Bump gradio from 5.27.0 to 6.15.1
DE
1mo ago+1+1+0123456789-1-1-0123456789
Bumps gradio from 5.27.0 to 6.15.1.
Changelog
Sourced from gradio's changelog.
6.15.1
Features
- #13388
c889673- tests:add regression coverage for theBlocks.from_config()proxy_url SSRF guard (GHSA-jmh7-g254-2cq9). Thanks@xr843!Fixes
- #13394
1c609af- Fix audio cache keys to include metadata. Thanks@3em0!- #13424
14ccbf1- Defer Node front proxy startup until Python is ready in SSR mode. Thanks@pngwn!- #13391
270c12a- fix(dataframe): handle empty and 1d auto datatype values. Thanks@danyalahmed1995!6.15.0
Features
- #13322
6c48f80- Allow applyinggr.cache()to intermediate functions directly. Thanks@abidlabs!- #13367
5d9c9fe- fix: upgrade handlebars to 4.7.9 (CVE-2026-33937). Thanks@orbisai0security!- #13408
6b0c8af- Markdown link fix. Thanks@dawoodkhan82!- #13366
10f43e0- Offload traffic to static workers and use node as the proxy. Thanks@freddyaboulton!Fixes
- #13384
feb7237- Isolate cookie jars in/proxy=requests so a malicious upstream Space cannot leak cookies into proxied requests to a different*.hf.space(GHSA-2mr9-9r47-px2g). Thanks@xr843!- #13344
563e7b7- Stop@gr.render from crashing with KeyError when an inner gr.Examples pops its fake-event fn. Thanks@GopalGB!- #13379
b8e8745- fix default tool logic in gr.ImageEditor. Thanks@hannahblair!- #13363
0872f5e- add colour picker unit tests. Thanks@hannahblair!- #13383
9acecd2- Warn when gr.Tabs() has non-Tab direct children (#9832). Thanks@wjddnwp29!- #13403
df56862- [js-client] close submit iterator on next/close race. Thanks@hysts!- #13380
5d7a9ba- update pypi prompt. Thanks@hannahblair!- #13390
d86903e- Add Estonian language support and translation. Thanks@paulpall!- #13336
14c8870- Add UploadButton unit tests. Thanks@freddyaboulton!- #13360
2887302- [codex] fix component load event target. Thanks@thomwolf!6.14.0
Features
- #13275
2d025c5- Model3D Unit Tests. Thanks@dawoodkhan82!- #13258
0d08926- add theme designer skill. Thanks@hannahblair!Fixes
- #13324
0453450- Fix gr.Slider crash for zero-width ranges. Thanks@onthebed!- #13264
f65acd0- Dialogue component unit tests. Thanks@freddyaboulton!- #13333
0e3c485- Remove Event From Queue When Cancelled. Thanks@freddyaboulton!- #13326
d42a1d7- Fix incorrect description of js parameter in Blocks.load. Thanks@AryaLolusare2712!- #13335
953efe0- Prevent Gallery Select Event From Triggering When Value Updated Programmatically. Thanks@freddyaboulton!6.13.0
... (truncated)
Commits
e3a20f8chore: update versions (#13419)14ccbf1Ssr node port (#13424)270c12afix(dataframe): handle empty and 1d auto datatype values (#13391)c889673test: regression coverage for from_config proxy_url SSRF guard (GHSA-jmh7-g25...1c609afFix audio cache keys to include metadata (#13394)0528c2cchore: update versions (#13352)6a0b417Stabilize image editor examples test (#13418)51497aedocs: add MiniMax example to ChatInterface providers guide (#13411)9acecd2Warn when gr.Tabs() has non-Tab direct children (#9832) (#13383)6b0c8afMarkdown link fix (#13408)- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by cubic
Upgrades gradio from 5.27.0 to 6.15.1, crossing into the 6.x line. This brings security fixes for cookie isolation in proxied requests and the handlebars dependency, plus assorted component bug fixes. This PR is currently not mergeable and will need a rebase onto main.
Migration
- Confirm app behavior against the 5.x to 6.x breaking changes before merging.
Security fixes
- Isolates cookie jars in
/proxy=requests (GHSA-2mr9-9r47-px2g) and upgradeshandlebars(CVE-2026-33937).