Skip to content

Bump the pip group across 2 directories with 1 update - #13

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-c37ff96d95
Open

Bump the pip group across 2 directories with 1 update#13
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-c37ff96d95

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 1 update in the / directory: starlette.
Bumps the pip group with 1 update in the /.migration-backup/apps/ai directory: starlette.

Updates starlette from 0.49.1 to 1.3.1

Release notes

Sourced from starlette's releases.

Version 1.3.1

What's Changed

Full Changelog: Kludex/starlette@1.3.0...1.3.1

Version 1.3.0

What's Changed

New Contributors

Full Changelog: Kludex/starlette@1.2.1...1.3.0

Version 1.2.1

What's Changed

New Contributors

Full Changelog: Kludex/starlette@1.2.0...1.2.1

Version 1.2.0

What's Changed

Full Changelog: Kludex/starlette@1.1.0...1.2.0

Version 1.1.0

... (truncated)

Changelog

Sourced from starlette's changelog.

1.3.1 (June 12, 2026)

Fixed

  • Enforce max_fields and max_part_size in FormParser #3329.
  • Enforce FormParser limits in parser callbacks #3331.

1.3.0 (June 11, 2026)

Added

  • Add httpx2 to the full extra #3323.
  • Annotate the URLPath protocol parameter with Literal #3285.

Fixed

  • Build request.url from structured components #3326.
  • Clamp oversized suffix ranges in FileResponse #3307.
  • Catch OSError alongside MultiPartException when closing temp files #3191.
  • Avoid collapsing exception groups raised from user code #2830.
  • Use removeprefix to strip the weak ETag indicator in is_not_modified #3193.
  • Fix IndexError in URL.replace() on a URL with no authority #3317.
  • Adjust testclient typing and warnings #3322.

1.2.1 (May 31, 2026)

Fixed

  • Use httpx2 for type checking in the testclient module #3304.
  • Add assert error for requires() when the request parameter is not a Request type #3298.

1.2.0 (May 28, 2026)

Added

  • Support httpx2 in the test client #3291.

1.1.0 (May 23, 2026)

Added

  • Use "application/octet-stream" as the FileResponse media type fallback #3283.

Fixed

  • Only dispatch standard HTTP verbs in HTTPEndpoint #3286.
  • Reject absolute paths in StaticFiles.lookup_path #3287.

1.0.1 (May 21, 2026)

... (truncated)

Commits
  • 8ebffd0 Version 1.3.1 (#3330)
  • 25b8e17 Enforce FormParser limits in parser callbacks (#3331)
  • dba1c4b Enforce max_fields and max_part_size in FormParser (#3329)
  • 45e51dc Use StarletteDeprecationWarning instead of DeprecationWarning (#3119)
  • 5f8610c Version 1.3.0 (#3327)
  • 167b585 Build request.url from structured components (#3326)
  • 3730925 Use removeprefix to strip weak ETag indicator in is_not_modified (#3193)
  • e6f7ad1 avoid collapsing exception groups from user code (#2830)
  • 115228f Annotate URLPath protocol parameter with Literal (#3285)
  • 113f193 docs: replace inline ASGI server list with link to canonical implemen… (#3204)
  • Additional commits viewable in compare view

Updates starlette from 1.0.1 to 1.3.1

Release notes

Sourced from starlette's releases.

Version 1.3.1

What's Changed

Full Changelog: Kludex/starlette@1.3.0...1.3.1

Version 1.3.0

What's Changed

New Contributors

Full Changelog: Kludex/starlette@1.2.1...1.3.0

Version 1.2.1

What's Changed

New Contributors

Full Changelog: Kludex/starlette@1.2.0...1.2.1

Version 1.2.0

What's Changed

Full Changelog: Kludex/starlette@1.1.0...1.2.0

Version 1.1.0

... (truncated)

Changelog

Sourced from starlette's changelog.

1.3.1 (June 12, 2026)

Fixed

  • Enforce max_fields and max_part_size in FormParser #3329.
  • Enforce FormParser limits in parser callbacks #3331.

1.3.0 (June 11, 2026)

Added

  • Add httpx2 to the full extra #3323.
  • Annotate the URLPath protocol parameter with Literal #3285.

Fixed

  • Build request.url from structured components #3326.
  • Clamp oversized suffix ranges in FileResponse #3307.
  • Catch OSError alongside MultiPartException when closing temp files #3191.
  • Avoid collapsing exception groups raised from user code #2830.
  • Use removeprefix to strip the weak ETag indicator in is_not_modified #3193.
  • Fix IndexError in URL.replace() on a URL with no authority #3317.
  • Adjust testclient typing and warnings #3322.

1.2.1 (May 31, 2026)

Fixed

  • Use httpx2 for type checking in the testclient module #3304.
  • Add assert error for requires() when the request parameter is not a Request type #3298.

1.2.0 (May 28, 2026)

Added

  • Support httpx2 in the test client #3291.

1.1.0 (May 23, 2026)

Added

  • Use "application/octet-stream" as the FileResponse media type fallback #3283.

Fixed

  • Only dispatch standard HTTP verbs in HTTPEndpoint #3286.
  • Reject absolute paths in StaticFiles.lookup_path #3287.

