Security: starlette CVE-2025-54121 appears reachable in BiliNote

[hamizan-azman]

Security: starlette CVE-2025-54121 appears reachable in BiliNote

Summary

During local dependency-impact validation, we observed behavior indicating that
JefferyHcool/BiliNote reaches code paths involving vulnerable starlette versions. Please review
whether the project currently pins or allows affected starlette releases, and upgrade or constrain
the dependency if needed.

Affected dependency

• Repository: https://github.com/JefferyHcool/BiliNote
• Dependency: starlette
• Version(s) observed: 0.46.1

Advisories observed

• CVE-2025-54121 / GHSA-2c2j-9gv5-cj73: GHSA-2c2j-9gv5-cj73

Local validation notes

• CVE-2025-54121, starlette 0.46.1: Local proof exercised the file upload path associated with Starlette multipart parsing.

Suggested fix

Please upgrade starlette to a version that includes the upstream security fixes for the advisories
above, or add a dependency constraint that prevents affected versions from being installed.

Disclosure note

We have not opened a public security issue elsewhere for these rows. If you prefer a private disclosure route, please point us to the right channel.

[hamizan-azman]

Follow-up clarification on the local validation note:

The Starlette CVE-2025-54121 proof used a 2 MB upload that reached Starlette UploadFile processing. The request triggered the synchronous SpooledTemporaryFile rollover path during multipart parsing and returned a successful upload URL.

No private data is included in this clarification.

[JefferyHcool]

已在 v2.4.4 修复并发布 🎉

确认问题：backend/requirements.txt 此前直接钉死 starlette==0.46.1，确实落在 CVE-2025-54121 / GHSA-2c2j-9gv5-cj73 的受影响范围（< 0.47.2）。

修复：

• starlette 0.46.1 → 0.47.2（含上游修复：multipart 解析大文件时，SpooledTemporaryFile 的内存→磁盘 rollover 改为在线程池执行，消除阻塞事件循环的 DoS 向量）。
• 因 FastAPI 0.115.12 的约束为 starlette<0.47.0，同步升级 FastAPI 0.115.12 → 0.116.2（约束放宽至 <0.48.0），与现有 pydantic 2.11.2 / anyio 4.9.0 / python-multipart 0.0.20 均兼容。

验证：pip check 无依赖冲突；2MB multipart 上传（触发 rollover 路径）正常；整套 Docker 栈在新框架下启动健康（sys_health backend/db ok）。

升级方式：Docker 用户 docker compose pull && docker compose up -d（等 ghcr 镜像构建完成后）。

关于私密披露：本仓库暂未配置 SECURITY.md / 私密通道；这类已公开 advisory 的依赖升级直接走公开 issue/PR 即可。感谢上报 🙏