fix: constrain starlette to >=1.0.1 (CVE-2026-48710) (backport #5977) (#5988)

GHSA-86qp-5c8j-p5mr


---

<a href="https://app.devin.ai/review/ogx-ai/ogx/pull/5977"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open in Devin Review">
  </picture>
</a>
<hr>This is an automatic backport of pull request #5977 done by
[Mergify](https://mergify.com).
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/ogx-ai/ogx/pull/5988"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open in Devin Review">
  </picture>
</a>
<!-- devin-review-badge-end -->

Signed-off-by: Eoin Fennessy <efenness@redhat.com>
Signed-off-by: Charlie Doern <cdoern@redhat.com>
Co-authored-by: Eoin Fennessy <efenness@redhat.com>
Co-authored-by: Matthew Farrellee <matt@cs.wisc.edu>

Author: 3 people

pyproject.toml

@@ -9,6 +9,7 @@ fallback_version = "0.4.5"
 required-version = ">=0.7.0"
 constraint-dependencies = [
     "pyasn1>=0.6.3",  # CVE-2026-30922: DoS via unbounded recursion
+    "starlette>=1.0.1",                # CVE-2026-48710
 ]
 
 [project]