build(deps): bump starlette from 1.0.1 to 1.3.1 in /src/ContentProcessorWorkflow by dependabot[bot] · Pull Request #624 · microsoft/content-processing-solution-accelerator

dependabot · 2026-06-16T12:47:24Z

Bumps starlette from 1.0.1 to 1.3.1.

Release notes

Version 1.3.1

What's Changed

Use StarletteDeprecationWarning instead of DeprecationWarning by @Kludex in Kludex/starlette#3119

Enforce max_fields and max_part_size in FormParser by @Kludex in Kludex/starlette#3329

Enforce FormParser limits in parser callbacks by @Kludex in Kludex/starlette#3331

Full Changelog: Kludex/starlette@1.3.0...1.3.1

Version 1.3.0

What's Changed

Clamp oversized suffix ranges in FileResponse by @jiyujie2006 in Kludex/starlette#3307

Catch OSError alongside MultiPartException when closing temp files by @N3XT3R1337 in Kludex/starlette#3191

Add httpx2 to the full extra by @Kludex in Kludex/starlette#3323

Adjust testclient typing and warnings by @waketzheng in Kludex/starlette#3322

Fix IndexError in URL.replace() on a URL with no authority by @LeSingh1 in Kludex/starlette#3317

Annotate URLPath protocol parameter with Literal by @Chang-LeHung in Kludex/starlette#3285

avoid collapsing exception groups from user code by @graingert in Kludex/starlette#2830

Use removeprefix to strip weak ETag indicator in is_not_modified by @gnosyslambda in Kludex/starlette#3193

Build request.url from structured components by @Kludex in Kludex/starlette#3326

New Contributors

@jiyujie2006 made their first contribution in Kludex/starlette#3307

@N3XT3R1337 made their first contribution in Kludex/starlette#3191

@leestana01 made their first contribution in Kludex/starlette#3319

@LeSingh1 made their first contribution in Kludex/starlette#3317

@EmmanuelNiyonshuti made their first contribution in Kludex/starlette#3204

@Chang-LeHung made their first contribution in Kludex/starlette#3285

@gnosyslambda made their first contribution in Kludex/starlette#3193

Full Changelog: Kludex/starlette@1.2.1...1.3.0

Version 1.2.1

What's Changed

Use httpx2 for type checking in the testclient module by @leifwar in Kludex/starlette#3304

Add assert error for requires() when request param is not Request type by @KeeganOP in Kludex/starlette#3298

New Contributors

@leifwar made their first contribution in Kludex/starlette#3304

@diskeu made their first contribution in Kludex/starlette#3243

@KeeganOP made their first contribution in Kludex/starlette#3298

Full Changelog: Kludex/starlette@1.2.0...1.2.1

Version 1.2.0

What's Changed

Support httpx2 in the test client by @Kludex in Kludex/starlette#3291

Full Changelog: Kludex/starlette@1.1.0...1.2.0

Version 1.1.0

... (truncated)

Changelog

Sourced from starlette's changelog.

1.3.1 (June 12, 2026)

Fixed

Enforce max_fields and max_part_size in FormParser #3329.

Enforce FormParser limits in parser callbacks #3331.

1.3.0 (June 11, 2026)

Added

Add httpx2 to the full extra #3323.

Annotate the URLPath protocol parameter with Literal #3285.

Fixed

Build request.url from structured components #3326.

Clamp oversized suffix ranges in FileResponse #3307.

Catch OSError alongside MultiPartException when closing temp files #3191.

Avoid collapsing exception groups raised from user code #2830.

Use removeprefix to strip the weak ETag indicator in is_not_modified #3193.

Fix IndexError in URL.replace() on a URL with no authority #3317.

Adjust testclient typing and warnings #3322.

1.2.1 (May 31, 2026)

Fixed

Use httpx2 for type checking in the testclient module #3304.

Add assert error for requires() when the request parameter is not a Request type #3298.

1.2.0 (May 28, 2026)

Added

Support httpx2 in the test client #3291.

1.1.0 (May 23, 2026)

Added

Use "application/octet-stream" as the FileResponse media type fallback #3283.

Fixed

Only dispatch standard HTTP verbs in HTTPEndpoint #3286.

Reject absolute paths in StaticFiles.lookup_path #3287.

