Update fastapi to 0.138.2 - #587
Conversation
📝 WalkthroughWalkthroughThe ChangesFastAPI Dependency Upgrade
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Line 2: The unpinned gitpython dependency in requirements.txt should be either
removed if unused or pinned to a सुरक्षित fixed version. Check whether any code
references GitPython via imports in the codebase, and if it is needed, update
the requirements entry to a version at least 3.1.41; otherwise delete the
dependency line entirely. Use the gitpython entry in requirements.txt as the
target to modify.
- Line 1: The dependency set is pinning FastAPI 0.138.2 alongside an
incompatible old Uvicorn release, so update the uvicorn requirement in
requirements.txt to a modern compatible version (0.34.0+ recommended) and keep
it aligned with FastAPI/Starlette support. Adjust the dependency pin near
fastapi==0.138.2, then verify the app imports and ASGI startup still work with
the updated uvicorn version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.138.2 | |||
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | 🏗️ Heavy lift
Uvicorn 0.4.6 is incompatible with FastAPI 0.138.2.
FastAPI 0.138.2 requires Starlette 1.0.0+, which in turn requires a modern uvicorn. Uvicorn 0.4.6 dates to ~2019 and lacks ASGI features that modern Starlette depends on. This version combination will likely fail at runtime with import errors or missing ASGI protocol support.
Update uvicorn to a compatible version (0.34.0+ recommended for Starlette 1.1+ / FastAPI 0.115+). Verify with:
#!/bin/bash
# Check uvicorn compatibility with fastapi 0.138.2
python -m pip index versions uvicorn 2>/dev/null || echo "pip index not available"
# Alternative: check PyPI for latest
curl -s https://pypi.org/pypi/uvicorn/json | jq '.info.version'🧰 Tools
🪛 OSV Scanner (2.4.0)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2022-42992)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-137)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-165)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2024-4)
[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` at line 1, The dependency set is pinning FastAPI
0.138.2 alongside an incompatible old Uvicorn release, so update the uvicorn
requirement in requirements.txt to a modern compatible version (0.34.0+
recommended) and keep it aligned with FastAPI/Starlette support. Adjust the
dependency pin near fastapi==0.138.2, then verify the app imports and ASGI
startup still work with the updated uvicorn version.
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.138.2 | |||
| gitpython | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
GitPython has multiple critical CVEs and should be pinned or removed.
The unpinned gitpython dependency resolves to 3.1.9 which has 14 critical vulnerabilities including RCE (GHSA-hcpj-qp55-gfph, GHSA-pr76-5cm5-w9cj), path traversal (GHSA-7545-fcxq-7j24), and arbitrary code execution. If GitPython is required, pin to >=3.1.41 (or latest) which patches these CVEs. If unused, remove it.
#!/bin/bash
# Check if gitpython is actually used in the codebase
rg -n "import git" --type=py -g '!*venv*' -g '!*site-packages*'
rg -n "from git" --type=py -g '!*venv*' -g '!*site-packages*'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` at line 2, The unpinned gitpython dependency in
requirements.txt should be either removed if unused or pinned to a सुरक्षित
fixed version. Check whether any code references GitPython via imports in the
codebase, and if it is needed, update the requirements entry to a version at
least 3.1.41; otherwise delete the dependency line entirely. Use the gitpython
entry in requirements.txt as the target to modify.
Source: Linters/SAST tools
|
Closing this in favor of #588 |
1 participant
This PR updates fastapi from 0.6.4 to 0.138.2.
Changelog
0.138.1
0.138.0
0.137.2
0.137.1
0.137.0
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1
0.129.0
0.128.8
0.128.7
0.128.6
0.128.5
0.128.4
0.128.3
0.128.2
0.128.1