build(deps-dev): bump starlette from 0.41.3 to 0.49.1

[dependabot]

Bumps starlette from 0.41.3 to 0.49.1.

Release notes

Sourced from starlette's releases.

Version 0.49.1

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

• Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

---

Full Changelog: Kludex/starlette@0.49.0...0.49.1

Version 0.49.0

Added

• Add encoding parameter to Config class #2996.
• Support multiple cookie headers in Request.cookies #3029.
• Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

• Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

---

New Contributors

• @​TheWesDias made their first contribution in Kludex/starlette#3017
• @​gmos2104 made their first contribution in Kludex/starlette#3027
• @​secrett2633 made their first contribution in Kludex/starlette#2996
• @​adam-sikora made their first contribution in Kludex/starlette#2976

Full Changelog: Kludex/starlette@0.48.0...0.49.0

Version 0.48.0

Added

• Add official Python 3.14 support #3013.

Changed

• Implement RFC9110 http status names #2939.

---

New Contributors

• @​yakimka made their first contribution in Kludex/starlette#2943
• @​mbeijen made their first contribution in Kludex/starlette#2939

Full Changelog: Kludex/starlette@0.47.3...0.48.0

... (truncated)

Changelog

Sourced from starlette's changelog.

0.49.1 (October 28, 2025)

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

• Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

0.49.0 (October 28, 2025)

Added

• Add encoding parameter to Config class #2996.
• Support multiple cookie headers in Request.cookies #3029.
• Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

• Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

0.48.0 (September 13, 2025)

Added

• Add official Python 3.14 support #3013.

Changed

• Implement RFC9110 http status names #2939.

0.47.3 (August 24, 2025)

Fixed

• Use asyncio.iscoroutinefunction for Python 3.12 and older #2984.

0.47.2 (July 20, 2025)

Fixed

• Make UploadFile check for future rollover #2962.

0.47.1 (June 21, 2025)

Fixed

• Use Self in TestClient.__enter__ #2951.
• Allow async exception handlers to type-check #2949.

... (truncated)

Commits

• 7e4b742 Version 0.49.1 (#3047)
• 4ea6e22 Merge commit from fork
• 7d88ea6 Version 0.49.0 (#3046)
• 26d66bb Do not pollute exception context in Middleware (#2976)
• a59397d Set encodings when reading config files (#2996)
• 3b7f0cb test: add test for unknown status (#3035)
• b09ce1a docs: fix legibility issues on sponsorship page (#3039)
• 0f0edcf Revert "Add Marcelo Trylesinski to the license (#3025)" (#3044)
• 3912d63 docs: add social icons (#3038)
• 4915a93 Add discord to README/docs (#3034)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[codspeed-hq]

CodSpeed Performance Report

Merging this PR will degrade performance by 32.61%

_{Comparing dependabot/pip/starlette-0.49.1 (cf9c17b) with master (c887846)¹}

Summary

⚡ 8 improved benchmarks
❌ 10 regressed benchmarks
✅ 66 untouched benchmarks

⚠️ Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	test_first[500]	2.9 ms	3.4 ms	-14.36%
⚡	test_avg[1000]	4.8 ms	4.2 ms	+14.27%
❌	test_get_one[1000]	3.8 ms	4.7 ms	-19.08%
❌	test_get_all_with_related_models[10]	12.5 ms	14.7 ms	-14.81%
⚡	test_get_one[500]	3.5 ms	3 ms	+14.07%
⚡	test_get_or_create_when_get[1000]	3.8 ms	3.3 ms	+15.68%
❌	test_max[1000]	3.2 ms	4.8 ms	-32.61%
❌	test_get_or_create_when_get[500]	2.9 ms	3.3 ms	-12.71%
⚡	test_get_or_create_when_get[250]	3.9 ms	3.4 ms	+14.74%
❌	test_saving_models_individually[10]	12.2 ms	13.8 ms	-11.74%
⚡	test_get_or_none[1000]	4.7 ms	3.9 ms	+20.89%
⚡	test_sum[500]	3 ms	2.7 ms	+10.08%
❌	test_exists[1000]	4.1 ms	5 ms	-17.2%
⚡	test_sum[1000]	4.1 ms	3.7 ms	+11.7%
❌	test_exists[500]	3.2 ms	3.8 ms	-15.41%
❌	test_first[1000]	3.8 ms	4.6 ms	-16.72%
❌	test_deleting_all[500]	2.7 ms	3.1 ms	-12.95%
⚡	test_deleting_all[1000]	4.9 ms	4 ms	+22.63%

Footnotes

1. No successful run was found on master (12b52f5) during the generation of this report, so c887846 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