build(deps): update deps with freeze-requirements.sh
Metadata
Current evaluation
Merged dependency update to starlette 0.41.0 using freeze-requirements.sh, resolving CVE-2024-47874 DoS vulnerability. Approved by two reviewers and passed all CI checks.
Suggested action: —
No scores available.
Issue body
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
[OSV scan report](https://osv.dev/vulnerability/GHSA-f96h-pmfr-66vw) shows that we are using an old version of `starlette` (0.39.2), a package that is a dependency of `sphinx-autobuild` package. According to [CVE-2024-47874](https://osv.dev/vulnerability/CVE-2024-47874), `starlette` < 0.40.0 suffers from a DoS vulnerability.
This PR updates `starlette` to version 0.41.0 using `freeze-requirements.sh` script.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged dependency update to starlette 0.41.0 using freeze-requirements.sh, resolving CVE-2024-47874 DoS vulnerability. Approved by two reviewers and passed all CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged dependency update to starlette 0.41.0 using freeze-requirements.sh, patching CVE-2024-47874 DoS vulnerability previously present in 0.39.2. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged update to starlette 0.41.0 to resolve CVE-2024-47874 DoS vulnerability. Applied via freeze-requirements.sh by external contributor linostar. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #5119 build(deps): update dependency starlette to v0.40.0 [security] (main) | snapcraft | merged | Merged dependency update upgrading starlette to v0.40.0 to resolve CVE-2024-47874, a denial-of-service vulnerability in multipart/form-data parsing. Approved by two reviewers with passing CI checks. | |
| #1180 build(deps): update dependency starlette to v0.47.2 [security] (main) | craft-parts | merged | Merged automated update upgrading starlette from 0.45.3 to 0.47.2 to resolve CVE-2025-54121, preventing main thread blocking during large file uploads. Approved by two reviewers and merged to main. | |
| #1181 build(deps): update dependency starlette to v0.47.2 [security] (hotfix/2.7) | craft-parts | merged | Merged automated upgrade of starlette from v0.45.3 to v0.47.2 to patch CVE-2025-54121, fixing a thread-blocking vulnerability during large uploads. Approved by two reviewers and merged into hotfix/2.7. | |
| #5120 build(deps): update dependency starlette to v0.40.0 [security] (hotfix/8.4) | snapcraft | merged | Merged security hotfix updating starlette from 0.38.4 to 0.40.0 on the hotfix/8.4 branch. Resolves CVE-2024-47874 DoS vulnerability in multipart/form-data parsing. Approved by two reviewers and passed CI. | |
| #350 build(deps): bump starlette | imagecraft | merged | Merged dependency update bumping starlette from v0.52.1 to v1.2.0 to resolve an OSV vulnerability. Approved by two reviewers and passed all CI checks prior to integration. | |
| #547 build(deps): add constraint for Starlette | starbase | merged | Merged a dependency update pinning Starlette to a version unaffected by the BadHost CVE. Approved by two reviewers and passing all CI checks, the change adds a version constraint to mitigate the vulnerability. | |
| #5118 build(deps): bump starlette from 0.38.5 to 0.40.0 | snapcraft | closed | Closed after approval to update starlette to 0.40.0, addressing a multipart/form-data DoS vulnerability. | |
| #228 build(deps): add constraint for Starlette | craft-platforms | merged | Merged to pin the Starlette indirect dependency, mitigating the BadHost CVE. Approved by two reviewers and integrated after passing the majority of CI checks. | |
| #376 build(deps): add constraint for Starlette | craft-store | merged | Merged to pin Starlette and mitigate the BadHost CVE. Approved by two reviewers and passed CI checks. The change adds a version constraint to the indirect dependency, resolving the security vulnerability. | |
| #190 build(deps): add constraint for Starlette | craft-grammar | merged | Merged to pin the Starlette dependency to a secure version, mitigating the BadHost CVE. Approved by two reviewers and passed CI checks. The update applied minor constraint changes across two files. |