[dependabot]

Bumps the python-examples group with 3 updates in the /demos directory: cmcp-runtime, openai and starlette.
Bumps the python-examples group with 6 updates in the /examples directory:

Package	From	To
cmcp-runtime	0.7.0	0.7.1
starlette	1.8.0	1.10.0
certifi	2026.10.19	2026.10.23
pycparser	3.11	3.12
transformers	5.19.0	5.20.2
cmcp-runtime	0.7.0	0.7.1
cedarpy	4.12.1	4.12.2
starlette	1.8.0	1.10.0

Updates cmcp-runtime from 0.7.0 to 0.7.1

Release notes

Sourced from cmcp-runtime's releases.

cmcp 0.7.1

Three security fixes, backported onto 0.7.0 so they ship without the breaking Agent Manifest binding change and the opaque provider removal waiting on main. Full detail in CHANGELOG.

• GHSA-frxc-7f57-6f4r: deny a Cedar Allow that comes with evaluation errors, instead of skipping the errored policy and allowing.
• GHSA-mrcx-xvv4-m7f8: bound the TPM AIA certificate fetch. Each hop resolves the host once, connects only to that checked address, and the hop and byte limits hold.
• GHSA-2p85-666x-xm7x: classify upstream drift against the drifted tool's own catalog entry.

SDK on PyPI as cmcp-runtime 0.7.1.

Changelog

Sourced from cmcp-runtime's changelog.

[0.7.1] - 2026-10-19

Security

• A Cedar Allow reached with evaluation errors was enforced as Allow (GHSA-frxc-7f57-6f4r). Cedar skips a policy whose condition errors, so a forbid reading a context attribute the current phase does not carry could not stop a matching permit. CedarBackend now denies any Allow that comes with evaluation errors, and the error reaches the tool_call or egress_denied audit row. So that a policy written for one phase does not deny in the other, both phases now carry the same context keys: egress adds session_max_sensitivity (the label string), arguments, baa_covered, compliance_domain, server_identity, destination_class and attestation_platform, and ingress adds egress (false), sensitivity_level, injection_events, reset_count and response_size_bytes (0). Without this the shipped BFSi demo denied every response at egress. A policy that reads a key outside that set, or workflow_id when the caller declared none, now denies.
• The TPM AIA certificate fetch was unbounded (GHSA-mrcx-xvv4-m7f8). The chain walk followed redirects to any address and read responses without a limit. It now refuses destinations that do not resolve to global addresses, checks every redirect the same way, follows at most three and ignores responses over 64 KiB. Each hop's host is resolved once and the connection goes to the checked address (the request still names the host, and HTTPS still verifies the certificate against it), so a second DNS answer cannot point the fetch somewhere else. The fetch no longer uses environment proxies. An on-prem CA whose AIA host has a private address falls back to the vendored bundle.
• Upstream drift was classified against the wrong catalog entry (GHSA-2p85-666x-xm7x). The scanner received the server of whichever entry was last in the catalog. Detection and fail-closed denial were not affected; only the classification written to the audit row was.

Commits

• 4a7163a fix(security): cmcp-runtime 0.7.1 backport (Cedar errors, AIA fetch, drift cl...
• See full diff in compare view

Updates openai from 3.31.0 to 3.37.0

Release notes

Sourced from openai's releases.

v3.37.0

3.37.0 (2026-10-22)

⚠ BREAKING CHANGES

• api: This minor release includes a breaking change to Decisions types. In Live response models, question instructions can now be a string or a list of structured text, image, or JSON parts; check isinstance(question.instructions, str) before using string operations and handle the structured form. Decisions request input types also include additional message roles and tool-history items, so update exhaustive type checks accordingly. Existing string instructions and DecisionInputMessageParam user-message inputs remain supported.

Features

• api: expand Decisions input and question types (#4158) (1e45ad1)

Chores

• api: preserve file and video polling helpers (#4155) (7db9d88)
• api: preserve upload helpers and Live connection defaults (#4152) (a29dc39)
• deps: bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109) (fa9a161)

v3.36.1

3.36.1 (2026-10-22)

Bug Fixes

• api: honor per-call WebSocket query settings (#4138) (d40a5e1)
• examples: stop microphone capture between recordings (#4143) (26e5d92)
• validate browser calls before reading driver state (#4142) (2bfe460)

Chores

• api: clarify service-account API key deletion (#4151) (6ed945e)

Refactors

• prepare handwritten chunked upload runtime (#4146) (2d58e82)
• prepare handwritten vector-store polling runtime (#4148) (7cd7028)

v3.36.0

3.36.0 (2026-10-21)

Features

• add Vertex AI support for the Responses API (#4139) (3e63d33)
• api: add 30-minute cache-write usage counts (#4111) (5589146)
• api: add compaction trigger IDs (#4122) (0e5794d)

... (truncated)

Changelog

Sourced from openai's changelog.

3.37.0 (2026-10-22)

⚠ BREAKING CHANGES

• api: This minor release includes a breaking change to Decisions types. In Live response models, question instructions can now be a string or a list of structured text, image, or JSON parts; check isinstance(question.instructions, str) before using string operations and handle the structured form. Decisions request input types also include additional message roles and tool-history items, so update exhaustive type checks accordingly. Existing string instructions and DecisionInputMessageParam user-message inputs remain supported.

Features

• api: expand Decisions input and question types (#4158) (1e45ad1)

Chores

• api: preserve file and video polling helpers (#4155) (7db9d88)
• api: preserve upload helpers and Live connection defaults (#4152) (a29dc39)
• deps: bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109) (fa9a161)

3.36.1 (2026-10-22)

Bug Fixes

• api: honor per-call WebSocket query settings (#4138) (d40a5e1)
• examples: stop microphone capture between recordings (#4143) (26e5d92)
• validate browser calls before reading driver state (#4142) (2bfe460)

Chores

• api: clarify service-account API key deletion (#4151) (6ed945e)

Refactors

• prepare handwritten chunked upload runtime (#4146) (2d58e82)
• prepare handwritten vector-store polling runtime (#4148) (7cd7028)

3.36.0 (2026-10-21)

Features

• add Vertex AI support for the Responses API (#4139) (3e63d33)
• api: add 30-minute cache-write usage counts (#4111) (5589146)
• api: add compaction trigger IDs (#4122) (0e5794d)
• api: add custom voice consent management (#4135) (de6d70d)
• types: prepare native synchronous WebSocket option type (#4118) (90c0bac)

... (truncated)

Commits

• e8a0fd2 release: 3.37.0 (#4154)
• fa9a161 chore(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109)
• 1e45ad1 feat(api): expand Decisions input and question types (#4158)
• 1f76a59 ci: allow time for browser dependency installation (#4159)
• 7db9d88 chore(api): preserve file and video polling helpers (#4155)
• a29dc39 chore(api): preserve upload helpers and Live connection defaults (#4152)
• 49e6757 release: 3.36.1 (#4145)
• 6ed945e chore(api): clarify service-account API key deletion (#4151)
• 7cd7028 refactor: prepare handwritten vector-store polling runtime (#4148)
• d40a5e1 fix(api): honor per-call WebSocket query settings (#4138)
• Additional commits viewable in compare view

Updates starlette from 1.7.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0

• Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
• The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
• FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

• Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
• starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

• Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
• Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
• WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.
• FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

• Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
• Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
• FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
• Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

... (truncated)

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

• Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.
• Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.
• Compare Match members by identity during routing #3665 and #3722.

Deprecated

• Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

• Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.
• Keep path parameter values that look like another placeholder in url_path_for() #3725.
• Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.
• Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.
• Strip only one pair of matching outer quotes from Config env file values #3720.
• Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.
• Report NaN and infinity correctly in FloatConvertor.to_string() #3716.
• Ignore Range on requests other than GET and HEAD in FileResponse #3679.

1.9.0 (October 18, 2026)

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

• Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

• Require Python 3.11 or later, dropping support for Python 3.10 #3592.
• Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
• Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.

... (truncated)

Commits

• 8aa828c Version 1.10.0 (#3728)
• a85a5c3 Substitute URL path parameters in a single pass (#3725)
• 6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
• b973efd Build URL-encoded form fields in parser callbacks (#3724)
• d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
• fb3e818 Compare remaining Match members by identity in routing (#3722)
• fc23aa1 Compare Match members by identity in Router.app (#3665)
• fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
• 4114432 Default omitted http.response.start headers in middlewares (#3721)
• 1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
• Additional commits viewable in compare view

Updates cmcp-runtime from 0.7.0 to 0.7.1

Release notes

Sourced from cmcp-runtime's releases.

cmcp 0.7.1

Three security fixes, backported onto 0.7.0 so they ship without the breaking Agent Manifest binding change and the opaque provider removal waiting on main. Full detail in CHANGELOG.

• GHSA-frxc-7f57-6f4r: deny a Cedar Allow that comes with evaluation errors, instead of skipping the errored policy and allowing.
• GHSA-mrcx-xvv4-m7f8: bound the TPM AIA certificate fetch. Each hop resolves the host once, connects only to that checked address, and the hop and byte limits hold.
• GHSA-2p85-666x-xm7x: classify upstream drift against the drifted tool's own catalog entry.

SDK on PyPI as cmcp-runtime 0.7.1.

Changelog

Sourced from cmcp-runtime's changelog.

[0.7.1] - 2026-10-19

Security

• A Cedar Allow reached with evaluation errors was enforced as Allow (GHSA-frxc-7f57-6f4r). Cedar skips a policy whose condition errors, so a forbid reading a context attribute the current phase does not carry could not stop a matching permit. CedarBackend now denies any Allow that comes with evaluation errors, and the error reaches the tool_call or egress_denied audit row. So that a policy written for one phase does not deny in the other, both phases now carry the same context keys: egress adds session_max_sensitivity (the label string), arguments, baa_covered, compliance_domain, server_identity, destination_class and attestation_platform, and ingress adds egress (false), sensitivity_level, injection_events, reset_count and response_size_bytes (0). Without this the shipped BFSi demo denied every response at egress. A policy that reads a key outside that set, or workflow_id when the caller declared none, now denies.
• The TPM AIA certificate fetch was unbounded (GHSA-mrcx-xvv4-m7f8). The chain walk followed redirects to any address and read responses without a limit. It now refuses destinations that do not resolve to global addresses, checks every redirect the same way, follows at most three and ignores responses over 64 KiB. Each hop's host is resolved once and the connection goes to the checked address (the request still names the host, and HTTPS still verifies the certificate against it), so a second DNS answer cannot point the fetch somewhere else. The fetch no longer uses environment proxies. An on-prem CA whose AIA host has a private address falls back to the vendored bundle.
• Upstream drift was classified against the wrong catalog entry (GHSA-2p85-666x-xm7x). The scanner received the server of whichever entry was last in the catalog. Detection and fail-closed denial were not affected; only the classification written to the audit row was.

Commits

• 4a7163a fix(security): cmcp-runtime 0.7.1 backport (Cedar errors, AIA fetch, drift cl...
• See full diff in compare view

Updates starlette from 1.7.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0

• Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
• The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
• FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

• Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
• starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

• Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
• Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
• WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.
• FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

• Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
• Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
• FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
• Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

... (truncated)

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

• Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.
• Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.
• Compare Match members by identity during routing #3665 and #3722.

Deprecated

• Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

• Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.
• Keep path parameter values that look like another placeholder in url_path_for() #3725.
• Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.
• Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.
• Strip only one pair of matching outer quotes from Config env file values #3720.
• Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.
• Report NaN and infinity correctly in FloatConvertor.to_string() #3716.
• Ignore Range on requests other than GET and HEAD in FileResponse #3679.

1.9.0 (October 18, 2026)

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

• Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

• Require Python 3.11 or later, dropping support for Python 3.10 #3592.
• Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
• Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.

... (truncated)

Commits

• 8aa828c Version 1.10.0 (#3728)
• a85a5c3 Substitute URL path parameters in a single pass (#3725)
• 6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
• b973efd Build URL-encoded form fields in parser callbacks (#3724)
• d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
• fb3e818 Compare remaining Match members by identity in routing (#3722)
• fc23aa1 Compare Match members by identity in Router.app (#3665)
• fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
• 4114432 Default omitted http.response.start headers in middlewares (#3721)
• 1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
• Additional commits viewable in compare view

Updates cmcp-runtime from 0.7.0 to 0.7.1

Release notes

Sourced from cmcp-runtime's releases.

cmcp 0.7.1

Three security fixes, backported onto 0.7.0 so they ship without the breaking Agent Manifest binding change and the opaque provider removal waiting on main. Full detail in CHANGELOG.

• GHSA-frxc-7f57-6f4r: deny a Cedar Allow that comes with evaluation errors, instead of skipping the errored policy and allowing.
• GHSA-mrcx-xvv4-m7f8: bound the TPM AIA certificate fetch. Each hop resolves the host once, connects only to that checked address, and the hop and byte limits hold.
• GHSA-2p85-666x-xm7x: classify upstream drift against the drifted tool's own catalog entry.

SDK on PyPI as cmcp-runtime 0.7.1.

Changelog

Sourced from cmcp-runtime's changelog.

[0.7.1] - 2026-10-19

Security

• A Cedar Allow reached with evaluation errors was enforced as Allow (GHSA-frxc-7f57-6f4r). Cedar skips a policy whose condition errors, so a forbid reading a context attribute the current phase does not carry could not stop a matching permit. CedarBackend now denies any Allow that comes with evaluation errors, and the error reaches the tool_call or egress_denied audit row. So that a policy written for one phase does not deny in the other, both phases now carry the same context keys: egress adds session_max_sensitivity (the label string), arguments, baa_covered, compliance_domain, server_identity, destination_class and attestation_platform, and ingress adds egress (false), sensitivity_level, injection_events, reset_count and response_size_bytes (0). Without this the shipped BFSi demo denied every response at egress. A policy that reads a key outside that set, or workflow_id when the caller declared none, now denies.
• The TPM AIA certificate fetch was unbounded (GHSA-mrcx-xvv4-m7f8). The chain walk followed redirects to any address and read responses without a limit. It now refuses destinations that do not resolve to global addresses, checks every redirect the same way, follows at most three and ignores responses over 64 KiB. Each hop's host is resolved once and the connection goes to the checked address (the request still names the host, and HTTPS still verifies the certificate against it), so a second DNS answer cannot point the fetch somewhere else. The fetch no longer uses environment proxies. An on-prem CA whose AIA host has a private address falls back to the vendored bundle.
• Upstream drift was classified against the wrong catalog entry (GHSA-2p85-666x-xm7x). The scanner received the server of whichever entry was last in the catalog. Detection and fail-closed denial were not affected; only the classification written to the audit row was.

Commits

• 4a7163a fix(security): cmcp-runtime 0.7.1 backport (Cedar errors, AIA fetch, drift cl...
• See full diff in compare view

Updates starlette from 1.8.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0

• Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
• The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
• FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

• Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
• starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

• Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
• Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
• WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.
• FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

• Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
• Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
• FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
• Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

... (truncated)

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

• Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.
• Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.
• Compare Match members by identity during routing Description has been truncated

[carloshvp]

Reviewed current head 06a44440cb58e174dbc36ba9e51c40701a138ae5.

The current-head hosted install failures expose incompatible released dependency requirements. ca2a-runtime==0.4.0 requires cedarpy==4.12.1, while the sovereign example now requires >=4.12.2. The industrial presenter lock also combines agent-manifest==0.15.0 with cmcp-runtime==0.7.1, whose published requirement is agent-manifest>=0.12.0,<0.13. Both jobs stop before their tests. Select a mutually compatible released set, regenerate the complete locks with platform markers preserved, and verify both installed environments with pip check and their scenario tests. Keep unrelated model/toolkit updates separate if that makes the compatible set reviewable.

Prepared with OpenAI Codex.

[carloshvp]

[P1] Keep a compatible released cA2A/Cedar set. This >=4.12.2 floor cannot resolve beside the existing ca2a-runtime==0.4.0, which pins Cedar 4.12.1. The current-head sovereign CI job fails with that exact conflict. Update the compatible set together and rerun installation plus the example.

[dinakarjs]

A DCO-signed repair is ready for author adoption: dinakarjs#9, commit 943d5a0ef11d7180740616f961efce24b7dece31. It restores a compatible released Cedar/Agent Manifest/runtime set and regenerates the affected locks. Fresh installations and dependency consistency pass; 52 sovereign tests and five live presenter tests pass. Incompatible standalone Cedar/Agent Manifest upgrades are deliberately deferred. Please review the companion's explicit scope and remaining matrix checks, adopt into this PR, then rerun hosted CI. This is a contributor correction, not independent approval. Prepared with Codex.