chore(deps): bump gradio from 6.10.0 to 6.15.0 in /envs/tbench2_env - #899
chore(deps): bump gradio from 6.10.0 to 6.15.0 in /envs/tbench2_env#899dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [gradio](https://github.com/gradio-app/gradio) from 6.10.0 to 6.15.0. - [Release notes](https://github.com/gradio-app/gradio/releases) - [Changelog](https://github.com/gradio-app/gradio/blob/main/CHANGELOG.md) - [Commits](https://github.com/gradio-app/gradio/compare/gradio@6.10.0...gradio@6.15.0) --- updated-dependencies: - dependency-name: gradio dependency-version: 6.15.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Scope: this PR touches a single file, envs/tbench2_env/uv.lock (+141/-161). gradio is a transitive dependency (via openenv's optional web UI) — it is not pinned in envs/tbench2_env/pyproject.toml — so a lock-only bump with no pyproject.toml edit is correct.
Automated Checks
- Lint: N/A (could not run) —
.claude/hooks/lint.shexits 1 becauseuvisn't installed in the review VM, and it only lints Python (src/,tests/,envs/). This diff is a TOML lockfile, so Python lint doesn't apply. I verified lockfile consistency manually and deferuv lock --checkto CI. - Debug code: CLEAN —
.claude/hooks/check-debug.shmatches are all pre-existing insrc/; none are in the changed lockfile.
Manual lock verification (Tier 1 substitute) — all live against PyPI
| Package | Change | sdist+wheel hash/size | requires-python | yanked | vulns |
|---|---|---|---|---|---|
| gradio | 6.10.0 → 6.15.0 | MATCH / MATCH | >=3.10 | no | 0 |
| gradio-client | 2.4.0 → 2.5.0 | MATCH / MATCH | >=3.10 | no | 0 |
| hf-gradio | 0.3.0 → 0.4.1 | MATCH / MATCH | >=3.10 | no | 0 |
| aiofiles | removed | n/a | — | — | — |
| ffmpy | removed | n/a | — | — | — |
- gradio 6.15.0's metadata explains and validates every transitive change: it now pins
gradio-client==2.5.0, requireshf-gradio<1.0,>=0.4.1(old 0.3.0 no longer satisfies this), and dropsaiofiles+ffmpyfrom its deps. So the two removals and two bumps are all required and consistent — not stray churn. - All 28 of gradio 6.15.0's runtime constraints are satisfied by the locked versions, and
requires-python >=3.10matches the env. - Lockfile
revisionbumped2 → 3(line 2). The env Dockerfile installs viauv sync --frozen, so the base image'suvmust understand lock revision 3 (should be fine on current base; noting for awareness). - This is a neutral maintenance bump, not a security fix (both 6.10.0 and 6.15.0 have no PyPI advisories).
Open RFCs Context
In Review: 000, 001, 002, 003, 005. Draft: 010. (004 has no Status header.) None cover dependency management / packaging / PyPI index selection → no RFC conflict for this change.
Tier 1: Fixes Required
None.
Tier 2: Alignment Discussion
Principle Conflicts
ALIGNMENT FLAG: Lockfile index provenance silently flipped from the internal HF mirror to public PyPI
- Principle at stake: PRINCIPLES.md — "Container isolation for reproducibility"
- The concern: Beyond the gradio bump, every remaining package's
sourceflippedhttps://pypi.registries.huggingface.tech/→https://pypi.org/simple(base: 133 on the mirror / 0 public; new: 0 on the mirror / 131 public — the 2 fewer are the droppedaiofiles/ffmpy). Artifact URLs (files.pythonhosted.org) and hashes are unchanged, so it's very likely benign, but it silently changes declared provenance and widens a cross-env split (other envs' lockfiles still declare the internal mirror). No committed config pins either index — it exists only insideuv.lockfiles. Worth a deliberate decision on the canonical index so all envs stay consistent. - Suggested reviewers: @Darktex (reproducibility principle author), @burtenshaw (dependabot/env tooling owner)
RFC Conflicts
None identified.
