build(deps): update dependency starlette to v0.47.2 [security] (hotfix/2.7)
Metadata
Current evaluation
Merged automated upgrade of starlette from v0.45.3 to v0.47.2 to patch CVE-2025-54121, fixing a thread-blocking vulnerability during large uploads. Approved by two reviewers and merged into hotfix/2.7.
Suggested action: —
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [starlette](https://redirect.github.com/encode/starlette) ([changelog](https://www.starlette.io/release-notes/)) | `==0.45.3` -> `==0.47.2` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
### GitHub Vulnerability Alerts
#### [CVE-2025-54121](https://redirect.github.com/encode/starlette/security/advisories/GHSA-2c2j-9gv5-cj73)
### Summary
When parsing a multi-part form with large files (greater than the [default max spool size](https://redirect.github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/formparsers.py#L126)) `starlette` will block the main thread to roll the file over to disk. This blocks the event thread which means we can't accept new connections.
### Details
Please see this discussion for details: [https://github.com/encode/starlette/discussions/2927#discussioncomment-13721403](https://redirect.github.com/encode/starlette/discussions/2927#discussioncomment-13721403). In summary the following UploadFile code (copied from [here](https://redirect.github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/datastructures.py#L436C5-L447C14)) has a minor bug. Instead of just checking for `self._in_memory` we should also check if the additional bytes will cause a rollover.
```python
@​property
def _in_memory(self) -> bool:
# check for SpooledTemporaryFile._rolled
rolled_to_disk = getattr(self.file, "_rolled", True)
return not rolled_to_disk
async def write(self, data: bytes) -> None:
if self.size is not None:
self.size += len(data)
if self._in_memory:
self.file.write(data)
else:
await run_in_threadpool(self.file.write, data)
```
I have already created a PR which fixes the problem: [https://github.com/encode/starlette/pull/2962](https://redirect.github.com/encode/starlette/pull/2962)
### PoC
See the discussion [here](https://redirect.github.com/encode/starlette/discussions/2927#discussioncomment-13721403) for steps on how to reproduce.
### Impact
To be honest, very low and not many users will be impacted. Parsing large forms is already CPU intensive so the additional IO block doesn't slow down `starlette` that much on systems with modern HDDs/SSDs. If someone is running on tape they might see a greater impact.
---
### Release Notes
<details>
<summary>encode/starlette (starlette)</summary>
### [`v0.47.2`](https://redirect.github.com/encode/starlette/releases/tag/0.47.2)
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.47.1...0.47.2)
#### Fixed
- Make `UploadFile` check for future rollover [#​2962](https://redirect.github.com/encode/starlette/pull/2962).
***
#### New Contributors
- [@​HonakerM](https://redirect.github.com/HonakerM) made their first contribution in [https://github.com/encode/starlette/pull/2962](https://redirect.github.com/encode/starlette/pull/2962)
**Full Changelog**: https://github.com/encode/starlette/compare/0.47.1...0.47.2
### [`v0.47.1`](https://redirect.github.com/encode/starlette/releases/tag/0.47.1): Version 0.47.1
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.47.0...0.47.1)
#### Fixed
- Use `Self` in `TestClient.__enter__` [#​2951](https://redirect.github.com/encode/starlette/pull/2951)
- Allow async exception handlers to type-check [#​2949](https://redirect.github.com/encode/starlette/pull/2949)
***
**Full Changelog**: https://github.com/encode/starlette/compare/0.47.0...0.47.1
### [`v0.47.0`](https://redirect.github.com/encode/starlette/releases/tag/0.47.0): Version 0.47.0
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.46.2...0.47.0)
#### Added
- Add support for ASGI `pathsend` extension [#​2671](https://redirect.github.com/encode/starlette/pull/2671).
- Add `partitioned` attribute to `Response.set_cookie` [#​2501](https://redirect.github.com/encode/starlette/pull/2501).
#### Changed
- Change `methods` parameter type from `list[str]` to `Collection[str]` [#​2903](https://redirect.github.com/encode/starlette/pull/2903).
