[Snyk] Security upgrade tornado from 5.1.1 to 6.5.8

[brookecastleberry]

Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• pip-sample/requirements.txt

⚠️ Warning

terminado 0.8.1 requires tornado, which is not installed.
notebook 5.7.0 requires tornado, which is not installed.
jupyter-console 6.6.3 has requirement traitlets>=5.4, but you have traitlets 4.3.2.
jupyter-console 6.6.3 has requirement ipykernel>=6.14, but you have ipykernel 5.0.0.
jupyter-console 6.6.3 has requirement jupyter-core!=5.0.*,>=4.12, but you have jupyter-core 4.4.0.
jupyter-console 6.6.3 has requirement jupyter-client>=7.0.0, but you have jupyter-client 5.2.3.
jupyter-client 5.2.3 requires tornado, which is not installed.
Jinja2 2.10 requires MarkupSafe, which is not installed.
ipython 7.34.0 has requirement jedi>=0.16, but you have jedi 0.12.1.
ipykernel 5.0.0 requires tornado, which is not installed.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[brookecastleberry]

The upgrade from Tornado v5.1.1 to v6.5.8 is a major version jump with significant breaking changes, primarily centered around the complete removal of older callback-based asynchronous patterns in favor of native async/await syntax.

Key Breaking Changes:

• Python Version Requirement: Support for Python 2.7 and 3.4 was dropped in v6.0. Support for Python 3.5 was dropped in v6.1. The new minimum required Python version for Tornado 6.5.8 is effectively Python 3.6+.
• Callback Arguments Removed: APIs deprecated in v5.x that accepted a callback argument have been removed. Code must be migrated to use the coroutine-based (async/await) interfaces. This impacts modules like tornado.httpclient, tornado.auth, and tornado.gen.
• @gen.coroutine and yield Deprecated: The tornado.gen.coroutine decorator and yield-based coroutines are no longer the primary method. While they may still work, the library has moved to native async def syntax. The @web.asynchronous decorator has been removed entirely.
• tornado.stack_context Removed: This module, deprecated in v5.1, has been completely removed.

Source: What's new in Tornado 6.0

Recommendation: This upgrade requires a significant refactoring effort. Do not merge this change without a dedicated migration plan. Developers must replace all callback-based patterns and older gen.coroutine usage with native async def and await keywords. It is critical to run tests with PYTHONWARNINGS=d on Tornado 5.1 to identify all deprecated APIs that need to be updated before attempting the upgrade.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.