← Back to issue list

build(deps): bump starlette

View original Github issue

Metadata

Project
imagecraft
Number
#350
Type
pull request
State
merged
Author
smethnani
Labels
—
Created
Updated
Closed

Current evaluation

Merged PR #350 as commit 920399b, bumping Starlette from v0.52.1 to v1.2.0 to resolve an OSV advisory; all reported CI checks passed.

Resolution: closed resolved

Reason: PR #350 was approved and merged as commit 920399b. The dependency update was applied and all lint, test, build, and security checks passed.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Bumps `starlette` from v0.52.1 -> v1.2.0 to resolve an osv --- - [x] I've followed the [contribution guidelines](https://github.com/canonical/imagecraft/blob/main/CONTRIBUTING.md). - [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [ ] I've successfully run `make lint && make test`. - [ ] I've added or updated any relevant documentation. - [ ] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged PR #350 as commit 920399b, bumping Starlette from v0.52.1 to v1.2.0 to resolve an OSV advisory; all reported CI checks passed.
stealth/space-bunny-alpha — closed resolved Merged the Starlette dependency update from v0.52.1 to v1.2.0 to address an OSV advisory; all reported CI checks passed.
qwen/qwen3.6-35b-a3b — — Merged dependency update bumping starlette from v0.52.1 to v1.2.0 to resolve an OSV vulnerability. Approved by two reviewers and passed all CI checks prior to integration.
qwen3.6-35b-a3b-mtp-q6 — — Merged dependency update bumping starlette from v0.52.1 to v1.2.0 to resolve an OSV vulnerability. Authored by maintainer smethnani, the change was successfully integrated into the repository.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#1629 build: bump starlette craft-parts merged Merged PR #1629 as commit 5363f3fd, bumping Starlette to resolve an OSV; remaining python-apt findings were judged false positives.
85%
#208 build(deps): bump starlette from 0.48.0 to 0.49.1 craft-platforms closed Closed unmerged as redundant after Dependabot lock-file maintenance in #211 made Starlette current.
84%
#5118 build(deps): bump starlette from 0.38.5 to 0.40.0 snapcraft closed Dependabot's starlette 0.38.5→0.40.0 PR touched no files (0 files changed) and was closed unmerged. The same security fix landed via Renovate PR #5119 (commit 9fa59f7c4, main) and #5120 (commit fceb8c169, hotfix/8.4).
84%
#84 build(deps): bump starlette from 0.48.0 to 0.49.1 debcraft merged Merged PR #84 in commit ee56b5f, updating Starlette from 0.48.0 to 0.49.1 to fix the FileResponse Range-header parsing vulnerability.
82%
#230 build(autogen): bump starlette for OSV imagecraft merged Merged as commit cd48836, bumping Starlette in imagecraft's lockfile (uv lock --upgrade-package starlette) to clear an OSV advisory; all CI checks passed.
82%
#5120 build(deps): update dependency starlette to v0.40.0 [security] (hotfix/8.4) snapcraft merged Renovate security bump of Starlette 0.38.4 -> 0.40.0 (CVE-2024-47874 multipart DoS) merged into hotfix/8.4 as commit fceb8c169; the equivalent main PR #5119 landed as 9fa59f7c4.
81%
#972 build(deps): add constraint for Starlette craft-providers merged Merged in #972 via commit 7ed9c81, constraining indirect Starlette to >=1.0.1 to avoid versions affected by the BadHost CVE.
80%
#357 build(deps): bump cryptography and starlette imagecraft merged Merged PR #357 (commit a868324) bumping cryptography v46.0.7 to v49.0.0 and adding a starlette>=1.3.1 constraint to clear OSV findings; approved with 1 reviewer and most CI checks passing.
80%
#1181 build(deps): update dependency starlette to v0.47.2 [security] (hotfix/2.7) craft-parts merged Renovate security bump of Starlette 0.45.3 -> 0.47.2 merged into hotfix/2.7 (approved, +1/-1 in pyproject.toml), fixing CVE-2025-54121 event-loop blocking on large uploads. Main counterpart merged as #1180 (48f28aa7).
80%
#1180 build(deps): update dependency starlette to v0.47.2 [security] (main) craft-parts merged Renovate security bump of starlette 0.45.3 → 0.47.2 merged into main as commit 48f28aa7 (PR #1180), fixing CVE-2025-54121 (event-loop blocking on large multipart uploads).
80%