@tduncan / Nvidia-Optimization-Stack-VLLM / commits / f6ba720963

(security) Upgrade Starlette to >= 1.0.1 to fix CVE-2026-48710 (#45675)

Signed-off-by: jperezde <jperezde@redhat.com> Co-authored-by: Isotr0py <mozf@mail2.sysu.edu.cn>

Juan Pérez de Algaba committed Jun 18, 2026 at 21:35 UTC f6ba7209632936d4908499afc799e96f6eee2725
4 files changed +49 -98
requirements/common.txt
+3 -2
@@ -11,13 +11,14 @@ transformers >= 5.5.3
11 tokenizers >= 0.21.1 # Required for fast incremental detokenization.
12 safetensors >= 0.6.2 # MXFP4/MXFP6 dtype support (F8_E8M0, F4) added in 0.6.0: https://github.com/huggingface/safetensors/pull/611
13 protobuf >= 5.29.6, !=6.30.*, !=6.31.*, !=6.32.*, !=6.33.0.*, !=6.33.1.*, !=6.33.2.*, !=6.33.3.*, !=6.33.4.* # Required by LlamaTokenizer, gRPC. CVE-2026-0994
14 -fastapi[standard] >= 0.115.0 # Required by FastAPI's form models in the OpenAI API server's audio transcriptions endpoint.
14 +fastapi[standard] >= 0.133.0, < 0.137.0 # First version supporting Starlette 1.0; < 0.137.0 avoids route-tree change that breaks model-hosting-container-standards handler overrides.
15 +starlette >= 1.0.1 # CVE-2026-48710: Host header injection in < 1.0.1
16 aiohttp >= 3.13.3
17 openai >= 2.0.0 # For Responses API with reasoning content
18 pydantic >= 2.12.0
19 prometheus_client >= 0.18.0
20 pillow # Required for image processing
20 -prometheus-fastapi-instrumentator >= 7.0.0
21 +prometheus-fastapi-instrumentator >= 8.0.0 # v8 unblocks starlette >= 1.0
22 tiktoken >= 0.6.0 # Required for DBRX tokenizer
23 lm-format-enforcer == 0.11.3
24 llguidance >= 1.7.0, < 1.8.0; platform_machine == "x86_64" or platform_machine == "arm64" or platform_machine == "aarch64" or platform_machine == "ppc64le"
requirements/test/cuda.txt
+23 -48
@@ -35,14 +35,11 @@ arctic-inference==0.1.1
35 # via -r requirements/test/cuda.in
36 argcomplete==3.5.1
37 # via datamodel-code-generator
38 -arrow==1.3.0
39 - # via isoduration
38 attrs==24.2.0
39 # via
40 # aiohttp
41 # hypothesis
42 # jsonschema
45 - # pytest-subtests
43 # referencing
44 audioread==3.0.1
45 # via librosa
@@ -57,9 +54,7 @@ azure-identity==1.25.2
54 azure-storage-blob==12.28.0
55 # via runai-model-streamer-azure
56 backoff==2.2.1
60 - # via
61 - # -r requirements/test/cuda.in
62 - # schemathesis
57 + # via -r requirements/test/cuda.in
58 bitsandbytes==0.49.2
59 # via -r requirements/test/cuda.in
60 black==24.10.0
@@ -110,7 +105,6 @@ colorama==0.4.6
105 # via
106 # perceptron
107 # sacrebleu
113 - # schemathesis
108 colorful==0.5.6
109 # via ray
110 colorlog==6.10.1
@@ -183,7 +177,7 @@ et-xmlfile==2.0.0
177 # via openpyxl
178 evaluate==0.4.3
179 # via lm-eval
186 -fastapi==0.128.0
180 +fastapi==0.136.3
181 # via
182 # -c requirements/common.txt
183 # gpt-oss
@@ -206,8 +200,6 @@ filelock==3.16.1
200 # virtualenv
201 fonttools==4.55.0
202 # via matplotlib
209 -fqdn==1.5.1
210 - # via jsonschema
203 frozendict==2.4.6
204 # via einx
205 frozenlist==1.5.0
@@ -269,7 +261,7 @@ h11==0.14.0
