[andreatnvidia]

📋 Summary

The workspace dependency audit fails on three advisories in Tornado 6.5.10. Update the notebook dependency to Tornado 6.6, which fixes the open redirect and HTTP parsing denial-of-service issues, so the committed workspace lock passes the audit.

🔗 Related Issue

N/A. Addresses the existing dependency-audit failure reported on #1120.

🔄 Changes

• Raise the notebook dependency floor to tornado>=6.6,<7.
• Regenerate the Tornado lock entry and matching requirement metadata. Other package records are unchanged.

🧪 Testing

• All three package test suites: 5,005 passed, 11 skipped.
• Workspace and e2e dependency audits report no known vulnerabilities.
• Lockfile, installed dependency compatibility, and generated security-constraints checks.
• Notebook kernel startup, async cell execution, DataDesigner config import, and kernel shutdown with Tornado 6.6.
• Jupyter server startup and an authenticated /api/status request.
• Repository Ruff lint/format commands; discarded their unrelated generated-notebook change.
• Unit/E2E test additions: N/A; dependency-only update.
• Live model-provider tests: not run.

✅ Checklist

• Follows commit message conventions.
• Commits are signed off (DCO).
• External-contributor issue requirement: N/A; maintainer change.
• Architecture docs: N/A; dependency-only update.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Raises the notebook dependency floor to Tornado 6.6 to address the advisories described in the PR.

• Notebook installs now use Tornado 6.6 or newer.

_{Reviews (2) · Last reviewed commit: "Merge branch 'main' into andreatnvidia/c..." · Reviewed by Greptile}

[svcnvidia-nemo-ci]

No Critical or Warning findings.

The notebook dependency floor, lock requirement metadata, and Tornado package record are consistent. Reviewed the affected installation, notebook execution, and security-audit paths; no introduced defect was identified.

Validation was static only. Tests, dependency resolution, audits, and Jupyter smoke checks were not executed, and upstream advisory ranges and artifact hashes were not independently verified.

Note: formal approval is not available for this request, so this review is posted as a comment only.

Review generated by codex. This was a full review. Request a full review with /review reset=true.

[nabinchha]

Thanks for putting this together, @andreatnvidia!

Summary

PR #1122 raises the notebook dependency floor to tornado>=6.6,<7 and updates its lock entry, matching the stated intent. Reviewed commit 0678acb4fa57220e04b59058300c49c9fc5ddb89.

Findings

No actionable findings.

What Looks Good

• The dependency floor and lock requirement metadata agree; unrelated dependency records remain unchanged.
• Tornado 6.6 requires Python 3.11+, matching the workspace and all three packages. This is consistent with the upstream release notes.
• All 43 locked Tornado artifacts match PyPI metadata for URL, SHA256, and size.

Residual Risk

Independent checks passed: uv lock --check --offline, uv audit --locked (189 packages; no known vulnerabilities or adverse project statuses), the generated security-constraints check, and Ruff's pyproject check. The author’s unit tests, E2E audit, and Jupyter runtime smoke tests were not repeated.

Verdict

Ship it — no introduced defects identified.

---

This review was generated by an AI assistant.