Update fastapi to 0.139.2 - #598
Conversation
📝 WalkthroughWalkthroughFastAPI is upgraded from version ChangesFastAPI dependency
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Line 1: Update the dependency pins in requirements.txt by pinning GitPython to
patched release 3.1.48 or later and upgrading Uvicorn to version 0.11.7 or
later; ensure the vulnerability reference targets GitPython rather than Uvicorn.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.139.2 | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
git ls-files src/requirements.txt
cat -n src/requirements.txt
rg -n "gitpython|uvicorn|fastapi" -S .Repository: salimfadhley/dockerized_python_playground
Length of output: 380
🌐 Web query:
GitHub advisory GHSA-7545-fcxq-7j24 Uvicorn HTTP response splitting affected versions fixed version
💡 Result:
GitHub advisory GHSA-7545-fcxq-7j24 does not pertain to Uvicorn, but rather to the GitPython library [1][2]. It describes a path traversal vulnerability in GitPython's reference APIs that allows for arbitrary file write and deletion outside of the repository [3][4]. Affected versions of GitPython include all versions prior to 3.1.48 [4][5]. The vulnerability was fixed in version 3.1.48 [4][6].
Citations:
- 1: GHSA-7545-fcxq-7j24
- 2: GHSA-7545-fcxq-7j24
- 3: https://osv.dev/vulnerability/GHSA-7545-fcxq-7j24
- 4: https://app.opencve.io/cve/CVE-2026-44243
- 5: https://nvd.nist.gov/vuln/detail/CVE-2026-44243
- 6: https://osv.dev/GHSA-7545-fcxq-7j24
🌐 Web query:
GitPython latest release PyPI security advisories unpinned dependency vulnerability
💡 Result:
As of July 16, 2026, the latest release of GitPython on PyPI is 3.1.50 [1][2], though documentation references version 3.1.51 [3]. There is no widely publicized security advisory specifically regarding an unpinned dependency vulnerability for GitPython. Security advisories for GitPython are managed through the project's official GitHub repository [4]. Recent security vulnerabilities identified in GitPython (through mid-2026) have primarily focused on input validation issues, such as: 1. Path traversal vulnerabilities in reference APIs allowing arbitrary file write/delete [5]. 2. Command injection via insecure Git options (e.g., bypasses in multi_options handling or kwarg normalization) [6][7]. 3. Remote Code Execution (RCE) via newline injection in configuration writers, which allows for poisoning .git/config and redirecting core.hooksPath [8][9]. Users are advised to check the official GitPython GitHub Security Advisories page to stay informed about the latest patches and vulnerability disclosures [4]. To mitigate risks, ensure your applications are updated to the latest available version and exercise caution when passing user-controlled input to GitPython APIs [5][6][7][8].
Citations:
- 1: https://github.com/gitpython-developers/GitPython/releases/tag/3.1.50
- 2: https://github.com/gitpython-developers/GitPython/tree/main/
- 3: https://gitpython.readthedocs.io/en/stable/intro.html
- 4: https://github.com/gitpython-developers/GitPython/security/advisories
- 5: GHSA-7545-fcxq-7j24
- 6: GHSA-rpm5-65cw-6hj4
- 7: GHSA-x2qx-6953-8485
- 8: GHSA-v87r-6q3f-2j67
- 9: GHSA-mv93-w799-cj2w
🌐 Web query:
FastAPI 0.139.2 Python >=3.10 release notes
💡 Result:
As of July 16, 2026, there is no FastAPI version 0.139.2. The latest available versions are 0.139.1 (released July 16, 2026) and 0.139.0 (released July 1, 2026) [1][2]. Versions of 0.139.2 exist for other software projects (such as gitlab-org/api/client-go), which may be the source of confusion [3][4][5]. Regarding Python version requirements, FastAPI maintains a requirement of Python 3.10 or newer [6][7]. This is explicitly documented in the project's configuration (e.g., pyproject.toml) and package metadata [6][7]. For the most accurate and up-to-date information, you can always check the official FastAPI release notes at https://fastapi.tiangolo.com/release-notes/ [8].
Citations:
- 1: https://github.com/fastapi/fastapi/releases/tag/0.139.0
- 2: https://github.com/fastapi/fastapi/releases/tag/0.139.1
- 3: https://gitlab.com/gitlab-org/api/client-go/-/tags/v0.139.2
- 4: Bump gitlab.com/gitlab-org/api/client-go from 0.138.0 to 0.139.2 Helvethink/gitlab-ci-exporter#75
- 5: Bump github.com/gohugoio/hugo from 0.138.0 to 0.139.2 in /hack/internal/tools kubernetes-sigs/kueue#3629
- 6: https://github.com/fastapi/fastapi/blob/0.136.3/pyproject.toml
- 7: https://pypi.org/project/fastapi/0.137.2/
- 8: https://fastapi.tiangolo.com/release-notes/
🌐 Web query:
Uvicorn 0.4.6 vulnerability advisory fixed version HTTP response splitting
💡 Result:
The vulnerability regarding HTTP response splitting in Uvicorn is tracked as CVE-2020-7695 [1][2]. This vulnerability affects all versions of Uvicorn prior to 0.11.7, including version 0.4.6 [1][3]. The vulnerability occurs because CRLF (Carriage Return/Line Feed) sequences were not properly escaped in the values of HTTP headers, which could allow an attacker to inject arbitrary headers or response bodies into HTTP responses [1][4]. To remediate this issue, users should upgrade to Uvicorn version 0.11.7 or higher [5][4].
Citations:
- 1: https://osv.dev/vulnerability/CVE-2020-7695
- 2: https://nvd.nist.gov/vuln/detail/cve-2020-7695
- 3: https://osv.dev/vulnerability/GHSA-f97h-2pfx-f59f
- 4: Security Notice & Bug Bounty - HTTP Response Splitting - huntr.dev Kludex/uvicorn#728
- 5: https://security.snyk.io/vuln/SNYK-PYTHON-UVICORN-570471
Pin the vulnerable dependency versions here gitpython should be pinned to a patched release (>=3.1.48), and uvicorn==0.4.6 needs an upgrade to at least 0.11.7. The GHSA cited here applies to GitPython, not Uvicorn.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2022-42992)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-137)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-165)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2024-4)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2162)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2163)
[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` at line 1, Update the dependency pins in
requirements.txt by pinning GitPython to patched release 3.1.48 or later and
upgrading Uvicorn to version 0.11.7 or later; ensure the vulnerability reference
targets GitPython rather than Uvicorn.
Source: Linters/SAST tools
|
Closing this in favor of #602 |
1 participant
This PR updates fastapi from 0.6.4 to 0.139.2.
Changelog
0.139.2
0.139.1
0.139.0
0.138.1
0.138.0
0.137.2
0.137.1
0.137.0
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1
0.129.0
0.128.8
0.128.7