fix(deps): bump starlette to 1.3.1 for VULN-88813

[shuningc]

Summary

• Remediate VULN-88813: request.form() urlencoded bodies ignored max_fields/max_part_size (fixed in 1.3.1).
• Raise optional starlette floor to >=1.3.1; bump dev fastapi to ^0.135.0 to drop the <0.47 Starlette cap.
• Lock: starlette 1.3.1, fastapi 0.135.4.

Notes

• fastapi is dev-only; runtime Starlette comes via optional middleware/openai/crewai extras (mcp/sse-starlette).
• Lock-only bump was insufficient due to fastapi 0.115 pinning starlette <0.47.

Test plan

• poetry check
• Installed starlette 1.3.1; poetry run pytest tests/ (1995 passed, 4 skipped)

Jira

VULN-88813

[etserend]

Code Review — AI-Assisted Feedback

Reviewed by Claude Code (Claude Opus), automated review to assist human reviewers.

Verdict: Approve with comments

Minimal (2 files), well-scoped CVE fix. Major-version starlette jump and dev fastapi bump are both necessary and CI-verified — two documentation nits below.

---

P3 — Major-version starlette jump (0.x → 1.x) affects optional-extra consumers (Claude Code)

File/Section: pyproject.toml:46
Issue: The optional starlette floor moves from >=0.27.0 to >=1.3.1, crossing the 0.x → 1.x stable boundary. Starlette 1.0 removed several long-deprecated APIs (legacy middleware constructors, deprecation-warning classes). Downstream users of the middleware, openai, or crewai extras who rely on those removed APIs could see install-time or import-time failures.
Evidence: -starlette = { version = ">=0.27.0", optional = true } → +starlette = { version = ">=1.3.1", optional = true }. Starlette 1.0 release notes: "removes all deprecated features marked for 1.0.0".
Recommended fix: Non-blocking — 1995 tests pass across the full CI matrix (Py 3.11–3.14 × Linux/macOS/Windows). Consider adding a CHANGELOG entry flagging the starlette 1.x floor as a potentially breaking change for consumers with custom starlette middleware.

---

P3 — Dev fastapi bump silently forces pydantic >=2.9.0 on contributors (Claude Code)

File/Section: pyproject.toml:79
Issue: fastapi ^0.135.0 now requires pydantic>=2.9.0 (was >=1.7.4) and drops Python <3.10 support. Dev-only, so no runtime impact, but contributors on stale local environments may hit resolver errors.
Evidence: Lock diff: pydantic = ">=1.7.4,..." → pydantic = ">=2.9.0", python-versions = ">=3.8" → ">=3.10".
Recommended fix: Optional — mention the pydantic v2 dev-env requirement in the PR description or CONTRIBUTING notes. No code change needed (project already requires ^3.11).

---

Reviewer	Model	Key Contribution
Claude Code	Claude Opus	Major-version starlette boundary, pydantic dev-env requirement, bonus CVEs fixed