chore(deps): update starlette requirement from >=1.1.0 to >=1.6.0 in /backend

[dependabot]

Updates the requirements on starlette to permit the latest version.

Release notes

Sourced from starlette's releases.

Version 1.6.0

What's Changed

• Add max_body_size to Starlette and route classes by @​Kludex in Kludex/starlette#3431
• Expose http.response.debug info via response extensions by @​y2kbugger in Kludex/starlette#3130

New Contributors

• @​y2kbugger made their first contribution in Kludex/starlette#3130

Full Changelog: Kludex/starlette@1.5.1...1.6.0

Changelog

Sourced from starlette's changelog.

1.6.0 (August 8, 2026)

Added

• Add max_body_size to Starlette and route classes #3431.
• Expose http.response.debug information via response extensions #3130.

1.5.1 (August 8, 2026)

Fixed

• Reject inverted single-byte ranges in FileResponse #3389.
• Limit FileResponse to 100 ranges #3430.

1.5.0 (August 8, 2026)

Added

• Add exclude_content_types parameter to GZipMiddleware #3418.

Changed

• Expand default excluded content types in GZipMiddleware #3421.

Fixed

• Flush GZip output for each streamed chunk #3419.
• Skip compression of partial responses in GZipMiddleware #3420.

1.4.1 (August 5, 2026)

Fixed

• Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.

1.4.0 (August 5, 2026)

Added

• Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.

Changed

• Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
• Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.

1.3.1 (June 12, 2026)

Fixed

... (truncated)

Commits

• 4f250d6 Version 1.6.0 (#3434)
• 9eea41a Expose http.response.debug info via response extensions (#3130)
• 38f8999 Add max_body_size to Starlette and route classes (#3431)
• c41236c Version 1.5.1 (#3432)
• 9c500db Limit FileResponse to 100 ranges (#3430)
• 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
• c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
• ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
• 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
• d96887e Add Pydantic Logfire banner to the docs (#3428)
• Additional commits viewable in compare view

[seonghobae]

@opencode-agent review

Please submit a formal independent review for unchanged exact head 91cb72766924bd06a4027cb94b3e405c5d898708 only if it satisfies the current live-base and repository policy. GitHub records all exact-head required CI/security/coverage/review contexts successful (with the GitHub Scorecard job's expected neutral duplicate excluded), zero unresolved review threads, and mergeable=true against current protected main 183331e1054fb14b4c017e77fcd0aae99e949277. Do not reuse predecessor evidence or approve if the live-base drift requires a fresh branch/check reconciliation.

[seonghobae]

@dependabot rebase

Protected main advanced to ac3bd20f14b3e169e1f53239e47bd2d410c2cbab, including the newly canonical Cryptography 50.0.0 hash locks. Please recreate this Starlette requirement update on that live base before further work. The current one-file head does not update either executable hash lock, so predecessor CI cannot establish that Starlette 1.4.1 was installed; after the bot-pushed rebase I will regenerate both owned locks and test the actual resolved dependency set.

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[seonghobae]

@dependabot recreate

Recreate the Starlette 1.4.1 dependency PR from protected main ac3bd20f14b3e169e1f53239e47bd2d410c2cbab; overwriting prior reconciliations is intentional. Preserve the canonical Cryptography 50.0.0 declaration and locks from main, and retain only the bot-owned Starlette requirement change. After recreation, both owned hash locks must be regenerated and the actually installed Starlette 1.4.1 dependency set must pass focused multipart/form/GZip/FileResponse/API regression coverage, full backend verification, security gates, and qualifying independent approval. No predecessor evidence transfers.

[seonghobae]

@dependabot rebase

[dependabot]

Superseded by #905.