chore(deps): force starlette>=1.0.1 for PYSEC-2026-161
starlette <1.0.1 has PYSEC-2026-161 (missing Host header validation poisons request.url.path, bypassing path-based auth). Pulled in as a transitive of fastapi. Override-dependencies forces the patched version; lock regenerated against starlette 1.0.1.
G
Greyson LaLonde committed
4990041ef75b65e9a2b245e0a08ca865569d1308
Parent: 88e95be
Committed by GitHub <noreply@github.com>
on 5/22/2026, 3:33:08 PM