Process note (not a code issue)
.github/dependabot.yml configures the uv updater with directory: "/" and exclude-paths: ["envs/**"], yet this native dependabot/uv/envs/tbench2_env/... PR modifies envs/tbench2_env/uv.lock — the exclude-paths rule doesn't appear to take effect for native per-env PRs. (This is expected for the intended codex/dependabot-envs-* aggregate roll-ups, but this is a native PR.) cc @burtenshaw
Summary
- 0 mechanical issues to fix (lockfile internally consistent; all hashes, sizes, and constraints verified against PyPI)
- 1 alignment point for human review (index-provenance flip)
- 0 RFC conflicts
- +1 process note (dependabot
exclude-pathsvs. native env PR)
Sent by Cursor Automation: Pre-review
| name = "gradio" | ||
| version = "6.10.0" | ||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | ||
| version = "6.15.0" |
There was a problem hiding this comment.
Named bump verified against PyPI: gradio 6.10.0 → 6.15.0, sdist+wheel sha256 and sizes MATCH, requires-python >=3.10 (env is >=3.10), not yanked, no advisories. gradio 6.15.0 pins gradio-client==2.5.0, requires hf-gradio>=0.4.1, and drops aiofiles/ffmpy — which is exactly the rest of this diff, so the transitive bumps and removals are all required and consistent.
| name = "aiofile" | ||
| version = "3.9.0" | ||
| source = { registry = "https://pypi.registries.huggingface.tech/" } | ||
| source = { registry = "https://pypi.org/simple" } |
There was a problem hiding this comment.
Tier 2 (discussion, not a blocker): this is the first of ~131 source lines that flip from the internal HF mirror (pypi.registries.huggingface.tech) to public PyPI (pypi.org/simple) across the whole file — a side effect bundled with the gradio bump. Download URLs (files.pythonhosted.org) and hashes are unchanged, so it's likely benign, but declared provenance changes silently and other envs still point at the mirror. Suggest a deliberate team decision on the canonical index (cc @Darktex / @burtenshaw).
|
Superseded by aggregate maintainer PR #902. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps gradio from 6.10.0 to 6.15.0.
Release notes
Sourced from gradio's releases.
Changelog
Sourced from gradio's changelog.
... (truncated)
Commits
0528c2cchore: update versions (#13352)6a0b417Stabilize image editor examples test (#13418)51497aedocs: add MiniMax example to ChatInterface providers guide (#13411)9acecd2Warn when gr.Tabs() has non-Tab direct children (#9832) (#13383)6b0c8afMarkdown link fix (#13408)df56862[js-client] close submit iterator on next/close race (#13403)1cbeb4fCi previews cdn (#13410)0fbdc49JS client cdn preview (#13409)14c8870Add UploadButton unit tests (#13336)10f43e0Offload traffic to static workers and use node as the proxy (#13366)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Gradio is a major UI/runtime dependency for this env; 6.10→6.15 can change behavior or APIs, though the bump includes security fixes (e.g. proxy cookie isolation, handlebars CVE). Lockfile-only change limits blast radius to install/reproducibility.
Overview
Updates
envs/tbench2_env/uv.lockso the resolved Gradio stack moves from 6.10.0 to 6.15.0, withgradio-client2.4.0→2.5.0 andhf-gradio0.3.0→0.4.1. Gradio’s declared dependencies no longer pullaiofilesorffmpyinto the lock.The lock refresh also points every package
sourceathttps://pypi.org/simpleinstead of the Hugging Face PyPI registry, and bumps the lockrevisionfrom 2 to 3. There are no application source changes—only the lockfile.Reviewed by Cursor Bugbot for commit 261ecb9. Bugbot is set up for automated code reviews on this repo. Configure here.