diff --git a/pyproject.toml b/pyproject.toml
index b179bd2..9cde3bf 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -12,7 +12,7 @@ dependencies = [
     # Pin starlette >=0.49.1 to fix CVE-2025-62727 (Range header DoS in
     # FileResponse).  FastAPI <0.120 caps starlette below 0.49, so we also
     # bump the FastAPI floor to 0.120.
-    "starlette>=1.0.0,<1.1",
+    "starlette>=1.0.0,<1.3",
     "uvicorn[standard]>=0.30,<0.48",
     "pydantic>=2.7,<3",
     "typer>=0.12,<0.27",
diff --git a/uv.lock b/uv.lock
index 52395e8..16152d1 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2215,7 +2215,7 @@ requires-dist = [
     { name = "sqlalchemy", marker = "extra == 'mysql'", specifier = ">=2,<3" },
     { name = "sqlalchemy", marker = "extra == 'postgres'", specifier = ">=2,<3" },
     { name = "sqlalchemy", marker = "extra == 'sqlite'", specifier = ">=2,<3" },
-    { name = "starlette", specifier = ">=1.0.0,<1.1" },
+    { name = "starlette", specifier = ">=1.0.0,<1.3" },
     { name = "structlog", specifier = ">=24,<26" },
     { name = "typer", specifier = ">=0.12,<0.27" },
     { name = "urllib3", specifier = ">=2.7.0" },
@@ -2495,15 +2495,15 @@ wheels = [
 
 [[package]]
 name = "starlette"
-version = "1.0.1"
+version = "1.2.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/08/a3/84e821cc54b4ab50ae6dbc6ac3800a651b65ec35f045cc73785380654057/starlette-1.0.1.tar.gz", hash = "sha256:512399c5f1de7fac99c88572212ded9ddeddef2fb32afa82d724000e88b38f4f", size = 2659596, upload-time = "2026-05-21T21:58:58.433Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/25/44/ec35f1b6e83094b997da438a02c8c9b0ade2b1e84cfc48bd4656780760a6/starlette-1.2.1.tar.gz", hash = "sha256:9b9b5ebb992e67d6093741e63c2f59e4f6fff986f81163c087867bd7b924b3f6", size = 2701854, upload-time = "2026-05-31T01:07:51.847Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ec/e1/b2df4bc09a1e51ff664c1e17018a4274b42e5e9352e4a478ea540512dc88/starlette-1.0.1-py3-none-any.whl", hash = "sha256:7c0e69b2ee1c848bd54669d908500117a3ee13de603a21427e5c6fc1adf98dcd", size = 72802, upload-time = "2026-05-21T21:58:56.551Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/54/196d0c1db10af76baa4f64894448505d60d3cdf70ef92cbb35f46a4e4c71/starlette-1.2.1-py3-none-any.whl", hash = "sha256:4de0082d08c8f6764a85a54cf1120d6939507a19905c7768acad2a9f875d2b89", size = 73350, upload-time = "2026-05-31T01:07:50.09Z" },
 ]
 
 [[package]]