fix(deps): resolve pip-audit failure for tornado by tkislan · Pull Request #146 · deepnote/deepnote-toolkit

tkislan · 2026-10-29T18:57:07Z

Summary

Audit - Production and Audit - Server fail on the latest PR run, 40929536773 on tk/servable-stored-dataframes (2026-10-29). The cause is three tornado advisories published on 2026-10-28. All three are fixed only in tornado 6.6, which requires Python 3.11, so the tornado security floor is split by Python version, as pillow and dnspython already are. No ignore-vulns entries are added.

Package	Group	Before	After	Advisories	Remediation
tornado (transitive via jupyter-server, ipykernel, jupyter-client, terminado)	main	6.5.10	6.6 on ≥ 3.11, 6.5.10 on 3.10	CVE-2026-115927, CVE-2026-116577, CVE-2026-116578	floor of the existing constraint in the transitive security block, split by Python version like pillow

     "requests>=2.32.4,<3",
-    "tornado>=6.5.9,<7",  # 6.5.9 fixes GHSA-3hv7-mjh2-fv65, GHSA-c2m8-h5v5-343r, GHSA-chx6-46f5-w4vp
+    "tornado>=6.6,<7; python_version >= '3.11'",  # 6.6 fixes CVE-2026-115927, CVE-2026-116577, CVE-2026-116578
+    "tornado>=6.5.9,<7; python_version < '3.11'",  # tornado 6.6 requires Python 3.11
     "filelock>=4.2.1,<5; python_version >= '3.11'",  # ...

Why the change looks the way it does

What the advisories cover:
- CVE-2026-116577: header obs-fold parsing takes quadratic time.
- CVE-2026-115927: chunked request bodies block the event loop.
- CVE-2026-116578: RedirectHandler open redirect.
- The GitHub advisories list < 6.6 as vulnerable and 6.6 as the first patched release. There is no 6.5.x backport; 6.5.10 is the last 6.5 release.
Why the floor is split by Python version:
- tornado 6.6 (released 2026-10-21) requires Python >= 3.11. Its release notes drop 3.9 and 3.10.
- So 3.10 keeps the old floor and stays on 6.5.10, as pillow did in fix(deps): resolve pip-audit failures for pillow, gitpython, certifi and black #143 and dnspython in fix(deps): resolve pip-audit failures for pymongo, dnspython, oauthlib and pylint #145. The 3.10 line's comment follows those lines too.
- tornado was already pinned in the transitive security block, so the existing line is edited in place.
Consumers: every tornado dependent in the lock accepts 6.6:
- ipykernel 6.31.0, jupyter-client 8.6.3, jupyter-server 2.21.0 and terminado 0.18.1 all require >=6.1/>=6.2.
- streamlit 1.56.0 caps tornado <7, but it only installs on 3.10, which stays on 6.5.10.
- streamlit 1.66.1 (3.11+) no longer depends on tornado.
Compatibility: the toolkit's own tornado use is web.authenticated and web.HTTPError on a jupyter-server APIHandler in deepnote_core/widget_assets.py. None of the 6.6 changes touch it:
- obs-fold rejection
- data_received chunk merging
- RedirectHandler/StaticFileHandler hardening
- WebSocket check_origin changes
- new deprecations
- cross_origin_protection, which is opt-in in 6.6
jupyter-server: its only 6.6-related issue was the HTTPServerRequest(start_line=...) deprecation, fixed in test code only (jupyter_server#1717).
Upper bound: the cap stays <7, like every other line in the block. The 6.6 notes say cross_origin_protection is expected to become the default in 6.7. That is worth checking when 6.7 ships, given the Jupyter server runs with disable_check_xsrf = True.

Lock file

As in fix(deps): resolve pip-audit failures for pillow, gitpython, certifi and black #143–fix(deps): resolve pip-audit failures for pymongo, dnspython, oauthlib and pylint #145, only the affected entries were spliced into the existing lock: the tornado blocks and content-hash.
- 6.5.10 gains markers = "python_version == \"3.10\"".
- A new 6.6 block is added for >= 3.11.
A plain poetry lock on main still rewrites about 25 unrelated per-Python entries.
Compared with a fresh lock of this pyproject.toml, the spliced lock's tornado blocks and content-hash match exactly. Every other difference is that pre-existing drift.

Testing

poetry check --lock passes.
pip-audit, with CI's flags (--require-hashes --disable-pip, ignoring only PYSEC-2024-161 and PYSEC-2026-113), on the Production, Server and Dev exports:
- Python 3.11, 3.12, 3.13 and 3.14: clean.
- Python 3.10: the expected exposures remain (see Not in this PR).
Lockless resolve: uv pip compile pyproject.toml --extra server, as in Wheel Install Check, resolves on 3.10–3.14: tornado 6.5.10 on 3.10 and 6.6 on 3.11+.
Unit tests on Python 3.13 in the Poetry venv synced to this lock (tornado 6.6): 1429 passed, 4 skipped.
- The 232 server/widget/jupyter/streamlit tests also pass with -W error::DeprecationWarning:tornado.
- None of the warnings come from tornado.
Review pass, tornado 6.6 with the locked Jupyter versions:
- On Python 3.11, tests/unit/test_widget_assets.py: 38 passed.
- On Python 3.11 and 3.13, a smoke test that starts jupyter-server, creates a kernel and runs code over the kernel websocket passes.
3.12 and 3.14 weren't run locally; this PR's CI matrix covers them.

