chore(deps): bump python-multipart from 0.0.26 to 0.0.27 in the uv group across 1 directory

[dependabot]

Bumps the uv group with 1 update in the / directory: python-multipart.

Updates python-multipart from 0.0.26 to 0.0.27

Release notes

Sourced from python-multipart's releases.

0.0.27

What's Changed

• Pass parse offsets via constructors by @​Kludex in Kludex/python-multipart#268
• Add multipart header limits by @​Kludex in Kludex/python-multipart#267

Full Changelog: Kludex/python-multipart@0.0.26...0.0.27

Changelog

Sourced from python-multipart's changelog.

0.0.27 (2026-04-27)

• Add multipart header limits #267.
• Pass parse offsets via constructors #268.

Commits

• 6d1d689 Version 0.0.27 (#272)
• 0b10220 Run CI on main branch pull requests (#271)
• 3e64f5f Add multipart header limits (#267)
• eb109cc Pass parse offsets via constructors (#268)
• 78e29ab Bump pytest from 9.0.2 to 9.0.3 (#266)
• b2ddd09 fuzz: Enhance fuzzing capabilities with new chunked and boundary tests (#264)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cmeans]

QA Round 1 — Pass

Head: 2e851d6

Diff scope: 2 files / +4 / -3.

• uv.lock (+3 / -3): single [[package]] block — python-multipart 0.0.26 → 0.0.27, new sdist URL/hash + wheel URL/hash. No transitive movement; nothing else in the lockfile shifted. dependabot-changelog workflow SUCCESS.
• CHANGELOG.md (+1): ## Unreleased / ### Changed entry slotted above the existing #98 bump (newest-first within the section).

Sourcing: transitive only — python-multipart is pulled in by mcp 1.26.0 via its [[package]].dependencies block. Direct repo references: grep -rn 'import.*multipart\|from.*multipart' src/ tests/ returns one comment in core/client.py:366 ("does not read _sid from multipart form data") and zero imports, so the bump can't break any of our code at import time. The MCP SDK is the only consumer, and it has no upper bound on python-multipart. Streamable HTTP / multipart-form code paths in MCP aren't on our active runtime today (per ADR-0001 deferral).

Upstream changes 0.0.26 → 0.0.27: Kludex/python-multipart#267 "Add multipart header limits" + #268 "Pass parse offsets via constructors". Both internal-improvement-only per the release notes; no documented API breaks.

Local verification at 2e851d6 (after uv sync --frozen --extra dev installed 0.0.27):

• uv run pytest: 605 passed / 112 deselected (integration+vdsm markers) / 17 warnings / 96.22% coverage — exact match against post-#101 baseline (no regression).
• ruff check src/ tests/ — clean.
• ruff format --check src/ tests/ — 69 files already formatted.
• mypy src/ — Success: no issues found in 28 source files.

CI on 2e851d6: 12 required SUCCESS + 1 SKIPPED, incl. vdsm integration tests SUCCESS. Dependabot CHANGELOG SUCCESS.

Findings: none. Zero blockers, zero substantive, zero observations.

Verdict: QA Pass. Applying Ready for QA Signoff as final act. Awaiting maintainer's QA Approved.

[cmeans]

LGTM