chore(deps): Bump the uv group across 3 directories with 3 updates by dependabot[bot] · Pull Request #129 · google/filonov

dependabot · 2026-03-10T10:50:50Z

Bumps the uv group with 1 update in the /libs/filonov directory: starlette.
Bumps the uv group with 1 update in the /libs/media-fetching directory: starlette.
Bumps the uv group with 3 updates in the /libs/media_similarity directory: protobuf, starlette and python-multipart.

Updates starlette from 0.48.0 to 0.49.1

Release notes

Sourced from starlette's releases.

Version 0.49.1

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

Full Changelog: Kludex/starlette@0.49.0...0.49.1

Version 0.49.0

Added

Add encoding parameter to Config class #2996.

Support multiple cookie headers in Request.cookies #3029.

Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

New Contributors

@TheWesDias made their first contribution in Kludex/starlette#3017

@gmos2104 made their first contribution in Kludex/starlette#3027

@secrett2633 made their first contribution in Kludex/starlette#2996

@adam-sikora made their first contribution in Kludex/starlette#2976

Full Changelog: Kludex/starlette@0.48.0...0.49.0

Changelog

Sourced from starlette's changelog.

0.49.1 (October 28, 2025)

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

0.49.0 (October 28, 2025)

Added

Add encoding parameter to Config class #2996.

Support multiple cookie headers in Request.cookies #3029.

Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

Commits

7e4b742 Version 0.49.1 (#3047)
4ea6e22 Merge commit from fork
7d88ea6 Version 0.49.0 (#3046)
26d66bb Do not pollute exception context in Middleware (#2976)
a59397d Set encodings when reading config files (#2996)
3b7f0cb test: add test for unknown status (#3035)
b09ce1a docs: fix legibility issues on sponsorship page (#3039)
0f0edcf Revert "Add Marcelo Trylesinski to the license (#3025)" (#3044)
3912d63 docs: add social icons (#3038)
4915a93 Add discord to README/docs (#3034)
Additional commits viewable in compare view

Updates starlette from 0.48.0 to 0.49.1

Release notes

Sourced from starlette's releases.

Version 0.49.1

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

Full Changelog: Kludex/starlette@0.49.0...0.49.1

Version 0.49.0

Added

Add encoding parameter to Config class #2996.

Support multiple cookie headers in Request.cookies #3029.

Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

New Contributors

@TheWesDias made their first contribution in Kludex/starlette#3017

@gmos2104 made their first contribution in Kludex/starlette#3027

@secrett2633 made their first contribution in Kludex/starlette#2996

@adam-sikora made their first contribution in Kludex/starlette#2976

Full Changelog: Kludex/starlette@0.48.0...0.49.0

Changelog

Sourced from starlette's changelog.

0.49.1 (October 28, 2025)

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

0.49.0 (October 28, 2025)

Added

Add encoding parameter to Config class #2996.

Support multiple cookie headers in Request.cookies #3029.

Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

Commits

7e4b742 Version 0.49.1 (#3047)
4ea6e22 Merge commit from fork
7d88ea6 Version 0.49.0 (#3046)
26d66bb Do not pollute exception context in Middleware (#2976)
a59397d Set encodings when reading config files (#2996)
3b7f0cb test: add test for unknown status (#3035)
b09ce1a docs: fix legibility issues on sponsorship page (#3039)
0f0edcf Revert "Add Marcelo Trylesinski to the license (#3025)" (#3044)
3912d63 docs: add social icons (#3038)
4915a93 Add discord to README/docs (#3034)
Additional commits viewable in compare view

Updates protobuf from 4.25.8 to 5.29.6

Release notes

Sourced from protobuf's releases.

Protocol Buffers v34.0-rc1

Announcements

This version includes breaking changes to: C++, Objective-C, PHP, Python.