Not in this PR

Python 3.10 stays exposed to the three tornado advisories. It is already exposed to pillow 12.3.0 (fix(deps): resolve pip-audit failures for pillow, gitpython, certifi and black #143), virtualenv 20.36.1 (fix(deps): audit the server extra and dev group and resolve their findings #144) and dnspython 2.8.0 (fix(deps): resolve pip-audit failures for pymongo, dnspython, oauthlib and pylint #145). None of these has a fix that supports 3.10. CD still builds 3.10 images, so those images keep tornado 6.5.10 under jupyter-server.
filelock 3.20.3 on Python 3.10 now has CVE-2026-112909 and CVE-2026-112910, published 2026-10-28, both fixed only in 4.2.1, which requires Python 3.11. The pin is unchanged:
- Every filelock release that installs on 3.10 is affected by CVE-2026-112909.
- 3.20.3 carries the fewest advisories of them: 2, against 3–17 for the other 3.10-installable releases.
- CVE-2026-112910 is Windows-only. CVE-2026-112909 needs a second local user able to rename or hard-link a file onto the lock path.
- The comment on the 3.10 filelock line is still accurate, so it isn't edited.
The audit jobs still check only Python 3.11. pip-audit skips entries whose markers exclude the running interpreter, so none of the 3.10-only findings above reach CI. Same caveat as in fix(deps): audit the server extra and dev group and resolve their findings #144 and fix(deps): resolve pip-audit failures for pymongo, dnspython, oauthlib and pylint #145.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HwkxN8YriHhdXBwMc4sd8h

Summary by CodeRabbit

Chores
- Updated the Tornado version requirements based on the Python version in use.

tornado 6.5.10 carries CVE-2026-115927, CVE-2026-116577 and CVE-2026-116578, fixed only in 6.6, which requires Python 3.11. The security floor is split by Python version, as for pillow and dnspython: 6.6 on 3.11+, the old 6.5.9 floor on 3.10, which stays exposed. Only the tornado blocks and content-hash were spliced into the lock. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwkxN8YriHhdXBwMc4sd8h

coderabbitai · 2026-10-29T18:57:36Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Essentials
Run ID: a7b9cd03-4c82-4975-963c-9b31abdb724f

Commits

Reviewing files that changed from the base of the PR and between 6d93e12 and 4af4744.

Files ignored due to path filters: 1

poetry.lock is excluded by !**/*.lock

Files selected for processing: 1

pyproject.toml

Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

Walkthrough

The Tornado dependency now requires version 6.6 or newer on Python 3.11 and newer. Older Python versions require version 6.5.9 or newer. Both requirements exclude version 7.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: mfranczel

Merge Risk: Minimal · up to 4af47

No verified merge-blocking issue remains in the reviewed dependency constraint.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the Tornado dependency fix and its purpose: resolving the pip-audit failure.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Updates Docs		PASS: This pull request only updates the Tornado dependency constraint and lock file. It does not implement a feature, so the documentation-update condition does not apply. The private internal landin…

Full details: Updates Docs

Explanation

PASS: This pull request only updates the Tornado dependency constraint and lock file. It does not implement a feature, so the documentation-update condition does not apply. The private internal landing-page repository is unavailable in this review; maintainers should verify its roadmap separately if needed.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-29T18:57:38Z

📦 Python package built successfully!

Version: 2.9.0.dev6+5273c13
Wheel: deepnote_toolkit-2.9.0.dev6+5273c13-py3-none-any.whl

Install:

pip install "deepnote-toolkit @ https://deepnote-staging-runtime-artifactory.s3.amazonaws.com/deepnote-toolkit-packages/2.9.0.dev6%2B5273c13/deepnote_toolkit-2.9.0.dev6%2B5273c13-py3-none-any.whl"

codecov · 2026-10-29T19:01:31Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.17%. Comparing base (6d93e12) to head (4af4744).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #146   +/-   ##
=======================================
  Coverage   78.17%   78.17%           
=======================================
  Files         120      120           
  Lines        6837     6837           
  Branches      990      990           
=======================================
  Hits         5345     5345           
  Misses       1182     1182           
  Partials      310      310

Flag	Coverage Δ
combined	`78.17% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

deepnote-bot · 2026-10-29T19:15:02Z

🚀 Review App Deployment Started

📝 Description	🌐 Link / Info
🌍 Review application	ra-146
🔑 Sign-in URL	Click to sign-in
📊 Application logs	View logs
🔄 Actions	Click to redeploy
🚀 ArgoCD deployment	View deployment
⏰ Last deployed	2026-10-29 19:15:01 (UTC)
📜 Deployed commit	`a9b04e2b4690493a3723e92e8bf22c9229de459b`
🛠️ Toolkit version	`5273c13`

coderabbitai Bot approved these changes Oct 29, 2026

View reviewed changes

tkislan marked this pull request as ready for review October 29, 2026 19:09

tkislan requested a review from a team as a code owner October 29, 2026 19:09

tkislan requested a review from m1so October 29, 2026 19:09

Navigation Menu

Repository navigation

fix(deps): resolve pip-audit failure for tornado - #146

fix(deps): resolve pip-audit failure for tornado#146
tkislan wants to merge 1 commit into
mainfrom
tk/fix-pip-audit-2026-10-29

tkislan commented Oct 29, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

codecov Bot commented Oct 29, 2026

Uh oh!

deepnote-bot commented Oct 29, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

tkislan commented Oct 29, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why the change looks the way it does

Lock file

Testing

Not in this PR

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

codecov Bot commented Oct 29, 2026

Codecov Report

Uh oh!

deepnote-bot commented Oct 29, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tkislan commented Oct 29, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading