Repository navigation
chore(deps): bump tornado from 6.5.8 to 6.5.9 in /envs/wildfire_env - #1302
Conversation
Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.8 to 6.5.9. - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.8...v6.5.9) --- updated-dependencies: - dependency-name: tornado dependency-version: 6.5.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Automated Checks
- Lint: N/A —
uvis not available in this review environment to run.claude/hooks/lint.sh, but the diff is a pureuv.lockregeneration (no Python/source files touched), so there is nothing for ruff/usort to lint. - Debug code: CLEAN —
.claude/hooks/check-debug.shonly surfaces pre-existingconsole.print/TODO occurrences in unrelatedsrc/openenv/cli/files; none are introduced by this diff.
Scope of the change
This PR only regenerates envs/wildfire_env/uv.lock, bumping the transitive tornado dependency from 6.5.8 → 6.5.9 (13 lines changed, hash/version/url updates only). No application code, API surface, environment behavior, or env-to-core boundary is touched.
Open RFCs Context
Scanned rfcs/ (000–012, all Draft/In Review/Accepted/Implemented per their headers). None reference wildfire_env, Tornado, or dependency-management policy, so no open RFC is relevant to this change.
Tier 1: Fixes Required
None — no lint failures, no debug code, no uninitialized variables/type errors, no missing imports, and no credential/injection concerns in the diff.
Tier 2: Alignment Discussion
Principle Conflicts
None identified. This is a lockfile-only dependency bump confined to a single env's uv.lock; it does not touch rewards, the client/server boundary, the WebSocket/MCP dual-API boundary, or any Gymnasium-pattern API surface from PRINCIPLES.md/INVARIANTS.md.
RFC Conflicts
None identified. No open RFC covers wildfire_env's dependencies or Tornado.
Summary
- 0 mechanical issues to fix
- 0 alignment points for human review
- 0 RFC conflicts to discuss
This is a routine, low-risk dependency bump safe to merge once CI passes.
Sent by Cursor Automation: Pre-review
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
Co-authored-by: benjamin.burtenshaw <benjamin.burtenshaw@huggingface.co>
Bumps tornado from 6.5.8 to 6.5.9.
Changelog
Sourced from tornado's changelog.
... (truncated)
Commits
75ef8b1Merge pull request #3719 from bdarnell/fixes-6593590cb4test: Hardcode SimpleAsyncHTTPClient in HTTP1xxLimitTestCase9fc5d6dtest: Make tracemalloc optional in httpclient_test555a2eeiostream: Treat connection resets as a clean close in read_until_close3ba622fRelease notes and version bump for 6.5.941eea68test: Fix some test issues only found by our custom tox configab1a778Merge remote-tracking branch 'bdarnell/claude/asynchttpclient-streaming-memor...437ab5fweb: Do not follow symlinks out of the static directory0394513httputil: Apply the argument count limit to query stringsb798f83http1connection: Return after reading the response that follows a 1xxDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only patch upgrade of a transitive Jupyter dependency with no direct code changes in this repo.
Overview
Updates
tornadoinenvs/wildfire_env/uv.lockfrom 6.5.8 to 6.5.9. No application source orpyprojectchanges—only resolved package metadata and wheel hashes for the Jupyter-related transitive dependency.The bump is a patch release; upstream notes include HTTP client/1xx handling, query-string argument limits, static-file symlink hardening, and
read_until_closebehavior on connection reset.Reviewed by Cursor Bugbot for commit 54b9946. Bugbot is set up for automated code reviews on this repo. Configure here.