From 23ebf88d8abcba065773811b1485cd4e2375b133 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 12:03:58 +0000
Subject: [PATCH] Bump python-multipart from 0.0.27 to 0.0.31 in /backend
 (#1747)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [python-multipart](https://github.com/Kludex/python-multipart)
from 0.0.27 to 0.0.31.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/python-multipart/releases">python-multipart's
releases</a>.</em></p>
<blockquote>
<h2>Version 0.0.31</h2>
<h2>What's Changed</h2>
<ul>
<li>Speed up multipart header parsing and callback dispatch by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/295">Kludex/python-multipart#295</a></li>
<li>Bound header field name size before validating by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/296">Kludex/python-multipart#296</a></li>
<li>Validate Content-Length is non-negative in parse_form by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/297">Kludex/python-multipart#297</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.30...0.0.31">https://github.com/Kludex/python-multipart/compare/0.0.30...0.0.31</a></p>
<h2>Version 0.0.30</h2>
<h2>What's Changed</h2>
<ul>
<li>Treat only <code>&amp;</code> as the urlencoded field separator by
<a href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/290">Kludex/python-multipart#290</a></li>
<li>Ignore RFC 2231 extended parameters in
<code>parse_options_header</code> by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/291">Kludex/python-multipart#291</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.29...0.0.30">https://github.com/Kludex/python-multipart/compare/0.0.29...0.0.30</a></p>
<h2>Version 0.0.29</h2>
<h2>What's Changed</h2>
<ul>
<li>Handle malformed RFC 2231 continuations in
<code>parse_options_header</code> by <a
href="https://github.com/manunio"><code>@​manunio</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/270">Kludex/python-multipart#270</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29">https://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29</a></p>
<h2>Version 0.0.28</h2>
<h2>What's Changed</h2>
<ul>
<li>Speed up partial-boundary tail scan via <code>bytes.find</code> by
<a href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/281">Kludex/python-multipart#281</a></li>
<li>Cap multipart boundary length at 256 bytes by <a
href="https://github.com/Kludex"><code>@​Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/282">Kludex/python-multipart#282</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28">https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md">python-multipart's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.31 (2026-06-04)</h2>
<ul>
<li>Speed up multipart header parsing and callback dispatch <a
href="https://redirect.github.com/Kludex/python-multipart/pull/295">#295</a>.</li>
<li>Bound header field name size before validating <a
href="https://redirect.github.com/Kludex/python-multipart/pull/296">#296</a>.</li>
<li>Validate <code>Content-Length</code> is non-negative in
<code>parse_form</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/297">#297</a>.</li>
</ul>
<h2>0.0.30 (2026-05-31)</h2>
<ul>
<li>Parse <code>application/x-www-form-urlencoded</code> bodies per the
WHATWG URL standard, treating only <code>&amp;</code> as a field
separator <a
href="https://redirect.github.com/Kludex/python-multipart/pull/290">#290</a>.</li>
<li>Ignore RFC 2231/5987 extended parameters (<code>name*</code>,
<code>filename*</code>) in <code>parse_options_header</code>, keeping
the plain parameter authoritative per <a
href="https://datatracker.ietf.org/doc/html/rfc7578#section-4.2">RFC
7578 §4.2</a> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/291">#291</a>.</li>
</ul>
<h2>0.0.29 (2026-05-17)</h2>
<ul>
<li>Handle malformed RFC 2231 continuations in
<code>parse_options_header</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/270">#270</a>.</li>
</ul>
<h2>0.0.28 (2026-05-10)</h2>
<ul>
<li>Speed up partial-boundary tail scan via <code>bytes.find</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/281">#281</a>.</li>
<li>Cap multipart boundary length at 256 bytes <a
href="https://redirect.github.com/Kludex/python-multipart/pull/282">#282</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/python-multipart/commit/4cffc68a165f7a6f6b7756ce006fabf07a05b7a4"><code>4cffc68</code></a>
Version 0.0.31 (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/298">#298</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/c814948acf509cef7881fa75c969969b19239bbf"><code>c814948</code></a>
Reject negative <code>Content-Length</code> in <code>parse_form</code>
(<a
href="https://redirect.github.com/Kludex/python-multipart/issues/297">#297</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/6b837d47bc68826ed5cbbcb50c6c6a6093444494"><code>6b837d4</code></a>
Bound header field name size before validating (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/296">#296</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/e0c4f9df2e737d1663fbbdd6563f80613a2089f9"><code>e0c4f9d</code></a>
Bump the github-actions group with 3 updates (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/294">#294</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/b8a01bb683e8e8675fdb5d831b206a478c8215aa"><code>b8a01bb</code></a>
Bump the python-packages group with 3 updates (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/293">#293</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/6732164f30c58e28589a1e22213d2f6b8c6bad9f"><code>6732164</code></a>
Speed up multipart header parsing and callback dispatch (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/295">#295</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/9d3ead568a259f222cff6425262ff63e88d930d4"><code>9d3ead5</code></a>
Version 0.0.30 (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/292">#292</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/3506c15ce99cb62faf2d5ceb3c4c1e5800cb843d"><code>3506c15</code></a>
Ignore RFC 2231 extended parameters in <code>parse_options_header</code>
(<a
href="https://redirect.github.com/Kludex/python-multipart/issues/291">#291</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/d69df35cd2cad9c72794c2c340db646afae957d8"><code>d69df35</code></a>
Treat only <code>&amp;</code> as the urlencoded field separator (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/290">#290</a>)</li>
<li><a
href="https://github.com/Kludex/python-multipart/commit/1e6ff9740b09fb439755f30e2b0e2ada1d297325"><code>1e6ff97</code></a>
Bump idna from 3.11 to 3.15 (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/289">#289</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.31">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python-multipart&package-manager=uv&previous-version=0.0.27&new-version=0.0.31)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/evroon/bracket/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 backend/pyproject.toml | 2 +-
 backend/uv.lock        | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index 242bb4c8..5d025d01 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -21,7 +21,7 @@ dependencies = [
     "pydantic_settings==2.14.2",
     "pyjwt==2.13.0",
     "python-dotenv==1.2.2",
-    "python-multipart==0.0.27",
+    "python-multipart==0.0.31",
     "sentry-sdk==2.63.0",
     "sqlalchemy==2.0.44",
     "sqlalchemy-stubs==0.4",
diff --git a/backend/uv.lock b/backend/uv.lock
index 6e1168be..21daf6f9 100644
--- a/backend/uv.lock
+++ b/backend/uv.lock
@@ -450,7 +450,7 @@ requires-dist = [
     { name = "pydantic-settings", specifier = "==2.14.2" },
     { name = "pyjwt", specifier = "==2.13.0" },
     { name = "python-dotenv", specifier = "==1.2.2" },
-    { name = "python-multipart", specifier = "==0.0.27" },
+    { name = "python-multipart", specifier = "==0.0.31" },
     { name = "sentry-sdk", specifier = "==2.63.0" },
     { name = "sqlalchemy", specifier = "==2.0.44" },
     { name = "sqlalchemy-stubs", specifier = "==0.4" },
@@ -1594,11 +1594,11 @@ wheels = [
 
 [[package]]
 name = "python-multipart"
-version = "0.0.27"
+version = "0.0.31"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/69/9b/f23807317a113dc36e74e75eb265a02dd1a4d9082abc3c1064acd22997c4/python_multipart-0.0.27.tar.gz", hash = "sha256:9870a6a8c5a20a5bf4f07c017bd1489006ff8836cff097b6933355ee2b49b602", size = 44043, upload-time = "2026-04-27T10:51:26.649Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/64/7e/9b35ad8f3d9ca680f7c87a88f19612fdd8da9796c4d3b46e560ac79dcc4a/python_multipart-0.0.31.tar.gz", hash = "sha256:fc631183bb13e56db3158a4909908dfb2e23565286744e798241e63750e5d680", size = 46689, upload-time = "2026-06-04T08:27:49.014Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/99/78/4126abcbdbd3c559d43e0db7f7b9173fc6befe45d39a2856cc0b8ec2a5a6/python_multipart-0.0.27-py3-none-any.whl", hash = "sha256:6fccfad17a27334bd0193681b369f476eda3409f17381a2d65aa7df3f7275645", size = 29254, upload-time = "2026-04-27T10:51:24.997Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/1e/7f7f299527a5a8ad90acd5f2f78dfa6c8495c6301a3205106ea68a84de96/python_multipart-0.0.31-py3-none-any.whl", hash = "sha256:8408153d68a9773291fc1da39a8b85a50044bddbabd2dd72e9229776b7b15e28", size = 29996, upload-time = "2026-06-04T08:27:47.804Z" },
 ]
 
 [[package]]