Skip to content

Update fastapi to 0.139.2 #598

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
Closed

Update fastapi to 0.139.2 #598

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.139.2

@coderabbitai coderabbitai Bot Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

git ls-files src/requirements.txt
cat -n src/requirements.txt
rg -n "gitpython|uvicorn|fastapi" -S .

Repository: salimfadhley/dockerized_python_playground

Length of output: 380

🌐 Web query:

GitHub advisory GHSA-7545-fcxq-7j24 Uvicorn HTTP response splitting affected versions fixed version

💡 Result:

GitHub advisory GHSA-7545-fcxq-7j24 does not pertain to Uvicorn, but rather to the GitPython library [1][2]. It describes a path traversal vulnerability in GitPython's reference APIs that allows for arbitrary file write and deletion outside of the repository [3][4]. Affected versions of GitPython include all versions prior to 3.1.48 [4][5]. The vulnerability was fixed in version 3.1.48 [4][6].

Citations:

🌐 Web query:

GitPython latest release PyPI security advisories unpinned dependency vulnerability

💡 Result:

As of July 16, 2026, the latest release of GitPython on PyPI is 3.1.50 [1][2], though documentation references version 3.1.51 [3]. There is no widely publicized security advisory specifically regarding an unpinned dependency vulnerability for GitPython. Security advisories for GitPython are managed through the project's official GitHub repository [4]. Recent security vulnerabilities identified in GitPython (through mid-2026) have primarily focused on input validation issues, such as: 1. Path traversal vulnerabilities in reference APIs allowing arbitrary file write/delete [5]. 2. Command injection via insecure Git options (e.g., bypasses in multi_options handling or kwarg normalization) [6][7]. 3. Remote Code Execution (RCE) via newline injection in configuration writers, which allows for poisoning .git/config and redirecting core.hooksPath [8][9]. Users are advised to check the official GitPython GitHub Security Advisories page to stay informed about the latest patches and vulnerability disclosures [4]. To mitigate risks, ensure your applications are updated to the latest available version and exercise caution when passing user-controlled input to GitPython APIs [5][6][7][8].

Citations:

🌐 Web query:

FastAPI 0.139.2 Python >=3.10 release notes

💡 Result:

As of July 16, 2026, there is no FastAPI version 0.139.2. The latest available versions are 0.139.1 (released July 16, 2026) and 0.139.0 (released July 1, 2026) [1][2]. Versions of 0.139.2 exist for other software projects (such as gitlab-org/api/client-go), which may be the source of confusion [3][4][5]. Regarding Python version requirements, FastAPI maintains a requirement of Python 3.10 or newer [6][7]. This is explicitly documented in the project's configuration (e.g., pyproject.toml) and package metadata [6][7]. For the most accurate and up-to-date information, you can always check the official FastAPI release notes at https://fastapi.tiangolo.com/release-notes/ [8].

Citations:

🌐 Web query:

Uvicorn 0.4.6 vulnerability advisory fixed version HTTP response splitting

💡 Result:

The vulnerability regarding HTTP response splitting in Uvicorn is tracked as CVE-2020-7695 [1][2]. This vulnerability affects all versions of Uvicorn prior to 0.11.7, including version 0.4.6 [1][3]. The vulnerability occurs because CRLF (Carriage Return/Line Feed) sequences were not properly escaped in the values of HTTP headers, which could allow an attacker to inject arbitrary headers or response bodies into HTTP responses [1][4]. To remediate this issue, users should upgrade to Uvicorn version 0.11.7 or higher [5][4].

Citations:

Pin the vulnerable dependency versions here gitpython should be pinned to a patched release (>=3.1.48), and uvicorn==0.4.6 needs an upgrade to at least 0.11.7. The GHSA cited here applies to GitPython, not Uvicorn.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2022-42992)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-137)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-165)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2024-4)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2162)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2163)

[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution

(GHSA-2mqj-m65w-jghx)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

(GHSA-7545-fcxq-7j24)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion

(GHSA-cwvm-v4w8-q58c)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation

(GHSA-hcpj-qp55-gfph)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

(GHSA-mv93-w799-cj2w)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

(GHSA-pr76-5cm5-w9cj)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

(GHSA-v87r-6q3f-2j67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution

(GHSA-wfm5-v35h-vwf4)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation

(GHSA-x2qx-6953-8485)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` at line 1, Update the dependency pins in
requirements.txt by pinning GitPython to patched release 3.1.48 or later and
upgrading Uvicorn to version 0.11.7 or later; ensure the vulnerability reference
targets GitPython rather than Uvicorn.

Source: Linters/SAST tools

gitpython
uvicorn==0.4.6