Bump python-multipart from 0.0.20 to 0.0.31 in /python/samples/demos/mcp_with_oauth - #14188
Conversation
Bumps [python-multipart](https://github.com/Kludex/python-multipart) from 0.0.20 to 0.0.31. - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.20...0.0.31) --- updated-dependencies: - dependency-name: python-multipart dependency-version: 0.0.31 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated Code Review
Reviewers: 5 | Confidence: 86%
✓ Correctness
This is a straightforward lockfile-only dependency bump of python-multipart from 0.0.20 to 0.0.31 in a sample demo's uv.lock. The secondary change to the exceptiongroup typing-extensions marker (< '3.12' → < '3.11') is a normal side effect of lockfile regeneration by uv, consistent with exceptiongroup 1.3.0's actual package metadata. No code changes, no correctness concerns.
✓ Security Reliability
This PR is a lock file-only change bumping the transitive dependency
python-multipartfrom 0.0.20 to 0.0.31. The new version includes several security-hardening fixes (boundary length caps, header size limits, Content-Length validation, stricter URL-encoded parsing). Theexceptiongroupmarker change from< '3.12'to< '3.11'is a normal lock file resolution update. No code changes are involved, and the hashes point to the canonical PyPI registry. No security or reliability concerns.
✓ Test Coverage
This PR is a straightforward dependency version bump of python-multipart from 0.20 to 0.31 in the uv.lock file of a demo/sample project (mcp_with_oauth). No application code, library code, or test code is changed — only the lock file is updated. There is no new or changed behavior that would require additional test coverage. The exceptiongroup marker change (python_full_version < '3.12' → < '3.11') is a normal consequence of regenerating the lock file with updated transitive dependency metadata. No test coverage concerns.
✓ Failure Modes
This PR is a lock file-only change bumping python-multipart from 0.0.20 to 0.0.31 (a transitive dependency, not directly imported by any sample code). The lock file is auto-generated by uv. The version bump includes security hardening (boundary length caps, header limits, Content-Length validation) and performance improvements. The exceptiongroup marker change is also a mechanical lock resolution update. No application code is modified and no failure modes are introduced.
✗ Design Approach
The bump updates the root demo lockfile, but it misses the nested
server/project that the sample’s README tells users to run for both OAuth servers. As a result, the documented server path still installspython-multipart==0.0.20, so the change does not fully address the dependency update for the sample as designed.
Flagged Issues
- The sample's README instructs users to
cd samples/demos/mcp_with_oauth/serverbefore runninguv run mcp-simple-auth-as/mcp-simple-auth-rs(README.md:16-19,34-40), and that nested project still lockspython-multipartto0.0.20inpython/samples/demos/mcp_with_oauth/server/uv.lock:426-431. Updating only the rootuv.lockleaves the actual OAuth server environment on the old version.
Automated review by dependabot[bot]'s agents
| [[package]] | ||
| name = "python-multipart" | ||
| version = "0.0.20" | ||
| version = "0.0.31" |
There was a problem hiding this comment.
This lockfile belongs to the root sk-mcp-auth client project, but the sample's documented OAuth server flow runs from samples/demos/mcp_with_oauth/server (README.md:16-19,34-40). That nested project still locks python-multipart to 0.0.20 in server/uv.lock:426-431, so the bump misses the server dependency path users actually execute.
|
Flagged issue The sample's README instructs users to Source: automated DevFlow PR review |
### Motivation and Context Consolidates the currently open Python and .NET Dependabot updates into one coordinated dependency change. This reduces duplicate review and CI work while preserving each source PR's update intent. The npm and Yarn updates are intentionally excluded from this draft and remain in their original Dependabot PRs. ### Related Issue Supersedes: - microsoft#14178 - microsoft#14184 - microsoft#14185 - microsoft#14186 - microsoft#14187 - microsoft#14188 - microsoft#14189 - microsoft#14191 - microsoft#14192 - microsoft#14202 - microsoft#14203 - microsoft#14204 - microsoft#14205 - microsoft#14207 - microsoft#14208 - microsoft#14211 - microsoft#14212 - microsoft#14213 - microsoft#14214 - microsoft#14215 - microsoft#14216 - microsoft#14217 - microsoft#14218 - microsoft#14219 - microsoft#14221 ### Description - Updates the selected .NET Aspire and AWS SDK package versions in central package management. - Updates the selected Python requirements and regenerates both affected uv lockfiles without losing earlier bumps. - Keeps the compatible ONNX Runtime/GenAI pair on Python 3.10 while applying ONNX Runtime GenAI 0.14.1 on Python 3.11 and newer. - Retains pyOpenSSL 26.2.0, which is newer than the 26.0.0 requested by its source PR and is required by the consolidated cryptography update. - Uses Pinecone 7.3 or newer on Windows, where Pinecone 7.0.1 imports the unavailable Unix `readline` module, while retaining the existing `~=7.0` range on macOS and Linux. - Constrains MCP to the compatible 1.x API because the current Semantic Kernel integration imports interfaces removed by MCP 2.0. ### Validation - Python unit tests passed across Python 3.10-3.13 on Ubuntu, Windows, and macOS, including Dapr jobs. - Python pre-commit, lock validation, spell checking, and integration-test aggregate checks passed. - .NET 9/10 builds, package-install checks, unit tests, AOT tests, formatting, and coverage checks passed on Ubuntu and Windows. - Merge Gatekeeper passed. ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [x] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄
|
Superseded by #14222 |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Bumps python-multipart from 0.0.20 to 0.0.31.
Release notes
Sourced from python-multipart's releases.
... (truncated)
Changelog
Sourced from python-multipart's changelog.
... (truncated)
Commits
4cffc68Version 0.0.31 (#298)c814948Reject negativeContent-Lengthinparse_form(#297)6b837d4Bound header field name size before validating (#296)e0c4f9dBump the github-actions group with 3 updates (#294)b8a01bbBump the python-packages group with 3 updates (#293)6732164Speed up multipart header parsing and callback dispatch (#295)9d3ead5Version 0.0.30 (#292)3506c15Ignore RFC 2231 extended parameters inparse_options_header(#291)d69df35Treat only&as the urlencoded field separator (#290)1e6ff97Bump idna from 3.11 to 3.15 (#289)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.