[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

[C++] Make generator headers private (protocolbuffers/protobuf@3a2af35)

[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (protocolbuffers/protobuf@7a75898)

[C++] Add [[nodiscard]] to many APIs. (protocolbuffers/protobuf@a70115f)

[C++] Make the arena-enabled constructors of RepeatedField, RepeatedPtrField, and Map private. (protocolbuffers/protobuf@ef890c3)

[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (protocolbuffers/protobuf@b115358)

[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (protocolbuffers/protobuf@68346ec)

[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (protocolbuffers/protobuf@837a2cd)

[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() && !is_repeated()) instead (protocolbuffers/protobuf@9dbc5d4)

[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

[C++] All entity names have length limit (2afb0dc)

[ObjC] Remove generate_minimal_imports generation option warning (protocolbuffers/protobuf@45b1297)

[ObjC] Fix nullability annotations on some GPB*Dictionary types. (protocolbuffers/protobuf@ea67d6d)

[ObjC] Remove -[GPBFieldDescriptor optional] (protocolbuffers/protobuf@3414dc1)

[Other] Remove deprecated flag for enabling MSVC support (protocolbuffers/protobuf@97c979b)

[PHP] Remove deprecated PHP APIs (protocolbuffers/protobuf@9c45014)

[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (protocolbuffers/protobuf@4208121, protocolbuffers/protobuf@cd76e67, protocolbuffers/protobuf@4208121)

[PHP] Add PHP typehints for setters and remove redundant GPBUtil checks (protocolbuffers/protobuf#25296) (protocolbuffers/protobuf@aee03b7)

[PHP] support default values for editions/proto2 (protocolbuffers/protobuf#25161) (protocolbuffers/protobuf@b01099d)

[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (protocolbuffers/protobuf@5b116fe)

[Python] Remove float_format/double_format from python proto text_format (protocolbuffers/protobuf@e4854a1)

[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (protocolbuffers/protobuf@00aaca1)

[Python] Remove float_precision from python proto json_format (protocolbuffers/protobuf@f027f1f)

[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[Python] Remove deprecated FieldDescriptor.label (protocolbuffers/protobuf@0a8ff55)

[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Migration Guide may include additional guidance for breaking changes.

Bazel

Fix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (#25168) (protocolbuffers/protobuf@8c857c3)

Breaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

Feat(bazel): wire up prebuilt protoc toolchain (#24115) (protocolbuffers/protobuf@cc23698)

Migrate proto_descriptor_set (#23369) (protocolbuffers/protobuf@8d4dfdd)

Compiler

Ruby codegen: support generation of rbs files (#15633) (protocolbuffers/protobuf@6ebdf85)

Avoid collision name problems between a message named Xyz and a direct sibling enum named XyzView (protocolbuffers/protobuf@eba53e8)

Generalizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (protocolbuffers/protobuf@ed3c571)

Fix a bug with custom features outside of the pb package. (protocolbuffers/protobuf@872d3ce)

Fix import option handling when include_imports isn't set. (protocolbuffers/protobuf@9ef9e80)

Fix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (protocolbuffers/protobuf@1229d4a)

Prevent accidental stripping of debug_redact options via import option. (protocolbuffers/protobuf@f58b098)

C++

Add EnumerateEnumValues function. (protocolbuffers/protobuf@397d5d9)

... (truncated)

Commits

See full diff in compare view

Updates starlette from 0.37.2 to 0.49.1

Release notes

Sourced from starlette's releases.

Version 0.49.1

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

Full Changelog: Kludex/starlette@0.49.0...0.49.1

Version 0.49.0

Added

Add encoding parameter to Config class #2996.

Support multiple cookie headers in Request.cookies #3029.

Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

New Contributors

@TheWesDias made their first contribution in Kludex/starlette#3017

@gmos2104 made their first contribution in Kludex/starlette#3027

@secrett2633 made their first contribution in Kludex/starlette#2996

@adam-sikora made their first contribution in Kludex/starlette#2976

Full Changelog: Kludex/starlette@0.48.0...0.49.0

Changelog

Sourced from starlette's changelog.

0.49.1 (October 28, 2025)

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

0.49.0 (October 28, 2025)

Added

Add encoding parameter to Config class #2996.

Support multiple cookie headers in Request.cookies #3029.

Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

Commits

7e4b742 Version 0.49.1 (#3047)
4ea6e22 Merge commit from fork
7d88ea6 Version 0.49.0 (#3046)
26d66bb Do not pollute exception context in Middleware (#2976)
a59397d Set encodings when reading config files (#2996)
3b7f0cb test: add test for unknown status (#3035)
b09ce1a docs: fix legibility issues on sponsorship page (#3039)
0f0edcf Revert "Add Marcelo Trylesinski to the license (#3025)" (#3044)
3912d63 docs: add social icons (#3038)
4915a93 Add discord to README/docs (#3034)
Additional commits viewable in compare view

Updates python-multipart from 0.0.20 to 0.0.22

Release notes

Sourced from python-multipart's releases.

