build(deps): bump starlette from 0.48.0 to 0.49.1
Metadata
Current evaluation
Closed unmerged as redundant after Dependabot lock-file maintenance in #211 made Starlette current.
Resolution: closed superseded
Reason: Dependabot closed the PR after commenting that Starlette was already up to date and the bump was no longer needed. Lock-file maintenance PR #211 superseded the dependency update, so no PR #208 commit was merged.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [starlette](https://github.com/Kludex/starlette) from 0.48.0 to 0.49.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p>
<blockquote>
<h2>Version 0.49.1</h2>
<p>This release fixes a security vulnerability in the parsing logic of the <code>Range</code> header in <code>FileResponse</code>.</p>
<p>You can view the full security advisory: <a href="https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8">GHSA-7f5h-v6xp-fcq8</a></p>
<h2>Fixed</h2>
<ul>
<li>Optimize the HTTP ranges parsing logic <a href="https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5">4ea6e22b489ec388d6004cfbca52dd5b147127c5</a></li>
</ul>
<hr />
<p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/0.49.0...0.49.1">https://github.com/Kludex/starlette/compare/0.49.0...0.49.1</a></p>
<h2>Version 0.49.0</h2>
<h2>Added</h2>
<ul>
<li>Add <code>encoding</code> parameter to <code>Config</code> class <a href="https://redirect.github.com/Kludex/starlette/pull/2996">#2996</a>.</li>
<li>Support multiple cookie headers in <code>Request.cookies</code> <a href="https://redirect.github.com/Kludex/starlette/pull/3029">#3029</a>.</li>
<li>Use <code>Literal</code> type for <code>WebSocketEndpoint</code> encoding values <a href="https://redirect.github.com/Kludex/starlette/pull/3027">#3027</a>.</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Do not pollute exception context in <code>Middleware</code> when using <code>BaseHTTPMiddleware</code> <a href="https://redirect.github.com/Kludex/starlette/pull/2976">#2976</a>.</li>
</ul>
<hr />
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/TheWesDias"><code>@TheWesDias</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3017">Kludex/starlette#3017</a></li>
<li><a href="https://github.com/gmos2104"><code>@gmos2104</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3027">Kludex/starlette#3027</a></li>
<li><a href="https://github.com/secrett2633"><code>@secrett2633</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/2996">Kludex/starlette#2996</a></li>
<li><a href="https://github.com/adam-sikora"><code>@adam-sikora</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/2976">Kludex/starlette#2976</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/0.48.0...0.49.0">https://github.com/Kludex/starlette/compare/0.48.0...0.49.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p>
<blockquote>
<h2>0.49.1 (October 28, 2025)</h2>
<p>This release fixes a security vulnerability in the parsing logic of the <code>Range</code> header in <code>FileResponse</code>.</p>
<p>You can view the full security advisory: <a href="https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8">GHSA-7f5h-v6xp-fcq8</a></p>
<h4>Fixed</h4>
<ul>
<li>Optimize the HTTP ranges parsing logic <a href="https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5">4ea6e22b489ec388d6004cfbca52dd5b147127c5</a></li>
</ul>
<h2>0.49.0 (October 28, 2025)</h2>
<h4>Added</h4>
<ul>
<li>Add <code>encoding</code> parameter to <code>Config</code> class <a href="https://redirect.github.com/Kludex/starlette/pull/2996">#2996</a>.</li>
<li>Support multiple cookie headers in <code>Request.cookies</code> <a href="https://redirect.github.com/Kludex/starlette/pull/3029">#3029</a>.</li>
<li>Use <code>Literal</code> type for <code>WebSocketEndpoint</code> encoding values <a href="https://redirect.github.com/Kludex/starlette/pull/3027">#3027</a>.</li>
</ul>
<h4>Changed</h4>
<ul>
<li>Do not pollute exception context in <code>Middleware</code> when using <code>BaseHTTPMiddleware</code> <a href="https://redirect.github.com/Kludex/starlette/pull/2976">#2976</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/Kludex/starlette/commit/7e4b7428f273dbdc875dcd036d20804bcfc7b2ee"><code>7e4b742</code></a> Version 0.49.1 (<a href="https://redirect.github.com/Kludex/starlette/issues/3047">#3047</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5"><code>4ea6e22</code></a> Merge commit from fork</li>
<li><a href="https://github.com/Kludex/starlette/commit/7d88ea6f8ec8aa99cdb5fc7a10b88db5aadfdfee"><code>7d88ea6</code></a> Version 0.49.0 (<a href="https://redirect.github.com/Kludex/starlette/issues/3046">#3046</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/26d66bbfb05c7bbecbbb57106c65f33682f8174e"><code>26d66bb</code></a> Do not pollute exception context in Middleware (<a href="https://redirect.github.com/Kludex/starlette/issues/2976">#2976</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/a59397db889e3a96c4f34b1406957a3b92e1e8b5"><code>a59397d</code></a> Set encodings when reading config files (<a href="https://redirect.github.com/Kludex/starlette/issues/2996">#2996</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/3b7f0cbf598be305528a498a35089ce723060372"><code>3b7f0cb</code></a> test: add test for unknown status (<a href="https://redirect.github.com/Kludex/starlette/issues/3035">#3035</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/b09ce1a99d352ee6f5b896597f03a1a57507afcd"><code>b09ce1a</code></a> docs: fix legibility issues on sponsorship page (<a href="https://redirect.github.com/Kludex/starlette/issues/3039">#3039</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/0f0edcf8007412d9536bf8714c5815ce8f5dba4b"><code>0f0edcf</code></a> Revert "Add Marcelo Trylesinski to the license (<a href="https://redirect.github.com/Kludex/starlette/issues/3025">#3025</a>)" (<a href="https://redirect.github.com/Kludex/starlette/issues/3044">#3044</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/3912d6313730cc6004dfb4436e37dbc1a81db7c8"><code>3912d63</code></a> docs: add social icons (<a href="https://redirect.github.com/Kludex/starlette/issues/3038">#3038</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/4915a9309fcad58ac08b9fa550563d3287b531ad"><code>4915a93</code></a> Add discord to README/docs (<a href="https://redirect.github.com/Kludex/starlette/issues/3034">#3034</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/Kludex/starlette/compare/0.48.0...0.49.1">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/canonical/craft-platforms/network/alerts).
</details>
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged as redundant after Dependabot lock-file maintenance in #211 made Starlette current. | |
| stealth/space-bunny-alpha | — | closed superseded | Dependabot's starlette 0.48.0→0.49.1 bump was closed unmerged; bot commented (2026-02-11) that starlette was already up-to-date, making the PR redundant. | |
| qwen/qwen3.6-35b-a3b | — | closed superseded | Closed by Dependabot because starlette was already updated to a newer version by another PR, making this dependency bump redundant. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Superseded By:
canonical/craft-platforms#211
(confidence 90%)
The subsequent lock-file maintenance update made the dedicated Starlette bump redundant.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5118 build(deps): bump starlette from 0.38.5 to 0.40.0 | snapcraft | closed | Dependabot's starlette 0.38.5→0.40.0 PR touched no files (0 files changed) and was closed unmerged. The same security fix landed via Renovate PR #5119 (commit 9fa59f7c4, main) and #5120 (commit fceb8c169, hotfix/8.4). | |
| #350 build(deps): bump starlette | imagecraft | merged | Merged PR #350 as commit 920399b, bumping Starlette from v0.52.1 to v1.2.0 to resolve an OSV advisory; all reported CI checks passed. | |
| #84 build(deps): bump starlette from 0.48.0 to 0.49.1 | debcraft | merged | Merged PR #84 in commit ee56b5f, updating Starlette from 0.48.0 to 0.49.1 to fix the FileResponse Range-header parsing vulnerability. | |
| #1181 build(deps): update dependency starlette to v0.47.2 [security] (hotfix/2.7) | craft-parts | merged | Renovate security bump of Starlette 0.45.3 -> 0.47.2 merged into hotfix/2.7 (approved, +1/-1 in pyproject.toml), fixing CVE-2025-54121 event-loop blocking on large uploads. Main counterpart merged as #1180 (48f28aa7). | |
| #5120 build(deps): update dependency starlette to v0.40.0 [security] (hotfix/8.4) | snapcraft | merged | Renovate security bump of Starlette 0.38.4 -> 0.40.0 (CVE-2024-47874 multipart DoS) merged into hotfix/8.4 as commit fceb8c169; the equivalent main PR #5119 landed as 9fa59f7c4. | |
| #1180 build(deps): update dependency starlette to v0.47.2 [security] (main) | craft-parts | merged | Renovate security bump of starlette 0.45.3 → 0.47.2 merged into main as commit 48f28aa7 (PR #1180), fixing CVE-2025-54121 (event-loop blocking on large multipart uploads). | |
| #972 build(deps): add constraint for Starlette | craft-providers | merged | Merged in #972 via commit 7ed9c81, constraining indirect Starlette to >=1.0.1 to avoid versions affected by the BadHost CVE. | |
| #5119 build(deps): update dependency starlette to v0.40.0 [security] (main) | snapcraft | merged | Merged in #5119 as 9fa59f7c4, upgrading Starlette 0.38.5 to 0.40.0 to remediate CVE-2024-47874's multipart form-data denial-of-service vulnerability. | |
| #1629 build: bump starlette | craft-parts | merged | Merged PR #1629 as commit 5363f3fd, bumping Starlette to resolve an OSV; remaining python-apt findings were judged false positives. | |
| #376 build(deps): add constraint for Starlette | craft-store | merged | Merged #376 via ed08e00, adding a Starlette >=1.0.1 constraint to avoid versions affected by the BadHost CVE. |