PYSEC-2026-161 is fixed in starlette>=1.0.1. fastapi==0.120.1 caps starlette<0.50.0, so it has to be bumped to lift that cap, but fastapi>=0.136.3 only requires starlette>=0.46.0 and would still resolve to a vulnerable version -- hence the explicit starlette floor below. Both requirements need Python >= 3.10, so 3.9 stays on the previous pin.

Signed-off-by: Ha Vu <ha@newmantle.tech>

Author: hongha912

pyproject.toml

@@ -134,9 +134,8 @@ snowflake = [
 starrocks = ["pymysql"]
 trino = ["trino"]
 web = [
-    # fastapi>=0.136.3 brings in starlette>=1.0.1, which fixes PYSEC-2026-161.
-    # Both require Python >= 3.10, so 3.9 stays on the previous pin.
     "fastapi>=0.136.3; python_version >= '3.10'",
+    "starlette>=1.0.1; python_version >= '3.10'",
     "fastapi==0.120.1; python_version < '3.10'",
     "watchfiles>=0.19.0",
     "uvicorn[standard]==0.22.0",
@@ -146,6 +145,7 @@ web = [
 lsp = [
     # Duplicate of web
     "fastapi>=0.136.3; python_version >= '3.10'",
+    "starlette>=1.0.1; python_version >= '3.10'",
     "fastapi==0.120.1; python_version < '3.10'",
     "watchfiles>=0.19.0",
     # "uvicorn[standard]==0.22.0",