Repository navigation
chore(deps): bump tornado from 6.5.8 to 6.5.9 in /envs/coding_env - #1286
Conversation
Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.8 to 6.5.9. - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.8...v6.5.9) --- updated-dependencies: - dependency-name: tornado dependency-version: 6.5.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
This PR is too large for Bugbot to review. It changes 402 lines and 237,331 characters. Split the change into smaller pull requests to get a review. |
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Scope
This PR is a Dependabot lockfile-only bump: the single changed file is envs/coding_env/uv.lock, upgrading the transitive dependency tornado 6.5.8 → 6.5.9 (pulled in via ipykernel/jupyter_client, used by the dev extra). pyproject.toml is unchanged, and no Python/source files are touched.
Automated Checks
- Lint: N/A —
uvis not available in this review sandbox, but it's moot regardless:lint.shonly scanssrc/,tests/, andenvs/Python files, and this PR touches zero Python files. - Debug code: CLEAN —
check-debug.shfound only pre-existingprint()/TODOoccurrences insrc/openenv/...unrelated to this diff (none introduced here).
Open RFCs Context
Scanned rfcs/000 through rfcs/012. None concern dependency pinning, lockfiles, or the coding_env's dev tooling, so no open RFC (Draft/In Review) is relevant to this change.
Note on the lockfile diff noise
Besides the tornado version bump itself, the diff flips the source.registry for 157 unrelated packages from https://pypi.registries.huggingface.tech/ (the internal HF mirror used when regenerating this lockfile in-house) to https://pypi.org/simple (Dependabot's sandbox has no access to that mirror, so uv lock falls back to the public index). This is expected churn, not a new behavior: the identical pattern occurred in the previously-merged tornado bump (3949b0a4), and main is subsequently re-normalized back to the HF mirror by a later internal run. No action needed here.
Tier 1: Fixes Required
None. No lint, debug, type, or security issues — there's no application code in this diff.
Tier 2: Alignment Discussion
Principle Conflicts
None identified. This is a transitive dev-dependency patch bump; it doesn't touch the Gymnasium-style API, client/server boundary, reward placement, or any other item in PRINCIPLES.md/INVARIANTS.md.
RFC Conflicts
None identified. No open RFC covers dependency management or this environment's dev tooling.
Summary
- 0 mechanical issues to fix
- 0 alignment points for human review
- 0 RFC conflicts to discuss
This is a routine, low-risk patch-version bump safe to merge on its own merits (pending normal CI).
Sent by Cursor Automation: Pre-review
Co-authored-by: benjamin.burtenshaw <benjamin.burtenshaw@huggingface.co>
Bumps tornado from 6.5.8 to 6.5.9.
Changelog
Sourced from tornado's changelog.
... (truncated)
Commits
75ef8b1Merge pull request #3719 from bdarnell/fixes-6593590cb4test: Hardcode SimpleAsyncHTTPClient in HTTP1xxLimitTestCase9fc5d6dtest: Make tracemalloc optional in httpclient_test555a2eeiostream: Treat connection resets as a clean close in read_until_close3ba622fRelease notes and version bump for 6.5.941eea68test: Fix some test issues only found by our custom tox configab1a778Merge remote-tracking branch 'bdarnell/claude/asynchttpclient-streaming-memor...437ab5fweb: Do not follow symlinks out of the static directory0394513httputil: Apply the argument count limit to query stringsb798f83http1connection: Return after reading the response that follows a 1xxDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only patch bump with no repo code changes; tornado is not a direct runtime dependency of the coding env server.
Overview
Bumps the locked tornado dependency from 6.5.8 to 6.5.9 in
envs/coding_env/uv.lock. There are no changes to application code orpyproject.toml; tornado remains a transitive dependency (e.g. via optional dev stackipykernel/jupyter-client).The new release is a patch-level upstream update that includes hardening around static file serving, query-string parsing, HTTP 1xx handling, and related client/stream behavior.
Reviewed by Cursor Bugbot for commit 69eea89. Bugbot is set up for automated code reviews on this repo. Configure here.