security: bump minimum versions for python-multipart and starlette

[pranayom]

Summary

Raises the dependency version floor for two packages to exclude releases with known security vulnerabilities:

python-multipart: >=0.0.9 → >=0.0.22

• GHSA-wp53-j4wj-2cfg — Arbitrary file write via non-default configuration (affects <0.0.22)
• GHSA-59g5-xgcq-4qw3 — Denial of service via malformed multipart/form-data boundary (affects <0.0.18)

starlette (python_version < '3.14'): >=0.27 → >=0.47.2

• GHSA-2c2j-9gv5-cj73 — DoS when parsing large files in multipart forms (affects <0.47.2)
• GHSA-f96h-pmfr-66vw — DoS via multipart/form-data (affects <0.40.0)

Why this matters

The previous minimum versions allowed pip to resolve to vulnerable releases. Users who pinned or cached older versions within the allowed range were exposed. Bumping the floor ensures all new installations pull patched versions.

The starlette>=0.48.0 constraint for Python 3.14 is already above all affected versions and is unchanged.

Test plan

• Verify uv lock / pip install resolves to patched versions
• Run existing test suite to confirm no compatibility regressions with the new minimums
• Confirm the 4 referenced GHSAs are no longer in the resolved dependency range

🤖 Generated with Claude Code