build(deps): update dependency starlette to v0.47.2 [security] (hotfix/2.7)
Metadata
Current evaluation
Renovate security bump of Starlette 0.45.3 -> 0.47.2 merged into hotfix/2.7 (approved, +1/-1 in pyproject.toml), fixing CVE-2025-54121 event-loop blocking on large uploads. Main counterpart merged as #1180 (48f28aa7).
Resolution: closed resolved
Reason: PR #1181 was merged into the hotfix/2.7 branch after two approvals, bumping starlette to ==0.47.2 in pyproject.toml; the same change landed on main via #1180 (commit 48f28aa7).
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [starlette](https://redirect.github.com/encode/starlette) ([changelog](https://www.starlette.io/release-notes/)) | `==0.45.3` -> `==0.47.2` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
### GitHub Vulnerability Alerts
#### [CVE-2025-54121](https://redirect.github.com/encode/starlette/security/advisories/GHSA-2c2j-9gv5-cj73)
### Summary
When parsing a multi-part form with large files (greater than the [default max spool size](https://redirect.github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/formparsers.py#L126)) `starlette` will block the main thread to roll the file over to disk. This blocks the event thread which means we can't accept new connections.
### Details
Please see this discussion for details: [https://github.com/encode/starlette/discussions/2927#discussioncomment-13721403](https://redirect.github.com/encode/starlette/discussions/2927#discussioncomment-13721403). In summary the following UploadFile code (copied from [here](https://redirect.github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/datastructures.py#L436C5-L447C14)) has a minor bug. Instead of just checking for `self._in_memory` we should also check if the additional bytes will cause a rollover.
```python
@​property
def _in_memory(self) -> bool:
# check for SpooledTemporaryFile._rolled
rolled_to_disk = getattr(self.file, "_rolled", True)
return not rolled_to_disk
async def write(self, data: bytes) -> None:
if self.size is not None:
self.size += len(data)
if self._in_memory:
self.file.write(data)
else:
await run_in_threadpool(self.file.write, data)
```
I have already created a PR which fixes the problem: [https://github.com/encode/starlette/pull/2962](https://redirect.github.com/encode/starlette/pull/2962)
### PoC
See the discussion [here](https://redirect.github.com/encode/starlette/discussions/2927#discussioncomment-13721403) for steps on how to reproduce.
### Impact
To be honest, very low and not many users will be impacted. Parsing large forms is already CPU intensive so the additional IO block doesn't slow down `starlette` that much on systems with modern HDDs/SSDs. If someone is running on tape they might see a greater impact.
---
### Release Notes
<details>
<summary>encode/starlette (starlette)</summary>
### [`v0.47.2`](https://redirect.github.com/encode/starlette/releases/tag/0.47.2)
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.47.1...0.47.2)
#### Fixed
- Make `UploadFile` check for future rollover [#​2962](https://redirect.github.com/encode/starlette/pull/2962).
***
#### New Contributors
- [@​HonakerM](https://redirect.github.com/HonakerM) made their first contribution in [https://github.com/encode/starlette/pull/2962](https://redirect.github.com/encode/starlette/pull/2962)
**Full Changelog**: https://github.com/encode/starlette/compare/0.47.1...0.47.2
### [`v0.47.1`](https://redirect.github.com/encode/starlette/releases/tag/0.47.1): Version 0.47.1
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.47.0...0.47.1)
#### Fixed
- Use `Self` in `TestClient.__enter__` [#​2951](https://redirect.github.com/encode/starlette/pull/2951)
- Allow async exception handlers to type-check [#​2949](https://redirect.github.com/encode/starlette/pull/2949)
***
**Full Changelog**: https://github.com/encode/starlette/compare/0.47.0...0.47.1
### [`v0.47.0`](https://redirect.github.com/encode/starlette/releases/tag/0.47.0): Version 0.47.0
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.46.2...0.47.0)
#### Added
- Add support for ASGI `pathsend` extension [#​2671](https://redirect.github.com/encode/starlette/pull/2671).
- Add `partitioned` attribute to `Response.set_cookie` [#​2501](https://redirect.github.com/encode/starlette/pull/2501).
#### Changed
- Change `methods` parameter type from `list[str]` to `Collection[str]` [#​2903](https://redirect.github.com/encode/starlette/pull/2903).
- Replace `import typing` by `from typing import ...` in the whole codebase [#​2867](https://redirect.github.com/encode/starlette/pull/2867).
#### Fixed
- Mark `ExceptionMiddleware.http_exception` as async to prevent thread creation [#​2922](https://redirect.github.com/encode/starlette/pull/2922).
***
#### New Contributors
- [@​danlapid](https://redirect.github.com/danlapid) made their first contribution in [https://github.com/encode/starlette/pull/2922](https://redirect.github.com/encode/starlette/pull/2922)
- [@​Flecart](https://redirect.github.com/Flecart) made their first contribution in [https://github.com/encode/starlette/pull/2501](https://redirect.github.com/encode/starlette/pull/2501)
- [@​AllenSH12](https://redirect.github.com/AllenSH12) made their first contribution in [https://github.com/encode/starlette/pull/2936](https://redirect.github.com/encode/starlette/pull/2936)
- [@​waketzheng](https://redirect.github.com/waketzheng) made their first contribution in [https://github.com/encode/starlette/pull/2867](https://redirect.github.com/encode/starlette/pull/2867)
- [@​jonathanberthias](https://redirect.github.com/jonathanberthias) made their first contribution in [https://github.com/encode/starlette/pull/2903](https://redirect.github.com/encode/starlette/pull/2903)
**Full Changelog**: https://github.com/encode/starlette/compare/0.46.2...0.47.0
### [`v0.46.2`](https://redirect.github.com/encode/starlette/releases/tag/0.46.2): Version 0.46.2
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.46.1...0.46.2)
#### What's Changed
- Use correct index on backwards compatible logic in `TemplateResponse` by [@​alex-oleshkevich](https://redirect.github.com/alex-oleshkevich) in [https://github.com/encode/starlette/pull/2909](https://redirect.github.com/encode/starlette/pull/2909)
- Prevents reraising of exception from `BaseHTTPMiddleware` by [@​ramannanda9](https://redirect.github.com/ramannanda9) in [https://github.com/encode/starlette/pull/2911](https://redirect.github.com/encode/starlette/pull/2911)
#### New Contributors
- [@​ahryniv](https://redirect.github.com/ahryniv) made their first contribution in [https://github.com/encode/starlette/pull/2913](https://redirect.github.com/encode/starlette/pull/2913)
- [@​ramannanda9](https://redirect.github.com/ramannanda9) made their first contribution in [https://github.com/encode/starlette/pull/2911](https://redirect.github.com/encode/starlette/pull/2911)
**Full Changelog**: https://github.com/encode/starlette/compare/0.46.1...0.46.2
### [`v0.46.1`](https://redirect.github.com/encode/starlette/releases/tag/0.46.1): Version 0.46.1
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.46.0...0.46.1)
#### Fixed
- Allow relative directory path when `follow_symlinks=True` [#​2896](https://redirect.github.com/encode/starlette/pull/2896).
***
**Full Changelog**: https://github.com/encode/starlette/compare/0.46.0...0.46.1
### [`v0.46.0`](https://redirect.github.com/encode/starlette/releases/tag/0.46.0): Version 0.46.0
[Compare Source](https://redirect.github.com/encode/starlette/compare/0.45.3...0.46.0)
#### Added
- `GZipMiddleware`: Make sure `Vary` header is always added if a response can be compressed [#​2865](https://redirect.github.com/encode/starlette/pull/2865).
#### Fixed
- Raise exception from background task on BaseHTTPMiddleware [#​2812](https://redirect.github.com/encode/starlette/pull/2812).
- `GZipMiddleware`: Don't compress on server sent events [#​2871](https://redirect.github.com/encode/starlette/pull/2871).
#### Changed
- `MultiPartParser`: Rename `max_file_size` to `spool_max_size` [#​2780](https://redirect.github.com/encode/starlette/pull/2780).
#### Deprecated
- Add deprecated warning to `TestClient(timeout=...)` [#​2840](https://redirect.github.com/encode/starlette/pull/2840).
#### New Contributors
- [@​musicinmybrain](https://redirect.github.com/musicinmybrain) made their first contribution in [https://github.com/encode/starlette/pull/2855](https://redirect.github.com/encode/starlette/pull/2855)
- [@​WilliamDEdwards](https://redirect.github.com/WilliamDEdwards) made their first contribution in [https://github.com/encode/starlette/pull/2870](https://redirect.github.com/encode/starlette/pull/2870)
- [@​mattmess1221](https://redirect.github.com/mattmess1221) made their first contribution in [https://github.com/encode/starlette/pull/2865](https://redirect.github.com/encode/starlette/pull/2865)
**Full Changelog**: https://github.com/encode/starlette/compare/0.45.3...0.46.0
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-parts).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS40MC4wIiwidXBkYXRlZEluVmVyIjoiNDEuNDAuMCIsInRhcmdldEJyYW5jaCI6ImhvdGZpeC8yLjciLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Renovate security bump of Starlette 0.45.3 -> 0.47.2 merged into hotfix/2.7 (approved, +1/-1 in pyproject.toml), fixing CVE-2025-54121 event-loop blocking on large uploads. Main counterpart merged as #1180 (48f28aa7). | |
| stealth/space-bunny-alpha | — | closed resolved | Merged #1181 into hotfix/2.7, upgrading Starlette 0.45.3 to 0.47.2 to address CVE-2025-54121's large-upload thread-blocking flaw. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged automated upgrade of starlette from v0.45.3 to v0.47.2 to patch CVE-2025-54121, fixing a thread-blocking vulnerability during large uploads. Approved by two reviewers and merged into hotfix/2.7. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged security hotfix updating starlette from 0.45.3 to 0.47.2 to resolve CVE-2025-54121. The update fixes main thread blocking during large file uploads and was auto-generated by Renovate for the hotfix/2.7 branch. |
Update history
No update history recorded yet.
Related work
-
Duplicate Of:
canonical/craft-parts#1180
(confidence 95%)
Same Starlette 0.45.3 -> 0.47.2 security bump targeting main; merged as commit 48f28aa7.
-
Likely Fixed By:
starlette#2962
(confidence 85%)
Upstream fix for CVE-2025-54121 (UploadFile rollover check), released in Starlette 0.47.2 as cited in the PR body.
-
Related To:
canonical/craft-parts#1629
(confidence 60%)
Later 'build: bump starlette' commit (5363f3fd); current pyproject requires starlette>=1.3.1.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1180 build(deps): update dependency starlette to v0.47.2 [security] (main) | craft-parts | merged | Renovate security bump of starlette 0.45.3 → 0.47.2 merged into main as commit 48f28aa7 (PR #1180), fixing CVE-2025-54121 (event-loop blocking on large multipart uploads). | |
| #5120 build(deps): update dependency starlette to v0.40.0 [security] (hotfix/8.4) | snapcraft | merged | Renovate security bump of Starlette 0.38.4 -> 0.40.0 (CVE-2024-47874 multipart DoS) merged into hotfix/8.4 as commit fceb8c169; the equivalent main PR #5119 landed as 9fa59f7c4. | |
| #5119 build(deps): update dependency starlette to v0.40.0 [security] (main) | snapcraft | merged | Merged in #5119 as 9fa59f7c4, upgrading Starlette 0.38.5 to 0.40.0 to remediate CVE-2024-47874's multipart form-data denial-of-service vulnerability. | |
| #5118 build(deps): bump starlette from 0.38.5 to 0.40.0 | snapcraft | closed | Dependabot's starlette 0.38.5→0.40.0 PR touched no files (0 files changed) and was closed unmerged. The same security fix landed via Renovate PR #5119 (commit 9fa59f7c4, main) and #5120 (commit fceb8c169, hotfix/8.4). | |
| #742 build(deps): update deps with freeze-requirements.sh | rockcraft | merged | Merged PR #742 as 5d776281, upgrading Starlette 0.39.2 to 0.41.0 to address the CVE-2024-47874 denial-of-service vulnerability. | |
| #350 build(deps): bump starlette | imagecraft | merged | Merged PR #350 as commit 920399b, bumping Starlette from v0.52.1 to v1.2.0 to resolve an OSV advisory; all reported CI checks passed. | |
| #84 build(deps): bump starlette from 0.48.0 to 0.49.1 | debcraft | merged | Merged PR #84 in commit ee56b5f, updating Starlette from 0.48.0 to 0.49.1 to fix the FileResponse Range-header parsing vulnerability. | |
| #208 build(deps): bump starlette from 0.48.0 to 0.49.1 | craft-platforms | closed | Closed unmerged as redundant after Dependabot lock-file maintenance in #211 made Starlette current. | |
| #2716 build(deps): add constraint for Starlette | charmcraft | merged | Merged into main via commit 4a54393b, adding a Starlette dependency constraint to avoid versions affected by the BadHost CVE. | |
| #972 build(deps): add constraint for Starlette | craft-providers | merged | Merged in #972 via commit 7ed9c81, constraining indirect Starlette to >=1.0.1 to avoid versions affected by the BadHost CVE. |