fix: constrain starlette to >=1.0.1 (CVE-2026-48710) (#5977)

GHSA-86qp-5c8j-p5mr
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/ogx-ai/ogx/pull/5977"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open in Devin Review">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------

Signed-off-by: Eoin Fennessy <efenness@redhat.com>
Co-authored-by: Matthew Farrellee <matt@cs.wisc.edu>

Author: eoinfennessy

pyproject.toml

@@ -24,7 +24,7 @@ constraint-dependencies = [
     "python-socketio>=5.14.0",         # CVE-2025-61765: RCE via pickle deserialization
     "requests>=2.34.2",
     "setuptools<81",                   # milvus-lite imports pkg_resources; setuptools 81+ removes it
-    "starlette>=0.49.1",
+    "starlette>=1.0.1",                # CVE-2026-48710
     "tornado>=6.5.5",
     "urllib3>=2.7.0",
     "transformers>=4.57.2,<5.0.0",     # CVE-2026-1839 fix only in 5.x; ogx doesn't use Trainer; 5.x breaks HybridCache imports