Update dependency gradio to v6#40
Open
mend-for-github-com[bot] wants to merge 1 commit into
Open
Conversation
mend-for-github-com
Bot
force-pushed
the
whitesource-remediate/gradio-6.x
branch
from
April 13, 2026 09:36
68d99f1 to
9087fa4
Compare
mend-for-github-com
Bot
force-pushed
the
whitesource-remediate/gradio-6.x
branch
from
May 28, 2026 12:32
9087fa4 to
c2f8e97
Compare
mend-for-github-com
Bot
force-pushed
the
whitesource-remediate/gradio-6.x
branch
from
July 2, 2026 18:22
c2f8e97 to
3ef4cef
Compare
mend-for-github-com
Bot
force-pushed
the
whitesource-remediate/gradio-6.x
branch
from
July 9, 2026 17:45
3ef4cef to
8ed1157
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==3.41.2→==6.20.0By merging this PR, the issue #2 will be automatically resolved and closed:
Release Notes
gradio-app/gradio (gradio)
v6.20.0Compare Source
Features
79b9171- Gallery Download All. Thanks @dawoodkhan82!784eb53- workflow: show downstream output on subgraph run. Thanks @hannahblair!59968e8- workflow: update input change handling. Thanks @hannahblair!0533483- Migrate Image components to Svelte 5. Thanks @dawoodkhan82!55241c8- workflow: auto add node on port click. Thanks @hannahblair!ec64242- workflow: validate model before invoking inference client. Thanks @hannahblair!f7b872e- Replace deprecated Starlette 422 status constant in queue validator error path. Thanks @copilot-swe-agent!75c5d1e- workflow: inject token into fn functions. Thanks @hannahblair!Fixes
876d333- FixJSONDecodeErrorwhen loading cached examples with negative number outputs. Thanks @hysts!1c5c538- Security: serve/gradio_api/file=<url>via an SSRF-safe streaming proxy instead of an open redirect. Thanks @abidlabs!4e72cd1- workflow: forward_tokento bound fn when no request session. Thanks @hannahblair!98de45e- Fix gr.Plot collapsing to zero height for autosize Plotly figures. Thanks @hysts!46d391b- Fix embedded Gradio apps growing infinitely tall on HF Spaces when usingvh/%heights orfill_height. Thanks @abidlabs!63609f1- Enforcemax_file_sizefor multipart uploads to the/component_serverroute. Thanks @abidlabs!c576675- Fixgr.ImageEditorhigh CPU usage when idle by sleeping the render loop when nothing is changing. Thanks @abidlabs!dcc654d- Fix ImageEditor transform tools and hidden cleanup. Thanks @dawoodkhan82!2e80558- Firestate.change()for streaming (.stream()) events. Thanks @hysts!7a595cb- Fix ImageEditor brush texture resets. Thanks @dawoodkhan82!461d82d- Use same-origin credentials in the JS client so cross-origin embeds work again. Thanks @hysts!745f20c- Fixgr.Tabs.select()event not firing when switching tabs. Thanks @abidlabs!6438369- Wait for in-flight head scripts before running js_on_load in gr.HTML. Thanks @hysts!9a72d0c- Fix Column staying hidden after a multi-yield visibility update. Thanks @hysts!882df35- FixTypeError: this.app.$destroy is not a functionwhen embedding a Gradio app with the<gradio-app>web component. Thanks @abidlabs!v6.19.0Compare Source
Features
53cb4ca- Runpnpm lintandpnpm ts:checkon CI. Thanks @abidlabs!a11c728- Re-translate i18n choices display names when the language is switched at runtime. Thanks @hysts!d4d340d- Rungr.Workflowsubgraphs via the Gradio API — each subgraph is exposed as a named endpoint (returning all of its outputs) reusing/info,/call, and/api, with a "View API" panel in the canvas. Thanks @abidlabs!Fixes
9d83502- Make dropdowns accessible to screen readers (combobox ARIA pattern). Thanks @hysts!0a933b4- Fixgr.SelectDatacoordinates when the image ingr.Imagedoes not fill its container. Thanks @hysts!8eafb31- refactor space and model discovery modal. Thanks @hannahblair!e5ec1ca- Fix fullscreen button not working in ImageSlider, interactive Image, native plots, and AnnotatedImage. Thanks @hysts!1d19f2b- Fix long unbroken text overflowing in the Markdown component. Thanks @hysts!v6.18.0Compare Source
Features
75c684e- Migrate Plot to Svelte 5. Thanks @dawoodkhan82!e547392- workflow: update pipeline UX around pro accounts. Thanks @hannahblair!100eaf2- workflow: implement drag selection. Thanks @hannahblair!dcd072c- Migrate Chatbot, Tabs, TabItem to Svelte 5. Thanks @dawoodkhan82!429faeb- Ensure every component dispatches achangeevent when its value changes. Thanks @abidlabs!8ec4cbc- Translate i18nchoicesdisplay names in choice-based components. Thanks @hysts!df59064- Treat expired OAuth sessions as logged out users. Thanks @abidlabs!a9550d8- Warn when a<script>tag is included in the content of agr.HTMLcomponent. Thanks @abidlabs!9362fd9- Use local HF token in Workflow, gated behind a write-token auth model. Thanks @abidlabs!Fixes