Version 0.0.22

What's Changed

Drop directory path from filename in File 9433f4b.

Full Changelog: Kludex/python-multipart@0.0.21...0.0.22

Version 0.0.21

What's Changed

Add support for Python 3.14 and drop EOL 3.8 and 3.9 by @hugovk in Kludex/python-multipart#216

New Contributors

@waketzheng made their first contribution in Kludex/python-multipart#203

Full Changelog: Kludex/python-multipart@0.0.20...0.0.21

Changelog

Sourced from python-multipart's changelog.

0.0.22 (2026-01-25)

Drop directory path from filename in File 9433f4b.

0.0.21 (2025-12-17)

Add support for Python 3.14 and drop EOL 3.8 and 3.9 #216.

Commits

bea7bbb Version 0.0.22 (#222)
0fb59a9 chore: add return type on test (#221)
9433f4b Merge commit from fork
d5c91ec Bump the github-actions group with 2 updates (#219)
5a90631 bump uv (#218)
1f72955 Version 0.0.21 (#217)
47ecfed Add support for Python 3.14 and drop EOL 3.8 and 3.9 (#216)
f18b709 Bump the github-actions group across 1 directory with 4 updates (#214)
b388e9a chore: use depedency-groups in pyproject.toml (#212)
6113e75 Bump the github-actions group across 1 directory with 3 updates (#210)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the uv group with 1 update in the /libs/filonov directory: [starlette](https://github.com/Kludex/starlette). Bumps the uv group with 1 update in the /libs/media-fetching directory: [starlette](https://github.com/Kludex/starlette). Bumps the uv group with 3 updates in the /libs/media_similarity directory: [protobuf](https://github.com/protocolbuffers/protobuf), [starlette](https://github.com/Kludex/starlette) and [python-multipart](https://github.com/Kludex/python-multipart). Updates `starlette` from 0.48.0 to 0.49.1 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.48.0...0.49.1) Updates `starlette` from 0.48.0 to 0.49.1 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.48.0...0.49.1) Updates `protobuf` from 4.25.8 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `starlette` from 0.37.2 to 0.49.1 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.48.0...0.49.1) Updates `python-multipart` from 0.0.20 to 0.0.22 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.20...0.0.22) --- updated-dependencies: - dependency-name: starlette dependency-version: 0.49.1 dependency-type: indirect dependency-group: uv - dependency-name: starlette dependency-version: 0.49.1 dependency-type: indirect dependency-group: uv - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: indirect dependency-group: uv - dependency-name: starlette dependency-version: 0.49.1 dependency-type: indirect dependency-group: uv - dependency-name: python-multipart dependency-version: 0.0.22 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Mar 10, 2026

dependabot bot mentioned this pull request Mar 10, 2026

build(deps): Bump python-multipart from 0.0.20 to 0.0.22 in /libs/media_similarity #121

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): Bump the uv group across 3 directories with 3 updates#129

chore(deps): Bump the uv group across 3 directories with 3 updates#129
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/uv/libs/filonov/uv-5aa622324e

dependabot bot commented on behalf of github Mar 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 10, 2026

Version 0.49.1

Fixed

Version 0.49.0

Added

Changed

New Contributors

0.49.1 (October 28, 2025)

Fixed

0.49.0 (October 28, 2025)

Added

Changed

Version 0.49.1

Fixed

Version 0.49.0

Added

Changed

New Contributors

0.49.1 (October 28, 2025)

Fixed

0.49.0 (October 28, 2025)

Added

Changed

Protocol Buffers v34.0-rc1

Announcements

Bazel

Compiler

C++

Version 0.49.1

Fixed

Version 0.49.0

Added

Changed

New Contributors

0.49.1 (October 28, 2025)

Fixed

0.49.0 (October 28, 2025)

Added

Changed

Version 0.0.22

What's Changed

Version 0.0.21

What's Changed

New Contributors

0.0.22 (2026-01-25)

0.0.21 (2025-12-17)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants