10783 (fixed 6.15.1). CVE-2026-49119 (FileExplorer path traversal) remains until 6.16.0.
| sdist = { url = "https://files.pythonhosted.org/packages/b9/7a/edc719d67beea0963721a7f552604faa0feaf218d4a51c6e0dacfb51ba6a/gradio-6.15.1.tar.gz", hash = "sha256:58be31be7b3aab53bbe61f21c20666b4a8a25a6737c399e02b7463d669625851", size = 36429761, upload-time = "2026-05-27T13:20:35.232Z" } | ||
| wheels = [ | ||
| { url = "https://files.pythonhosted.org/packages/7e/e2/41f991b2e212b7afda3a9927676ebf8af302e5a2c632b330bd70bf2cf2c1/gradio-6.14.0-py3-none-any.whl", hash = "sha256:bb702f5ab643510d167bae54269ad6e985c2185174d388fe542cc5957f51f4fd", size = 19687959, upload-time = "2026-04-30T16:50:26.914Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/00/87/b6d08b4b0a5bf7bb219c4c44d1d267ce6dfbc1ff062ca05ce251a50d18a5/gradio-6.15.1-py3-none-any.whl", hash = "sha256:f4f50488f8da1137b8e0d65fe656348b11bac3cd2f5ccab60636eb45e5a6f39f", size = 20093799, upload-time = "2026-05-27T13:20:31.18Z" }, |
There was a problem hiding this comment.
Wheel hash verified against PyPI (2026-07-15): sha256:f4f50488…a6f39f, size 20093799 — matches. The sdist on L829 (sha256:58be31be…625851, size 36429761) also matches; requires_python >=3.10 (env requires >=3.10); neither artifact is yanked.
|
Folded this env-only Dependabot update into aggregate PR #921. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps gradio from 6.14.0 to 6.15.1.
Changelog
Sourced from gradio's changelog.
Commits
e3a20f8chore: update versions (#13419)14ccbf1Ssr node port (#13424)270c12afix(dataframe): handle empty and 1d auto datatype values (#13391)c889673test: regression coverage for from_config proxy_url SSRF guard (GHSA-jmh7-g25...1c609afFix audio cache keys to include metadata (#13394)0528c2cchore: update versions (#13352)6a0b417Stabilize image editor examples test (#13418)51497aedocs: add MiniMax example to ChatInterface providers guide (#13411)9acecd2Warn when gr.Tabs() has non-Tab direct children (#9832) (#13383)6b0c8afMarkdown link fix (#13408)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only dependency bump with no local code changes; upstream includes security fixes, which lowers risk versus staying on 6.14.0.
Overview
Updates
gradioinenvs/openspiel_env/uv.lockfrom 6.14.0 to 6.15.1 (sdist/wheel URLs and hashes only). No repo application code changes.The pinned release pulls in upstream fixes and hardening (e.g. SSRF/
proxy_urlguards, cookie isolation for/proxy=requests, handlebars CVE-2026-33937), plus minor UI/runtime fixes (dataframe empty/1d values, SSR Node proxy timing, audio cache keys).Reviewed by Cursor Bugbot for commit 34e6907. Bugbot is set up for automated code reviews on this repo. Configure here.