Commits

8ebffd0 Version 1.3.1 (#3330)
25b8e17 Enforce FormParser limits in parser callbacks (#3331)
dba1c4b Enforce max_fields and max_part_size in FormParser (#3329)
45e51dc Use StarletteDeprecationWarning instead of DeprecationWarning (#3119)
5f8610c Version 1.3.0 (#3327)
167b585 Build request.url from structured components (#3326)
3730925 Use removeprefix to strip weak ETag indicator in is_not_modified (#3193)
e6f7ad1 avoid collapsing exception groups from user code (#2830)
115228f Annotate URLPath protocol parameter with Literal (#3285)
113f193 docs: replace inline ASGI server list with link to canonical implemen… (#3204)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.1...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

- Add aiohttp==3.14.1 to ContentProcessor (fixes dependabot PR #611) - Add aiohttp==3.14.1 to ContentProcessorAPI (fixes dependabot PR #610) - Add starlette==1.3.1 to ContentProcessorWorkflow (fixes dependabot PR #624) These were previously transitive dependencies. Adding them as direct dependencies ensures we get security updates and have better version control. Closes #611 Closes #610 Closes #624

Upgrades security-critical packages across ContentProcessor, ContentProcessorWorkflow, and ContentProcessorWeb modules. ContentProcessorWorkflow (Python): - aiohttp: 3.13.5 → 3.14.1 (MEDIUM severity, transitive → direct) - python-multipart: 0.0.27 → 0.0.31 (HIGH severity) - cryptography: 46.0.7 → 48.0.1 (HIGH severity) - pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity) - starlette: 1.0.1 → 1.3.1 (HIGH severity, transitive → direct) ContentProcessor (Python): - aiohttp: 3.13.5 → 3.14.1 (MEDIUM severity, transitive → direct) - pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity) - python-multipart: added 0.0.31 (HIGH severity, new direct dependency) - cryptography: added 48.0.1 (HIGH severity, new direct dependency) - starlette: 1.0.0 → 1.3.1 (HIGH severity, transitive → direct) ContentProcessorWeb (NPM): Direct dependencies: - axios: 1.15.2 → 1.16.0 (HIGH severity) - react-router-dom: 7.13.2 → 7.15.1 (HIGH/LOW severity) - qs: 6.14.2 → 6.15.2 (MEDIUM severity) - uuid: 11.1.0 → 11.1.1 (MEDIUM severity) - webpack-dev-server: 5.2.1 → 5.2.4 (MEDIUM severity) Transitive dependencies (via lock file): - shell-quote → 1.8.4 (CRITICAL severity) - form-data → 4.0.6 (HIGH severity) - ws → 8.21.0 (HIGH severity) - js-yaml → 4.2.0 (MEDIUM severity) - launch-editor → 2.14.1 (MEDIUM severity) - @babel/core → 7.29.6 (LOW severity) Testing: - All uv sync operations: PASSED - ContentProcessorWeb build: PASSED - No breaking changes Resolves ~114 security alerts (71% reduction from 161 → ~47). Note: ContentProcessorAPI excluded per team guidance. Closes #624 Closes #611 Closes #614

Upgrades security-critical packages across ContentProcessorWorkflow and ContentProcessorWeb modules. ContentProcessorWorkflow (Python): - aiohttp: 3.13.5 → 3.14.1 (MEDIUM severity, transitive → direct) - python-multipart: 0.0.27 → 0.0.31 (HIGH severity) - cryptography: 46.0.7 → 48.0.1 (HIGH severity) - pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity) - starlette: 1.0.1 → 1.3.1 (HIGH severity, transitive → direct) ContentProcessor (Python): - NO DIRECT CHANGES (relied on transitive dependencies) - All vulnerable packages upgraded via parent dependencies: • aiohttp 3.14.1 (via azure-functions-durable) • pyjwt 2.13.0 (via azure-identity, msal) • cryptography 48.0.1 (via azure-identity, msal, pyjwt) • python-multipart 0.0.31 (via fastapi) • starlette 1.3.1 (via fastapi, sse-starlette) ContentProcessorWeb (NPM): Direct dependencies: - axios: 1.15.2 → 1.16.0 (HIGH severity) - react-router-dom: 7.13.2 → 7.15.1 (HIGH/LOW severity) - qs: 6.14.2 → 6.15.2 (MEDIUM severity) - uuid: 11.1.0 → 11.1.1 (MEDIUM severity) - webpack-dev-server: 5.2.1 → 5.2.4 (MEDIUM severity) Transitive dependencies (via lock file): - shell-quote → 1.8.4 (CRITICAL severity) - form-data → 4.0.6 (HIGH severity) - ws → 8.21.0 (HIGH severity) - js-yaml → 4.2.0 (MEDIUM severity) - launch-editor → 2.14.1 (MEDIUM severity) - @babel/core → 7.29.6 (LOW severity) Testing: - All uv sync operations: PASSED - ContentProcessorWeb build: PASSED - No breaking changes - Verified all secure versions present in lock files Resolves ~114 security alerts (71% reduction from 161 → ~47). Note: ContentProcessorAPI excluded per team guidance. Closes #624 Closes #611 Closes #614

