Fix CVE-2025-62727: Update starlette to 0.49.1#13016
Conversation
This commit updates the starlette package from version 0.48.0 to 0.49.1 to address the security vulnerability CVE-2025-62727. Changes: - Updated pyproject.toml starlette minimum version to >=0.49.1 - Updated poetry.lock with new starlette 0.49.1 version and hashes - Updated uv.lock starlette specifier to >=0.49.1 Co-authored-by: openhands <openhands@all-hands.dev>
|
Starlette upgrade looks safe. |
Coverage report
This PR does not seem to contain any modification to coverable code. |
|
I was able to have a successful conversation with OpenHands: 
|
all-hands-bot
left a comment
There was a problem hiding this comment.
🟢 Good taste - Security fix done right
This is a straightforward security patch. All lock files are updated consistently, the version bump is correct, and the change is minimal. The proof is in CI passing.
VERDICT: ✅ Worth merging - Simple, correct security fix with no real concerns.
KEY INSIGHT: When a security fix is this simple, the biggest risk is overthinking it—ship it once CI confirms compatibility.
| "sqlalchemy[asyncio]>=2.0.40", | ||
| "sse-starlette>=3.0.2", | ||
| "starlette>=0.48", | ||
| "starlette>=0.49.1", |
There was a problem hiding this comment.
🟡 Suggestion: The PR description claims "The package APIs remain compatible" but provides no source. Consider linking to the Starlette 0.49.1 release notes or changelog so reviewers can verify compatibility claims. Not blocking—CI passing is the real proof—but helpful for documentation.
| pypdf = "^6.0.0" | ||
| pillow = "^11.3.0" | ||
| starlette = "^0.48.0" | ||
| starlette = "^0.49.1" |
There was a problem hiding this comment.
✅ Correctly updated both the dependency constraint (line 94) and the explicit pin (line 224). This is the right way to handle security updates across both places.
Summary
This PR addresses the security vulnerability CVE-2025-62727 by updating the
starlettepackage from version 0.48.0 to 0.49.1.Changes
pyproject.toml:>=0.48to>=0.49.1^0.48.0to^0.49.1poetry.lockwith new starlette 0.49.1 version and SHA256 hashesuv.lockstarlette specifier to>=0.49.1Security
Testing
This is a security patch that updates a dependency version. The package APIs remain compatible.
@aivong-openhands can click here to continue refining the PR
To run this PR locally, use the following command:
GUI with Docker: