build(deps): bump starlette from 0.48.0 to 0.49.1
Metadata
Current evaluation
Merged PR #84 in commit ee56b5f, updating Starlette from 0.48.0 to 0.49.1 to fix the FileResponse Range-header parsing vulnerability.
Resolution: closed resolved
Reason: PR #84 was approved and merged as commit ee56b5f with all CI checks passing. Starlette 0.49.1 includes upstream commit 4ea6e22, fixing the FileResponse Range-header vulnerability.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [starlette](https://github.com/Kludex/starlette) from 0.48.0 to 0.49.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p>
<blockquote>
<h2>Version 0.49.1</h2>
<p>This release fixes a security vulnerability in the parsing logic of the <code>Range</code> header in <code>FileResponse</code>.</p>
<p>You can view the full security advisory: <a href="https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8">GHSA-7f5h-v6xp-fcq8</a></p>
<h2>Fixed</h2>
<ul>
<li>Optimize the HTTP ranges parsing logic <a href="https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5">4ea6e22b489ec388d6004cfbca52dd5b147127c5</a></li>
</ul>
<hr />
<p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/0.49.0...0.49.1">https://github.com/Kludex/starlette/compare/0.49.0...0.49.1</a></p>
<h2>Version 0.49.0</h2>
<h2>Added</h2>
<ul>
<li>Add <code>encoding</code> parameter to <code>Config</code> class <a href="https://redirect.github.com/Kludex/starlette/pull/2996">#2996</a>.</li>
<li>Support multiple cookie headers in <code>Request.cookies</code> <a href="https://redirect.github.com/Kludex/starlette/pull/3029">#3029</a>.</li>
<li>Use <code>Literal</code> type for <code>WebSocketEndpoint</code> encoding values <a href="https://redirect.github.com/Kludex/starlette/pull/3027">#3027</a>.</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Do not pollute exception context in <code>Middleware</code> when using <code>BaseHTTPMiddleware</code> <a href="https://redirect.github.com/Kludex/starlette/pull/2976">#2976</a>.</li>
</ul>
<hr />
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/TheWesDias"><code>@TheWesDias</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3017">Kludex/starlette#3017</a></li>
<li><a href="https://github.com/gmos2104"><code>@gmos2104</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3027">Kludex/starlette#3027</a></li>
<li><a href="https://github.com/secrett2633"><code>@secrett2633</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/2996">Kludex/starlette#2996</a></li>
<li><a href="https://github.com/adam-sikora"><code>@adam-sikora</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/2976">Kludex/starlette#2976</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/0.48.0...0.49.0">https://github.com/Kludex/starlette/compare/0.48.0...0.49.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p>
<blockquote>
<h2>0.49.1 (October 28, 2025)</h2>
<p>This release fixes a security vulnerability in the parsing logic of the <code>Range</code> header in <code>FileResponse</code>.</p>
<p>You can view the full security advisory: <a href="https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8">GHSA-7f5h-v6xp-fcq8</a></p>
<h4>Fixed</h4>
<ul>
<li>Optimize the HTTP ranges parsing logic <a href="https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5">4ea6e22b489ec388d6004cfbca52dd5b147127c5</a></li>
</ul>
<h2>0.49.0 (October 28, 2025)</h2>
<h4>Added</h4>
<ul>
<li>Add <code>encoding</code> parameter to <code>Config</code> class <a href="https://redirect.github.com/Kludex/starlette/pull/2996">#2996</a>.</li>
<li>Support multiple cookie headers in <code>Request.cookies</code> <a href="https://redirect.github.com/Kludex/starlette/pull/3029">#3029</a>.</li>
<li>Use <code>Literal</code> type for <code>WebSocketEndpoint</code> encoding values <a href="https://redirect.github.com/Kludex/starlette/pull/3027">#3027</a>.</li>
</ul>
<h4>Changed</h4>
<ul>
<li>Do not pollute exception context in <code>Middleware</code> when using <code>BaseHTTPMiddleware</code> <a href="https://redirect.github.com/Kludex/starlette/pull/2976">#2976</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/Kludex/starlette/commit/7e4b7428f273dbdc875dcd036d20804bcfc7b2ee"><code>7e4b742</code></a> Version 0.49.1 (<a href="https://redirect.github.com/Kludex/starlette/issues/3047">#3047</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5"><code>4ea6e22</code></a> Merge commit from fork</li>
<li><a href="https://github.com/Kludex/starlette/commit/7d88ea6f8ec8aa99cdb5fc7a10b88db5aadfdfee"><code>7d88ea6</code></a> Version 0.49.0 (<a href="https://redirect.github.com/Kludex/starlette/issues/3046">#3046</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/26d66bbfb05c7bbecbbb57106c65f33682f8174e"><code>26d66bb</code></a> Do not pollute exception context in Middleware (<a href="https://redirect.github.com/Kludex/starlette/issues/2976">#2976</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/a59397db889e3a96c4f34b1406957a3b92e1e8b5"><code>a59397d</code></a> Set encodings when reading config files (<a href="https://redirect.github.com/Kludex/starlette/issues/2996">#2996</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/3b7f0cbf598be305528a498a35089ce723060372"><code>3b7f0cb</code></a> test: add test for unknown status (<a href="https://redirect.github.com/Kludex/starlette/issues/3035">#3035</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/b09ce1a99d352ee6f5b896597f03a1a57507afcd"><code>b09ce1a</code></a> docs: fix legibility issues on sponsorship page (<a href="https://redirect.github.com/Kludex/starlette/issues/3039">#3039</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/0f0edcf8007412d9536bf8714c5815ce8f5dba4b"><code>0f0edcf</code></a> Revert "Add Marcelo Trylesinski to the license (<a href="https://redirect.github.com/Kludex/starlette/issues/3025">#3025</a>)" (<a href="https://redirect.github.com/Kludex/starlette/issues/3044">#3044</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/3912d6313730cc6004dfb4436e37dbc1a81db7c8"><code>3912d63</code></a> docs: add social icons (<a href="https://redirect.github.com/Kludex/starlette/issues/3038">#3038</a>)</li>
<li><a href="https://github.com/Kludex/starlette/commit/4915a9309fcad58ac08b9fa550563d3287b531ad"><code>4915a93</code></a> Add discord to README/docs (<a href="https://redirect.github.com/Kludex/starlette/issues/3034">#3034</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/Kludex/starlette/compare/0.48.0...0.49.1">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
You can trigger a rebase of this PR by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/canonical/debcraft/network/alerts).
</details>
> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #84 in commit ee56b5f, updating Starlette from 0.48.0 to 0.49.1 to fix the FileResponse Range-header parsing vulnerability. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #84 in commit ee56b5f, updating Starlette from 0.48.0 to 0.49.1 to patch the FileResponse Range-header parsing vulnerability. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged dependabot update to bump starlette from 0.48.0 to 0.49.1. The upgrade patches a FileResponse Range header security vulnerability and adds minor features. CI checks passed and reviewers approved the merge. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged Dependabot PR bumping starlette from 0.48.0 to 0.49.1. The update applies new features, optimizations, and a critical security fix for FileResponse Range header parsing. Successfully integrated into the codebase. |
Update history
No update history recorded yet.
Related work
-
Related To:
starlette#3047
(confidence 95%)
Starlette 0.49.1 release included the upstream Range-header parsing fix in commit 4ea6e22.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #208 build(deps): bump starlette from 0.48.0 to 0.49.1 | craft-platforms | closed | Closed unmerged as redundant after Dependabot lock-file maintenance in #211 made Starlette current. | |
| #5118 build(deps): bump starlette from 0.38.5 to 0.40.0 | snapcraft | closed | Dependabot's starlette 0.38.5→0.40.0 PR touched no files (0 files changed) and was closed unmerged. The same security fix landed via Renovate PR #5119 (commit 9fa59f7c4, main) and #5120 (commit fceb8c169, hotfix/8.4). | |
| #350 build(deps): bump starlette | imagecraft | merged | Merged PR #350 as commit 920399b, bumping Starlette from v0.52.1 to v1.2.0 to resolve an OSV advisory; all reported CI checks passed. | |
| #1180 build(deps): update dependency starlette to v0.47.2 [security] (main) | craft-parts | merged | Renovate security bump of starlette 0.45.3 → 0.47.2 merged into main as commit 48f28aa7 (PR #1180), fixing CVE-2025-54121 (event-loop blocking on large multipart uploads). | |
| #5120 build(deps): update dependency starlette to v0.40.0 [security] (hotfix/8.4) | snapcraft | merged | Renovate security bump of Starlette 0.38.4 -> 0.40.0 (CVE-2024-47874 multipart DoS) merged into hotfix/8.4 as commit fceb8c169; the equivalent main PR #5119 landed as 9fa59f7c4. | |
| #5119 build(deps): update dependency starlette to v0.40.0 [security] (main) | snapcraft | merged | Merged in #5119 as 9fa59f7c4, upgrading Starlette 0.38.5 to 0.40.0 to remediate CVE-2024-47874's multipart form-data denial-of-service vulnerability. | |
| #1181 build(deps): update dependency starlette to v0.47.2 [security] (hotfix/2.7) | craft-parts | merged | Renovate security bump of Starlette 0.45.3 -> 0.47.2 merged into hotfix/2.7 (approved, +1/-1 in pyproject.toml), fixing CVE-2025-54121 event-loop blocking on large uploads. Main counterpart merged as #1180 (48f28aa7). | |
| #742 build(deps): update deps with freeze-requirements.sh | rockcraft | merged | Merged PR #742 as 5d776281, upgrading Starlette 0.39.2 to 0.41.0 to address the CVE-2024-47874 denial-of-service vulnerability. | |
| #357 build(deps): bump cryptography and starlette | imagecraft | merged | Merged PR #357 (commit a868324) bumping cryptography v46.0.7 to v49.0.0 and adding a starlette>=1.3.1 constraint to clear OSV findings; approved with 1 reviewer and most CI checks passing. | |
| #972 build(deps): add constraint for Starlette | craft-providers | merged | Merged in #972 via commit 7ed9c81, constraining indirect Starlette to >=1.0.1 to avoid versions affected by the BadHost CVE. |