diff --git a/python-starlette.spec b/python-starlette.spec
index cf547afacaae41d80cb79b6c94a5165d09c43ff8..d690b885ed6b8da2cf6a8b0174b804184b3afe2a 100644
--- a/python-starlette.spec
+++ b/python-starlette.spec
@@ -1,6 +1,7 @@
 %define anolis_release 1
 %global pypi_name starlette
-%global pypi_version 0.37.2
+%global pypi_version 0.49.1
+%bcond_without tests
 
 Name:           python-%{pypi_name}
 Version:        %{pypi_version}
@@ -8,8 +9,8 @@ Release:        %{anolis_release}%{?dist}
 Summary:        The little ASGI library that shines
 
 License:        BSD-3-Clause
-URL:            https://github.com/encode/starlette
-Source0:        %{pypi_source}
+URL:            https://www.starlette.io/
+Source0:        https://github.com/encode/starlette/archive/%{version}/starlette-%{version}.tar.gz
 BuildArch:      noarch
 
 BuildRequires:  python3-devel
@@ -40,6 +41,9 @@ async web services in Python.
 
 %prep
 %autosetup -n %{pypi_name}-%{pypi_version}
+sed -i '/^[[:space:]]*license-files[[:space:]]*=/d' pyproject.toml
+sed -i '/Programming Language :: Python :: 3.13/d' pyproject.toml
+sed -i '\|Programming Language :: Python :: 3\.14|d' pyproject.toml
 %generate_buildrequires
 %pyproject_buildrequires
 
@@ -51,14 +55,20 @@ async web services in Python.
 %pyproject_save_files %{pypi_name}
 
 %check
+%if 0%{?_without_tests}
 %pyproject_check_import
 k="${k-}${k+ and }not test_lifespan_with_on_events"
 %pytest -W 'ignore::trio.TrioDeprecationWarning' -k "${k-}"
+%endif
 
 %files -n python3-%{pypi_name} -f %{pyproject_files}
 %license LICENSE.md
 %doc README.md
 
 %changelog
+* Wed Dec 17 2025 lzq11122 <lzq02303433@alibaba-inc.com> - 0.49.1-1
+- Update to 0.49.1 for fix CVE-2025-62727
+
 * Thu Apr 11 2024 Shenglong Zhu <shenglongzhu@linux.alibaba.com> - 0.37.2-1
 - Initial package.
+
diff --git a/starlette-0.37.2.tar.gz b/starlette-0.37.2.tar.gz
deleted file mode 100644
index db79be3dd915fd1d949817033af16161e8c6e023..0000000000000000000000000000000000000000
Binary files a/starlette-0.37.2.tar.gz and /dev/null differ
diff --git a/starlette-0.49.1.tar.gz b/starlette-0.49.1.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..e51c215d1d63300a0ae9c9114d294f3c61420598
Binary files /dev/null and b/starlette-0.49.1.tar.gz differ