Bump tornado from 6.5.5 to 6.5.6 - #103
Conversation
Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.6. - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.5...v6.5.6) --- updated-dependencies: - dependency-name: tornado dependency-version: 6.5.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe pip-audit scan flagged This is a pre-existing vulnerability unrelated to the tornado bump in this PR. A fix requires the upstream PyTorch maintainers to release a patched version and update the advisory with a fixed version. Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved or explicitly ignored by a human reviewer. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in Recommended next steps
This PR (tornado bump from 6.5.5 → 6.5.6) itself is a valid security fix. The blocking pip-audit failure is unrelated to the tornado change and is caused by a pre-existing torch vulnerability with no upstream fix. Human review is required to proceed. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been recorded in the PyPI vulnerability database:
Why this cannot be auto-fixedpip-audit reports A fix requires the upstream PyTorch maintainers to release a patched version and for the PyPI vulnerability database to record it. Once that happens, aieng-bot can re-run and apply the update automatically. Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in Recommended next steps
Note on this PRThis PR (bumping tornado 6.5.5 → 6.5.6) is itself a valid security fix and is otherwise ready to merge. The torch vulnerability is a pre-existing issue unrelated to this PR's changes. This PR will not be auto-merged until the torch vulnerability is resolved or explicitly waived. |
|
Superseded by #106. |
1 participant
Bumps tornado from 6.5.5 to 6.5.6.
Changelog
Sourced from tornado's changelog.
... (truncated)
Commits
aba2569Merge pull request #3626 from bdarnell/fixes-656a24b260httpclient_test: Accept an additional error message varianta74240aRelease notes and version bump for 6.5.6.e8fc7edsimple_httpclient: Strip auth headers on cross-origin redirects96dc88cspeedups: validate mask lengthff808b3http1connection: Enforce max_body_size in _GzipMessageDelegateede4e37auth: Correctly parse check_authentication response1c178beRemove obsolete curl force_timeout workaroundc99d55bReplace deprecated pycurl IOCTLFUNCTION callback with SEEKFUNCTION2761431Merge pull request #3587 from bdarnell/fix-linkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.