Build(deps): Bump python-multipart from 0.0.26 to 0.0.32 in /python#6406
Build(deps): Bump python-multipart from 0.0.26 to 0.0.32 in /python#6406dependabot[bot] wants to merge 2 commits into
Conversation
Bumps [python-multipart](https://github.com/Kludex/python-multipart) from 0.0.26 to 0.0.27. - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.26...0.0.27) --- updated-dependencies: - dependency-name: python-multipart dependency-version: 0.0.27 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
e8f5966 to
6b2ff3e
Compare
|
@copilot: update this PR to bump python-multipart to 0.0.31 instead of 0.0.27 and regenerate python/uv.lock. If the resolver will not choose 0.0.31 from existing constraints, add a security floor in python/pyproject.toml under [tool.uv] constraint-dependencies for python-multipart>=0.0.31, then regenerate python/uv.lock. The current bump only fixes the old <0.0.27 alert; 0.0.31 should cover the newer python-multipart alerts too. |
Done. |
Motivation and Context
Bumps python-multipart from 0.0.26 to 0.0.32 to address multiple security advisories. The previous bump to 0.0.27 only covered the older
<0.0.27alert; version 0.0.32 (satisfying>=0.0.31) covers the newer python-multipart vulnerability alerts as well.Description
python-multipart>=0.0.31tooverride-dependenciesinpython/pyproject.toml.constraint-dependencieswas insufficient becauselitellm[proxy]pinspython-multipartexactly at==0.0.27; an override is required to bypass that exact pin.python/uv.lock— the resolver selected 0.0.32 (latest version satisfying>=0.0.31).Contribution Checklist