[PR #244] fix: turn off gradio share in the demos and bump the gradio pin #236

New issue

Open

opened 2026-10-26 21:14:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 21:14:26 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/deepseek-ai/Janus/pull/244
Author: @Dextheking1
Created: 10/23/2026
Status: 🔄 Open

Base: main ← Head: fix/demo-share-and-gradio-pin

📝 Commits (1)

fc0db5f fix: demos stop sharing publicly, bump gradio pin

📊 Changes

5 files changed (+10 additions, -7 deletions)

View changed files

📝 demo/app.py (+2 -1)
📝 demo/app_janusflow.py (+2 -1)
📝 demo/app_januspro.py (+2 -1)
📝 pyproject.toml (+2 -2)
📝 requirements.txt (+2 -2)

📄 Description

the three gradio demos (demo/app.py, demo/app_januspro.py, demo/app_janusflow.py) launch with share=True and no auth, and the repo pins gradio 3.48.0. that version sits in the CVE-2023-51449 range, where the /file endpoint reads arbitrary files off the host. run the demo as shipped and the public share link exposes the box it runs on.

fix: launch with share=False in all three demos, with a comment saying to set it back yourself if you need a public link. bump the pin to gradio 4.44.1 and gradio-client 1.3.0 (the pair gradio 4.44.1 requires) in requirements.txt and pyproject.toml.

demo logic is untouched. the demos were not run end to end here, no weights on this box. changed python files compile, pyproject still parses.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/deepseek-ai/Janus/pull/244 **Author:** [@Dextheking1](https://github.com/Dextheking1) **Created:** 10/23/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/demo-share-and-gradio-pin` --- ### 📝 Commits (1) - [`fc0db5f`](https://github.com/deepseek-ai/Janus/commit/fc0db5f18cf380d0fa8a8f2ecb680e2cc798f555) fix: demos stop sharing publicly, bump gradio pin ### 📊 Changes **5 files changed** (+10 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `demo/app.py` (+2 -1) 📝 `demo/app_janusflow.py` (+2 -1) 📝 `demo/app_januspro.py` (+2 -1) 📝 `pyproject.toml` (+2 -2) 📝 `requirements.txt` (+2 -2) </details> ### 📄 Description the three gradio demos (demo/app.py, demo/app_januspro.py, demo/app_janusflow.py) launch with share=True and no auth, and the repo pins gradio 3.48.0. that version sits in the CVE-2023-51449 range, where the /file endpoint reads arbitrary files off the host. run the demo as shipped and the public share link exposes the box it runs on. fix: launch with share=False in all three demos, with a comment saying to set it back yourself if you need a public link. bump the pin to gradio 4.44.1 and gradio-client 1.3.0 (the pair gradio 4.44.1 requires) in requirements.txt and pyproject.toml. demo logic is untouched. the demos were not run end to end here, no weights on this box. changed python files compile, pyproject still parses. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-26 21:14:26 +00:00

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

deepseek-ai/Janus#236

No description provided.

Rows
Columns