Support Starlette 1.x to address CVE-2026-48710

[kirylbelavus]

Summary

OPAL's shared dependency constraints cannot currently resolve a patched version of Starlette for CVE-2026-48710 / GHSA-86qp-5c8j-p5mr.

packages/requires.txt declares:

• fastapi>=0.109.1,<1
• pydantic[email]>=1.9.1,<2
• starlette>=0.40.0,<1

The GitHub advisory marks Starlette <=1.0.0 as affected and 1.0.1 as the first patched release. The current <1 upper bound therefore excludes every patched version.

These shared requirements are consumed by all three OPAL packages and installed directly in both Debian and Alpine Docker build stages, including the opal-server image.

Compatibility blockers

Changing only the Starlette constraint to starlette>=1.0.1,<2 produces an unsatisfiable dependency set:

1. Starlette 1.0.1 requires Python >=3.10, while the OPAL packages and CI matrix still support Python 3.9.
2. FastAPI releases compatible with Starlette 1.x require Pydantic 2, while OPAL pins Pydantic <2.

Source locations

• packages/requires.txt

References

• GHSA-86qp-5c8j-p5mr
• Upstream fix PR #3279
• Starlette 1.0.1 release

Finding ID: CVE-2026-48710
Advisory ID: GHSA-86qp-5c8j-p5mr

[linear-code]

PER-15885