fix(security): bump starlette 1.0.1 → 1.3.1 (GHSA-82w8-qh3p-5jfq, GHSA-jp82-jpqv-5vv3)

[AIalliAI]

Summary

Bump pinned starlette from 1.0.1 to 1.3.1 across all extras (dev, mcp, computer-use, web).

CVEs Fixed

CVE	Severity	Description
GHSA-82w8-qh3p-5jfq	CVSS 7.5	request.form() limits silently ignored → DoS
GHSA-jp82-jpqv-5vv3	CVSS 5.3	Unvalidated request path poisons url.hostname
GHSA-x746-7m8f-x49c	CVSS 7.5	StaticFiles SSRF via UNC paths (Windows)
GHSA-wqp7-x3pw-xc5r	CVSS 5.3	Arbitrary HTTP method dispatch via getattr

All fixed in starlette 1.3.1. fastapi 0.133.1 remains compatible.

Files Changed

• pyproject.toml — 4 pin sites updated (dev, mcp, computer-use, web)
• uv.lock — resolved starlette 1.3.1

No code changes — pin-only bump.

[alt-glitch]

This was generated by AI during triage.

Related to the June/July-2026 dependency-CVE cluster — this is part of an overlapping set of consolidated pin bumps. Other open PRs bumping starlette 1.0.1 -> 1.3.1 (and adjacent CVE pins) for the same OSV/Dependabot findings: #56830, #59993, #47998 (tracking #47997). These are competing/overlapping, not duplicates — a maintainer should pick a single canonical consolidated dependency bump. Defense-in-depth dependency hygiene (out-of-scope per SECURITY.md §3.2, no §3.1 boundary crossing / PoC), so priced P2 on ordinary merits, not escalated by the security label.

[egilewski]

suggesting changes

CI is currently failing on this PR head in All required checks pass, Python tests / Run tests slice 5/8, Python tests / Run tests slice 3/8. The comparable current main status is not failing for those check(s), so deeper review should wait for the PR-specific required-check failure to be fixed.

Please fix or rerun the failing check, then push a new head or ask for re-review.

Signed: GPT-5.5-low in Codex

[AIalliAI]

Superseded by dependabot PR #46870 which covers the same starlette bump.