Skip to content
This repository was archived by the owner on Jul 29, 2025. It is now read-only.

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Oct 15, 2024

Bumps the pip group with 1 update in the / directory: starlette.

Updates starlette from 0.37.2 to 0.40.0

Release notes

Sourced from starlette's releases.

Version 0.40.0

This release fixes a Denial of service (DoS) via multipart/form-data requests.

You can view the full security advisory: GHSA-f96h-pmfr-66vw

Fixed

  • Add max_part_size to MultiPartParser to limit the size of parts in multipart/form-data requests fd038f3.

Version 0.39.2

Fixed

  • Allow use of request.url_for when only "app" scope is available #2672.
  • Fix internal type hints to support python-multipart==0.0.12 #2708.

Full Changelog: Kludex/starlette@0.39.1...0.39.2

Version 0.39.1

Fixed

  • Avoid regex re-compilation in responses.py and schemas.py #2700.
  • Improve performance of get_route_path by removing regular expression usage #2701.
  • Consider FileResponse.chunk_size when handling multiple ranges #2703.
  • Use token_hex for generating multipart boundary strings #2702.

Full Changelog: Kludex/starlette@0.39.0...0.39.1

Version 0.39.0

Added

  • Add support for HTTP Range to FileResponse #2697

Full Changelog: Kludex/starlette@0.38.6...0.39.0

Version 0.38.6

Fixed

  • Close unclosed MemoryObjectReceiveStream in TestClient #2693.

Full Changelog: Kludex/starlette@0.38.5...0.38.6

... (truncated)

Changelog

Sourced from starlette's changelog.

0.40.0 (October 15, 2024)

This release fixes a Denial of service (DoS) via multipart/form-data requests.

You can view the full security advisory: GHSA-f96h-pmfr-66vw

Fixed

  • Add max_part_size to MultiPartParser to limit the size of parts in multipart/form-data requests fd038f3.

0.39.2 (September 29, 2024)

Fixed

  • Allow use of request.url_for when only "app" scope is available #2672.
  • Fix internal type hints to support python-multipart==0.0.12 #2708.

0.39.1 (September 25, 2024)

Fixed

  • Avoid regex re-compilation in responses.py and schemas.py #2700.
  • Improve performance of get_route_path by removing regular expression usage #2701.
  • Consider FileResponse.chunk_size when handling multiple ranges #2703.
  • Use token_hex for generating multipart boundary strings #2702.

0.39.0 (September 23, 2024)

Added

0.38.6 (September 22, 2024)

Fixed

  • Close unclosed MemoryObjectReceiveStream in TestClient #2693.

0.38.5 (September 7, 2024)

Fixed

  • Schedule BackgroundTasks from within BaseHTTPMiddleware #2688. This behavior was removed in 0.38.3, and is now restored.

0.38.4 (September 1, 2024)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Oct 15, 2024
StanislawHorna added a commit that referenced this pull request Oct 19, 2024
* ProjectInit (#1)

* init structure

* add Requests custom module

* add helper func for requests

* add models for network devices

* add controller for network devices

* change uptime to str instead of timedelta

* add WanConnection status

* reduce input params for modelFields.map_data_values

* add web api support

* add support for web api

* add Switch port status

* add support for router ports

* add Access Point radio rx/tx metrics

* add basic workflows

* add router to app structure

* update README.md

* add Docker

* add healthcheck endpoint

* version 0.0.1

* include top-level .env file

* fix Access Point port stats

* implement Info prometheus client type

* add rx tx rates for switch and router

* add packets stats

* fix fetching stats for last port

* add temp for routers

* fix router traffic recording on disconnected port

* workaround for Omada returning empty stats

* add rate for AP radios

* remove default values for SwitchPortStats

* add AP packets retries

* fix formatting

* add HealthCheck

* set custom external port

* Update readme (#2)

* add site name to params

* add types

* update README

* add readmes

* Add Grafana Dashboards (#3)

* fix typo

* add README for app controller

* add exporter metrics table to readme

* move helper script to avoid import issues

* add dashboard pictures

* add dashboard .json files

* add dashboard screenshots

* remove readme

* add logos

* Update README.md

* add docker logo

* add link to dashboards

* version: 1.0.0

* Add github actions badges

* Fix OpenAPI token refresh (#4)

* fix method to create url

* request new token if refresh failed

* version: 1.0.1

* Add metrics suffix to avoid warnings (#5)

* add _sum suffixes

* version: 1.1.0

* update dashboards

* Remove _rate metrics, handle empty port responses (#6)

* remove switch port rate

* remove router port rate

* remove rate metrics from access point

* add try except block for router ports

* version 1.2.0

* fix type

* Add OpenAPI token re-request (#7)

* remove requestsResult helper

* bump version

* Logs and Traces (#8)

* init logs and traces for Omada Request

* Omada component instrumented

* instrument app controllers

* set version

* update requirements

* change hostname to ip

* remove config none

* add span_id to logs

* adjust healthcheck start_period

* set interval to 1m

* typo fixes

* add 0 padding

* add prometheus instrument

* set port of different loki

* separate exporter metrics from app metrics

* implement necessary catches and log exceptions

* adjust Request class to new Telemetry functions

* refactor .env file usage

* add deployment env to traces and logs

* Update dashboards (#9)

* update GF Dashboards

* update Dashboards pictures

* update READMEs

* bump version

* fix note IMPORTANT

* add links
Bumps the pip group with 1 update in the / directory: [starlette](https://github.com/encode/starlette).


Updates `starlette` from 0.37.2 to 0.40.0
- [Release notes](https://github.com/encode/starlette/releases)
- [Changelog](https://github.com/encode/starlette/blob/master/docs/release-notes.md)
- [Commits](Kludex/starlette@0.37.2...0.40.0)

---
updated-dependencies:
- dependency-name: starlette
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/pip/pip-f0796b5709 branch from 2f18e07 to 0cd3432 Compare October 19, 2024 10:45
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants