fix: constrain starlette to >=1.0.1 (CVE-2026-48710)

[eoinfennessy]

GHSA-86qp-5c8j-p5mr

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[cdoern]

@Mergifyio backport release-0.7.x

[mergify]

backport release-0.7.x

✅ Backports have been created

Details

• #5979 fix: constrain starlette to >=1.0.1 (CVE-2026-48710) (backport #5977) has been created for branch release-0.7.x but encountered conflicts

Cherry-pick of 41c94c4 has failed:

On branch mergify/bp/release-0.7.x/pr-5977
Your branch is up to date with 'origin/release-0.7.x'.

You are currently cherry-picking commit 41c94c49.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   pyproject.toml
	both modified:   uv.lock

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[cdoern]

@Mergifyio backport release-0.4.x

[mergify]

backport release-0.4.x

✅ Backports have been created

Details

• #5988 fix: constrain starlette to >=1.0.1 (CVE-2026-48710) (backport #5977) has been created for branch release-0.4.x but encountered conflicts

Cherry-pick of 41c94c4 has failed:

On branch mergify/bp/release-0.4.x/pr-5977
Your branch is up to date with 'origin/release-0.4.x'.

You are currently cherry-picking commit 41c94c49.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   pyproject.toml
	both modified:   uv.lock

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally