Repository navigation
chore(deps): bump gradio from 6.12.0 to 6.16.0 in /envs/reasoning_gym_env - #1317
Conversation
Bumps [gradio](https://github.com/gradio-app/gradio) from 6.12.0 to 6.16.0. - [Release notes](https://github.com/gradio-app/gradio/releases) - [Changelog](https://github.com/gradio-app/gradio/blob/main/CHANGELOG.md) - [Commits](https://github.com/gradio-app/gradio/compare/gradio@6.12.0...gradio@6.16.0) --- updated-dependencies: - dependency-name: gradio dependency-version: 6.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Automated Checks
- Lint: N/A —
uvis not installed in this review sandbox, sobash .claude/hooks/lint.shcould not execute. Not a blocker: the diff touches onlyenvs/reasoning_gym_env/uv.lock, a generated lockfile that isn't subject tousort/ruffformatting. - Debug code: CLEAN for this diff —
check-debug.shflags pre-existingprint()/TODOoccurrences elsewhere insrc/(e.g.test_local_docker_provider.py,mcp_client.py), but none of those files are part of this PR's changes.
Change Summary
This is a Dependabot lockfile-only update: envs/reasoning_gym_env/uv.lock bumps gradio 6.12.0 → 6.16.0 and gradio-client 2.4.1 → 2.5.0 (12 lines changed, hashes/URLs only). gradio is not a direct dependency of reasoning_gym_env's pyproject.toml — it's pulled in transitively through openenv core (used for the optional debug web interface gated by ENABLE_WEB_INTERFACE). No application code, pyproject.toml, Dockerfile, or openenv.yaml is touched.
Open RFCs Context
Scanned all RFCs in rfcs/ (000–012, several Draft/In Review). None reference gradio, dependency pinning, or the reasoning_gym environment specifically, so there's no active design discussion this bump could preempt or conflict with.
Tier 1: Fixes Required
None — no source files changed, nothing to lint or fix.
Tier 2: Alignment Discussion
Principle Conflicts
None identified. This doesn't touch the Gym-like API, MCP boundary, reward computation, or client/server separation (INVARIANTS.md), nor any of the core principles in PRINCIPLES.md.
RFC Conflicts
None identified.
Summary
- 0 mechanical issues to fix
- 0 alignment points for human review
- 0 RFC conflicts to discuss
This is a low-risk, mechanical dependency bump safe to merge once CI passes.
Sent by Cursor Automation: Pre-review
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
Co-authored-by: benjamin.burtenshaw <benjamin.burtenshaw@huggingface.co>
Bumps gradio from 6.12.0 to 6.16.0.
Changelog
Sourced from gradio's changelog.
... (truncated)
Commits
99ca159chore: update versions (#13432)05d2fd4gr.Dropdown()Fixes (#13451)0486d96Fix runtime language switching not re-translating component props, and other ...f9aed6ddocs: upgrade MiniMax demo to M3 (#13462)a11359dFix another ssr server startup race condition (#13458)fb3b812Show a landing page for browser GET requests to the MCP endpoint (#13459)397e39bFix various typos found by codespell (#13440)f29d16afix: SSRF in Image/Gallery SVG and Audio postprocessing (GHSA-3xvj-7669-6whx)...c029722ci: upgrade Playwright to 1.60 (#13457)e71c760ci: shorten Playwright install timeout (#13455)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Lockfile-only resolution change with no source edits; main risk is indirect runtime/UI behavior if Gradio is used transitively when the env is rebuilt.
Overview
Updates
envs/reasoning_gym_env/uv.lockso the resolvedgradiopackage moves from 6.12.0 → 6.16.0 and its companiongradio-clientfrom 2.4.1 → 2.5.0 (new PyPI URLs/hashes only). There are no application or dependency manifest edits in this PR—only the pinned versions used when installing that environment.The newer Gradio line includes several security and stability fixes (e.g. path traversal in
FileExplorer, OAuth redirect handling, SSRF guards for media postprocessing) plus minor UX/runtime tweaks; anything in this env that transitively depends on Gradio will pick those up on the nextuv sync/install.Reviewed by Cursor Bugbot for commit bce7022. Bugbot is set up for automated code reviews on this repo. Configure here.