- Replace `import typing` by `from typing import ...` in the whole codebase [#​2867](https://redirect.github.com/encode/starlette/pull/2867).
#### Fixed
- Mark `ExceptionMiddleware.http_exception` as async to prevent thread creation [#​2922](https://redirect.github.com/encode/starlette/pull/2922).
***
#### New Contributors
- [@​danlapid](https://redirect.github.com/danlapid) made their first contribution in [https://github.com/encode/starlette/pull/2922](https://redirect.github.com/encode/starlette/pull/2922)
- [@​Flecart](https://redirect.github.com/Flecart) made their first contribution in [https://github.com/encode/starlette/pull/2501](https://redirect.github.com/encode/starlette/pull/2501)
- [@​AllenSH12](https://redirect.github.com/AllenSH12) made their first contribution in [https://github.com/encode/starlette/pull/2936](https://redirect.github.com/encode/starlette/pull/2936)
- [@​waketzheng](https://redirect.github.com/waketzheng) made their first contribution in [https://github.com/encode/starlette/pull/2867](https://redirect.github.com/encode/starlette/pull/2867)
- [@​jonathanberthias](https://redirect.github.com/jonathanberthias) made their first contribution in [https://github.com/encode/starlette/pull/2903](https://redirect.github.com/encode/starlette/pull/2903)
**Full Changelog**: https://github.com/encode/starlette/compare/0.46.2...0.47.0
### [`v0.46.2`](https://redirect.github.com/encode/starlette/releases/tag/0.46.2): Version 0.46.2
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.46.1...0.46.2)
#### What's Changed
- Use correct index on backwards compatible logic in `TemplateResponse` by [@​alex-oleshkevich](https://redirect.github.com/alex-oleshkevich) in [https://github.com/encode/starlette/pull/2909](https://redirect.github.com/encode/starlette/pull/2909)
- Prevents reraising of exception from `BaseHTTPMiddleware` by [@​ramannanda9](https://redirect.github.com/ramannanda9) in [https://github.com/encode/starlette/pull/2911](https://redirect.github.com/encode/starlette/pull/2911)
#### New Contributors
- [@​ahryniv](https://redirect.github.com/ahryniv) made their first contribution in [https://github.com/encode/starlette/pull/2913](https://redirect.github.com/encode/starlette/pull/2913)
- [@​ramannanda9](https://redirect.github.com/ramannanda9) made their first contribution in [https://github.com/encode/starlette/pull/2911](https://redirect.github.com/encode/starlette/pull/2911)
**Full Changelog**: https://github.com/encode/starlette/compare/0.46.1...0.46.2
### [`v0.46.1`](https://redirect.github.com/encode/starlette/releases/tag/0.46.1): Version 0.46.1
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.46.0...0.46.1)
#### Fixed
- Allow relative directory path when `follow_symlinks=True` [#​2896](https://redirect.github.com/encode/starlette/pull/2896).
***
**Full Changelog**: https://github.com/encode/starlette/compare/0.46.0...0.46.1
### [`v0.46.0`](https://redirect.github.com/encode/starlette/releases/tag/0.46.0): Version 0.46.0
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.45.3...0.46.0)
#### Added
- `GZipMiddleware`: Make sure `Vary` header is always added if a response can be compressed [#​2865](https://redirect.github.com/encode/starlette/pull/2865).
#### Fixed
- Raise exception from background task on BaseHTTPMiddleware [#​2812](https://redirect.github.com/encode/starlette/pull/2812).
- `GZipMiddleware`: Don't compress on server sent events [#​2871](https://redirect.github.com/encode/starlette/pull/2871).
#### Changed
- `MultiPartParser`: Rename `max_file_size` to `spool_max_size` [#​2780](https://redirect.github.com/encode/starlette/pull/2780).
#### Deprecated
- Add deprecated warning to `TestClient(timeout=...)` [#​2840](https://redirect.github.com/encode/starlette/pull/2840).
#### New Contributors
- [@​musicinmybrain](https://redirect.github.com/musicinmybrain) made their first contribution in [https://github.com/encode/starlette/pull/2855](https://redirect.github.com/encode/starlette/pull/2855)
- [@​WilliamDEdwards](https://redirect.github.com/WilliamDEdwards) made their first contribution in [https://github.com/encode/starlette/pull/2870](https://redirect.github.com/encode/starlette/pull/2870)
- [@​mattmess1221](https://redirect.github.com/mattmess1221) made their first contribution in [https://github.com/encode/starlette/pull/2865](https://redirect.github.com/encode/starlette/pull/2865)
**Full Changelog**: https://github.com/encode/starlette/compare/0.45.3...0.46.0
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-parts).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40MC4wIiwidXBkYXRlZEluVmVyIjoiNDEuNDAuMCIsInRhcmdldEJyYW5jaCI6ImhvdGZpeC8yLjciLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged automated upgrade of starlette from v0.45.3 to v0.47.2 to patch CVE-2025-54121, fixing a thread-blocking vulnerability during large uploads. Approved by two reviewers and merged into hotfix/2.7. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged security hotfix updating starlette from 0.45.3 to 0.47.2 to resolve CVE-2025-54121. The update fixes main thread blocking during large file uploads and was auto-generated by Renovate for the hotfix/2.7 branch. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1180 build(deps): update dependency starlette to v0.47.2 [security] (main) | craft-parts | merged | Merged automated update upgrading starlette from 0.45.3 to 0.47.2 to resolve CVE-2025-54121, preventing main thread blocking during large file uploads. Approved by two reviewers and merged to main. | |
| #5120 build(deps): update dependency starlette to v0.40.0 [security] (hotfix/8.4) | snapcraft | merged | Merged security hotfix updating starlette from 0.38.4 to 0.40.0 on the hotfix/8.4 branch. Resolves CVE-2024-47874 DoS vulnerability in multipart/form-data parsing. Approved by two reviewers and passed CI. | |
| #5119 build(deps): update dependency starlette to v0.40.0 [security] (main) | snapcraft | merged | Merged dependency update upgrading starlette to v0.40.0 to resolve CVE-2024-47874, a denial-of-service vulnerability in multipart/form-data parsing. Approved by two reviewers with passing CI checks. | |
| #5118 build(deps): bump starlette from 0.38.5 to 0.40.0 | snapcraft | closed | Closed after approval to update starlette to 0.40.0, addressing a multipart/form-data DoS vulnerability. | |
| #350 build(deps): bump starlette | imagecraft | merged | Merged dependency update bumping starlette from v0.52.1 to v1.2.0 to resolve an OSV vulnerability. Approved by two reviewers and passed all CI checks prior to integration. | |
| #84 build(deps): bump starlette from 0.48.0 to 0.49.1 | debcraft | merged | Merged dependabot update to bump starlette from 0.48.0 to 0.49.1. The upgrade patches a FileResponse Range header security vulnerability and adds minor features. CI checks passed and reviewers approved the merge. | |
| #742 build(deps): update deps with freeze-requirements.sh | rockcraft | merged | Merged dependency update to starlette 0.41.0 using freeze-requirements.sh, resolving CVE-2024-47874 DoS vulnerability. Approved by two reviewers and passed all CI checks. | |
| #547 build(deps): add constraint for Starlette | starbase | merged | Merged a dependency update pinning Starlette to a version unaffected by the BadHost CVE. Approved by two reviewers and passing all CI checks, the change adds a version constraint to mitigate the vulnerability. | |
| #376 build(deps): add constraint for Starlette | craft-store | merged | Merged to pin Starlette and mitigate the BadHost CVE. Approved by two reviewers and passed CI checks. The change adds a version constraint to the indirect dependency, resolving the security vulnerability. | |
| #1241 build(deps): add constraint for Starlette | rockcraft | merged | Merged change pins Starlette to a version unaffected by the BadHost CVE. Approved by two reviewers with all CI checks passing, the update enforces the secure dependency constraint across two files. |