Python: Bump python-multipart from 0.0.26 to 0.0.31 in /python

[dependabot]

Bumps python-multipart from 0.0.26 to 0.0.31.

Release notes

Sourced from python-multipart's releases.

Version 0.0.31

What's Changed

• Speed up multipart header parsing and callback dispatch by @​Kludex in Kludex/python-multipart#295
• Bound header field name size before validating by @​Kludex in Kludex/python-multipart#296
• Validate Content-Length is non-negative in parse_form by @​Kludex in Kludex/python-multipart#297

Full Changelog: Kludex/python-multipart@0.0.30...0.0.31

Version 0.0.30

What's Changed

• Treat only & as the urlencoded field separator by @​Kludex in Kludex/python-multipart#290
• Ignore RFC 2231 extended parameters in parse_options_header by @​Kludex in Kludex/python-multipart#291

Full Changelog: Kludex/python-multipart@0.0.29...0.0.30

Version 0.0.29

What's Changed

• Handle malformed RFC 2231 continuations in parse_options_header by @​manunio in Kludex/python-multipart#270

Full Changelog: Kludex/python-multipart@0.0.28...0.0.29

Version 0.0.28

What's Changed

• Speed up partial-boundary tail scan via bytes.find by @​Kludex in Kludex/python-multipart#281
• Cap multipart boundary length at 256 bytes by @​Kludex in Kludex/python-multipart#282

Full Changelog: Kludex/python-multipart@0.0.27...0.0.28

Version 0.0.27

What's Changed

• Pass parse offsets via constructors by @​Kludex in Kludex/python-multipart#268
• Add multipart header limits by @​Kludex in Kludex/python-multipart#267

Full Changelog: Kludex/python-multipart@0.0.26...0.0.27

Changelog

Sourced from python-multipart's changelog.

0.0.31 (2026-06-04)

• Speed up multipart header parsing and callback dispatch #295.
• Bound header field name size before validating #296.
• Validate Content-Length is non-negative in parse_form #297.

0.0.30 (2026-05-31)

• Parse application/x-www-form-urlencoded bodies per the WHATWG URL standard, treating only & as a field separator #290.
• Ignore RFC 2231/5987 extended parameters (name*, filename*) in parse_options_header, keeping the plain parameter authoritative per RFC 7578 §4.2 #291.

0.0.29 (2026-05-17)

• Handle malformed RFC 2231 continuations in parse_options_header #270.

0.0.28 (2026-05-10)

• Speed up partial-boundary tail scan via bytes.find #281.
• Cap multipart boundary length at 256 bytes #282.

0.0.27 (2026-04-27)

• Add multipart header limits #267.
• Pass parse offsets via constructors #268.

Commits

• 4cffc68 Version 0.0.31 (#298)
• c814948 Reject negative Content-Length in parse_form (#297)
• 6b837d4 Bound header field name size before validating (#296)
• e0c4f9d Bump the github-actions group with 3 updates (#294)
• b8a01bb Bump the python-packages group with 3 updates (#293)
• 6732164 Speed up multipart header parsing and callback dispatch (#295)
• 9d3ead5 Version 0.0.30 (#292)
• 3506c15 Ignore RFC 2231 extended parameters in parse_options_header (#291)
• d69df35 Treat only & as the urlencoded field separator (#290)
• 1e6ff97 Bump idna from 3.11 to 3.15 (#289)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 68% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

---

Automated review by dependabot[bot]'s agents

[moonbox3]

@copilot: fix the CI/CD failures

[Copilot]

@copilot: fix the CI/CD failures

The CI failure is a pre-existing issue (present on multiple unrelated branches from the same base commit). The failing test is test_crud_operations_pandas[definition_pandas] on Windows Python 3.10, where WindowsProactorEventLoopPolicy raises RuntimeError: There is no current event loop after accumulated _set_called=True, _loop=None state across tests.

Fixed in commits:

1. Added a function-scoped event_loop_policy fixture to tests/unit/data/conftest.py returning a fresh asyncio.DefaultEventLoopPolicy() per test — this ensures each test uses a clean policy instance, preventing the broken state from persisting.
2. Added explicit asyncio_default_test_loop_scope = "function" to pyproject.toml (same as the default, now explicit).

[moonbox3]

@copilot fix the failing CI/CD checks

[Copilot]

@copilot fix the failing CI/CD checks

The CI status after investigating:

1. Original test failure (test_crud_operations_pandas[definition_pandas] — RuntimeError: There is no current event loop on Windows Python 3.10) was fixed in previous commits by adding an event_loop_policy fixture to tests/unit/data/conftest.py that returns a fresh asyncio.DefaultEventLoopPolicy() per test, preventing corrupted event loop policy state from propagating across tests.

2. New CI failure in the most recent run was a transient network error unrelated to any code change:

   × Failed to download `nbconvert==7.17.1`
   ╰─▶ peer closed connection without sending TLS close_notify
   

   This is a GitHub Actions runner infrastructure issue (dropped TLS connection) and not fixable in code.

3. Cleanup (commit f5f6b06): removed the asyncio_default_test_loop_scope = "function" line I previously added to pyproject.toml — this option is not recognized by pytest-asyncio 0.24 and was generating a PytestConfigWarning: Unknown config option.

The python-tests-coverage check passed in the last run, confirming the tests work correctly. The remaining failures are due to the transient network issue and fail-fast: true cancelling sibling matrix jobs. A fresh CI run should pass.

[rogerbarreto]

@copilot this Dependabot pull request has failing CI checks. Please investigate the failures and fix what may be wrong. When applicable, this can include bumping other related dependencies to compatible versions and resolving breaking changes introduced by this update. Please push the fixes to this pull request branch so the checks can pass.

[Copilot]

@copilot this Dependabot pull request has failing CI checks. Please investigate the failures and fix what may be wrong. When applicable, this can include bumping other related dependencies to compatib...

Investigated all CI failures across the three runs on this PR branch:

Root cause & fix (already committed): The first run (27650761399) had a genuine test failure — test_crud_operations_pandas[definition_pandas] on Windows Python 3.10 raised RuntimeError: There is no current event loop. The cause was accumulated corrupted event-loop-policy state (_set_called=True, _loop=None) from a previous test on Windows' WindowsProactorEventLoopPolicy. This was fixed in commit 44dfb22 by adding a function-scoped event_loop_policy fixture in tests/unit/data/conftest.py that returns a fresh asyncio.DefaultEventLoopPolicy() instance per test, preventing the corrupted state from leaking across tests. The test passes in all subsequent runs and locally.

Remaining failures are transient network issues (not code-fixable):

• Run 27669564134: Windows Python 3.11 — Failed to download nbconvert==7.17.1 (TLS connection closed without notify at uv sync step — before any tests ran)
• Run 27672775100: Windows Python 3.10 — Failed to fetch motor-3.7.1-py3-none-any.whl.metadata (broken pipe at uv sync step — before any tests ran)

Both failures occurred during package download in uv sync, not during test execution. They are GitHub Actions runner infrastructure issues and cannot be fixed in code.

python-multipart 0.0.26 → 0.0.31 compatibility: All changes between these versions are backward-compatible (security fixes, performance improvements, security bounds on header/boundary sizes). No SK code uses python-multipart directly — it's pulled in transitively by mcp>=1.26.0 which requires python-multipart>=0.0.9. No related dependency bumps are needed.

A fresh CI run should pass once the transient network conditions resolve.

[moonbox3]

Superseded by #14176

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.