1.0.1 (May 21, 2026)

... (truncated)

Commits
  • 8ebffd0 Version 1.3.1 (#3330)
  • 25b8e17 Enforce FormParser limits in parser callbacks (#3331)
  • dba1c4b Enforce max_fields and max_part_size in FormParser (#3329)
  • 45e51dc Use StarletteDeprecationWarning instead of DeprecationWarning (#3119)
  • 5f8610c Version 1.3.0 (#3327)
  • 167b585 Build request.url from structured components (#3326)
  • 3730925 Use removeprefix to strip weak ETag indicator in is_not_modified (#3193)
  • e6f7ad1 avoid collapsing exception groups from user code (#2830)
  • 115228f Annotate URLPath protocol parameter with Literal (#3285)
  • 113f193 docs: replace inline ASGI server list with link to canonical implemen… (#3204)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the pip group across 2 directories with 1 update
10e92ad 
Bumps the pip group with 1 update in the / directory: [starlette](https://github.com/Kludex/starlette).
Bumps the pip group with 1 update in the /.migration-backup/apps/ai directory: [starlette](https://github.com/Kludex/starlette).


Updates `starlette` from 0.49.1 to 1.3.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@0.49.1...1.3.1)

Updates `starlette` from 1.0.1 to 1.3.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@0.49.1...1.3.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.3.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: starlette
  dependency-version: 1.3.1
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jun 17, 2026
@dependabot dependabot Bot mentioned this pull request Jun 17, 2026
Closed
gitar-bot[bot]
gitar-bot Bot reviewed Jul 12, 2026
View reviewed changes
Comment thread requirements.txt
pydantic==2.10.5
sse-starlette==2.2.1
starlette==0.49.1
starlette==1.3.1

@gitar-bot gitar-bot Bot Jul 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Bug: starlette==1.3.1 likely conflicts with fastapi==0.115.6

In requirements.txt, fastapi==0.115.6 declares a dependency constraint of starlette>=0.40.0,<0.42.0. Pinning starlette==1.3.1 (a major-version jump) directly violates that constraint. pip install will either fail to resolve the dependency graph or, if forced, install a Starlette version whose ABI/API FastAPI 0.115.6 was never tested against — risking import/runtime errors. Note the previous pin (0.49.1) was already outside FastAPI's range, so this is a pre-existing inconsistency the bump does not fix. Recommend either upgrading fastapi to a release that supports Starlette 1.x, or removing the explicit starlette pin and letting FastAPI resolve a compatible version. The .migration-backup/apps/ai/requirements.txt uses fastapi==0.124.0, which is more likely to accept Starlette 1.x, but its compatibility should also be confirmed.

Was this helpful? React with 👍 / 👎

@gitar-bot

gitar-bot Bot commented Jul 12, 2026

Copy link
Copy Markdown
Code Review ⚠️ Changes requested 0 resolved / 1 findings

Updates starlette to 1.3.1 across the repository, but the change is blocked by a version conflict with fastapi==0.115.6 that requires resolution.

⚠️ Bug: starlette==1.3.1 likely conflicts with fastapi==0.115.6

📄 requirements.txt:1 📄 requirements.txt:7 📄 .migration-backup/apps/ai/requirements.txt:1 📄 .migration-backup/apps/ai/requirements.txt:7

In requirements.txt, fastapi==0.115.6 declares a dependency constraint of starlette>=0.40.0,<0.42.0. Pinning starlette==1.3.1 (a major-version jump) directly violates that constraint. pip install will either fail to resolve the dependency graph or, if forced, install a Starlette version whose ABI/API FastAPI 0.115.6 was never tested against — risking import/runtime errors. Note the previous pin (0.49.1) was already outside FastAPI's range, so this is a pre-existing inconsistency the bump does not fix. Recommend either upgrading fastapi to a release that supports Starlette 1.x, or removing the explicit starlette pin and letting FastAPI resolve a compatible version. The .migration-backup/apps/ai/requirements.txt uses fastapi==0.124.0, which is more likely to accept Starlette 1.x, but its compatibility should also be confirmed.

🤖 Prompt for agents 
Code Review: Updates `starlette` to 1.3.1 across the repository, but the change is blocked by a version conflict with `fastapi==0.115.6` that requires resolution.

1. ⚠️ Bug: starlette==1.3.1 likely conflicts with fastapi==0.115.6
   Files: requirements.txt:1, requirements.txt:7, .migration-backup/apps/ai/requirements.txt:1, .migration-backup/apps/ai/requirements.txt:7

   In `requirements.txt`, `fastapi==0.115.6` declares a dependency constraint of `starlette>=0.40.0,<0.42.0`. Pinning `starlette==1.3.1` (a major-version jump) directly violates that constraint. `pip install` will either fail to resolve the dependency graph or, if forced, install a Starlette version whose ABI/API FastAPI 0.115.6 was never tested against — risking import/runtime errors. Note the previous pin (`0.49.1`) was already outside FastAPI's range, so this is a pre-existing inconsistency the bump does not fix. Recommend either upgrading `fastapi` to a release that supports Starlette 1.x, or removing the explicit `starlette` pin and letting FastAPI resolve a compatible version. The `.migration-backup/apps/ai/requirements.txt` uses `fastapi==0.124.0`, which is more likely to accept Starlette 1.x, but its compatibility should also be confirmed.
Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply Compact 
gitar auto-apply:on         

gitar display:verbose

Was this helpful? React with 👍 / 👎 | Gitar

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gitar-bot gitar-bot[bot] gitar-bot[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants