fix: constrain starlette to >=1.0.1 (CVE-2026-48710) (#5977)

GHSA-86qp-5c8j-p5mr
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/ogx-ai/ogx/pull/5977"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open in Devin Review">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------

Signed-off-by: Eoin Fennessy <efenness@redhat.com>
Co-authored-by: Matthew Farrellee <matt@cs.wisc.edu>
(cherry picked from commit 41c94c4)
Signed-off-by: Charlie Doern <cdoern@redhat.com>

Author: 2 people

pyproject.toml

@@ -9,6 +9,7 @@ fallback_version = "0.7.1"
 required-version = ">=0.7.0"
 constraint-dependencies = [
     "pyasn1>=0.6.3",  # CVE-2026-30922: DoS via unbounded recursion
+    "starlette>=1.0.1",                # CVE-2026-48710
 ]
 
 [project]