deps(py): bump python-multipart from 0.0.26 to 0.0.27 in /backend in the pip-security group across 1 directory#591
Conversation
Bumps the pip-security group with 1 update in the /backend directory: [python-multipart](https://github.com/Kludex/python-multipart). Updates `python-multipart` from 0.0.26 to 0.0.27 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.26...0.0.27) --- updated-dependencies: - dependency-name: python-multipart dependency-version: 0.0.27 dependency-type: direct:production dependency-group: pip-security ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Review Council Results4 tests 2 ✅ 0s ⏱️ For more details on these failures, see this check. Results for commit 1b1a3bc. |
Blb3D
left a comment
Blb3D
left a comment
There was a problem hiding this comment.
Reviewed upstream patch (Kludex/python-multipart#267) and audited test fixtures.
Fix correctness: per-state instrumentation across HEADER_FIELD_START / HEADER_FIELD / HEADER_VALUE_START / HEADER_VALUE / HEADER_VALUE_ALMOST_DONE with per-part counter resets at part_begin and boundary continuation. Both attack vectors (excessive headers, oversized header line) covered. Clean MultipartParseError on overflow.
Defaults vs FilaOps traffic: MAX_HEADER_COUNT=8, MAX_HEADER_SIZE=4224 bytes per line. FilaOps upload endpoints (PO documents, quote attachments, customer/order/material imports, settings logos) all use browser-driven multipart with 2-3 headers per part and ~200-byte header lines — comfortable headroom.
Test fixture audit: all 30+ TestClient files={...} call sites generate standard httpx multipart (2 headers per part). No hand-crafted raw multipart bodies. No regressions expected.
CI: all green (FilaOps CI, CodeQL py+js, backend unit/integration tests, PRO Code Guard, GitGuardian, Review Council). The duplicate Review Council FAILURE entry is the known double-fire — dedicated workflow run passed.
Merging to close DoS attack surface across 14 upload endpoints.
1 participant
Bumps the pip-security group with 1 update in the /backend directory: python-multipart.
Updates
python-multipartfrom 0.0.26 to 0.0.27Release notes
Sourced from python-multipart's releases.
Changelog
Sourced from python-multipart's changelog.
Commits
6d1d689Version 0.0.27 (#272)0b10220Run CI on main branch pull requests (#271)3e64f5fAdd multipart header limits (#267)eb109ccPass parse offsets via constructors (#268)78e29abBump pytest from 9.0.2 to 9.0.3 (#266)b2ddd09fuzz: Enhance fuzzing capabilities with new chunked and boundary tests (#264)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.