261 # uvicorn
262 h2==4.3.0
263 # via httpx
272 -harfile==0.3.0
264 +harfile==0.5.0
265 # via schemathesis
266 hf-xet==1.4.3
267 # via huggingface-hub
@@ -309,7 +301,7 @@ hypothesis==6.131.0
301 # hypothesis-graphql
302 # hypothesis-jsonschema
303 # schemathesis
312 -hypothesis-graphql==0.11.1
304 +hypothesis-graphql==0.13.0
305 # via schemathesis
306 hypothesis-jsonschema==0.23.1
307 # via schemathesis
@@ -318,7 +310,6 @@ idna==3.10
310 # anyio
311 # email-validator
312 # httpx
321 - # jsonschema
313 # requests
314 # yarl
315 imagehash==4.3.2
@@ -335,8 +326,6 @@ instanttensor==0.1.5
326 # via -r requirements/test/cuda.in
327 isodate==0.7.2
328 # via azure-storage-blob
338 -isoduration==20.11.0
339 - # via jsonschema
329 isort==5.13.2
330 # via datamodel-code-generator
331 jinja2==3.1.6
@@ -356,15 +345,14 @@ joblib==1.4.2
345 # librosa
346 # nltk
347 # scikit-learn
359 -jsonpointer==3.0.0
360 - # via jsonschema
348 jsonschema==4.23.0
349 # via
350 # -c requirements/common.txt
351 # hypothesis-jsonschema
352 # mistral-common
353 # ray
367 - # schemathesis
354 +jsonschema-rs==0.46.5
355 + # via schemathesis
356 jsonschema-specifications==2024.10.1
357 # via jsonschema
358 junit-xml==1.9
@@ -715,18 +703,20 @@ pydantic-core==2.41.1
703 pydantic-extra-types==2.10.5
704 # via mistral-common
705 pygments==2.18.0
718 - # via rich
706 + # via
707 + # pytest
708 + # rich
709 pyjwt==2.11.0
710 # via msal
711 pyparsing==3.2.0
712 # via matplotlib
723 -pyrate-limiter==3.7.0
713 +pyrate-limiter==4.4.0
714 # via schemathesis
715 pystemmer==3.0.0
716 # via mteb
717 pytablewriter==1.2.0
718 # via lm-eval
729 -pytest==8.3.5
719 +pytest==9.1.0
720 # via
721 # -r requirements/test/cuda.in
722 # buildkite-test-collector
@@ -737,10 +727,9 @@ pytest==8.3.5
727 # pytest-mock
728 # pytest-rerunfailures
729 # pytest-shard
740 - # pytest-subtests
730 # pytest-timeout
731 # schemathesis
743 -pytest-asyncio==0.24.0
732 +pytest-asyncio==1.4.0
733 # via -r requirements/test/cuda.in
734 pytest-cov==6.3.0
735 # via -r requirements/test/cuda.in
@@ -752,13 +741,10 @@ pytest-rerunfailures==14.0
741 # via -r requirements/test/cuda.in
742 pytest-shard==0.1.2
743 # via -r requirements/test/cuda.in
755 -pytest-subtests==0.14.1
756 - # via schemathesis
744 pytest-timeout==2.3.1
745 # via -r requirements/test/cuda.in
746 python-dateutil==2.9.0.post0
747 # via
761 - # arrow
748 # botocore
749 # matplotlib
750 # pandas
@@ -829,15 +815,12 @@ requests==2.32.3
815 # tiktoken
816 responses==0.25.3
817 # via genai-perf
832 -rfc3339-validator==0.1.4
833 - # via jsonschema
834 -rfc3987==1.3.8
835 - # via jsonschema
818 rich==13.9.4
819 # via
820 # genai-perf
821 # mteb
822 # perceptron
823 + # schemathesis
824 # typer
825 rouge-score==0.1.2
826 # via lm-eval
@@ -868,7 +851,7 @@ safetensors==0.7.0
851 # segmentation-models-pytorch
852 # timm
853 # transformers
871 -schemathesis==3.39.15
854 +schemathesis==4.21.6
855 # via -r requirements/test/cuda.in
856 scikit-image==0.25.2
857 # via albumentations
@@ -912,7 +895,6 @@ six==1.16.0
895 # junit-xml
896 # opencensus
897 # python-dateutil
915 - # rfc3339-validator
898 # rouge-score
899 smart-open==7.1.0
900 # via ray
@@ -938,10 +920,10 @@ sqlalchemy==2.0.41
920 # optuna
921 sqlitedict==2.1.0
922 # via lm-eval
941 -starlette==0.50.0
923 +starlette==1.3.1
924 # via
925 + # -c requirements/common.txt
926 # fastapi
944 - # schemathesis
927 # starlette-testclient
928 starlette-testclient==0.4.1
929 # via schemathesis
@@ -966,6 +948,7 @@ tenacity==9.1.2
948 # gpt-oss
949 # lm-eval
950 # plotly
951 + # schemathesis
952 tensorizer==2.10.1
953 # via -r requirements/test/cuda.in
954 termcolor==3.1.0
@@ -990,10 +973,6 @@ tokenizers==0.22.2
973 # -c requirements/common.txt
974 # -r requirements/test/cuda.in
975 # transformers
993 -tomli==2.2.1
994 - # via schemathesis
995 -tomli-w==1.2.0
996 - # via schemathesis
976 torch==2.11.0+cu130
977 # via
978 # -c requirements/cuda.txt
@@ -1066,8 +1045,6 @@ typer==0.15.2
1045 # huggingface-hub
1046 # perceptron
1047 # transformers
1069 -types-python-dateutil==2.9.0.20241206
1070 - # via arrow
1048 typing-extensions==4.15.0
1049 # via
1050 # -c requirements/common.txt
@@ -1092,6 +1069,8 @@ typing-extensions==4.15.0
1069 # pydantic
1070 # pydantic-core
1071 # pydantic-extra-types
1072 + # pytest-asyncio
1073 + # schemathesis
1074 # sentence-transformers
1075 # sqlalchemy
1076 # starlette
@@ -1099,11 +1078,11 @@ typing-extensions==4.15.0
1078 # typer
1079 # typing-inspection
1080 typing-inspection==0.4.2
1102 - # via pydantic
1081 + # via
1082 + # fastapi
1083 + # pydantic
1084 tzdata==2024.2
1085 # via pandas
1105 -uri-template==1.3.0
1106 - # via jsonschema
1086 urllib3==2.2.3
1087 # via
1088 # blobfile
@@ -1122,8 +1101,6 @@ vocos==0.1.0
1101 # via -r requirements/test/cuda.in
1102 wcwidth==0.2.13
1103 # via ftfy
1125 -webcolors==24.11.1
1126 - # via jsonschema
1104 werkzeug==3.1.3
1105 # via schemathesis
1106 word2number==1.1
@@ -1135,8 +1112,6 @@ xxhash==3.5.0
1112 # datasets
1113 # evaluate
1114 yarl==1.17.1
1138 - # via
1139 - # aiohttp
1140 - # schemathesis
1115 + # via aiohttp
1116 zipp==3.23.0
1117 # via importlib-metadata
requirements/test/rocm.txt
+21 -47
@@ -51,15 +51,12 @@ arctic-inference==0.1.1
51 # via -r requirements/test/rocm.in
52 argcomplete==3.6.3
53 # via datamodel-code-generator
54 -arrow==1.4.0
55 - # via isoduration
54 astor==0.8.1
55 # via depyf
56 attrs==26.1.0
57 # via
58 # aiohttp
59 # jsonschema
62 - # pytest-subtests
60 # referencing
61 audioread==3.0.1
62 # via librosa
@@ -74,9 +71,7 @@ azure-identity==1.25.3
71 azure-storage-blob==12.28.0
72 # via runai-model-streamer-azure
73 backoff==2.2.1
77 - # via
78 - # -r requirements/test/rocm.in
79 - # schemathesis
74 + # via -r requirements/test/rocm.in
75 bitsandbytes==0.49.2
76 # via -r requirements/test/rocm.in
77 black==26.3.1
@@ -139,7 +134,6 @@ colorama==0.4.6
134 # via
135 # perceptron
136 # sacrebleu
142 - # schemathesis
137 colorful==0.5.8
138 # via ray
139 colorlog==6.10.1
@@ -258,8 +252,6 @@ filelock==3.25.2
252 # virtualenv
253 fonttools==4.62.1
254 # via matplotlib
261 -fqdn==1.5.1
262 - # via jsonschema
255 frozendict==2.4.7
256 # via einx
257 frozenlist==1.8.0
@@ -328,7 +320,7 @@ h11==0.16.0
320 # uvicorn
321 h2==4.3.0
322 # via httpx
331 -harfile==0.4.0
323 +harfile==0.5.0
324 # via schemathesis
325 hf-xet==1.4.3
326 # via huggingface-hub
@@ -378,7 +370,7 @@ hypothesis==6.151.9
370 # hypothesis-graphql
371 # hypothesis-jsonschema
372 # schemathesis
381 -hypothesis-graphql==0.12.0
373 +hypothesis-graphql==0.13.0
374 # via schemathesis
375 hypothesis-jsonschema==0.23.1
376 # via schemathesis
@@ -387,7 +379,6 @@ idna==3.11
379 # anyio
380 # email-validator
381 # httpx
390 - # jsonschema
382 # requests
383 # yarl
384 ijson==3.5.0
@@ -408,8 +399,6 @@ interegular==0.3.3
399 # via lm-format-enforcer
400 isodate==0.7.2
401 # via azure-storage-blob
411 -isoduration==20.11.0
412 - # via jsonschema
402 isort==8.0.1
403 # via datamodel-code-generator
404 jinja2==3.1.6
@@ -435,8 +424,6 @@ joblib==1.5.3
424 # librosa
425 # nltk
426 # scikit-learn
438 -jsonpointer==3.1.0
439 - # via jsonschema
427 jsonschema==4.26.0
428 # via
429 # -c requirements/common.txt
@@ -445,7 +432,8 @@ jsonschema==4.26.0
432 # mcp
433 # mistral-common
434 # ray
448 - # schemathesis
435 +jsonschema-rs==0.46.5
436 + # via schemathesis
437 jsonschema-specifications==2025.9.1
438 # via jsonschema
439 junit-xml==1.9
@@ -792,7 +780,7 @@ prometheus-client==0.24.1
780 # opentelemetry-exporter-prometheus
781 # prometheus-fastapi-instrumentator
782 # ray
795 -prometheus-fastapi-instrumentator==7.1.0
783 +prometheus-fastapi-instrumentator==8.0.0
784 # via
785 # -c requirements/common.txt
786 # -r requirements/test/../common.txt
@@ -876,20 +864,22 @@ pydantic-settings==2.13.1
864 # fastapi
865 # mcp
866 pygments==2.19.2
879 - # via rich
867 + # via
868 + # pytest
869 + # rich
870 pyjwt==2.12.1
871 # via
872 # mcp
873 # msal
874 pyparsing==3.3.2
875 # via matplotlib
886 -pyrate-limiter==3.9.0
876 +pyrate-limiter==4.4.0
877 # via schemathesis
878 pystemmer==3.0.0
879 # via mteb
880 pytablewriter==1.2.1
881 # via lm-eval
892 -pytest==8.3.5
882 +pytest==9.1.0
883 # via
884 # -r requirements/test/rocm.in
885 # buildkite-test-collector
@@ -900,10 +890,9 @@ pytest==8.3.5
890 # pytest-mock
891 # pytest-rerunfailures
892 # pytest-shard
903 - # pytest-subtests
893 # pytest-timeout
894 # schemathesis
906 -pytest-asyncio==0.24.0
895 +pytest-asyncio==1.4.0
896 # via -r requirements/test/rocm.in
897 pytest-cov==6.3.0
898 # via -r requirements/test/rocm.in
@@ -915,13 +904,10 @@ pytest-rerunfailures==14.0
904 # via -r requirements/test/rocm.in
905 pytest-shard==0.1.2
906 # via -r requirements/test/rocm.in
918 -pytest-subtests==0.14.2
919 - # via schemathesis
907 pytest-timeout==2.3.1
908 # via -r requirements/test/rocm.in
909 python-dateutil==2.9.0.post0
910 # via
924 - # arrow
911 # botocore