Upgrades security-critical packages across ContentProcessor, ContentProcessorWorkflow, and ContentProcessorWeb modules. ContentProcessorWorkflow (Python): - aiohttp: 3.13.5 → 3.14.1 (MEDIUM severity, transitive → direct) - python-multipart: 0.0.27 → 0.0.31 (HIGH severity) - cryptography: 46.0.7 → 48.0.1 (HIGH severity) - pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity) - starlette: 1.0.1 → 1.3.1 (HIGH severity, transitive → direct) ContentProcessor (Python): - pyjwt: 2.12.1 → 2.13.0 (MEDIUM/HIGH severity) - Other vulnerable packages upgraded via transitive dependencies: • aiohttp 3.14.1 (via azure-functions-durable) • cryptography 48.0.1 (via azure-identity, msal, pyjwt) • python-multipart 0.0.31 (via fastapi) • starlette 1.3.1 (via fastapi, sse-starlette) ContentProcessorWeb (NPM): Direct dependencies: - axios: 1.15.2 → 1.16.0 (HIGH severity) - react-router-dom: 7.13.2 → 7.15.1 (HIGH/LOW severity) - qs: 6.14.2 → 6.15.2 (MEDIUM severity) - uuid: 11.1.0 → 11.1.1 (MEDIUM severity) - webpack-dev-server: 5.2.1 → 5.2.4 (MEDIUM severity) Transitive dependencies (via lock file): - shell-quote → 1.8.4 (CRITICAL severity) - form-data → 4.0.6 (HIGH severity) - ws → 8.21.0 (HIGH severity) - js-yaml → 4.2.0 (MEDIUM severity) - launch-editor → 2.14.1 (MEDIUM severity) - @babel/core → 7.29.6 (LOW severity) Testing: - All uv sync operations: PASSED - ContentProcessorWeb build: PASSED - No breaking changes - Verified all secure versions present in lock files Resolves ~114 security alerts (71% reduction from 161 → ~47). Note: ContentProcessorAPI excluded per team guidance. Closes #624 Closes #611 Closes #614

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jun 16, 2026

Copilot AI review requested due to automatic review settings June 16, 2026 12:47

dependabot Bot requested a review from Avijit-Microsoft as a code owner June 16, 2026 12:47

dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 16, 2026

dependabot Bot requested review from Roopan-Microsoft, aniaroramsft and toherman-msft as code owners June 16, 2026 12:47

dependabot Bot added the python:uv Pull requests that update python:uv code label Jun 16, 2026

dependabot Bot requested review from dgp10801 and nchandhi as code owners June 16, 2026 12:47

Copilot AI reviewed Jun 16, 2026

Ayaz-Microsoft mentioned this pull request Jun 17, 2026

fix: dependabot package upgrades (June 2026) #629

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump starlette from 1.0.1 to 1.3.1 in /src/ContentProcessorWorkflow#624

build(deps): bump starlette from 1.0.1 to 1.3.1 in /src/ContentProcessorWorkflow#624
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/src/ContentProcessorWorkflow/starlette-1.3.1

dependabot Bot commented on behalf of github Jun 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jun 16, 2026

Version 1.3.1

What's Changed

Version 1.3.0

What's Changed

New Contributors

Version 1.2.1

What's Changed

New Contributors

Version 1.2.0

What's Changed

Version 1.1.0

1.3.1 (June 12, 2026)

Fixed

1.3.0 (June 11, 2026)

Added

Fixed

1.2.1 (May 31, 2026)

Fixed

1.2.0 (May 28, 2026)

Added

1.1.0 (May 23, 2026)

Added

Fixed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant