fix(security): FastAPI 0.143.1 / Starlette 1.7.0 to clear last HIGH CVEs in lite image

[dvejsada]

Stacked on #15. Merge that first; GitHub will retarget this PR to main.

Why

With #15 in place, the lite image still had 3 fixable HIGH CVEs, all in Starlette. fastapi==0.115.12 held it at starlette<0.47:

CVE	Fixed in
CVE-2025-62727 (FileResponse Range DoS)	0.49.1
CVE-2026-48818 (StaticFiles UNC SSRF, Windows)	1.1.0
CVE-2026-54283 (request.form() limits ignored for urlencoded)	1.3.1

Changes (requirements.txt and requirements.lite.txt)

• fastapi 0.115.12 → 0.143.1
• starlette → 1.7.0, now pinned explicitly because FastAPI ≥0.133 sets no upper bound. FastAPI's own CI runs against 1.7.0, and Starlette has no known vulnerabilities newer than 1.3.1.
• mistralai 2.6.0 → 2.10.1. FastAPI ≥0.142 requires opentelemetry-api>=1.44. mistralai 2.6.0 blocked that through its opentelemetry-semantic-conventions<0.61 cap, which 2.10 removes. The breaking changes in mistralai 2.7–2.10.1 are in the evaluations, workflows and campaigns APIs, not OCR.

No app code changes:

• Startup/shutdown: Starlette 1.0 removed on_startup/on_shutdown/on_event; the app already uses lifespan.
• Decorators: Starlette 1.0 also removed its own app.middleware/app.exception_handler decorators, but the ones the app calls are FastAPI's own methods.
• Middleware and uploads: BaseHTTPMiddleware, CORS and UploadFile work unchanged.
• uvicorn and the test client: uvicorn 0.28.0 and httpx 0.28.1 (used by TestClient) need no change.

Behaviour change to be aware of

Since FastAPI 0.132, JSON requests without a JSON Content-Type header are rejected. LibreChat sends application/json (axios default), and uploads are multipart. Any other client that posts JSON without the header would now be rejected. FastAPI(strict_content_type=False) restores the old behaviour if needed.

Verification (Dockerfile.lite)

• docker build -f Dockerfile.lite succeeds and pip check is clean.
• Resolved versions: fastapi 0.143.1, starlette 1.7.0, mistralai 2.10.1, opentelemetry-api 1.45.1, uvicorn 0.28.0, httpx 0.28.1, anyio 4.15.1.
• OPENAI_API_KEY=test_key python -m pytest: 385 passed, 1 skipped (same as before).
• Trivy (--severity CRITICAL,HIGH --ignore-unfixed): 0.
• The unit tests replace mistralai with a fake module, so I also ran the real mistralai 2.10.1 library against a mocked server. Mistral(server_url="https://api.eu.mistral.ai") with ocr.process sent both document_url and image_url requests to /v1/ocr, and .pages[].markdown read back correctly.

Not done: a live OCR call with a real key, and a build of the full Dockerfile (its extra packages don't constrain Starlette or OpenTelemetry).

🤖 Generated with Claude Code