[prediction] fastapi<=0.124.4 cap blocks patched Starlette (CVE-2026-48710 / BadHost, CISA KEV) #7164

The prediction, full and testing extras in google-cloud-aiplatform 2.2.0 declare fastapi>=0.71.0,<=0.124.4. FastAPI 0.124.4 requires starlette>=0.40.0,<0.51.0, so these extras cannot resolve to a Starlette version patched for CVE-2026-48710 (GHSA-86qp-5c8j-p5mr), fixed in starlette>=1.0.1. The CVE was added to CISA's KEV catalog in September 2026.

This affects Custom Prediction Routines: LocalModel.build_cpr_model installs google-cloud-aiplatform[prediction] in the image, so every CPR container ships a vulnerable Starlette unless users override it in requirements.txt, which produces a declared dependency conflict and fails pip check.

FastAPI dropped the Starlette upper bound in 0.133.0 and google-adk already moved to fastapi>=0.133,<1 / starlette>=1.3.1,<2.

Thanks for your help!