Update Starlette to 0.49.1 in uv.lock

[ColeMurray]

Summary

Updates the locked version of Starlette from 0.47.3 to 0.49.1 to address security vulnerabilities in earlier versions.

This PR updates only the uv.lock file without modifying the dependency constraints in pyproject.toml, avoiding any potential breaking changes for downstream consumers while still providing a secure default version for direct users of this repository.

Changes

• Updated uv.lock to pin Starlette to version 0.49.1
• No changes to pyproject.toml files (maintains >=0.27 constraint)

Rationale

This approach follows the principle of not pinning specific versions in library code to avoid breaking downstream consumers, while still ensuring that users who clone and install this repository directly will get the secure version by default.

Test Plan

• Formatting checks pass (ruff format)
• Linting checks pass (ruff check)
• Type checking passes (pyright)
• CI tests will run automatically

Related

• Issue: Security: Update Starlette dependency to address vulnerabilities #1557
• Alternative PR with constraint updates: Update Starlette dependency to >=0.49.1 #1556

[Kludex]

Same as #1552.

[ColeMurray]

@Kludex the vulnerable starlette version is pinned in the uv.lock and is causing downstream consumers to pull it in as a transitive dependency.

Surely we aren't suggesting that everyone downstream of MCP should explicitly add the updated starlette version to resolve this since we're not willing to update the lock file, right?