build: bump fastapi and starlette pins in openai frontend

[mc-nv]

What does the PR do?

Backports the fastapi and starlette pin bump to r26.08, so the release branch
picks up the starlette CVE fix.

starlette moves to >=1.3.1,<2. That floor cannot be met by the pinned
fastapi, because releases before 0.133.0 cap starlette below 1.0, so fastapi
moves to 0.136.3. The upper bound stays below 0.137.0 because vllm requires
fastapi[standard]<0.137.0,>=0.133.0. The two pins are coupled, which is why
they move together.

Cherry-picked from the change already merged to main.

Checklist

• PR title reflects the change and is of format <commit_type>: <Title>
• Changes are described in the pull request.
• Related issues are referenced.
• Populated github labels field
• Added test plan and verified test passes.
• Verified that the PR passes existing CI.
• Verified copyright is correct on all changed files.
• Added succinct git squash message before merging ref.
• All template sections are filled out.
• Optional: Additional screenshots for behavior/output changes with before/after.

Commit Type:

Check the conventional commit type
box here and add the label to the github PR.

• build
• ci
• docs
• feat
• fix
• perf
• refactor
• revert
• style
• test

Related PRs:

• build: bump fastapi and starlette pins in openai frontend #8940

Where should the reviewer start?

python/openai/requirements.txt — confirm the backported pins match what landed
on main and that the vllm constraint still holds for the 26.08 train.

Test plan:

Diff against r26.08 is a single file, +5/-5, identical to the change merged
to main.

• CI Pipeline ID:

Caveats:

The fastapi bound is dictated by vllm's own requirement range, so a future vllm
bump on this branch may need this revisited.

Background

Part of the post-code-freeze security scan pass for 26.08. The CVE fix landed on
main first and is backported here so the release branch is not left on the
vulnerable starlette range.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Relates to: TRI-1683

[greptile-apps]

Greptile Summary

Updates the OpenAI frontend’s coupled FastAPI and Starlette dependency pins to include the Starlette security fix while remaining within vLLM’s FastAPI compatibility range.

• Pins FastAPI to 0.136.3.
• Requires Starlette 1.3.1 or newer while remaining below 2.0.
• Documents why the two dependency bounds must move together.

Confidence Score: 5/5

The PR appears safe to merge, with no actionable defects identified in the coordinated dependency update.

The changed pins preserve the documented vLLM FastAPI range while raising Starlette to the security-fixed release, and the investigated advisory leads were neither introduced nor made reachable by this change.

Important Files Changed

Filename	Overview
python/openai/requirements.txt	The coordinated FastAPI and Starlette pin update is internally consistent with the compatibility constraints documented by the PR.

_{Reviews (1): Last reviewed commit: "build: bump fastapi and starlette pins i..." | Re-trigger Greptile}