Bump starlette from 0.48.0 to 0.49.1 in /e2e_tests in the pip group across 1 directory by dependabot[bot] · Pull Request #4738 · microsoft/AzureTRE

dependabot · 2025-10-28T22:53:43Z

Bumps the pip group with 1 update in the /e2e_tests directory: starlette.

Updates starlette from 0.48.0 to 0.49.1

Release notes

Version 0.49.1

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

Full Changelog: Kludex/starlette@0.49.0...0.49.1

Version 0.49.0

Added

Add encoding parameter to Config class #2996.

Support multiple cookie headers in Request.cookies #3029.

Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

New Contributors

@TheWesDias made their first contribution in Kludex/starlette#3017

@gmos2104 made their first contribution in Kludex/starlette#3027

@secrett2633 made their first contribution in Kludex/starlette#2996

@adam-sikora made their first contribution in Kludex/starlette#2976

Full Changelog: Kludex/starlette@0.48.0...0.49.0

Changelog

Sourced from starlette's changelog.

0.49.1 (October 28, 2025)

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

0.49.0 (October 28, 2025)

Added

Add encoding parameter to Config class #2996.

Support multiple cookie headers in Request.cookies #3029.

Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

Commits

7e4b742 Version 0.49.1 (#3047)
4ea6e22 Merge commit from fork
7d88ea6 Version 0.49.0 (#3046)
26d66bb Do not pollute exception context in Middleware (#2976)
a59397d Set encodings when reading config files (#2996)
3b7f0cb test: add test for unknown status (#3035)
b09ce1a docs: fix legibility issues on sponsorship page (#3039)
0f0edcf Revert "Add Marcelo Trylesinski to the license (#3025)" (#3044)
3912d63 docs: add social icons (#3038)
4915a93 Add discord to README/docs (#3034)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the pip group with 1 update in the /e2e_tests directory: [starlette](https://github.com/Kludex/starlette). Updates `starlette` from 0.48.0 to 0.49.1 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.48.0...0.49.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 0.49.1 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2025-10-28T22:54:26Z

Unit Test Results

658 tests 658 ✅ 7s ⏱️
1 suites 0 💤
1 files 0 ❌

Results for commit d595db6.

♻️ This comment has been updated with latest results.

tamirkamara · 2025-10-29T08:48:11Z

/test-extended 98a7a20

github-actions · 2025-10-29T08:48:25Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/18902123415 (with refid 63019940)

(in response to this comment from @tamirkamara)

github-actions · 2025-10-29T14:56:56Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/18902123415 (with refid 63019940)

(in response to this comment from @tamirkamara)

tamirkamara · 2025-10-29T15:22:38Z

@copilot this upgrade of starlette needs to include an upgrade of fastapi to resolve the following dependency conflict:

The conflict is caused by:
    The user requested starlette==0.49.1
    fastapi 0.118.0 depends on starlette<0.49.0 and >=0.40.0

Copilot · 2025-10-29T15:22:55Z

@tamirkamara I've opened a new pull request, #4739, to work on those changes. Once the pull request is ready, I'll request review from you.

… conflict (#4739) * Initial plan * Upgrade fastapi to 0.120.2 to resolve starlette 0.49.1 dependency conflict Co-authored-by: tamirkamara <26870601+tamirkamara@users.noreply.github.com> * Remove COMPONENTS section from CHANGELOG.md Co-authored-by: tamirkamara <26870601+tamirkamara@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: tamirkamara <26870601+tamirkamara@users.noreply.github.com>

tamirkamara · 2025-10-29T19:38:49Z

/test-extended 701c030

github-actions · 2025-10-29T19:39:19Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/18920036098 (with refid 63019940)

(in response to this comment from @tamirkamara)

github-actions · 2025-10-30T05:36:10Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/18920036098 (with refid 63019940)

(in response to this comment from @tamirkamara)

github-actions · 2025-10-30T07:46:04Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/18920036098 (with refid 63019940)

(in response to this comment from @tamirkamara)

tamirkamara · 2025-10-30T10:56:35Z

/test-force-approve 701c030

github-actions · 2025-10-30T10:56:52Z

🤖 pr-bot 🤖

✅ Marking tests as complete (for commit 701c030)

(in response to this comment from @tamirkamara)

marrobi

LGTM - might want to add to the changelog.

tamirkamara · 2025-10-30T11:04:42Z

/test-force-approve d595db6

github-actions · 2025-10-30T11:04:54Z

🤖 pr-bot 🤖

✅ Marking tests as complete (for commit d595db6)

(in response to this comment from @tamirkamara)

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 28, 2025

dependabot Bot requested a review from a team as a code owner October 28, 2025 22:53

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 28, 2025

github-actions Bot added the external PR from an external contributor label Oct 28, 2025

tamirkamara assigned Copilot Oct 29, 2025

Copilot AI mentioned this pull request Oct 29, 2025

Bump starlette to 0.49.1 and fastapi to 0.120.2 to resolve dependency conflict #4739

Merged

Copilot AI and others added 2 commits October 29, 2025 18:12

Bump version from 0.25.0 to 0.25.1

701c030

tamirkamara approved these changes Oct 30, 2025

View reviewed changes

marrobi approved these changes Oct 30, 2025

View reviewed changes

Update Starlette and FastAPI versions

d595db6

tamirkamara enabled auto-merge (squash) October 30, 2025 11:04

tamirkamara merged commit abd1166 into main Oct 30, 2025
12 checks passed

tamirkamara deleted the dependabot/pip/e2e_tests/pip-91ab757ed1 branch October 30, 2025 11:04

Conversation

dependabot Bot commented on behalf of github Oct 28, 2025

Version 0.49.1

Fixed

Version 0.49.0

Added

Changed

New Contributors

0.49.1 (October 28, 2025)

Fixed

0.49.0 (October 28, 2025)

Added

Changed

Uh oh!

github-actions Bot commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unit Test Results

Uh oh!

tamirkamara commented Oct 29, 2025

Uh oh!

github-actions Bot commented Oct 29, 2025

Uh oh!

github-actions Bot commented Oct 29, 2025

Uh oh!

tamirkamara commented Oct 29, 2025

Uh oh!

Copilot AI commented Oct 29, 2025

Uh oh!

tamirkamara commented Oct 29, 2025

Uh oh!

github-actions Bot commented Oct 29, 2025

Uh oh!

github-actions Bot commented Oct 30, 2025

Uh oh!

github-actions Bot commented Oct 30, 2025

Uh oh!

tamirkamara commented Oct 30, 2025

Uh oh!

github-actions Bot commented Oct 30, 2025

Uh oh!

marrobi left a comment

Choose a reason for hiding this comment

Uh oh!

tamirkamara commented Oct 30, 2025

Uh oh!

github-actions Bot commented Oct 30, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Oct 28, 2025 •

edited

Loading