912 # matplotlib
913 # pandas
@@ -1016,16 +1002,13 @@ requests==2.32.5
1002 # tiktoken
1003 responses==0.26.0
1004 # via genai-perf
1019 -rfc3339-validator==0.1.4
1020 - # via jsonschema
1021 -rfc3987==1.3.8
1022 - # via jsonschema
1005 rich==14.3.3
1006 # via
1007 # genai-perf
1008 # mteb
1009 # perceptron
1010 # rich-toolkit
1011 + # schemathesis
1012 # typer
1013 rich-toolkit==0.19.7
1014 # via
@@ -1063,7 +1046,7 @@ safetensors==0.7.0
1046 # segmentation-models-pytorch
1047 # timm
1048 # transformers
1066 -schemathesis==3.39.15
1049 +schemathesis==4.21.6
1050 # via -r requirements/test/rocm.in
1051 scikit-image==0.26.0
1052 # via albumentations
@@ -1120,7 +1103,6 @@ six==1.17.0
1103 # junit-xml
1104 # opencensus
1105 # python-dateutil
1123 - # rfc3339-validator
1106 # rouge-score
1107 smart-open==7.5.1
1108 # via ray
@@ -1149,13 +1131,14 @@ sqlitedict==2.1.0
1131 # via lm-eval
1132 sse-starlette==3.3.4
1133 # via mcp
1152 -starlette==0.52.1
1134 +starlette==1.3.1
1135 # via
1136 + # -c requirements/common.txt
1137 + # -r requirements/test/../common.txt
1138 # fastapi
1139 # mcp
1140 # model-hosting-container-standards
1141 # prometheus-fastapi-instrumentator
1158 - # schemathesis
1142 # sse-starlette
1143 # starlette-testclient
1144 starlette-testclient==0.4.1
@@ -1182,6 +1165,7 @@ tenacity==9.1.4
1165 # via
1166 # gpt-oss
1167 # lm-eval
1168 + # schemathesis
1169 tensorizer==2.10.1
1170 # via
1171 # -c requirements/rocm.txt
@@ -1215,10 +1199,6 @@ tokenizers==0.22.2
1199 # -r requirements/test/../common.txt
1200 # -r requirements/test/rocm.in
1201 # transformers
1218 -tomli==2.4.0
1219 - # via schemathesis
1220 -tomli-w==1.2.0
1221 - # via schemathesis
1202 torch-c-dlpack-ext==0.1.5
1203 # via tilelang
1204 tqdm==4.67.3
@@ -1301,8 +1281,10 @@ typing-extensions==4.15.0
1281 # pydantic
1282 # pydantic-core
1283 # pydantic-extra-types
1284 + # pytest-asyncio
1285 # referencing
1286 # rich-toolkit
1287 + # schemathesis
1288 # sentence-transformers
1289 # sqlalchemy
1290 # starlette
@@ -1317,10 +1299,6 @@ typing-inspection==0.4.2
1299 # mcp
1300 # pydantic
1301 # pydantic-settings
1320 -tzdata==2025.3
1321 - # via arrow
1322 -uri-template==1.3.0
1323 - # via jsonschema
1302 urllib3==2.6.3
1303 # via
1304 # blobfile
@@ -1351,8 +1329,6 @@ watchfiles==1.1.1
1329 # uvicorn
1330 wcwidth==0.6.0
1331 # via ftfy
1354 -webcolors==25.10.0
1355 - # via jsonschema
1332 websockets==16.0
1333 # via uvicorn
1334 werkzeug==3.1.6
@@ -1370,9 +1346,7 @@ xxhash==3.6.0
1346 # datasets
1347 # evaluate
1348 yarl==1.23.0
1373 - # via
1374 - # aiohttp
1375 - # schemathesis
1349 + # via aiohttp
1350 z3-solver==4.15.4.0
1351 # via tilelang
1352 zipp==3.23.0
requirements/test/xpu.txt
+2 -1
@@ -593,8 +593,9 @@ soxr==0.5.0.post1
593 # mistral-common
594 sqlitedict==2.1.0
595 # via lm-eval
596 -starlette==1.0.0
596 +starlette==1.3.1
597 # via
598 + # -c requirements/common.txt
599 # fastapi
600 # starlette-testclient
601 starlette-testclient==0.4.1