build(deps): update deps with freeze-requirements.sh
Metadata
Current evaluation
Merged PR #742 as 5d776281, upgrading Starlette 0.39.2 to 0.41.0 to address the CVE-2024-47874 denial-of-service vulnerability.
Resolution: closed resolved
Reason: The approved dependency update was merged in commit 5d776281, regenerating frozen requirements with Starlette 0.41.0.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
[OSV scan report](https://osv.dev/vulnerability/GHSA-f96h-pmfr-66vw) shows that we are using an old version of `starlette` (0.39.2), a package that is a dependency of `sphinx-autobuild` package. According to [CVE-2024-47874](https://osv.dev/vulnerability/CVE-2024-47874), `starlette` < 0.40.0 suffers from a DoS vulnerability.
This PR updates `starlette` to version 0.41.0 using `freeze-requirements.sh` script.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #742 as 5d776281, upgrading Starlette 0.39.2 to 0.41.0 to address the CVE-2024-47874 denial-of-service vulnerability. | |
| stealth/space-bunny-alpha | — | closed resolved | PR #742 merged as commit 5d776281, re-freezing dev requirements via freeze-requirements.sh to bump starlette 0.39.2 -> 0.41.0, fixing the DoS in CVE-2024-47874 (GHSA-f96h-pmfr-66vw) via sphinx-autobuild. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR rockcraft#742 (commit 5d776281) by linostar bumped starlette 0.39.2 → 0.41.0 in frozen docs requirements via freeze-requirements.sh, clearing the CVE-2024-47874/GHSA-f96h-pmfr-66vw DoS advisory. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #742 (commit 5d776281), updating Starlette from 0.39.2 to 0.41.0 via freeze-requirements.sh to address the CVE-2024-47874 denial-of-service vulnerability. | |
| stealth/space-bunny-alpha | — | closed resolved | Dependabot-style PR merged as commit 5d776281, bumping starlette 0.39.2 to 0.41.0 via freeze-requirements.sh to clear the CVE-2024-47874 DoS advisory (GHSA-f96h-pmfr-66vw). | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #742 (5d776281), updating Starlette from 0.39.2 to 0.41.0 with freeze-requirements.sh to address CVE-2024-47874’s DoS vulnerability. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged dependency update to starlette 0.41.0 using freeze-requirements.sh, resolving CVE-2024-47874 DoS vulnerability. Approved by two reviewers and passed all CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged dependency update to starlette 0.41.0 using freeze-requirements.sh, patching CVE-2024-47874 DoS vulnerability previously present in 0.39.2. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5120 build(deps): update dependency starlette to v0.40.0 [security] (hotfix/8.4) | snapcraft | merged | Renovate security bump of Starlette 0.38.4 -> 0.40.0 (CVE-2024-47874 multipart DoS) merged into hotfix/8.4 as commit fceb8c169; the equivalent main PR #5119 landed as 9fa59f7c4. | |
| #5119 build(deps): update dependency starlette to v0.40.0 [security] (main) | snapcraft | merged | Merged in #5119 as 9fa59f7c4, upgrading Starlette 0.38.5 to 0.40.0 to remediate CVE-2024-47874's multipart form-data denial-of-service vulnerability. | |
| #1180 build(deps): update dependency starlette to v0.47.2 [security] (main) | craft-parts | merged | Renovate security bump of starlette 0.45.3 → 0.47.2 merged into main as commit 48f28aa7 (PR #1180), fixing CVE-2025-54121 (event-loop blocking on large multipart uploads). | |
| #1181 build(deps): update dependency starlette to v0.47.2 [security] (hotfix/2.7) | craft-parts | merged | Renovate security bump of Starlette 0.45.3 -> 0.47.2 merged into hotfix/2.7 (approved, +1/-1 in pyproject.toml), fixing CVE-2025-54121 event-loop blocking on large uploads. Main counterpart merged as #1180 (48f28aa7). | |
| #5118 build(deps): bump starlette from 0.38.5 to 0.40.0 | snapcraft | closed | Dependabot's starlette 0.38.5→0.40.0 PR touched no files (0 files changed) and was closed unmerged. The same security fix landed via Renovate PR #5119 (commit 9fa59f7c4, main) and #5120 (commit fceb8c169, hotfix/8.4). | |
| #350 build(deps): bump starlette | imagecraft | merged | Merged PR #350 as commit 920399b, bumping Starlette from v0.52.1 to v1.2.0 to resolve an OSV advisory; all reported CI checks passed. | |
| #84 build(deps): bump starlette from 0.48.0 to 0.49.1 | debcraft | merged | Merged PR #84 in commit ee56b5f, updating Starlette from 0.48.0 to 0.49.1 to fix the FileResponse Range-header parsing vulnerability. | |
| #208 build(deps): bump starlette from 0.48.0 to 0.49.1 | craft-platforms | closed | Closed unmerged as redundant after Dependabot lock-file maintenance in #211 made Starlette current. | |
| #2716 build(deps): add constraint for Starlette | charmcraft | merged | Merged into main via commit 4a54393b, adding a Starlette dependency constraint to avoid versions affected by the BadHost CVE. | |
| #1241 build(deps): add constraint for Starlette | rockcraft | merged | Merged PR #1241 in commit 703bbc20, constraining indirect Starlette to a version not affected by the BadHost CVE. |