From 730740339cf8dd93ea4b1cdb8d77fb846651ea63 Mon Sep 17 00:00:00 2001 From: shuningc Date: Fri, 24 Jul 2026 11:06:02 -0700 Subject: [PATCH] fix(deps): bump python-multipart to 0.0.32 for VULN-88812 Remediate path traversal when UPLOAD_DIR and UPLOAD_KEEP_FILENAME=True (fixed in 0.0.22). Transitive via fastapi/starlette/mcp; lock-only bump. Co-authored-by: Cursor --- poetry.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/poetry.lock b/poetry.lock index 84e8d17b..af97fba7 100644 --- a/poetry.lock +++ b/poetry.lock @@ -4446,15 +4446,15 @@ cli = ["click (>=5.0)"] [[package]] name = "python-multipart" -version = "0.0.20" +version = "0.0.32" description = "A streaming multipart parser for Python" optional = true -python-versions = ">=3.8" +python-versions = ">=3.10" groups = ["main"] markers = "extra == \"openai\" or extra == \"all\" or python_version <= \"3.13\" and (extra == \"openai\" or extra == \"all\" or extra == \"crewai\")" files = [ - {file = "python_multipart-0.0.20-py3-none-any.whl", hash = "sha256:8a62d3a8335e06589fe01f2a3e178cdcc632f3fbe0d492ad9ee0ec35aab1f104"}, - {file = "python_multipart-0.0.20.tar.gz", hash = "sha256:8dd0cab45b8e23064ae09147625994d090fa46f5b0d1e13af944c331a7fa9d13"}, + {file = "python_multipart-0.0.32-py3-none-any.whl", hash = "sha256:ff6d3f776f16878c894e52e107296ffc890e913c611b1a4ec6c44e2821fe2e23"}, + {file = "python_multipart-0.0.32.tar.gz", hash = "sha256:be54b7f3fa167bb83e4fcd936b887b708f4e57fe75911c02aebf53efaf8d938e"}, ] [[package]]