Bump tornado from 6.5.7 to 6.5.8 in /python - #14357
Conversation
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: No findings
Scope: full PR (1 commit(s)): b5031caf41ed
Model: claude-opus-4.8
Overview
This is a lockfile-only change (python/uv.lock) that bumps the transitive
dependency tornado 6.5.7 -> 6.5.8 (an upstream security/maintenance release) and,
as a side effect of regeneration by a newer uv, strips a tautological
sys_platform == 'darwin' or 'linux' or 'win32' marker from 754 dependency
entries. The change is verifiably safe: uv lock --check resolves the lock
cleanly against the unchanged pyproject.toml, the full package universe is
byte-for-byte identical at 328 packages except the single tornado version, all
nine tornado wheel hashes plus the sdist match PyPI exactly, and no source
registry or hash pin was weakened. The only residual concerns are Low-priority
tooling/reproducibility and review-hygiene items (the marker churn is unrelated
to the tornado bump and is not reproducible under the CI-pinned uv 0.5.x), none
of which is a functional defect.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.
Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.7 to 6.5.8. - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.7...v6.5.8) --- updated-dependencies: - dependency-name: tornado dependency-version: 6.5.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
b5031ca to
ad0acb7
Compare
|
Looks like tornado is up-to-date now, so this is no longer needed. |
|
Superseded by #14385 |
### Motivation and Context Consolidates the currently open Dependabot updates into one reviewable dependency PR while preserving each source update's intent across GitHub Actions, .NET, Python, and JavaScript sample dependencies. ### Description Updates pinned GitHub Actions, central NuGet package versions, Python dependency constraints and uv lockfiles, and npm/Yarn lockfiles for the affected samples. Overlapping lockfile updates were regenerated or reconciled so that all compatible requested versions are retained together on the latest `main`. The incompatible MCP 2.x and Python 3.10 `onnxruntime-genai` updates are excluded, the private-feed-only `@humanfs/node` update is omitted, and the logging abstractions floor is aligned with the updated Azure AI Projects dependency. ### Related Issue Supersedes: - microsoft#14177 - microsoft#14179 - microsoft#14180 - microsoft#14190 - microsoft#14209 - microsoft#14230 - microsoft#14233 - microsoft#14254 - microsoft#14257 - microsoft#14259 - microsoft#14260 - microsoft#14261 - microsoft#14271 - microsoft#14272 - microsoft#14273 - microsoft#14274 - microsoft#14276 - microsoft#14280 - microsoft#14282 - microsoft#14299 - microsoft#14300 - microsoft#14335 - microsoft#14337 - microsoft#14338 - microsoft#14339 - microsoft#14357 - microsoft#14358 - microsoft#14361 - microsoft#14365 - microsoft#14366 - microsoft#14367 - microsoft#14368 - microsoft#14369 ### Contribution Checklist - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [ ] I didn't break anyone 😄 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: rogerbarreto <19890735+rogerbarreto@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d3c2550f-f129-4660-9461-af1288241064
Bumps tornado from 6.5.7 to 6.5.8.
Changelog
Sourced from tornado's changelog.
... (truncated)
Commits
a55abe3Merge pull request #3704 from bdarnell/security-6.5.8fc79488docs: add additional credit to release notes7b01763Fix test_strip_headers_on_redirect's URL-embedded-credentials casesd72fff8release notes and version bump for 6.5.8b168818auth: Formally deprecated OpenIDMixinda28476web: Also check for semicolons in deprecated mixed-case cookie args8d6363ehttputil: Enforce a new limit on the number of arguments in a requestde85b3fhttputil: Apply multipart max_parts limit earlier