This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 7911e760dc2 Bump starlette to 1.3.1 for bounded form parsing (#73302)
7911e760dc2 is described below
commit 7911e760dc2b5c557b94cfb6e1ea14f30fad9a69
Author: Amogh Desai <[email protected]>
AuthorDate: Fri Sep 18 10:13:41 2026 +0530
Bump starlette to 1.3.1 for bounded form parsing (#73302)
---
airflow-core/pyproject.toml | 5 ++++-
uv.lock | 2 +-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/airflow-core/pyproject.toml b/airflow-core/pyproject.toml
index e2cc2e4db34..d186d5d17f6 100644
--- a/airflow-core/pyproject.toml
+++ b/airflow-core/pyproject.toml
@@ -100,7 +100,10 @@ dependencies = [
# https://github.com/apache/airflow/issues/68562
"fastapi[standard-no-fastapi-cloud-cli]>=0.129.0,<0.137.0",
"uvicorn>=0.37.0",
- "starlette>=1.0.1",
+ # 1.3.1 is the first release whose urlencoded FormParser enforces
max_fields/max_part_size
+ # and reports them as a 400. Below it, an unauthenticated form body to
POST /auth/token is
+ # parsed with no field-count or field-size bound at all.
+ "starlette>=1.3.1",
"httpx>=0.25.0",
'importlib_metadata>=6.5;python_version<"3.12"',
'importlib_metadata>=7.0;python_version>="3.12"',
diff --git a/uv.lock b/uv.lock
index 6cb44239575..157eb691173 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2182,7 +2182,7 @@ requires-dist = [
{ name = "rich-argparse", specifier = ">=1.0.0" },
{ name = "setproctitle", specifier = ">=1.3.3" },
{ name = "sqlalchemy", extras = ["asyncio"], specifier = ">=2.0.50" },
- { name = "starlette", specifier = ">=1.0.1" },
+ { name = "starlette", specifier = ">=1.3.1" },
{ name = "statsd", marker = "extra == 'statsd'", specifier = ">=3.3.0" },
{ name = "structlog", specifier = ">=26.1.0" },
{ name = "svcs", specifier = ">=25.1.0" },
