Bump tornado from 6.5.5 to 6.5.6#179
Conversation
Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.6. - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.5...v6.5.6) --- updated-dependencies: - dependency-name: tornado dependency-version: 6.5.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedCVE-2025-3000 affects A fix requires the upstream PyTorch maintainers to release a new version that addresses this CVE. Once a patched release is published to PyPI, aieng-bot can re-run and apply the update automatically. Note on this PRThis PR itself (bumping tornado from 6.5.5 to 6.5.6) is a valid security fix and the change is correct. The torch CVE is a pre-existing issue that blocks CI on this branch, unrelated to the tornado bump. Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability is in Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
|
Superseded by #182. |
1 participant
Bumps tornado from 6.5.5 to 6.5.6.
Changelog
Sourced from tornado's changelog.
... (truncated)
Commits
aba2569Merge pull request #3626 from bdarnell/fixes-656a24b260httpclient_test: Accept an additional error message varianta74240aRelease notes and version bump for 6.5.6.e8fc7edsimple_httpclient: Strip auth headers on cross-origin redirects96dc88cspeedups: validate mask lengthff808b3http1connection: Enforce max_body_size in _GzipMessageDelegateede4e37auth: Correctly parse check_authentication response1c178beRemove obsolete curl force_timeout workaroundc99d55bReplace deprecated pycurl IOCTLFUNCTION callback with SEEKFUNCTION2761431Merge pull request #3587 from bdarnell/fix-linkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.