Bump tornado from 6.4.2 to 6.5.1

changelogs/unreleased/9139-dependabot.yml

@@ -0,0 +1,6 @@
+change-type: patch
+description: Bump tornado from 6.4.2 to 6.5.1
+destination-branches:
+- iso8
+sections:
+  other-note: "Bump tornado version to 6.5.1 (CVE-2025-47287)"

mypy-baseline.txt

@@ -2,7 +2,6 @@ src/inmanta/agent/cache.py:0: error: Function is missing a type annotation for o
 src/inmanta/agent/forking_executor.py:0: error: Argument 1 of "connection_made" is incompatible with supertype "BaseProtocol"; supertype defines the argument type as "BaseTransport"  [override]
 src/inmanta/agent/forking_executor.py:0: note: See https://mypy.readthedocs.io/en/stable/common_issues.html#incompatible-overrides
 src/inmanta/agent/forking_executor.py:0: note: This violates the Liskov substitution principle
-src/inmanta/agent/handler.py:0: error: Argument 2 to "chain_future" has incompatible type "concurrent.futures._base.Future[T]"; expected "_asyncio.Future[Any]"  [arg-type]
 src/inmanta/agent/handler.py:0: error: Argument 3 to "log" of "LogLine" has incompatible type "**dict[str, object]"; expected "datetime | None"  [arg-type]
 src/inmanta/agent/handler.py:0: error: Returning Any from function declared to return "bool"  [no-any-return]
 src/inmanta/agent/reporting.py:0: error: Incompatible types in assignment (expression has type "None", variable has type Module)  [assignment]
@@ -1016,10 +1015,7 @@ src/inmanta/protocol/rest/client.py:0: error: Incompatible types in assignment (
 src/inmanta/protocol/rest/client.py:0: error: Returning Any from function declared to return "Result"  [no-any-return]
 src/inmanta/protocol/rest/client.py:0: error: Value expression in dictionary comprehension has incompatible type "str"; expected type "bytes"  [misc]
 src/inmanta/protocol/rest/client.py:0: note: Use "-> None" if function does not return a value
-src/inmanta/protocol/rest/server.py:0: error: Argument 1 to "Application" has incompatible type "list[Rule]"; expected "list[Rule | list[Any] | tuple[str | Matcher, Any] | tuple[str | Matcher, Any, dict[str, Any]] | tuple[str | Matcher, Any, dict[str, Any], str]] | None"  [arg-type]
 src/inmanta/protocol/rest/server.py:0: error: Argument 1 to "get_global_url_map" of "RESTServer" has incompatible type "Sequence[CallTarget]"; expected "list[CallTarget]"  [arg-type]
-src/inmanta/protocol/rest/server.py:0: note: "List" is invariant -- see https://mypy.readthedocs.io/en/stable/common_issues.html#variance
-src/inmanta/protocol/rest/server.py:0: note: Consider using "Sequence" instead, which is covariant
 src/inmanta/references.py:0: error: Parameter 1 of Literal[...] is invalid  [valid-type]
 src/inmanta/references.py:0: error: Returning Any from function declared to return "type[T] | None"  [no-any-return]
 src/inmanta/resources.py:0: error: "Resource" has no attribute "receive_events"; maybe "get_receive_events"?  [attr-defined]

requirements.txt

@@ -51,7 +51,7 @@ Sphinx-Substitution-Extensions==2025.4.3
 texttable==1.7.0
 time-machine==2.16.0
 toml==0.10.2
-tornado==6.4.2
+tornado==6.5.1
 types-python-dateutil==2.9.0.20250516
 types-PyYAML==6.0.12.20250516
 types-setuptools==80.8.0.20250521

setup.py

@@ -29,7 +29,8 @@
     "pyyaml~=6.0",
     "setuptools",
     "texttable~=1.0",
-    "tornado~=6.0",
+    # tornado>6.5 because of CVE https://github.com/advisories/GHSA-7cx3-6m66-7c5m
+    "tornado>6.5",
     # lower bound because of ilevkivskyi/typing_inspect#100
     "typing_inspect~=0.9",
     "ruamel.yaml~=0.17",