Skip to content

Update fastapi to 0.139.0 #588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
+1 −1
Closed

Update fastapi to 0.139.0 #588

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.139.0

@coderabbitai coderabbitai Bot Jul 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Repo files matching requirements:\n'
git ls-files | rg '(^|/)(requirements|pyproject|poetry.lock|Pipfile)(\.|$)|requirements\.txt$'

printf '\nContents of src/requirements.txt with line numbers:\n'
cat -n src/requirements.txt

printf '\nSearch for uvicorn pin references:\n'
rg -n "uvicorn|fastapi|gitpython" src/requirements.txt . -g 'requirements.txt' -g 'pyproject.toml' -g 'Pipfile' -g 'Pipfile.lock' -g 'poetry.lock' || true

Repository: salimfadhley/dockerized_python_playground

Length of output: 614

🌐 Web query:

uvicorn 0.4.6 security advisory log injection HTTP response splitting

💡 Result:

Uvicorn version 0.4.6 is affected by two high-severity security vulnerabilities, both of which were addressed in version 0.11.7 [1][2]. 1. HTTP Response Splitting (CVE-2020-7695): Uvicorn versions before 0.11.7 are vulnerable to HTTP response splitting because they fail to properly escape CRLF (carriage return/line feed) sequences in HTTP header values [1][3]. An attacker can exploit this by providing crafted input that results in the insertion of arbitrary HTTP headers or even an arbitrary response body [4][3]. 2. Log Injection and ANSI Escape Sequence Injection (CVE-2020-7694): Uvicorn versions before 0.11.7 are also vulnerable to log injection via ANSI escape sequence injection [2][5]. The server's default request logger processes URLs using urllib.parse.unquote before logging them [6][2]. An attacker can request crafted URLs containing percent-encoded ANSI escape sequences, which, when decoded and logged, can: * Pollute access logs with fake entries [6][5]. * Interact with terminal emulators displaying the logs, potentially leading to unauthorized terminal control [6][5]. Both issues were publicly disclosed and resolved in uvicorn 0.11.7 [1][2]. It is strongly recommended to upgrade to a version later than 0.11.7 to mitigate these risks [5].

Citations:

🌐 Web query:

uvicorn 0.4.6 vulnerabilities CVE

💡 Result:

Uvicorn version 0.4.6 is affected by two known security vulnerabilities, both of which were addressed in version 0.11.7 [1][2]. The vulnerabilities are: 1. Log Injection (CVE-2020-7694): This vulnerability allows attackers to perform ANSI escape sequence injection through the request logger [2][3]. By requesting crafted URLs, an attacker can pollute access logs or interact with the terminal emulator displaying the logs [4][3]. 2. HTTP Response Splitting (CVE-2020-7695): This vulnerability occurs because CRLF (Carriage Return Line Feed) sequences are not properly escaped in HTTP header values [2][5]. Attackers can exploit this to inject arbitrary headers into HTTP responses or return an arbitrary response body [2][5]. Because version 0.4.6 is significantly older than the patched version (0.11.7), it is recommended to update to a modern, supported version of Uvicorn to mitigate these and other potential security risks [2][6].

Citations:

Update the ASGI server pin too. uvicorn==0.4.6 is still pinned here, and that release is affected by log-injection and HTTP response-splitting issues fixed in 0.11.7. Bump it alongside FastAPI.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` at line 1, The dependency pins need to be updated
together: fastapi is already pinned, but uvicorn remains on an unsafe old
release. In requirements.txt, update the uvicorn version pin to at least 0.11.7
alongside the FastAPI bump, keeping the dependency list consistent and using the
existing package entry to locate the change.

Source: Linters/SAST tools

gitpython
uvicorn==0.4.6