be20ce8- Fix UI freeze when one event makes multiple components of the same type visible. Thanks @hysts!87f42b9- workflow: preserve dropdown, radio and checkbox inputs. Thanks @hannahblair!c440779- Close matplotlib figures after rendering them ingr.Plot. Thanks @hysts!751a397- Close iterator on terminal error in JS client. Thanks @hysts!ba4963e- Runjsfunctions in event listeners even whenfnis not explicitly set toNone. Thanks @abidlabs!e0e2445- Fix state handling for simple call API. Thanks @abidlabs!4549d87- Accept permanent redirects (301, 308) innetworking.url_ok. Thanks @abidlabs!2d6eb2a- Treat api_name=False events as private in API info. Thanks @abidlabs!965a36c- workflow: dont render nodes for optional params on spawn. Thanks @hannahblair!1b611f8- Fixes grouped accordion borders and empty plot legends. Thanks @dawoodkhan82!v6.17.3Compare Source
Features
c26e797- fix workflow canvas repo.url. Thanks @pngwn!v6.16.0Compare Source
Features
96d4fd1- Make the session heartbeat interval configurable via theGRADIO_HEARTBEAT_INTERVALenvironment variable (#13346). Thanks @wjddnwp29!6320116- Show a friendly landing page (instead of a raw JSON-RPC error) when the MCP endpoint is opened in a browser. Thanks @ShirGanon!Fixes
97d541f- Fix path traversal ingr.FileExplorer.preprocessby validating selected paths with_safe_join(consistent withls()), rejecting absolute/..paths that escaperoot_dir. Thanks @abidlabs!010ee63- Fix open-redirect bypass ingradio.oauth._redirect_to_targetwhere 4+ leading slashes (or backslashes) in_target_urlproduced a scheme-relative redirect to an external host, restoring CVE-2026-28415. Thanks @abidlabs!0d670ad- Fix browser freeze when a dataframe's value is set (e.g. via a tab select event), and only dispatch the tabs select event when the selected tab actually changes. Thanks @freddyaboulton!702a8b1- Fix runtime language switching not re-translating component labels/values (only the footer updated).@gradio/utilsresolved its own duplicatesvelte-i18ninstance whose locale store was never updated; the retranslation trigger now uses the live formatter store injected by@gradio/core. Thanks @abidlabs!939e84c- Defer Node front proxy startup until Python is ready in SSR mode. Thanks @pngwn!48d0e27- Fix SSRF inImage/GallerySVG postprocessing andAudiostreaming postprocessing by routing user-influenced URL fetches throughsafehttpx. Thanks @abidlabs!29bd7a0-gr.Dropdown()Fixes. Thanks @dawoodkhan82!v6.15.2Compare Source
Features
36f6b4e- upgradestarlettedependency to 1.0.1 or higher. Thanks @abidlabs!Fixes
67df918- Convert audio to int16 for all formats inaudio_to_fileso non-WAV outputs (mp3, flac, ogg) no longer encode as noise. Thanks @GopalGB!v6.15.1Compare Source
Features
c889673- tests:add regression coverage for theBlocks.from_config()proxy_url SSRF guard (GHSA-jmh7-g254-2cq9). Thanks @xr843!Fixes
1c609af- Fix audio cache keys to include metadata. Thanks @3em0!14ccbf1- Defer Node front proxy startup until Python is ready in SSR mode. Thanks @pngwn!270c12a- fix(dataframe): handle empty and 1d auto datatype values. Thanks @danyalahmed1995!v6.15.0Compare Source
Features
6c48f80- Allow applyinggr.cache()to intermediate functions directly. Thanks @abidlabs!5d9c9fe- fix: upgrade handlebars to 4.7.9 (CVE-2026-33937). Thanks @orbisai0security!6b0c8af- Markdown link fix. Thanks @dawoodkhan82!10f43e0- Offload traffic to static workers and use node as the proxy. Thanks @freddyaboulton!Fixes
feb7237- Isolate cookie jars in/proxy=requests so a malicious upstream Space cannot leak cookies into proxied requests to a different*.hf.space(GHSA-2mr9-9r47-px2g). Thanks @xr843!563e7b7- Stop @gr.render from crashing with KeyError when an inner gr.Examples pops its fake-event fn. Thanks @GopalGB!b8e8745- fix default tool logic in gr.ImageEditor. Thanks @hannahblair!0872f5e- add colour picker unit tests. Thanks @hannahblair!9acecd2- Warn when gr.Tabs() has non-Tab direct children (#9832). Thanks @wjddnwp29!df56862- [js-client] close submit iterator on next/close race. Thanks @hysts!5d7a9ba- update pypi prompt. Thanks @hannahblair!d86903e- Add Estonian language support and translation. Thanks @paulpall!14c8870- Add UploadButton unit tests. Thanks @freddyaboulton!2887302- [codex] fix component load event target. Thanks @thomwolf!v6.14.0Compare Source
