build(deps): bump starlette from 0.46.2 to 1.3.1 in /src/bin/calaos_mcp - #175
build(deps): bump starlette from 0.46.2 to 1.3.1 in /src/bin/calaos_mcp#175dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [starlette](https://github.com/Kludex/starlette) from 0.46.2 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.46.2...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Taken, but not as proposed: this PR as it stands produces a dependency set that cannot be installed anywhere. Dependabot bumped Landed instead as a coordinated bump on branch Exposure assessment. Most of the seven starlette advisories do not reach this sidecar: no Verified out of band in a python3.11 venv with the full coordinated set: This PR will close automatically when the grouped branch lands on |
Reprend la PR Dependabot #175, mais PAS telle quelle : la PR est INSTALLABLE NULLE PART en l'etat. fastapi==0.115.12 exige "starlette>=0.40.0,<0.47.0" ; poser starlette==1.3.1 a cote rend le jeu de dependances irresoluble (pip: ResolutionImpossible). Dependabot ne l'a pas vu et la CI non plus, parce que .github/workflows/ci.yml ne resout jamais ce pyproject.toml. D'ou la montee coordonnee de fastapi : la premiere serie qui accepte starlette 1.x se situe vers 0.13x ; on prend la derniere, 0.141.1, celle qui a ete verifiee de bout en bout. CVE starlette adressees (toutes < 1.3.1) : - GHSA-7f5h-v6xp-fcq8 (high) DoS O(n^2) via fusion d'en-tetes Range dans FileResponse. - GHSA-wqp7-x3pw-xc5r (high) SSRF / vol d'identifiants NTLM via chemins UNC dans StaticFiles (Windows). - GHSA-82w8-qh3p-5jfq (high) limites de request.form() ignorees en silence sur x-www-form-urlencoded -> DoS. - GHSA-x746-7m8f-x49c (medium) methode HTTP arbitraire dispatchee vers un attribut de HTTPEndpoint via getattr. - GHSA-86qp-5c8j-p5mr (medium) absence de validation de l'en-tete Host empoisonnant request.url.path. - GHSA-2c2j-9gv5-cj73 (medium) DoS a l'analyse de gros fichiers multipart. - GHSA-jp82-jpqv-5vv3 (low) chemin de requete non valide concatene dans l'autorite, empoisonne request.url.hostname. Portee reelle : plusieurs de ces failles ne s'appliquent pas au sidecar (pas de StaticFiles, pas de HTTPEndpoint, pas de FileResponse, cible Linux, pas de formulaire multipart). En revanche les deux failles Host/URL touchent directement un composant derriere un reverse proxy C++ qui transmet des Host externes tels quels, et BearerAuthMiddleware discrimine sur request.url.path pour laisser passer /healthz sans authentification : c'est exactement le chemin qu'un empoisonnement de request.url.path viserait. Verification : le conteneur de build n'embarque ni starlette ni fastapi ni pytest, donc "make check" ne couvre PAS ce changement (les suites python retombent sur unittest et n'importent jamais calaos_mcp.server). Verifie hors bande dans un venv python3.11 : jeu complet resolu, create_app() construit, GET /healthz -> 200, POST /mcp initialize -> 200 (protocole 2025-06-18), POST /mcp sans Bearer -> 401, tests/python : 34 passed / 2 skipped.
…rdonnée mcp/fastapi/starlette 7 PR instruites : 5 fermées (npm dev-only, jamais shippées — dont #168 immutable 3.8.3 qui était une régression), 2 fusionnées en une montée coordonnée. mcp 1.16.0→1.28.1, fastapi 0.115.12→0.141.1, starlette 0.46.2→1.3.1 : #175 seule donnait ResolutionImpossible, fastapi==0.115.12 exigeant starlette<0.47. Premier merge qui a un effet réel sur l'image : avant T3.23 ce pyproject.toml n'était lu par aucun chemin de build. Vérifié dans l'image reconstruite — les trois versions sont effectivement installées, la sonde configure.ac de T3.23 (API privée mcp._session_manager comprise) reste verte face à mcp 1.28.1, /healthz 200, POST /mcp 401 sans Bearer / 200 avec. make check 70/70. Restent ouverts F-DEP-2, F-DEP-3, F-DEP-5, et les 12 alertes Dependabot : fermer une PR ne ferme pas l'alerte.
1 participant
Bumps starlette from 0.46.2 to 1.3.1.
Release notes
Sourced from starlette's releases.
... (truncated)
Changelog
Sourced from starlette's changelog.
... (truncated)
Commits
8ebffd0Version 1.3.1 (#3330)25b8e17EnforceFormParserlimits in parser callbacks (#3331)dba1c4bEnforcemax_fieldsandmax_part_sizeinFormParser(#3329)45e51dcUseStarletteDeprecationWarninginstead ofDeprecationWarning(#3119)5f8610cVersion 1.3.0 (#3327)167b585Buildrequest.urlfrom structured components (#3326)3730925Useremoveprefixto strip weak ETag indicator inis_not_modified(#3193)e6f7ad1avoid collapsing exception groups from user code (#2830)115228fAnnotate URLPath protocol parameter with Literal (#3285)113f193docs: replace inline ASGI server list with link to canonical implemen… (#3204)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.