Bump the prod-deps group with 3 updates

[dependabot]

Bumps the prod-deps group with 3 updates: casefy, jinja2 and starlette.

Updates casefy from 1.0.0 to 1.1.0

Release notes

Sourced from casefy's releases.

1.1.0

What's Changed

• The keep_together parameter in snakecase and separatorcase now allows arbitrary substrings and not just uppercase, alphabetic characters (#6).

Full Changelog: dmlls/python-casefy@v1.0.0...v1.1.0

Commits

• 7222a29 Bump version to v1.1.0
• 214817e Update docs
• d1db116 Format code
• 74b1ed2 Allow arbitrary substrings in keep_together (#6)
• b7daafa Bump version to v1.0.0
• See full diff in compare view

Updates jinja2 from 3.1.5 to 3.1.6

Release notes

Sourced from jinja2's releases.

3.1.6

This is the Jinja 3.1.6 security release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Jinja2/3.1.6/ Changes: https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6

• The |attr filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. GHSA-cpwx-vrp4-4pq7

Changelog

Sourced from jinja2's changelog.

Version 3.1.6

Released 2025-03-05

• The |attr filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. :ghsa:cpwx-vrp4-4pq7

Commits

• 1520688 release version 3.1.6
• 90457bb Merge commit from fork
• 065334d attr filter uses env.getattr
• 033c200 start version 3.1.6
• bc68d4e use global contributing guide (#2070)
• 247de5e use global contributing guide
• ab8218c use project advisory link instead of global
• b4ffc8f release version 3.1.5 (#2066)
• See full diff in compare view

Updates starlette from 0.45.3 to 0.46.1

Release notes

Sourced from starlette's releases.

Version 0.46.1

Fixed

• Allow relative directory path when follow_symlinks=True #2896.

---

Full Changelog: encode/starlette@0.46.0...0.46.1

Version 0.46.0

Added

• GZipMiddleware: Make sure Vary header is always added if a response can be compressed #2865.

Fixed

• Raise exception from background task on BaseHTTPMiddleware #2812.
• GZipMiddleware: Don't compress on server sent events #2871.

Changed

• MultiPartParser: Rename max_file_size to spool_max_size #2780.

Deprecated

• Add deprecated warning to TestClient(timeout=...) #2840.

New Contributors

• @​musicinmybrain made their first contribution in encode/starlette#2855
• @​WilliamDEdwards made their first contribution in encode/starlette#2870
• @​mattmess1221 made their first contribution in encode/starlette#2865

Full Changelog: encode/starlette@0.45.3...0.46.0

Changelog

Sourced from starlette's changelog.

0.46.1 (March 8, 2025)

Fixed

• Allow relative directory path when follow_symlinks=True #2896.

0.46.0 (February 22, 2025)

Added

• GZipMiddleware: Make sure Vary header is always added if a response can be compressed #2865.

Fixed

• Raise exception from background task on BaseHTTPMiddleware #2812.
• GZipMiddleware: Don't compress on server sent events #2871.

Changed

• MultiPartParser: Rename max_file_size to spool_max_size #2780.

Deprecated

• Add deprecated warning to TestClient(timeout=...) #2840.

Commits

• df754ca Version 0.46.1 (#2900)
• 9b704ac Add sponsorship page (#2899)
• bc3b400 Allow relative directory path when follow_symlinks=True (#2896)
• 4915873 Bump the python-packages group with 6 updates (#2894)
• 708930c Document how to configure CORSMiddleware globally (#2885)
• a404872 Version 0.46.0 (#2883)
• 9a8e929 Document how to resize the threadpool (#2881)
• 5cc4ddf Raise exception from background task on BaseHTTPMiddleware (#2812)
• f13d354 fix(gzip): Make sure Vary header is always added if a response can be compres...
• abe3554 Add notes about the GZip middleware (#2880)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.