Features
2d025c5- Model3D Unit Tests. Thanks @dawoodkhan82!0d08926- add theme designer skill. Thanks @hannahblair!Fixes
0453450- Fix gr.Slider crash for zero-width ranges. Thanks @onthebed!f65acd0- Dialogue component unit tests. Thanks @freddyaboulton!0e3c485- Remove Event From Queue When Cancelled. Thanks @freddyaboulton!d42a1d7- Fix incorrect description of js parameter in Blocks.load. Thanks @AryaLolusare2712!953efe0- Prevent Gallery Select Event From Triggering When Value Updated Programmatically. Thanks @freddyaboulton!v6.13.0Compare Source
Features
30264b5- docs: Add "Common Patterns" section to Textbox component docs. Thanks @yuzegong746-cmd!6809249- Fix typo inRequest.stateserialization. Thanks @abidlabs!d6f24df- Improve curl info. Thanks @freddyaboulton!e39f028- Add ImageSlider unit tests. Thanks @pngwn!b6b0d02- Fix batched queue events losing request context. Thanks @abidlabs!5fd7698- Fix timing and TTL comparisons bugs. Thanks @abidlabs!cab8be0- CLI/Agent API Docs. Thanks @freddyaboulton!8b47ccb- Skills Reorg + sync to huggingface/skills. Thanks @freddyaboulton!948fcb8- fix(reloading): copyserverattr before swapping blocks. Thanks @cbensimon!e6b1634- Dropdown Unit Tests. Thanks @freddyaboulton!2fdc8cf- Fixgradio skills add. Thanks @abidlabs!Fixes
2e9eb51- Restore select-all checkbox in boolean column headers ofgr.Dataframe. Thanks @pngwn!b5e6491- Dataframe: allow native context menu and text selection on static cells. Thanks @pngwn!1d5994d- Dataframe: fix extreme rendering slowdown withdatatype="date"(and any future dtype with asymmetric string casts) by firingEditableCell's shim-blur only on edit teardown instead of every render. Also makes the hidden sizing-row computation faster by avoiding Date rendering for every entry. Thanks @pngwn!77fca72- Dataset: fix gallery view using wrong component metadata index and fix broken pagination after Svelte 5 migration. Thanks @ParamChordiya!79c5776- ReworkDataframewrapping, truncation, and column width sizing. Thanks @pngwn!bb9c130- Fix snippet generator crash on datetime values in Dataframe inputs. Thanks @ParamChordiya!d75e311-model3dply freeze fix. Thanks @dawoodkhan82!e9c963e- Unit tests for js/paramviewer, js/timer, js/markdown. Thanks @freddyaboulton!v6.12.0Compare Source
Features
0dd1c79- Slider Tests. Thanks @dawoodkhan82!a1cbf32- Vendor in / pin Gradio dependencies and useexclude-newerflag in our CI. Thanks @abidlabs!89f7a09- Layout tests. Thanks @pngwn!bc53d08- Chatbot Unit Tests. Thanks @freddyaboulton!ff90963- Add Documentation Group for gr.Cache. Thanks @freddyaboulton!109f32d- reloading: Copyserverattr for Space reloader. Thanks @cbensimon!457f130- Gallery Unit Tests. Thanks @freddyaboulton!3a30ef6- Add comprehensive DateTime tests and fix whitespace preprocess bug. Thanks @pngwn!ffc00ff- Annotated image unit tests. Thanks @freddyaboulton!45c4ecd- Add@gr.cache()decorator for caching deterministic functions, as as well as a lower-levelgr.Cachethat uses dependency injection. Thanks @abidlabs!348327f- fix : check validation_response instead of validation_data. Thanks @nameearly!Fixes
6261872- fix(share): clearer error message when cert write failed during sharing init. Thanks @xuan25!66817ca- Label tests. Thanks @pngwn!d58702c- Pop finished events from queue data structures. Thanks @moktamd!9efdcb5- Reducegradiopackage size by restoring frontend settings. Thanks @abidlabs!755c3d3- fix: show validation errors on StatusTracker-dependent components. Thanks @hysts!9953db9- fix: preserve special characters in uploaded filenames. Thanks @xr843!4005b93- Fix ZeroGPU handling forgr.Server. Thanks @abidlabs!v6.11.0Compare Source
Features
c13daab- add test utils. Thanks @pngwn!a4e1c92- Audio and Video unit tests. Thanks @freddyaboulton!9487b60- migrate dataframe to svelte 5. Thanks @pngwn!64828b0- Add Image Unit Tests. Thanks @freddyaboulton!7aec6bd- Add Starlette 1.0 compatibility by relaxing version constraint. Thanks @xr843!a8e0cc6- Run Pre/Post processing for components in a separate thread. Thanks @freddyaboulton!Fixes
a5d4096- Fix Tab Interactive Bug. Thanks @freddyaboulton!03a9d4c- fix: prevent [object Object] when label matches a nested i18n key. Thanks [@m