Repository navigation
build(deps): bump tornado to 6.6 - #890
Open
spetznick-elia wants to merge 2 commits into
Open
spetznick-elia wants to merge 2 commits into
spetznick-elia wants to merge 2 commits into
Conversation
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are reported for the dependency and tooling updates.
No open issues 🎉
What changed in this PR
Consolidates the Tornado security updates from #881–#887 across ToOp’s root and six package environments. Tornado is a transitive dependency of the Jupyter development tooling; no application code changes are included.
Changes:
- Upgrade Tornado from 6.5.10 to 6.6 in all seven lockfiles, refreshing distribution URLs, hashes, and wheel metadata.
- Update Docker’s pinned uv image to 0.13.7 from #878 while retaining Python 3.14.7.
| File | Description |
|---|---|
uv.lock |
Lock Tornado 6.6 in the root environment. |
packages/topology_optimizer_pkg/uv.lock |
Lock Tornado 6.6 for topology optimization tooling. |
packages/interfaces_pkg/uv.lock |
Lock Tornado 6.6 for interfaces tooling. |
packages/importer_pkg/uv.lock |
Lock Tornado 6.6 for importer tooling. |
packages/grid_helpers_pkg/uv.lock |
Lock Tornado 6.6 for grid helpers tooling. |
packages/dc_solver_pkg/uv.lock |
Lock Tornado 6.6 for DC solver tooling. |
packages/contingency_analysis_pkg/uv.lock |
Lock Tornado 6.6 for contingency analysis tooling. |
Dockerfile |
Update uv to 0.13.7 with its pinned image digest. |
Review effort: Balanced
Takes the uv part of #878. The python:3.15.0 base image is left out because the packages require python <3.15. Signed-off-by: Sascha Petznick <229719644+spetznick-elia@users.noreply.github.com>
Re-locks root and all per-package lockfiles (6.5.10 -> 6.6), fixing GHSA-pcg2-g6cj-q92c, GHSA-r4j5-9xpp-3985 and GHSA-pw9p-v7r6-gx4p. tornado is only pulled in by the Jupyter dev tooling. Supersedes #881-#887. Signed-off-by: Sascha Petznick <229719644+spetznick-elia@users.noreply.github.com>
spetznick-elia
force-pushed
the
chore/bump-deps-2026-11-06
branch
from
November 6, 2026 13:09
31dc0b6 to
b2105ae
Compare
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Checklist
Please check if the PR fulfills these requirements:
Does this PR already have an issue describing the problem?
No linked issue. Dependabot raised 21 security alerts for tornado (three advisories, each in all seven lockfiles) and
opened one fix PR per lockfile. This PR bundles them so CI runs once.
Supersedes #881, #882, #883, #884, #885, #886, #887. Partly supersedes #878 (see below). #869 is already on
mainvia #871 and can be closed.
What is the new behavior and why?
tornado 6.6 is now locked in the root and every package environment, which closes these advisories:
RedirectHandlervia protocol-relative URLsToOp does not use tornado itself; it comes in through the Jupyter dev tooling (ipykernel, jupyter-server, jupyterlab).
The Docker image now builds with uv 0.13.7 (from #878).
Deliberately left out:
requires-python = ">=3.11,<3.15"and CI tests3.11–3.14, so the image stays on 3.14.7 until 3.15 support is added.
pandas<3.Does this PR introduce a breaking change?