Bump python-multipart from 0.0.20 to 0.0.31 in /python/samples/demos/mcp_with_oauth#14188
Conversation
Bumps [python-multipart](https://github.com/Kludex/python-multipart) from 0.0.20 to 0.0.31. - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.20...0.0.31) --- updated-dependencies: - dependency-name: python-multipart dependency-version: 0.0.31 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated Code Review
Reviewers: 5 | Confidence: 86%
✓ Correctness
This is a straightforward lockfile-only dependency bump of python-multipart from 0.0.20 to 0.0.31 in a sample demo's uv.lock. The secondary change to the exceptiongroup typing-extensions marker (< '3.12' → < '3.11') is a normal side effect of lockfile regeneration by uv, consistent with exceptiongroup 1.3.0's actual package metadata. No code changes, no correctness concerns.
✓ Security Reliability
This PR is a lock file-only change bumping the transitive dependency
python-multipartfrom 0.0.20 to 0.0.31. The new version includes several security-hardening fixes (boundary length caps, header size limits, Content-Length validation, stricter URL-encoded parsing). Theexceptiongroupmarker change from< '3.12'to< '3.11'is a normal lock file resolution update. No code changes are involved, and the hashes point to the canonical PyPI registry. No security or reliability concerns.
✓ Test Coverage
This PR is a straightforward dependency version bump of python-multipart from 0.20 to 0.31 in the uv.lock file of a demo/sample project (mcp_with_oauth). No application code, library code, or test code is changed — only the lock file is updated. There is no new or changed behavior that would require additional test coverage. The exceptiongroup marker change (python_full_version < '3.12' → < '3.11') is a normal consequence of regenerating the lock file with updated transitive dependency metadata. No test coverage concerns.
✓ Failure Modes
This PR is a lock file-only change bumping python-multipart from 0.0.20 to 0.0.31 (a transitive dependency, not directly imported by any sample code). The lock file is auto-generated by uv. The version bump includes security hardening (boundary length caps, header limits, Content-Length validation) and performance improvements. The exceptiongroup marker change is also a mechanical lock resolution update. No application code is modified and no failure modes are introduced.
✗ Design Approach
The bump updates the root demo lockfile, but it misses the nested
server/project that the sample’s README tells users to run for both OAuth servers. As a result, the documented server path still installspython-multipart==0.0.20, so the change does not fully address the dependency update for the sample as designed.
Flagged Issues
- The sample's README instructs users to
cd samples/demos/mcp_with_oauth/serverbefore runninguv run mcp-simple-auth-as/mcp-simple-auth-rs(README.md:16-19,34-40), and that nested project still lockspython-multipartto0.0.20inpython/samples/demos/mcp_with_oauth/server/uv.lock:426-431. Updating only the rootuv.lockleaves the actual OAuth server environment on the old version.
Automated review by dependabot[bot]'s agents
| [[package]] | ||
| name = "python-multipart" | ||
| version = "0.0.20" | ||
| version = "0.0.31" |
There was a problem hiding this comment.
This lockfile belongs to the root sk-mcp-auth client project, but the sample's documented OAuth server flow runs from samples/demos/mcp_with_oauth/server (README.md:16-19,34-40). That nested project still locks python-multipart to 0.0.20 in server/uv.lock:426-431, so the bump misses the server dependency path users actually execute.
|
Flagged issue The sample's README instructs users to Source: automated DevFlow PR review |
Bumps python-multipart from 0.0.20 to 0.0.31.
Release notes
Sourced from python-multipart's releases.
... (truncated)
Changelog
Sourced from python-multipart's changelog.
... (truncated)
Commits
4cffc68Version 0.0.31 (#298)c814948Reject negativeContent-Lengthinparse_form(#297)6b837d4Bound header field name size before validating (#296)e0c4f9dBump the github-actions group with 3 updates (#294)b8a01bbBump the python-packages group with 3 updates (#293)6732164Speed up multipart header parsing and callback dispatch (#295)9d3ead5Version 0.0.30 (#292)3506c15Ignore RFC 2231 extended parameters inparse_options_header(#291)d69df35Treat only&as the urlencoded field separator (#290)1e6ff97Bump idna from 3.11 to 3.15 (#289)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.